All Posts

2 min Nexpose

Find Vulnerable pcAnywhere Installations with DAGs

On Monday, Symantec made the rare decision to tell their customer base to either uninstall or disable their remote control software suite pcAnywhere . Symantec made this decision because their users were at risk to be exploited by publicly known vulnerabilities that they had not been able to create a patch for yet. This recommendation to disable software due to act
4 min Nexpose

"Pass the hash" with Nexpose and Metasploit

I am proud to announce that Nexpose 5.1.0 now supports "pass the hash" , a technique to remotely authenticate against a Windows machine (or any SMB/CIFS server) with the mere possession of LM/NTLM password hashes, without needing to crack or brute force them. Nexpose is able to use the hashes to perform credentialed scans to produce very detailed scan results of all sorts of local and remote vulnerabilities that may otherwise not be detectable. And pe
2 min Metasploit

Remote-Controlling Metasploit Through APIs

Metasploit offers some great ways to automate its functionality through a programming interface. Metasploit users have built custom tools and processes based on this functionality, saving them time to conduct repetitive tasks, or enabling them to schedule automated tasks. Our most advanced customers have even intgrated Metasploit Pro into their enterprise security infrastructure to automatically verify the exploitability of vulnerabilities to make their vulnerability management program more ef
2 min Metasploit

Weekly Metasploit Update: Subverting NATs, 64-bit LoadLibrary Support, and More!

NAT-PMP'ing is now easy This week, we have three new modules and an accompanying Rex protocol parser for the NAT Port-Mapping Protocol (NAT-PMP ), the ad-hoc router management protocol favored by Apple. Over the weekend, Rapid7 Lead Security Engineer and confessed protocol nerd Jon Hart forgot the password to a little-used Airport base station, so rather than merely resetting the device, he instead busted out a trio of Metasploit modules t
5 min

Security Research: Video Conferencing Equipment Firewalls

Update: David Maldow of Human Productivity Lab wrote a response to the NYT article that presented an industry perspective on our findings. Mythical Videoconferencing Hackers and why we stand behind our claims. Introduction Today's issue of the New York Times contains an article describing the results of research I conducted over the last three months. In short, a large portion of vid
4 min Metasploit

Metasploit Updated: Forensics, SCADA, SSH Public Keys, and More

Been a busy week here at Metasploit, so let's get to it. Forensics-Centric Updates New this week is Brandon Perry's offline Windows registry enhancements. Featuring a pile of extensions to Rex (Metasploit's general purpose parsing library) and the tools/reg.rb utility, this update builds on TheLightCosine's ShadowCopy library and makes life a lot easier for the forensics investigator looking to parse through Windows registry hives. Brandon goes into the technical details over here

2 min

Get CPE Credits For Attending Free Rapid7 Online Webinars

Hopefully you're enjoying our webinars for their content, but did you know that you're eligible to receive 1 CPE credit per webinar you attend? There's no need to send us your CISSP number, just self-report in the (ISC)2 portal. Here's how you do it (click on the images to enlarge): 1. Ensure you archive your webinar registration confirmation email in case you get audited in the future. 2. Login into the (ISC)2 website and click on Submit CPEs. 3. On the next screen, scroll to the v
5 min Metasploit

Adventures in the Windows NT Registry: A step into the world of Forensics and Information Gathering

As of a few days ago , the Metasploit Framework has full read-only access to offline registry hives. Within Rex you will now find a Rex::Registry namespace that will allow you to load and parse offline NT registry hives (includes Windows 2000 and up), implemented in pure Ruby. This is a great addition to the framework because it allows you to be sneakier and more stealthy while gathering information on a remote computer. You no longer need

3 min

How You Can Efficiently Audit Passwords With Metasploit

While unpatched systems are often the first stepping stone of a breach, it's often weak or shared credentials that help attackers intrude deeper into the network and breach sensitive data. Common problems are: * Weak passwords that lack length or complexity * Passwords contained in dictionaries * Passwords that are easily guessed based on information about the infrastructure * Vendor default passwords * Replaying cached credentials * Re-use of passwords across trust zones * Develo
2 min Metasploit

Metasploit Framework Updated: Railgun, AIX, and More

Time for another Metasploit Update - this week we've got some new goodies for Meterpreter's Railgun, SSH, AIX, and a few new exploit modules. Enjoy! Railgun Updates Metasploit open source contributors Chao-Mu and kernelsmith have been busy over the last month or so, cranking out a pile of commits to Railgun in order to facilitate Windows API error message handling. For you non-post module developers, Railgun is a super-handy Meterpreter extension that "turns Ruby into a weapon," and you can get
1 min Nexpose

Three Ways to Integrate Metasploit With Nexpose

Metasploit has three ways to integrate with Nexpose vulnerability scanner. I've heard some confusion about what the different options are, so I'd like to summarize them here briefly: 1. Importing Nexpose reports: This is a simple, manual file import. Apart from Nexpose, Metasploit can import about 13 different third-party reports from vulnerability management solutions and web application scanners. This feature works in all Metasploit editions. 2. Initiate a Nexpose scan from M
2 min Metasploit

Metasploit Updated: Year in Review

Turns out, the week between Christmas and New Years was pretty slow, at least as far as Metasploit Framework development was concerned. This release has a few small spot fixes on Framework, and a handful of new modules. ShadowCopy The most significant addition to the framework was TheLightCosine's work on the appropriately scary-sounding ShadowCopy library. Based on the research published by Tim Tomes and Mark Baggett , the modules implementing this l
1 min Metasploit

Creating a FISMA Report in Metasploit Pro

If you're working in IT security in U.S. federal government, chances are that you have to comply with the Federal Information Security Management Act of 2002 (FISMA). With Metasploit Pro , you can generate FISMA compliance reports that map penetration testing findings to controls, as recommended by Special Publication 800-53a (Appendix G) published by the National Institute of Standards and Technology (NIST) and by Consensus Audit Guidelines

3 min Metasploit

How to Leverage the Command Line in Metasploit Pro

"I'm more comfortable with the Metasploit command line," is an objection I often hear from long-time Metasploit Framework users who are thinking about purchasing a copy of Metasploit Pro or Metasploit Express. What many penetration testers don't know is that you can use the command line in the commercial Metasploit editions, and leverage their advantages at the same time. Reporting: The commercial Metasploit editions include one-click reporting that includes any work you have completed on the

1 min Metasploit

Jumping to another network with VPN pivoting

VPN Pivoting is one of the best but also most elusive features in Metasploit Pro, so the best way is to see it. That's why I've decided to post a snippet of a recent webinar, where HD Moore shows this feature in action. VPN pivoting enables users to route any network traffic through an exploited host with two NICs to a different network. For example, you could run nmap, Metasploit network discovery, or Nexpose vulnerability scans through the VPN pivot. Using a TUN/TAP adaptor on the Metasploit

Popular Topics

Tags