Lost with Metasploit!

[mrsmash]

Hello guys!

I have a question about Metasploit. I want to use Metasploit with xssf, and i'm using Backbox linux.

The problem is, i only seem to get metasploit-framework and not metasploit itself.

Metasploit-framework does work, the problem is that it cant seem to find the xssf plugin.

All tutorials on the internet tell me to put xssf in the opt/metasploit/plugin map, but i don't even have that map! Only opt/metasploit-framework/plugins/xssf And when i place the entire trunk into that place, it still says it "failed to load"

Does anyone know how to fix this?

Oh yeah, i tried pasting it in plugins and in plugins/xssf still cant find it.

Edited January 16, 2015 by mrsmash

[digip]

Plug-in or "exploit"?

Start here though: https://www.offensive-security.com/community-projects/metasploit-unleashed/ and post back the versions of everything, from msf, plugin code, etc, although I think all exploit code copied from source of sites like exploit database for example, are forward/backwards compatible since its ruby based, but don't quote me on that. Not sure on plugins though and if they require different dependencies.

[mrsmash]

Plug-in or "exploit"?

Start here though: https://www.offensive-security.com/community-projects/metasploit-unleashed/ and post back the versions of everything, from msf, plugin code, etc, although I think all exploit code copied from source of sites like exploit database for example, are forward/backwards compatible since its ruby based, but don't quote me on that. Not sure on plugins though and if they require different dependencies.

Thank you for your reply.

My metasploit-framework is version 4.11.0-dev

I'm not shure if its wise to post the entire code of the plugin, but here is a link the official website https://code.google.com/p/xssf/

Does this info help?

Thanks for your time! :)

[digip]

Its opensource code, don't think its an issue to post it...lol

Anyway, https://code.google.com/p/xssf/source/browse/trunk/plugins/xssf.rb vs say http://www.exploit-db.com/exploits/10068/

I'm not a headcore metasploit user, but looking at the top. The plug-in calls its own code first, as where most MSF exploits, call MSF directly.

require 'msf/core'

Because this is not just the exploit code in a ruby drop in, and is a whole module that has more than one page of code it executes and uses for source, you need to place all the files in the correct directory paths to execute the payload and have metasploit see and use it. So if you are say, put the entire trunk in the one directory, its most likely going to fail becuse each part of the file, needs to be in the correct paths to execute and show up as a payload. The files in the google code trunk, all have their own paths they need to be in. Usually, an SVN install or clone just copies the files locally to your home folder, but look through how the code works, and where you need to put each file and directory of the XSSF files. I think msf also has its own directory for auxillary files specifically and mubix did an episode on how to create auxillary files, but I don't think the whole directory gets dropped in one location.

If there are errors it throws, which usually say "missing xyz" or can't find "/some/path/filename.rb" than thats a clue as to where it wants specific files to live before it will work.

Also, install instructions here, look to be using MSF 3 - https://code.google.com/p/xssf/wiki/Installand instll paths. I think have changed drastically with moving to MSF4, which I think was a complete overhaul to the code base with same ability to use older exploits. If using Back Track 3, it will probably work like they list on google code, so long as you don't update anything, since the older install had spcial paths for BT3 and MSF that will probably be what its looking for. In later updates, MSF4 and up I beleive, follows different install paths and homes for modules, which you might have to update the google code to point to the updated system files, paths, etc.

Edited January 17, 2015 by digip