Metasploit Framework 6.4 Released: What’s New!

Metasploit Framework 6.4 introduces significant improvements to Kerberos authentication. The auxiliary/admin/kerberos/forge_ticket module now supports diamond and sapphire techniques alongside golden and silver tickets and is compatible with Windows Server 2022. 

A new post/windows/manage/kerberos_tickets module allows Kerberos tickets to be dumped from compromised systems, similar to Rubeus’s klist/dump.

The auxiliary/gather/windows_secrets_dump module now supports pass-the-ticket authentication with DCSync, enabling domain credential dumping using a valid Kerberos ticket. 

Metasploit allows advanced configuration of DNS resolution for pivoting scenarios where rules can be defined to resolve specific domains (e.g., *.lab.lan) through a chosen nameserver, potentially reached via an established session (e.g., session 1).

Examples of manipulating the DNS configuration

It lets you control where DNS requests originate, create static host mappings, or define a fallback rule to use specific nameservers for all other domains, ensuring DNS queries are directed as needed during penetration testing. 

Viewing the current configuration

Metasploit 6.4 introduced new SMB session types, allowing direct interaction with SMB shares. Sessions can be initiated by setting the CreateSession option in specific modules. 

The session opened as a new SMB session type

Once a session is established, directories can be navigated, and files can be uploaded and downloaded.

Other functionalities like secret dumping and PsExec can be leveraged through the session. 

Metasploit’s PsExec supports the SMB session to open a Meterpreter session

Kerberos authentication is also supported for these sessions, offering penetration testers a more streamlined approach to exploiting and managing compromised SMB servers.

New SQL Session Types Examples

It introduced new auxiliary modules that can establish database sessions of different types, including PostgreSQL, MSSQL, and MySQL, similar to SMB sessions. These sessions can be initiated using the CreateSession option. 

Active sessions

For instance, the auxiliary module scanner/mssql/mssql_login can create a new MSSQL session after successful authentication.

Once a session is established, the “sessions” command can be used to list all active sessions, and “sessions -i <session id>” can be used to interact with a specific session.  

an interactive prompt for running multiple multi-line queries

Within the interactive session, users can execute SQL queries using the “query” command or start an interactive SQL shell using the “query_interactive” command, which allows for post-exploitation database interaction after compromising a system.

New features in Metasploit 6.4 improve module discoverability, enable memory searching for Windows Meterpreter, and implement indirect syscalls to bypass EDR/AV detection. 

The technique hides the system call by jumping to the syscall instruction within ntdll.dll.

The position of the corresponding native API function in memory, assuming sequential assignment starting from zero, determines the system call number. 

Another improvement is hierarchical search, which includes searching based on module actions and aliases.

In contrast, a new API allows memory searching within a process for specific data patterns, potentially revealing sensitive information.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

8 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

8 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

11 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

14 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

15 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

15 hours ago