From Security Weekly WikiJump to navigationJump to search
= Tech Segment: Gettin' down with Armitage =
Armitage A new third party GUI for Matasploit. Looks really sexy. Sometimes you just need a pretty GUI… This one by the folks over at fastandeasyhacking.com.
Let's get it up and running! You need a database, mysql, postgres, or mysql. I chose mysql. I'll leave the Mysql setup for Metasploit as an exercise for the reader.
We'll need to make sure tht you have the ruby modiles installed.
# gem install mysql
Now we can start all of our services, such asstart the msf rpc set up and start armitage:
…or we can go for the Hail Mary, otherwise known as db_autopwn.
It works, for sure, but I'm not convinced. I thin the by port works better (more tries) than by vulnerability…by vulnerability, I've had it try stuff that didn't work across the board and have them be vulnerable to other items. I think this stems form the fact that we haven;t really discovered much about the targets. Either way, it will fire off a whole bunch of attacks:
So, it works, it works well, but there are some issues in how I like to use it for legitimate purposes. For example:
# Output of meterpreter commands end up in a Java window, which can be a nightmare to copy and paste into something else. Sure, using the Gui equivalent can often dump stuff into a new tab that can be exported (such as hashdump), but then the output isn't in pwdump format, then not easily identifiable by machine.