Exploitation Framework

[Illiac]

Hello,

I am looking for an exploitation framework to 'get used to'.
This seems quite out of the blue and the obvious answer would be: "Use Metasploit". But there is a small issue with that.

The framework I am looking for has / should have the following features:
- CLI Based Interface (so it can be accessed over SSH).
- Runs on x86_64 and x86 Linux.
- Allows me to choose an exploit and attach a payload to it.
- Is easily extended by my own 0-days.
- Allows easy IO with other applications.
- Does not have a Binary installer, but a repository I can pull the source off and then (build) and run it.
- Is Free as RMS describes it.
- Does not cost more than $100k a year for unlimited targets and unlimited users.
- Has a fuzzing part to it.
- Aids developing exploits. Think Burp Suite, Offset Searcher and Pattern searcher (pop, ret).

I had a look at Inguma, Metasploit, Canvas and Core Impact.

Inguma: Still in very Alpha stages. I can help adding functions if I polish up my Python. But the exploit part (seems) undesign.
Metasploit: Not RMS Free, since Rapid7 took over things are going down-hill. Binary installer isn't what I require.
Canvas: Seems like an right candidate. But I am unaware of it's costs. Also I never worked with it just had a look at the Videos and heard some talks about it.
Core: Only Windows?


I am wondering if there is one I am missing and if someone could maybe give some advice to my needs?

Thanks

- Illiac

[iproute]

I know this is the obvious answer, but doesnt metasploit fit most of those requirements? A former co-worker friend put plenty of his own stuff into metasploit. And it has an RPC daemon that can be used for external apps. Also have an SVN repo. As far as users, you could just add users and properly manage permissions with sudo with proper fine tuning. Just my 2 cents, though from the sound of it, you're more talented than I in much of this... I've yet to delve into exploit development for instance. Guess I've spent too much time lately on my telco stuff, but hey, thats my line of work.

[Illiac]

I couldn't seem to find the Metasploit 4 repo.

I thought about using Metasploit 3 and adding functions to it (maybe even fork it).

[g0tmi1k]

I couldn't seem to find the Metasploit 4 repo.

Repos: apt-cache show framework && apt-get install framework
Path: /pentest/exploits/framework or /opt/framework

[iproute]

Though the URL says framework3, I believe 4 resides on it, as if you dig around on the svn repo a bit (tags rather than trunk) , you can find weekly updates into october of this year.

svn checkout https://www.metasploit.com/svn/framework3/trunk /opt/metasploit3/msf3/

so that should still be valid for work from 'from-source'. Just change the directory it ends up in if you so desire.

[Illiac]

Repos: apt-cache show framework && apt-get install framework
Path: /pentest/exploits/framework or /opt/framework

Alright, let me correct myself.
Source Code Repositories.

@iproute
Thanks I didn't look at far. I'll have a look.

Anyone an other thought about the other frameworks?