Eight years after the formation of the last significant branch, the vulnerability analysis platform, Metasploit Framework, is launched in its most renewed version 5.0.
Currently, the Metasploit Framework package includes 3795 modules with the implementation of various exploits and attack methods.
The project also maintains a database containing approximately 136710 vulnerabilities. Metasploit's code is written in Ruby and distributed under the BSD license. Modules can be developed in Ruby, Python, and Go.
Metasploit is an open-source project for computer security , which provides information about security vulnerabilities and helps in penetration testing ("Pentesting") and the development of signatures for intrusion detection systems.
Its best-known subproject is the Metasploit Framework, a tool for developing and executing exploits against a remote machine. Other important subprojects include opcode databases, a shellcode archive, and security research.
The Metasploit Framework provides cybersecurity specialists with a set of tools for the rapid development and debugging of vulnerabilities , as well as for verifying vulnerabilities and the systems' performance in the event of a successful attack.
A basic command line interface is proposed to scan the network and test systems for vulnerabilities, including testing the applicability of actual exploits. As part of the Community and Pro editions, an intuitive web interface is also provided.
Metasploit 5.0 major enhancements
This new release added the "evasion" module, which allows the user to create executable payload files, evading antivirus activations.
The module makes it possible to reproduce more realistic conditions when verifying the system , taking into account typical antivirus malware techniques.
For example, techniques such as shellcode encryption, code randomization, and lock execution under the emulator are used to evade the antivirus.
In addition to the Ruby language, Python and Go can now be used to develop external modules for the Framework.
A basic web services framework has also been added that implements a REST API to automate tasks and work with databases, supports various authentication schemes, and offers opportunities for parallel execution of operations;
Metasploit 5.0 features an implemented API based on JSON-RPC , which simplifies the integration of Metasploit with various tools and programming languages.
Users can now run their own PostgreSQL RESTful service to connect multiple Metasploit consoles and external toolkits.
On the other hand, the possibility of parallel processing of operations with the database and the console (msfconsole) is provided , which makes it possible to carry out the execution of some package operations on the shoulders of the service that serves the database.
For payload, the meta-shell concept and the meta-command "background" are implemented, which allows you to run background sessions in the background and downloads after the operation on the remote side, and manage them without using a Meterpreter-based session .
Finally , the last point that can be highlighted is that the ability to check multiple hosts with one module at a time was added by configuring the IP address range in the RHOSTS option or by specifying a link to the file with the addresses in the format /etc/hosts through the URL "file://";
The search engine has been redesigned, which shortened the startup time and removed the database from dependencies.
How to get Metasploit 5.0?
For those interested in installing this new version of Metasploit 5.0, you can go to the project's official website where you can download the version you need.
Since Metasploit has two versions, one community (free) and the Pro version with direct support from the creators.
For those of us who are Linux users, we can obtain this new version by opening a terminal and running:
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && \
chmod 755 msfinstall && \
./msfinstall