New version of Metasploit exploit framework

New versions of HD Moore's open source Metasploit framework are now available. The software allows interested parties to create exploits for security holes using a plug'n'play-like process. The stable build was assigned version number 2.7, while Moore raised the 3.0 development build up to Beta 3 status.

Moore claims that Metasploit 2.7 will be the last version of the 2.x series, with developmental resources applied to the 3.x series going forward. The changes from the prior version are primarily cosmetic, although Moore reports having worked on the reliability of large payloads in exports. He also added in 14 new pre-prepared exploit modules.

The code basis for the 3.0 framework is to be completely reworked. The changes will include an automated exploit mode for network administrators to test database-supported vulnerabilities in their network and support for the creation of what are known as "raw" WLAN packets through lorcon. The latter is used to exploit vulnerabilities in WLAN drivers as well as payloads for the kernel mode.

Lorcon (Loss of Radio Connectivity) is the WLAN packet creation tool used by Jon Ellch and David Maynor to turn up critical security holes in WLAN drivers. Those holes were shown to compromise Windows and Linux computers as well as MacBooks.

See also:

• Homepage of the Metasploit project
• Metasploit Framework 2.7 Released, announcement from HD Moore
• Metasploit Framework 3.0 Released, announcement from HD Moore
• Exploits for All, background article on Metasploit at heise Security

(ehe)