How to remediate – Metasploit HTTP Server detection

1. Introduction

2. Technical Explanation

The vulnerability occurs when a Metasploit HTTP server is running without necessary restrictions. Attackers can connect to this server remotely to gain access to the framework’s capabilities. This allows them to scan for vulnerabilities and potentially exploit other systems on the network. The main precondition is that the server must be accessible over the network, typically via port 80 or 443.

• Root cause: An unnecessary Metasploit HTTP service is active.
• Exploit mechanism: An attacker connects to the server and uses available modules to scan for vulnerabilities on other systems. For example, they might use a module to identify an unpatched SMB vulnerability.
• Scope: Affected platforms are those running the Metasploit Framework, typically Linux distributions like Kali Linux or Ubuntu, but also Windows when using Metasploit within a virtual machine.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking for listening ports associated with Metasploit. A thorough method involves examining running processes.

• Quick checks: Use the following command to check for listening ports: netstat -tulnp | grep 'metasploit'
• Scanning: Nessus plugin ID 16384 may detect this, but results should be verified.
• Logs and evidence: Check system logs for processes named ‘msfconsole’ or related Metasploit components. Event IDs will vary depending on the operating system.

netstat -tulnp | grep 'metasploit'

4. Solution / Remediation Steps

Disable the service if it is not required. This prevents attackers from connecting and exploiting the framework.

4.1 Preparation

• Ensure no critical security assessments are in progress that rely on this service. Change windows may be needed for production systems, requiring approval from IT management.

4.2 Implementation

1. Step 1: Stop the Metasploit HTTP server process using sudo systemctl stop metasploit-http or equivalent command depending on your Linux distribution.
2. Step 2: Disable the service from starting automatically at boot with sudo systemctl disable metasploit-http.

4.3 Config or Code Example

Before

systemctl status metasploit-http
● metasploit-http.service - Metasploit HTTP Server
   Loaded: loaded (/lib/systemd/system/metasploit-http.service; enabled; vendor preset: disabled)
   Active: active (running) since ...

After

systemctl status metasploit-http
● metasploit-http.service - Metasploit HTTP Server
   Loaded: loaded (/lib/systemd/system/metasploit-http.service; disabled)
   Active: inactive (dead) since ...

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability type include least privilege and safe defaults.

• Practice 1: Least privilege – only grant access to Metasploit to authorised personnel, reducing the impact if compromised.
• Practice 2: Safe defaults – ensure unnecessary services are disabled by default.

4.5 Automation (Optional)

#!/bin/bash
# Script to disable Metasploit HTTP service on multiple Linux systems
for host in $(cat /path/to/hostlist); do
  ssh $host "sudo systemctl stop metasploit-http"
  ssh $host "sudo systemctl disable metasploit-http"
done

5. Verification / Validation

Confirm the fix by checking if the HTTP server is no longer listening on the expected port. A negative test involves attempting to connect to the server.

• Post-fix check: Run netstat -tulnp | grep 'metasploit' and verify no processes are listed.
• Re-test: Re-run the earlier detection command (netstat -tulnp | grep 'metasploit') to confirm it returns no results.
• Smoke test: Ensure any other essential services on the system continue to function as expected, such as SSH access.
• Monitoring: Monitor system logs for unexpected Metasploit processes or network connections. Example query: grep 'metasploit' /var/log/syslog.

netstat -tulnp | grep 'metasploit' # Should return no output

6. Preventive Measures and Monitoring

Update security baselines to include disabling unnecessary services, such as the Metasploit HTTP server. Add checks in CI/CD pipelines to prevent this issue.

• Baselines: Update your system hardening baseline or CIS control configuration to explicitly disable the Metasploit HTTP service.

7. Risks, Side Effects, and Roll Back

Disabling the service may impact ongoing penetration testing activities. Rolling back involves re-enabling the service.

• Risk or side effect 1: Disabling the HTTP server will prevent active Metasploit sessions from functioning correctly.
• Risk or side effect 2: If other applications rely on this port, they may also be affected.
• Roll back:
  1. Step 1: Re-enable the service with sudo systemctl enable metasploit-http.
  2. Step 2: Start the service with sudo systemctl start metasploit-http.

8. References and Resources

• Vendor advisory or bulletin: https://www.rapid7.com/products/metasploit/