Extrabacon's Sploit Framework: Or how to break the Ruby bonds of Metasploit

No ratings

Presented at BSidesSeattle 2017 by

Daniel Reilly

Sploit is the modular core that runs the EXTRABACON exploit in the ShadowBroker's tool dump. While everyone is focused on the news of the 0-days, the recent porting of this older exploit to newer ASA versions (http://www.securityweek.com/leaked-cisco-asa-exploit-adapted-newer-versions) I chose to look at the underlying structure. First because there are already a number of talented researchers covering every angle of each exploit in greater detail than I could. Second because the hidden jewel that is the Sploit framework deserves some attention as well. In my talk I will go over the python structure of the Sploit Framework as well as examine the general structure of the exploits contained in the dump. Finally I will discuss how to port exploits from other systems (like Metasploit) into the Sploit framework. I will conclude with a demo (hopefully live but possibly recorded) of exploiting the ever popular Metasploitable VM in a closed environment.