Hacker Giraffe USES Metasploit
Hacker Giraffe says he used Metasploit to hack into teachers’ machines at his school.
Explicit Confidence 98% · Hacker Giraffe EP 31 Details
“The school is running Windows XP. Just fire up good old Metasploit”
Tool
tool:metasploit
Also: Metasploit framework
A penetration-testing and exploitation framework used as a comparison for the capabilities of the implant.
A penetration-testing and exploitation framework used as a comparison for the capabilities of the implant.
“For those of you familiar with Metasploit”
“something like Metasploit on lots and lots of steroids”
Tool that includes Meterpreter and is used to remotely control a compromised computer.
“This is part of a tool called Metasploit.”
Penetration-testing framework used by Hacker Giraffe while experimenting with school computers.
“Just fire up good old Metasploit”
Off-the-shelf penetration-testing tool used by the attackers after moving away from identifiable Carbanak malware.
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike.”
Framework described as containing exploits and tools and used to receive Meterpreter sessions.
“He pulls Metasploit up and waits and watches.”
Penetration-testing and exploitation tool mentioned as an example of software used to gain access to a victim machine.
“set up a phishing e-mail and use Metasploit to gain access to the victim’s machine”
Open-source penetration-testing and exploitation framework containing a ready-to-run MS08-067 exploit.
“It’s called Metasploit. Metasploit is an incredible hacking framework.”
Penetration-testing framework identified in the episode as a way to set up a reverse shell.
“This is easily set up, too, with a tool called Metasploit.”
Hacking framework whose API was controlled through an iPhone front end in the account described by the episode.
“he wrote a Metasploit front end on the iPhone”
Hacking framework used in the episode to perform SMTP enumeration.
“It’s called Metasploit and Metasploit can do a lot of things.”
A toolkit used to identify and deploy exploits against the Windows 98 and Drupal systems.
“Metasploit, what do you have for 1998 Windows systems?”
“Metasploit is a really cool toolkit with lots of exploits and vulnerabilities”
Security tool included in the BackTrack distribution.
“like Metasploit, Aircrack, Burp Suite, SQL Map”
Open-source exploit-development and penetration-testing framework containing exploits, payloads, encoders, NOP generators, and post-exploitation modules.
“Metasploit is an exploit toolkit”
“you can assemble an exploit like Legos”
Tool used to upload a payload and obtain operating-system-level access to a Tomcat server.
“uploaded a payload using Metasploit to it”
Penetration-testing and listener framework mentioned as a tool Chris might use for PDF-based compromises.
“Is it Metasploit that you’ve used?”
“we would use Metasploit as a pen tester”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | MS08-067 | Explicit | 57 |
| outgoing | USES | reverse shell | Explicit | 69 |
| outgoing | USES | SMTP enumeration | Explicit | 87 |
| outgoing | DEVELOPED_BY | HD Moore | Explicit | 114 |
| outgoing | USES | Samba zero-day exploit | Explicit | 114 |
| outgoing | USES | ARP spoofing | Explicit | 114 |
| outgoing | USES | Meterpreter | Explicit | 114 |
| outgoing | OPERATED_BY | Rapid7 | Explicit | 114 |
| outgoing | ASSOCIATED_WITH | Wassenaar Agreement | Explicit | 114 |
| incoming | USES | Hacker Giraffe | Explicit | 31 |
| incoming | USES | Carbanak | Explicit | 35 |
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | USES | Project Raven | Explicit | 47 |
| incoming | USES | Os | Explicit | 101 |
| incoming | USES | HD Moore | Explicit | 114 |
| incoming | USES | Blaster | Explicit | 114 |
| incoming | ASSOCIATED_WITH | SAINTexploit | Explicit | 114 |
| incoming | USES | Jason Haddix | Explicit | 130 |
| incoming | USES | Chris Rock | Explicit | 151 |
Hacker Giraffe USES Metasploit
Hacker Giraffe says he used Metasploit to hack into teachers’ machines at his school.
Explicit Confidence 98% · Hacker Giraffe EP 31 Details
“The school is running Windows XP. Just fire up good old Metasploit”
Carbanak USES Metasploit
After Carbanak signatures became known, the attackers switched to the off-the-shelf tool Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike”
Tinker Secor USES Metasploit
Tinker used Metasploit to listen for and manage the reverse-shell connection from the compromised finance computer.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“He pulls Metasploit up and waits and watches.”
Project Raven USES Metasploit
Project Raven used or taught the use of Metasploit to gain access to victims' machines.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“use Metasploit to gain access to the victim’s machine”
Metasploit USES MS08-067
Metasploit includes a pre-programmed MS08-067 exploit that can be run against a vulnerable Windows XP machine.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“You pick the MS08-067 exploit, then point at your Windows XP machine, type run, and boom. You’re in”
Metasploit USES reverse shell
Jack says a reverse shell can be set up with Metasploit in the described remote-access scenario.
Explicit Confidence 98% · Jack Rhysider EP 69 Details
“This is easily set up, too, with a tool called Metasploit. This is just a reverse-shell”
Metasploit USES SMTP enumeration
Jack explains that Metasploit can perform SMTP enumeration.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“It’s called Metasploit and Metasploit can do a lot of things.”
“one thing it can do is SMTP enumeration”
Os USES Metasploit
Os used Metasploit to find an accessibility-feature exploit for a Windows 98 system and later to identify an exploit against a Drupal web server.
Explicit Confidence 99% · Os EP 101 Details
“I’m like, alright; Metasploit, what do you have for 1998 Windows systems?”
“I go through the Metasploit table”
Metasploit DEVELOPED_BY HD Moore
HD is described as deciding to make Metasploit to organize and share his exploits.
Explicit Confidence 99% · Jack Rhysider EP 114 Details
“that’s why HD Moore decided to make Metasploit.”
HD Moore USES Metasploit
HD used Metasploit to conduct penetration tests and test systems.
Explicit Confidence 98% · HD Moore EP 114 Details
“we desperately needed this tool to do our job”
“HD even tried attacking it with Metasploit”
Metasploit USES Samba zero-day exploit
HD says he wrote his own version of the Samba zero-day exploit and put it on metasploit.com.
Explicit Confidence 99% · HD Moore EP 114 Details
“we wrote our own version of the exploit, put it on metasploit.com”
Metasploit USES ARP spoofing
An attacker ARP-spoofed an ISP gateway in an attack connected to the Metasploit website.
Explicit Confidence 91% · HD Moore EP 114 Details
“ARP-spoofed the gateway by hacking the ISP’s infrastructure”
Blaster USES Metasploit
HD says Windows shellcode first published by Metasploit soon appeared in the Blaster worm.
Explicit Confidence 95% · HD Moore EP 114 Details
“The first Windows shell code ever published by Metasploit ended up in the Blaster worm almost immediately afterwards.”
Metasploit USES Meterpreter
Meterpreter is presented as a payload integrated into Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 114 Details
“At some point, Metasploit got a new feature called Meterpreter.”
Metasploit OPERATED_BY Rapid7
After Rapid7 acquired Metasploit, a Rapid7 team worked on it full time and commercialized a professional version while keeping the framework open source.
Explicit Direction flagged Confidence 97% · HD Moore EP 114 Details
“Even now, there’s a whole team at Rapid7 working on Metasploit full time.”
Metasploit ASSOCIATED_WITH Wassenaar Agreement
HD says Rapid7 lobbying helped separate Metasploit framework from the Wassenaar Agreement's US interpretation.
Explicit Confidence 94% · HD Moore EP 114 Details
“splitting Metasploit framework from the Wassenaar Agreement”
SAINTexploit ASSOCIATED_WITH Metasploit
HD describes SAINTexploit as having substantial similarities to Metasploit framework, including shellcode and exploit code.
Explicit Confidence 98% · HD Moore EP 114 Details
“Half this shell code is ours and half these exploits really look really like the code that we wrote.”
Jason Haddix USES Metasploit
Jason uploaded a payload to a Tomcat server using Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 130 Details
“Jason just uploaded a payload using Metasploit to it”
Chris Rock USES Metasploit
Chris says he used Metasploit in penetration-testing work and used a listener comparable to Metasploit in this operation.
Explicit Confidence 97% · Chris Rock EP 151 Details
“we would use Metasploit as a pen tester”
“have a listener like Metasploit, but we would have our own listeners”