10 min read

(For more resources related to this topic, see here.)

Reinventing Metasploit

Consider a scenario where the systems under the scope of the penetration test are very large in number, and we need to perform a post-exploitation function such as downloading a particular file from all the systems after exploiting them. Downloading a particular file from each system manually will consume a lot of time and will be tiring as well. Therefore, in a scenario like this, we can create a custom post-exploitation script that will automatically download a file from all the systems that are compromised.

This article focuses on building programming skill sets for Metasploit modules. This article kicks off with the basics of Ruby programming and ends with developing various Metasploit modules. In this article, we will cover the following points:

  • Understanding the basics of Ruby programming

  • Writing programs in Ruby programming

  • Exploring modules in Metasploit

  • Writing your own modules and post-exploitation modules

Let’s now understand the basics of Ruby programming and gather the required essentials we need to code Metasploit modules.

Before we delve deeper into coding Metasploit modules, we must know the core features of Ruby programming that are required in order to design these modules. However, why do we require Ruby for Metasploit? The following key points will help us understand the answer to this question:

  • Constructing an automated class for reusable code is a feature of the Ruby language that matches the needs of Metasploit

  • Ruby is an object-oriented style of programming

  • Ruby is an interpreter-based language that is fast and consumes less development time

  • Earlier, Perl used to not support code reuse

Ruby – the heart of Metasploit

Ruby is indeed the heart of the Metasploit framework. However, what exactly is Ruby? According to the official website, Ruby is a simple and powerful programming language. Yokihiru Matsumoto designed it in 1995. It is further defined as a dynamic, reflective, and general-purpose object-oriented programming language with functions similar to Perl.

You can download Ruby for Windows/Linux from http://rubyinstaller.org/downloads/.

You can refer to an excellent resource for learning Ruby practically at http://tryruby.org/levels/1/challenges/0.

Creating your first Ruby program

Ruby is an easy-to-learn programming language. Now, let’s start with the basics of Ruby. However, remember that Ruby is a vast programming language. Covering all the capabilities of Ruby will push us beyond the scope of this article. Therefore, we will only stick to the essentials that are required in designing Metasploit modules.

Interacting with the Ruby shell

Ruby offers an interactive shell too. Working on the interactive shell will help us understand the basics of Ruby clearly. So, let’s get started. Open your CMD/terminal and type irb in it to launch the Ruby interactive shell.

Let’s input something into the Ruby shell and see what happens; suppose I type in the number 2 as follows:

irb(main):001:0> 2
=> 2

The shell throws back the value. Now, let’s give another input such as the addition operation as follows:

irb(main):002:0> 2+3
=> 5

We can see that if we input numbers using an expression style, the shell gives us back the result of the expression.

Let’s perform some functions on the string, such as storing the value of a string in a variable, as follows:

irb(main):005:0> a= "nipun"
=> "nipun"
irb(main):006:0> b= "loves metasploit"
=> "loves metasploit"

After assigning values to the variables a and b, let’s see what the shell response will be when we write a and a+b on the shell’s console:

irb(main):014:0> a
=> "nipun"
irb(main):015:0> a+b
=> "nipunloves metasploit"

We can see that when we typed in a as an input, it reflected the value stored in the variable named a. Similarly, a+b gave us back the concatenated result of variables a and b.

Defining methods in the shell

A method or function is a set of statements that will execute when we make a call to it. We can declare methods easily in Ruby’s interactive shell, or we can declare them using the script as well. Methods are an important aspect when working with Metasploit modules. Let’s see the syntax:

def method_name [( [arg [= default]]...[, * arg [, &expr ]])]
expr
end

To define a method, we use def followed by the method name, with arguments and expressions in parentheses. We also use an end statement following all the expressions to set an end to the method definition. Here, arg refers to the arguments that a method receives. In addition, expr refers to the expressions that a method receives or calculates inline. Let’s have a look at an example:

irb(main):001:0> def week2day(week)
irb(main):002:1> week=week*7
irb(main):003:1> puts(week)
irb(main):004:1> end
=> nil

We defined a method named week2day that receives an argument named week. Further more, we multiplied the received argument with 7 and printed out the result using the puts function. Let’s call this function with an argument with 4 as the value:

irb(main):005:0> week2day(4)
28
=> nil

We can see our function printing out the correct value by performing the multiplication operation. Ruby offers two different functions to print the output: puts and print. However, when it comes to the Metasploit framework, the print_line function is used.

Variables and data types in Ruby

A variable is a placeholder for values that can change at any given time. In Ruby, we declare a variable only when we need to use it. Ruby supports numerous variables’ data types, but we will only discuss those that are relevant to Metasploit. Let’s see what they are.

Working with strings

Strings are objects that represent a stream or sequence of characters. In Ruby, we can assign a string value to a variable with ease as seen in the previous example. By simply defining the value in quotation marks or a single quotation mark, we can assign a value to a string.

It is recommended to use double quotation marks because if single quotations are used, it can create problems. Let’s have a look at the problem that may arise:

irb(main):005:0> name = 'Msf Book'
=> "Msf Book"
irb(main):006:0> name = 'Msf's Book'
irb(main):007:0' '

We can see that when we used a single quotation mark, it worked. However, when we tried to put Msf’s instead of the value Msf, an error occurred. This is because it read the single quotation mark in the Msf’s string as the end of single quotations, which is not the case; this situation caused a syntax-based error.

The split function

We can split the value of a string into a number of consecutive variables using the split function. Let’s have a look at a quick example that demonstrates this:

irb(main):011:0> name = "nipun jaswal"
=> "nipun jaswal"
irb(main):012:0> name,surname=name.split(' ')
=> ["nipun", "jaswal"]
irb(main):013:0> name
=> "nipun"
irb(main):014:0> surname
=> "jaswal"

Here, we have split the value of the entire string into two consecutive strings, name and surname by using the split function. However, this function split the entire string into two strings by considering the space to be the split’s position.

The squeeze function

The squeeze function removes extra spaces from the given string, as shown in the following code snippet:

irb(main):016:0> name = "Nipun     Jaswal"
=> "Nipun     Jaswal"
irb(main):017:0> name.squeeze
=> "Nipun Jaswal"

Numbers and conversions in Ruby

We can use numbers directly in arithmetic operations. However, remember to convert a string into an integer when working on user input using the .to_i function. Simultaneously, we can convert an integer number into a string using the .to_s function.

Let’s have a look at some quick examples and their output:

irb(main):006:0> b="55"
=> "55"
irb(main):007:0> b+10
TypeError: no implicit conversion of Fixnum into String
        from (irb):7:in `+'
        from (irb):7
        from C:/Ruby200/bin/irb:12:in `<main>'
irb(main):008:0> b.to_i+10
=> 65
irb(main):009:0> a=10
=> 10
irb(main):010:0> b="hello"
=> "hello"
irb(main):011:0> a+b
TypeError: String can't be coerced into Fixnum
        from (irb):11:in `+'
        from (irb):11
        from C:/Ruby200/bin/irb:12:in `<main>'
irb(main):012:0> a.to_s+b
=> "10hello"

We can see that when we assigned a value to b in quotation marks, it was considered as a string, and an error was generated while performing the addition operation. Nevertheless, as soon as we used the to_i function, it converted the value from a string into an integer variable, and addition was performed successfully. Similarly, with regards to strings, when we tried to concatenate an integer with a string, an error showed up. However, after the conversion, it worked.

Ranges in Ruby

Ranges are important aspects and are widely used in auxiliary modules such as scanners and fuzzers in Metasploit.

Let’s define a range and look at the various operations we can perform on this data type:

irb(main):028:0> zero_to_nine= 0..9
=> 0..9
irb(main):031:0> zero_to_nine.include?(4)
=> true
irb(main):032:0> zero_to_nine.include?(11)
=> false
irb(main):002:0> zero_to_nine.each{|zero_to_nine| print(zero_to_nine)}
0123456789=> 0..9
irb(main):003:0> zero_to_nine.min
=> 0
irb(main):004:0> zero_to_nine.max
=> 9

We can see that a range offers various operations such as searching, finding the minimum and maximum values, and displaying all the data in a range. Here, the include? function checks whether the value is contained in the range or not. In addition, the min and max functions display the lowest and highest values in a range.

Arrays in Ruby

We can simply define arrays as a list of various values. Let’s have a look at an example:

irb(main):005:0> name = ["nipun","james"]
=> ["nipun", "james"]
irb(main):006:0> name[0]
=> "nipun"
irb(main):007:0> name[1]
=> "james"

So, up to this point, we have covered all the required variables and data types that we will need for writing Metasploit modules.

For more information on variables and data types, refer to the following link:

http://www.tutorialspoint.com/ruby/

Refer to a quick cheat sheet for using Ruby programming effectively at the following links:

https://github.com/savini/cheatsheets/raw/master/ruby/RubyCheat.pdf

http://hyperpolyglot.org/scripting

Methods in Ruby

A method is another name for a function. Programmers with a different background than Ruby might use these terms interchangeably. A method is a subroutine that performs a specific operation. The use of methods implements the reuse of code and decreases the length of programs significantly. Defining a method is easy, and their definition starts with the def keyword and ends with the end statement. Let’s consider a simple program to understand their working, for example, printing out the square of 50:

def print_data(par1)
square = par1*par1
return square
end
answer=print_data(50)
print(answer)

The print_data method receives the parameter sent from the main function, multiplies it with itself, and sends it back using the return statement. The program saves this returned value in a variable named answer and prints the value.

Decision-making operators

Decision making is also a simple concept as with any other programming language. Let’s have a look at an example:

irb(main):001:0> 1 > 2
=> false
irb(main):002:0> 1 < 2
=> true

Let’s also consider the case of string data:

irb(main):005:0> "Nipun" == "nipun"
=> false
irb(main):006:0> "Nipun" == "Nipun"
=> true

Let’s consider a simple program with decision-making operators:

#Main
num = gets
num1 = num.to_i
decision(num1)
#Function
def decision(par1)
print(par1)
par1= par1
if(par1%2==0)
print("Number is Even")
else
print("Number is Odd")
end
end

We ask the user to enter a number and store it in a variable named num using gets. However, gets will save the user input in the form of a string. So, let’s first change its data type to an integer using the to_i method and store it in a different variable named num1. Next, we pass this value as an argument to the method named decision and check whether the number is divisible by two. If the remainder is equal to zero, it is concluded that the number is divisible by true, which is why the if block is executed; if the condition is not met, the else block is executed.

The output of the preceding program will be something similar to the following screenshot when executed in a Windows-based environment:

Packt

LEAVE A REPLY

Please enter your comment!
Please enter your name here