The feature I am most excited about is the new Post Exploitation support. I hinted at this new module type in the 3.5.2 release announcement and with 3.6, more than 20 new modules are available. Post modules are a new, more powerful, replacement for meterpreter scripts. Scripts were clearly tied to a single platform: meterpreter for Windows. With modules it is much easier to abstract common tasks into libraries for any platform that can expose a session. For example, file operations are common across all platforms -- windows/meterpreter, windows/shell, linux/shell, etc. Post modules can simply include Post::File and have access to platform-agnostic methods for interacting with the file system. In the near future, this sort of abstraction will be extended to Windows registry manipulation and service control.
Too much generality can make it difficult to access OS-level features and when you really need to get down and dirty with a session, you still can. Post modules have a Session object exactly as meterpreter scripts did and you can still access all of the low-level methods available to it. That means you can use railgun for performing complex system manipulation (ie. smartlocker) when necessary. A major benefit of Post modules is the ability to easily include other mixins from the framework. From a user's perspective, this means more consistent reporting and option handling than are currently available with scripts. This also opens the door to local exploits for a variety of platforms, including Windows, Linux, and even Cisco IOS through SSH and Telnet sessions.
Although post modules are meant to replace meterpreter scripts, scripts are not going away any time soon. We understand that many users still rely on private scripts for their post-exploitation needs and porting all of them to the new format will take time. So while we will be favoring module contributions over scripts, that doesn't mean your private code is suddenly going to stop working.
This is an exciting release. As always, it is immediately available from the
Metasploit Framework downloads page.
