Abstract

Writing Metasploit plugins - from vulnerability to exploit

This talk shall focus on exploit development from vulnerabilities. We have seen many postings on security forums which vaguely describe a vulnerability, or sometimes provide a “proof-of-concept” exploit.

The Metasploit Framework is a powerful tool to assist in the process of vulnerability testing and exploit development. The framework can also be used as an engine to run exploits, with different payloads and post-exploitation mechanisms.

In this talk, we shall look at how we can construct exploits from published vulnerabilities, using facilities provided by the Metasploit framework. A Unix and a Windows vulnerability example shall be covered. Next we shall demonstrate how to write this exploit as a Metasploit plug-in, so that it can be integrated into the Metasploit Framework.

Participants shall get insights into discovery and verification of vulnerabilities, finding the entry points, gaining control of program flow, choices of shellcode and finally writing a working exploit for the vulnerability. Participants shall also get an overview of Metasploit’s internal modules and how to integrate custom exploits with the Metasploit framework.

Bring-Your-Own-Laptop! This session is quite interactive and hands-on. We shall be hosting a local area network during this session, which features an exploit laboratory. We shall be crafting exploits along the session and trying them out.