Description:

For little more flexibility in Metasploit, to lay the groundwork for how you can get Metasploit's MSGPACK Remote Procedure Call (RPC) interface and the Python programming language to play nicely together while at the same time demonstrating how it could be used in practice. Let's lay out the testing scenario. Assume, through one method or another, I've obtained the clear-text password for a single user - Bob. I have Bob's Windows credentials and can easily, through RDP or psexec, access his machine. I've determined that Bob is a Linux Administrator. I wish to determine what, if any, Linux servers allow me to log in as "root" using Bob's compromised password.

For this exercise, I'll be interacting with Metasploit via the RPC interface (rather than directly with the console). The RPC interface allows clients to locally or remotely execute Metasploit commands, including running aux modules and exploits, interacting with sessions, talking to a database, etc. Python, a popular scripting language, can communicate over RPC. Therefore, I can write a Python script to "remote control" my Metasploit instance.

At the end, you can interact with the established sessions through the open msfconsole or create additional scriptable events executed through the Python script. Of course, my entire example that i would demonstrate would be a bit contrived, considering the same could be accomplished simply through msfconsole and by setting the RHOSTS option to the 10.0.1.1/24. Again, this is intended to be a basic introduction of Metasploit's RPC interface and its usage in Python.

Prerequisites:

Little Knowledge About Linux/Shell/Python.

Speaker Info:

i <3 OPEN SOURCE. i <3 OSHO. i <3 Linux Kernel. i <3 Pen-Testing, for sure. ;)

Speaker Links:

https://mozillians.org/en-US/u/priyevardhan.singh/ , https://github.com/priyevsingh, https://www.launchpad.net/~priyevardhan-singh, https://wiki.mozilla.org/User:Priyevardhan.singh