TaoSecurity Blog

I've wanted to try Metasploit 3 since it was released in late March. I noticed the metasploit/devel FreeBSD port, but it wanted me to install framework-3.0-beta-3-svn.tar.gz. I decided to install Metasploit 3 (gold) manually, using the FreeBSD port dependencies for guidance. I installed the following via the ports tree: devel/subversion devel/ruby-gems databases/rubygem-activerecord lang/ruby18 Then I extracted the framework-3.0.tar.gz I downloaded to /usr/local/src. When I tried to run msfweb, I got this error: Cannot find gem for Rails ~> 1.2.2.0: Install the missing gem with “gem install - v=1.2.2 rails”, or change environment.rb to define RAILS_GEM_VERSION with your desired version. Hmm. First I decided I needed to install www/rubygem-rails, which I did. Next I looked in framework-3.0/data/msfweb/config and found environment.rb, with these lines which I added to specify 1.2.3 instead of 1.2.2: # Specifies gem version of Rails to use when vendor/rails is not present #...

Thanks to Tom Ptacek , I learned of a truly lame SANS poll questioning the responsibility of the Metasploit ie_xp_pfv_metafile component. The poll results as of now show the following: Was the release of the 2nd generation WMF exploit on Dec 31st 2005 irresponsible ? 35 % =>Yes, I 'd like to see the authors brought to justice 21 % =>Yes, they made the world a worse place 32 % =>No, the bad guys had already equal ammunition 11 % =>No, I believe the ends did justify the means Total Answers: 1379 Regarding the first option -- what law exists against writing Metasploit components? About the last -- what "ends" are in play? I would have liked to have seen the following option: "No, I now have a means to test the effectiveness of patches, anti-virus/malware products, and other defensive measures." Without a way to test the effectiveness of countermeasures, defenders are as much at the mercy of the intruders as they are the software vendors who fail t...

One of the criticisms of open source software is that there is no one to blame when a customer needs a problem solved. For example, if an open source OS or application is found to suffer a vulnerability, no one is seen to be responsible for patching it. Following this line of thinking, commercial software is considered a superior choice for consumers (whether corporations or individuals). When a problem happens, users can rely on the vendor. The recent SANS ISC post about the WMF vulnerability has completely annihilated this argument. I have criticized SANS in the past, but I cannot fault their handling of the ongoing fiasco. I've never seen anything like this plea by Tom Liston before: Looking forward to the week ahead, I find myself in the very peculiar position of having to say something that I don't believe has ever been said here in the Handler's diary before: "Please, trust us." I've written more than a few diaries, and I've often been silly ...

I wrote about the Metasploit Framework in April 2004 . The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. This week they released version 2.3, which offers 3 user interfaces, 46 exploits, and 68 payloads. One of the more interesting additions is the Meterpreter ( .pdf ). This is a replacement for calling cmd.exe on Windows after an exploit succeeds. Windows support is currently offered and UNIX (to replace calling /bin/sh) is planned. The Meterpreter is extensible, so you can add features once you gain control of the target. You can browse the exploits and payloads using their Web-based interface.

You may have seen the Slashdot article on the Metasploit Project . From the project's Web site: "The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. This release includes 18 exploits and 27 payloads; many of these exploits are either the only ones publicly available or just much more reliable than anything else out there. The Framework will run on any modern system that has a working Perl interpreter." I gave the project a try. First I read the Crash Course user's guide , which told me to install p5-ReadLine-Gnu . I did so using the FreeBSD ports tree: orr:/usr/ports/devel/p5-ReadLine-Gnu# make install ===> Vulnerability check disabled, database not found >> Term-ReadLine-Gnu-1.14.tar.gz doesn't seem to exist in /usr/ports/distfiles/. >> Attempting to fetch from http://www.cpan.dk/CPAN/modules/by-module/Term/. Receiving Term-ReadLine-Gnu-1.14.tar.gz (65140 bytes): 100% ...truncated... On...