Metasploit 3.4 and SET 0.6.1 on iPhone 4

Metasploit 3.4 and SET 0.6.1 on iPhone 4

Metasploit and SET on iPhone4Metasploit 3.4.2 on the iPhone 4

Just a quick update on getting your favorite tools on iOS 4 – Metasploit and SET. You need to have a Jailbroken iPhone with SSH access for this. You will also need to install nano and APT 0.7 Strict via Cydia. Getting everything up and running is a breeze now. Open a console and type in:

cd /private/var/
apt-get install subversion nano ruby rubygems wget python
apt-get clean
wget http://www.metasploit.com/releases/framework-3.4.1.tar.bz2
tar jxpf framework-3.4.1.tar.bz2
cd msf3
svn update

Remember that everything takes a bit more time on the iPhone, be patient while running msfconsole for the first time. Once that’s done, its a quick path to a shell:

Metasploit Framework Shell iphone 4

Social Engineering Toolkit (SET) 0.6.1

Also a breeze to install:

cd /private/var/
svn co http://svn.thepentest.com/social_engineering_toolkit/ SET/
cd SET/
./set # (Agree to install the pexpect and beautiful soup python modules).

Edit your set config file found at config/set_config and change the msf path to /private/var/msf3 (or relevant path). We ran the Website Cloner with a Malicious Java Applet :

Social Engineering Toolkit iPhone 4

And were immediately greeted by a meterpreter shell:

Meterpreter Shell on iPhone 4

UPDATE: A few days after this post was made, the Cydia repos got an updated ruby 1.9 package, which breaks metasploit completely.

muts:/private/var/msf3 root# ./msfconsole
ruby(528,0x3e7c27c8) malloc: *** error for object 0x316eff0: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
Abort trap

To resolve this, uninstall ruby 1.9, and rubygems, and install the older packages (ruby_1.8.6-p111-5_iphoneos-arm.deb and rubygems_1.2.0-3_iphoneos-arm.deb) manually with dpkg.

UPDATE FOR 2020

Advanced Web Attacks and Exploitation

Advanced Web Attacks and Exploitation (AWAE)

Learn white box web application penetration testing and advanced source code review methods. Now with 50% more content, including a black box module.

Earn your OSWE

FOLLOW US ON TWITTER:

@offsectraining

@kalilinux

@exploitdb