Cortana Tutorial - Armitage

Low-­‐level Metasploit Control
Metasploit offers a remote API for programmers to write clients against. This API covers
most of what you would want to do with Metasploit. Cortana abstracts this API for you, but
there may be times when you want to talk to Metasploit directly or you may want to extend
the Cortana API for your scripts.
To call an RPC API method:
call("module.method", ...);
The call method accepts any number of arguments. Cortana will convert that data you
provide to the types expected by the RPC server. It's very good at doing this.
Cortana's control of Metasploit builds on this one function. Because this is a choke-­‐point for
all Metasploit control, it presents an interesting opportunity. With Cortana, you may hook
any call to Metasploit, rewrite the parameters, and send it on its way. The means to do this
is a filter. Cortana filters are like event listeners. Filters accept the arguments to some
action, inspect them, and potentially change them in some way.
Cortana allows filters to catch any call to Metasploit. Here's a module spy that lists all
modules (with arguments) launched by scripts in the current Cortana container:
filter module_execute {
println("Launched: $1 / $2");
println("Arguments: $3");
return @_;
}
Filters must return their arguments. The return @_ line at the bottom of this filter
accomplishes this. In Sleep, the array @_ contains the arguments passed to the current
function.
&call is one of the few Cortana functions that block. This means Cortana will wait until
Metasploit returns a result and then provide it to you. If you don't need the result of the
method you're calling, then use the &call_async function. This will queue the call and allow
it to execute without blocking other Cortana scripts or the Armitage user interface.
To find out which calls are available, consult the Metasploit Remote API document:
https://community.rapid7.com/servlet/JiveServlet/downloadBody/1516-­‐102-­‐3-­‐
2501/RemoteAPI_4.1.pdf
High-­‐Level Metasploit Control
To interact with Metasploit, you do not need to use a virtual console or learn the Metasploit
Remote API. Cortana provides several functions to make it easy to launch modules and
query information about them.
13