I don't go back to another episode on How to Hack.
So today we'll be discussing about misapply framework for Beginners and we'll be looking at the architecture
or the framework of Manasquan framework.
And look at the modules are available instead of splotchy, as well as exploit and exploitation that
we'll use alongside Cymatics.
And this can really accelerate the pace of how quickly we're performing our penetration testing.
And this can be really useful and helpful, especially when we are trying to understand more about how
we could utilize misapply to help us get access into systems, find vulnerabilities, look at exploits
as well as Palouse.
They're available as well on top of that to post exploitation.
What do we do after we get into the system?
Are we able dumble passwords?
I'll be able to get privilege escalation.
So again, all these are key questions that you probably have.
You have been using metastable for a while now.
So what exactly is a better supply framework, so that supply framework is a penetration testing platform
that allow us to use different modules and the modules on the right, you can see a module is a standalone
piece of code that is in some or in a lot of ways not interacted with the other modules inside that
supply framework.
So you could do this on yourself.
If you look at some of the template guy about coding your own exploited coding or in modules inside
that supply framework.
So that's a great way to start off with a special later on when you're trying to program some of these
features.
And we'll definitely be uploading a video about how you could create your own modules.
Look at some of the exploits that you could potentially look at and be able to use and upload or change
some of the code because everything is open source.
So play framework has two versions.
One is the pro version.
So you have to pay for that.
And one that we've been looking at in a lot of tutorials have always been a free one.
And of course, there are some limitations in terms of free one.
So, again, if you are a full time penetration tester or you're doing a lot of security assessments,
so highly recommended to go for a paid version.
And of course, if you look at a bottom, we have services of medicine.
So, again, if you look at some of the tutorials online, we could see that sometimes people would
have to study a possible sequel in order to start running the database of services inside supply.
So, again, this could be because of supply use, possible sequel to actually stall all this data.
So, again, you have to start to services before you're able to kick some ass boyfriend work.
So today, we'll cover three key points in the agenda, so first of all, is about misplay framework,
how does it work?
And abattoirs in terms of the margins there available for you using that display framework?
And lastly, how can we scope and define the kind of parameters and options that we want to push into
the system?
So first of all, let's understand three key points as part of our supply framework.
So the very first is vulnerability.
We have to make sure that we want to find our vulnerability inside the system, inside the machine.
We're trying to hack into by using exploits and so on.
So this is the part where we have to scanning modules available in some way framework that we can utilize
or to.
We could also use other tools like and MAP to find out the service version of the software version that
has those services running out to find out what kind of services are running into the system.
So, again, if a system is fully patch, have no vulnerability and then we have to start thinking about
zero day potential as we want to craft out our exploit inside the system.
So, again, that could be very tedious and cumbersome and could take a really long time to develop.
And of course, the vulnerabilities are basically areas of opportunities that we can actually hack into
the system.
So vulnerability will be one of the key terms that we must understand.
And number two is in terms of exploit.
So exploit is what happens when we are able to bypass the security mechanism inside a particular service
or a software operating system.
So, again, this allow us to be able to take control of the system to control the software or the services
running inside an operating system and arbitrages payload.
So payload is what do we do after we get into the system?
Do we want to show?
Do we want it to trigger a shutdown?
So again, payload come alongside with matter supply mainly as shells to give us control of the system
so that we can do a lot more different kind of commands, manipulation of the system as part of a supply
framework.
So what's the advantages of using misapply framework compared to, say, using manual way of trying
to do penetration testing?
So there are five key ways for us to think about in terms of the advantages.
So one is more supply is use a lot in a lot of penetration testing tools, a lot of auditing platforms.
And it is used extensively to test companies for your security posture very, very frequently.
And as such, having skill set amount of supply will be very helpful for you, because whenever you're
joining a new team of penetration testers, chances are they have Mattiske boyfriend running.
And it will be great if you are familiar with it, because some of the interview questions could also
come alongside with that.
And of course, the great thing is that it simplifies complicated or complex task.
So complex tasks, meaning that you have sequential of actions that need to be carried out as part of
your penetration testing.
As such, you could use manage supply scripts to also automate it for you as much as possible so you
can simplify many of this complex task together.
And you can also put session on a background and use your own scripts to run through and execute inside
a current session.
So, again, a lot of this complexity can be taken out and simplified to the user matter.
Splotchy.
No tree is in terms of the range of capabilities that he can use along with matter supply, because
it is built in a old and systematic way.
So you can think of the mortgages that are available and you have auxillary scanners and you have exploits
and you have post exploitation.
So all these are really segmented into many different modules, many different in terms of a cyber attack
chain.
How are you trying to work around a system?
So again, all this already of all that for you.
So it's easy for you to visualize how where you are in the attack phase, where which part of the penetration
testing you're at and what is the next step for you in order to carry them out.
So this is all consistent updates.
You get a lot of updates as you run about a supply framework into your system.
So all this updates can help troubleshoot system, make sure the system are running fine and making
sure your exploits are working as intended.
So, again, all these updates are great for you, especially in terms of trying to make sure that you
can perform your penetration testing smoothly.
And of course, the great point is there are thousands of bodies inside that a supply framework.
And this is really helpful because all these functions have been built by many of these penetration
testers.
And you can use them and be able to accelerate how quickly you are performing a penetration testing
and all these tools at and help you find out potential vulnerabilities, exploits, as well as Paillot
so that you are able to speed up the pace of how quickly you could get into the system and generate
those reports necessary in order to find out more things about the entity to target entity of the target
enterprise.
So here we got a screenshot of my display, so whenever you in colonics or if you have install it on
your Windows operating system, all you do is enter MSF console.
You'll be brought into this page.
So here we can see you've got two dozen four exploits, one zero nine auxillary, three four two post
five six four payloads, forty five Encoders, 10 and Ops and seven invasion.
So again, a lot of modules available as part of it.
That could be austinmer of attack as it comes to doing and performing penetration testing.
So one of the key things I really want to share with you as the number one advice when it comes to using
metaphore framework is to go into the help wherever you are.
So it is an interactive shell.
So every time you're moving from one shell to another shell or you're moving from one place to another
inside a supply framework, go ahead and to help freely enter help whenever you have the chance to.
And you can see all the commands available to you that you can kihn that you can enter into.
And this is really helpful for you to get yourself familiar with the user matter supply framework.
So over here, in this case, we enter help and we can see all the functions and features and commands
that we can use alongside with it.
So this is really helpful in terms of trying to get yourself familiar with the supply framework.
So, of course, now we move on into the exploits or exploits of ranked exploits are rank in terms of
how good they are, do actually go off the system.
So we got a ranking of excellent, great, good, normal, average, low and manual.
So, of course, the best option to choose from will be excellent ranking because that entry to the
system don't crash, because if the system crashes, then that could actually alert system administrators.
And if you're doing a penetration testing on production systems, this is highly dangerous.
In fact, most of the time you should always go after penetration testing on the environment or where
the systems are actually merit to a separate lab test or a virtual set up where you could actually mimic
real life production environment and be able to do all this testing on.
So they'll be the number one advice for whenever we're doing penetration testing.
So of course, we got the different kind of rankings.
So we have to choose wisely what we want to use when it comes to executing many of these payloads.
So over here, when you do a search on exploit or you want to show exploits, it will show you the thousands
of exploits available.
And of course, the first one we can look at is the ID number.
So that number of stars from one foreign country, I can from one all the way to two one and we can
see the windows, we understand, for the Windows operating system.
So again, it could be Eunuch's, it could be any other type of Android devices as well.
So depending on the operating system, followed by the service on top of the operating system and from
the service, followed by a service type of service version.
So that could be very software driven.
So I'll say, for example, you're using a Windows so you could be a directory, could be an easy FTP.
And of course, followed by the date, the date when the KVI common vulnerability exposure was released,
followed by the ranking of the exploit.
Yes.
No.
And a final one is actually on the version number of the particular exploit.
So over here, of course, so we can show options whenever we are inside a supply framework.
So once you have selected the use of that particular exploit payload or any of those modules, you can
enter show option.
So show options will show you the perimeters that are needed in order to execute this particular module.
So in this case, we're using Windows Sambi MS 17 zero one zero.
So in this case, we got our host, we got DG Treys, we got like a Tab's down pipe and so on.
So, again, all this some of them, if you see under Thirt column, is required.
So requirements it's compulsory is a value that you must specify in order to use that particular module.
And of course, on the right side, we have the description about the module and here all the description
about a parameter and an option that you have.
So, again, very important.
If you need any help, go ahead and to help really to understand more about the module and all the commands
is available for you to use as part of the module.
Of course, this would go us into the Paillot, so what happened after you exploited in the system?
You want to execute something you want to execute?
Most of the time, a payload and a payload is usually a shell.
So, again, there are a number of shells that we can choose from.
So you see on the background, we have windows, which is the operating system, type 64 architecture,
the platform architecture.
And then of course, we got Shell and we got different social media protocols.
The most popular one of all, because it gives us a lot of capabilities in terms of penetration testing,
while we can also do and get a normal shell of windows.
Again, this is depending on the kind of privileges you're going to get or you think that you're going
to get as part of your penetration testing.
But the most preferred, of course, is made a printer, but, of course, made a printer.
Also has some of these potential items that could be detected by antivirus system or endpoint detection
and response systems.
So, again, all this choosing of a selection of the payload is very important as part of penetration
testing, especially if you're trying to penetrate into systems that are highly updated.
So, again, all these are things that you want to keep in mind when you're selecting the kind of payloads
to go in into.
So here we go.
Also, middle school is a great way in terms of exploiting a system, getting to payload, which has
a lot of functions and features in terms of post exploitation as well as exploitation.
So in terms of privilege, escalation, uploading, downloading a files, etc., so great way, especially
in terms of running many different kind of modules, especially when it comes to penetration testing.
So it's one of the most preferred shell, if you could get it, without detection.
So again, this will be a great way for you to actually try out many of these different commands.
So, again, as device enter help the moment you're in session, and this could actually show all the
features and commands that you want to see.
And from there on, you'll be able to find out things that you can do Furter and things that you could
be limited to.
And you have to a background session and be able to run all those sexploitation.
So, of course, this will bring us to post exploitation.
So the question is always now, then, of exploiting the system.
What's next?
What do I do next?
How do I get passwords?
How do I get persistance?
So, again, there are a lot of post exploitation modules available in site Matus boyfriend that can
help you in that way.
So, of course, is a heart attack into Target organization.
You want to pivot from one machine to another machine.
You want to do scanning on the environment.
You want to find out what protocols you're using, what servers they have, what services they have
on top of those servers.
So, again, all these are capable in helping you actually expand the scope of your exploitation.
So here we got post Windows Exploit.
So, of course, you can actually do a search on post and we can actually see all the modules available
as part of post exploitation.
We got privilege escalation and we got dumping out of data dumping and passwords.
So, again, all these are there for us to take a look at.
So especially when we go into tutorial later, we can actually see many of these modules and see how
they function and work and what kind of data we can actually pull out from the system.
So directly from the screenshot we could see, we could look at post Windows, Manesh webcam, we can
look at resolving IP addresses, we can look at wireless list.
So again, all this are some of the polls exploitation now we could be using in order to find out more
information about a system trying to get privilege escalation again, many different items and features
that we can look into.
So there are also a lot of auxillary modules available as part of their supply framework, so in this
case, on the right side, we have Etman, we got crawlers, we got scanners and we got Fyssas.
So when you go into Mazwai framework, you can search for Auxillary and you can see all this modules
available or all these subcategories available.
So there are a lot more subcategories that you can look at that may be outside of scope of today's lecture.
So, again, do explore them whenever you have to.
Time to.
So, of course, the first one is the crawler, so Criollo actually allow us to crawl into the system,
so allow us to crawl through Web application servers, allow us to find our subdirectory, do a crawling
into the system, like how we deploy web crawlers from search engines and we'll go into the site deeply
finding out things that may be accidentally being exposed to publicly available information.
So, again, we can use MSF Criollo on that and that can help us crawl into the Web server and finding
out all this information.
And of course, we also got a scanner, so scanners help us scan that particular service, whether it's
available that is vulnerable to different kind of exploits.
So we have done a number of tutorials about using auxillary scanner where we scan the Windows 10 operating
system to see if it was vulnerable to eternal blue.
So, again, that could be the first step you take before you run the exploit, because if the system
is not vulnerable, then you will not be able to exploit it.
And then you have to start scanning for other items inside a target machine before you're able to run,
you exploit.
So, of course, we have to go forcing so we uploaded a new video on SQL injection that was a full tutorial
on that.
So that was really interesting.
So it's fairly similar in the sense that we are trying to foster service of the system.
We're trying to inject code into the system to break it, to get past the buffer and be able to inject
things into the system.
So we're trying to find software Bachs.
So in this case, as part of the auxillary modules of fazing inside Manzoni framework, we got support
for a different protocol.
So we got DNS, FTP and so on.
So again, all these are ways and areas where we can try to push and inject code into those services
to see when we can actually find vulnerabilities inside a system.
So a lot more manual effort in terms of checking those systems or services for vulnerabilities.
So, of course, before we go into dictatorial, the most important question right now you have in your
mind is how can we write our own exploding supply framework?
So again, we are going to cover it is in subsequent tutorial.
So stay tuned for that.
So for now, let us go into the tutorial of going through into metastable framework.
So on the left side of screen of colonics running and all you got to do is actually click on the terminal
emulator and we can actually zoom in a little.
So it's easier for you to see.
So I can actually go in and or MSF console.
So this will start up the amount of supply framework immediately, just like what we see on the electric
slide.
So I'm here on a lecture slide.
We can see that we actually keun into MSF console.
So over here we are starting the med supply framework console.
So once we're in, we'll be able to see, number one, the number of exploits, auxillary modules,
pulse exploitation payloads, encoders and no ops as well.
Seven, evasion.
So now once we're in, all you got to do is enter help.
So when you enter help, it will show you all the commands available.
So again, wherever you are in the interactive shell, it's great if you have the ability to go into
the help page or help command and it will show you all the parameters and all the commands that you
can actually key in into the system.
So this is a great way to actually explore and begin exploring new supply frameworks.
So a very important way to understand more about exploiting.
So, of course, as demonstrated on the lecture slide, we'll be looking also, of course, at some
other key areas in terms of exploit so you can actually enter Shole followed by exploits and you hit
enter and debt.
So if you enter shool and if you do a double tap on a keyboard, it will show all the options that you
have a spot of Schull.
So here when you see Schull, there's a show all show auxillary and codas and so on.
So of course we can enter a show, for example, on exploits.
So this would actually show and pull out all the exploits from the database.
And we want to show you what exploits are available as part of a supply framework.
So when I hit enter and is this could take some time to load because it's trying to pull all this data
out from the database.
So you may take a little while for the query to complete.
So of course, likewise you could see show all you could enter, show auxillary and exploits no ops,
show options, payloads and so on.
So again, a very important way for us to understand about how we could actually see all the modules
inside the system.
So show is one of those commands that you will use extensively to actually find out modules that you
can look out for.
And another option that we have is also in terms of searching.
So in terms of searching, we can also search specifically, we can search for any keywords, just like
how you use any of the search engine so you can to search, followed by the type of payload that you
could be looking for.
You could be looking for anything, perhaps, for example, related to Android or anything example related
to Apache.
So, again, all these are things that you can actually look for as you are using Matus framework.
So, of course, in this case, we're still waiting for this show.
So now we have to return.
So if you remember earlier from the lecture right over here on the right site, we have different kind
of ratings.
So ranking.
So we got the rankings of excellent, great, good, normal, average, low end manuell.
So in this case, when you enter on the show exploits, we can see normal average manuell.
Great.
And maybe you're looking for Excelon over here like Weisse.
We can see it over here.
So again, we are able to see all the modules information as part of it.
So, of course, moving back, we can enter.
Such as?
Well.
And perhaps you want to search for Android so you can search on that.
And it was show you all the different modules available.
So if you scroll all the way up is actually over here, we can see Auxillary as the type of modules
we're looking for.
And now we have the administrator, Android, Google Play store.
And of course, we got a ranking disclosure data as a CSV exploit.
And of course, on the right side, we have a description of the particular module.
So as you scroll down, we can see the different kind of auxillary modules are available for you to
use.
So we have Gater, we have Geter, we got a scanner again, we got a server.
And of course, as you scroll down, we have exploit exploit, followed by the operating system type.
And then the major category followed by the subcategory are the name of the particular service that
we're exploiting into.
So here we got the Android debark breech.
So we actually show Android Buckeridge the past few videos about how we could actually be able to exploit
them.
So, again, really, really useful on that.
So because Stagefright MP four, so this is a way for actually the user to execute AMP for video file
and you gain complete control of the system.
So again, many exploits for us to actually try and test out on.
It's a great way for us to understand more about a system operating system question.
And of course, we've got a different kind of payloads.
So payloads are basically giving us shell.
So we got a normal android shell.
And of course, we also got meta preta shell over here that you can see.
So reverse TCP reverse ETPs.
And of course we've got post exploitation as part of the operating system.
So we've got post Android Geter trying to dump all hash values.
We're trying to get some information.
We are trying to get wireless access point information, so again, also not a great one, removing
a lock from the remote device lock.
So, again, many different impulse exploitation that we can look at as part of media supply framework.
So moving forward, of course, we have seen all of the exploits and of course, over here we can also
use exploits.
So in this case, I actually have a Windows operating system running over here so I can enter CMD.
So this will show us the IP configuration of this particular this particular operating system.
So we got one or two, one six eight one eight nine.
So we are going to minimize this and that is going to be our target machine and we're going to use my
display here to try to gain access into the system.
So the first thing I use is perhaps I will search, I'll do a search on SMB because there is a very
popular exploit in Windows using SMB or I could search on internal blue.
So again, either one would be fine.
So there's a lot of SMB over here so I can do a search on internal.
And over here we've got five matching modules from our search results.
So the first one is a auxillary module administrator.
So it would be checking on the internal blue SMB windows.
Come on execution.
We got auxillary scanner.
So scanner is actually a way for us to scan a system to see if it is vulnerable to a particular exploit.
And of course, we've got a number of exploits here.
We've got two, three, four and five.
So we've got eternal blue, we got SMB MI 17 zero one zero.
So again, we've got a blue internal blue eight.
We got execute and of course that is on Eterno Blue Champion SMB Remote Windows Code execution.
We've got Semba double pulser RSI so we can actually enter, use auxillary scanner SMB, SMB on a score
at seventeen, hit enter indebt, enter show options.
So over here again, if you see Caerphilly back into the sleights, we actually have a show options
capability.
So that is the part where we want to find out more information or details about the particular exploit.
So again, we are able to find all those information directly from here by entering show options.
So if you see over here, we can see all the show options available to you on that.
So we can enter a set.
Of course, here we can see the parameter that we have a key in.
So required.
No required.
No, no, that's a yes.
A nameplate.
So we have already supplied those information over there and we have another one of our hosts so we
can actually set our house and we can actually specify the IP address of the target machine.
So one or two one six eight one eight nine.
So go ahead, enter that one two one six eight one eight nine hit enter and that we can actually see
the armholes information, of course, moving forward.
We see that the rest of the information has been filled in.
So once you're done on that, go ahead, hit front.
So again, here we are checking whether the system invulnerable.
So he says host is slightly vulnerable to me, 17 zero one zero Windows 10 zero one four three nine
sixty four.
So once we have check on the system, we can do a search once again to actually find out about what
explodes we can use.
So in this case, we can select number four so we can enter, use, exploit windows SMB Mouse 17 zero
one zero.
So use exploit windows SMB Mouse 17 zero one zero c p c heat enter and debt and to show options.
So again, here we will see what are the parameters where it is compulsory for us to actually look into.
So here we got the DB trace, which has already been Felic attempts already been filled.
So we get a feeling into our hosts.
So our host is the target IP address, as mentioned earlier, said our hosts one or two one six eight
one eight nine.
So in my case it is eight nine again.
In your case it could be a different IP address.
So we can go ahead and hit enter on debt and now we can enter show Paillot, what are the palettes available
to get with this exploit?
So again, it's retrieving the information from the database.
So here we can see we've got two zero eight number of exploit, a number of Palouse that we can use.
So here we can see Windows eight.
Sixty four, we can see reverse Meenakshi DP.
So the one is going to be the most suitable for today's tutorial.
We're actually on me to Preeta, so let's screw up a little more and see that we can see all the windows.
Sixty four metre preeta shell that we can get so in case we are going to be more interested in this
one.
So this is a Windows XP for me.
To Preeta Reverse underscore the DP.
So copy the selection.
I'll scroll all the way down, I'll add to set payload and I'll pace the selection from the clipboard
so I can pay selection hit enter on that enter show options.
So now because we have a payload that would give us a shell reverse shell, we have to set the elbows
or the local listener hostname.
So what I'm going to do is I'm going to enter IP ADR the final the IP address of your colonics machine.
So in this case I'll call the next machine is one or two one six eight one nine one.
So go ahead and enter set.
One, two one six eight one nine one and talk show options again to check all the options, all the
values, and make sure that you have a key parameter on that.
So here we go, Ellos.
We got the airport number as well, and we got all the parameters set forward in as well in our house.
So once you have all this information in place, go ahead, enter exploit.
And that would give us our shall allow me to put a shell into the target machine.
So once you're in the shell meter, pretty shake and enter help.
So once again, in help, we can see all the modules available for us and we can actually see a lot
of information, a lot of capabilities, a lot of things that we can enter into.
So one example is we can actually enter the different kind of modules that we can use at our car, commands
that we can use.
So the question mark also is a way to put up the help manual and we can background a current session.
We can kill processes that are inside a system, we can migrate and so on.
So some of the commonly used ones will be on the system information system infl so we can go ahead and
screw all the way down and antiracist infl.
So it's very important that you try out all these different commands because it will be very helpful
for you to get yourself familiar with Matus framework so you understand everything about Matus framework.
So once again, I hope you learned something valuable in today's lecture and tutorial.
And if you like what you watch remotely like, subscribe to the channel so that you can be kept abreast
of the latest episode of Tutorial.
And if have any questions, feel free to leave a comment below and I'll try my best to answer any of
your queries.
Thank you so much once again for watching.