INTRODUCTION:
All persons who engage in Pen-test or are active in the field of Information Security are aware of what is Metasploit and the work done, but the initial learning Metasploit can be intimidating for the 'newbies' who are interested in penetration testing, but mostly have no idea where to start.
Armitage is a graphical representation advanced Metasploit Framework, its main feature is to map each stage Penetration Testing, Information Gathering, Operation and Post Exploitation, with a few clicks.
Armitage is available in all versions of BackTrack, and can be installed on any linux distro without any problems.
We can open it from BackTrack - Exploitation Tools - Network Exploitation Tools - Metasploit Framework - Armitage, or simply type in the console armitage.
Armitage on BackTrack Launch
Starting Metasploit RPC Server
Connecting to Metasploit RPC Server
Armitage trafficked Interface
INFORMATION GATHERING:
Information gathering is the most important component of any Penetration Testing, because without the necessary information there is no way to get on with the job. Armitage provides functions for listing information, leveraging the scaneo with Nmap and Metasploit modules. The three main features are nmap scanning, and enumeration msfscan dns.
Msfscan consists of a beam Scanning Auxiliary Metasploit modules, the analysis is executed regardless of the availability of the machine. Therefore, for a more efficient exploration would be better to run arp or ping scan using nmap before running msfscan.
The results returned by Armitage is stored in its database, it is useful to review this information in other stages of Penetration Testing. Armitage also import the results of the analysis of other tools such as Nessus or Nmap in its database, giving the user the flexibility to include the results of other tools.
Scan List's
Nmap Scan List's
Nmap quick scan ranges
Running Nmap Scan
Nmap Scan Results
EXPLOITATION:
Armitage has made the process of exploitation as a game with just making a click's, clicking on "Find Attack" Armitage shows the list of exploits based on open ports that were found at the time of the Nmap Scan.
We can run the exploit relevant with the click of it and keep clicking "Launch". All variables required for Metasploit to launch the exploit is automatically filled by Armitage. Most of the time, Armitage default settings will suffice for most exploits.
Once meterpreter session is created, the GUI of the machine (victim) turns red (with lightning).
An interesting feature is the "Hail Mary", this function will start all shortlisted exploits the host automatically.
Find Attack on the Host's
Complete Attack
Hail Mary Attack
Hail Mary Running Attack
Options for Launching the Exploit
Execution Exploit with Metasploit with mapping variables
Host Exploited - Retrieved Meterpreter Session
POST - EXPLOITATION:
Armitage The best part is the ability to run all Post-Exploitation processes with just a few simple clicks's run.
The list of available functions are:
Armitage The best part is the ability to run all Post-Exploitation processes with just a few simple clicks's run.
The list of available functions are:
- Dump hash
- Privilege Escalation
- Exploring the file system
- Pivot Setup attack
- Doing pivot machine information through
Exploited Host: 192.168.1.20
Post-Exploitation Options: Access
Post-Exploitation options: Interact
Post-Exploitation Options: Explore
Post-Exploitation Options: Pivoting
Post-Exploitation Options: Hash Dump
Hash Dumping
View all items stored in the database
Exploited Host Hash
Post-Exploitation Options: ARP Scan
ARP Scan Results
Browse Files
Browse Files Results
Post-Exploitation Modules: Windows - Linux
Host Screenshot (Victim)
With these steps Introduction, Information Gathering, and Post-Exploitation Exploitation, we have successfully performed our audit and penetration testing towards a specific objective.
Armitage offers many more options that can be used depending on the modules and servers that can be found in our victim system.
