Edit

Module 20: The Metasploit Framework

Getting Familiar with Metasploit

Setup and Work with MSF

Startin the database service and creating/initializing the MSF database:

kali@kali:~$ sudo msfdb init

Enabling the database server at boot:

kali@kali:~$ sudo systemctl enable postgresql

Launching the Metasploit Framework Console

kali@kali:~$ sudo msfconsole

Verifying the database connectivity:

msf6 > db_status

Use workspaces to keep your gathered data separate!

# Displaying current workspace
msf6 > workspace
* default
  demo

# Switching workspaces
msf6 > workspace demo
[*] Workspace: demo

# Creating a new workspace named pen200
msf6 > workspace -a pen200
[*] Added workspace: pen200
[*] Workspace: pen200

Populating the database:

Listing findings:

Viewing modules:

Auxiliary Modules

Listing all auxiliary modules:

Searching for specific types of modules in the auxiliary category:

Selecting a module found for use:

Getting information about the currently activated module:

Listing Basic Options for the module:

Setting option values:

Launching an exploit:

Listing discovered vulnerabilities:

Exploit Modules

Same kind of deal as the Auxiliary modules except you want to pick an exploit and then set a payload.

Using Metasploit Payloads

Staged vs Non-Staged Payloads

Non-staged: Sent in its entirety along with the exploit. These are generally more stable. The downside is the size will be bigger than other types.

Staged: Sent in two parts; the first contains a small primary payload that causes the victim machine to connect back to the attacker, transfer a larger secondary payload containing the rest of the shellcode, and then execute it.

Examples in Metasploit:

The two payloads above only differ in the character following shell before reverse_tcp. The /shell/reverse_tcp is a staged payload. The /shell_reverse_tcp is a non-staged payload.

Meterpreter Payload

The Meterpreter payload is a multi-function payload that can be dynamically extended at run-time. It resides entirely in memory and communication is encrypted by default.

Useful Meterpreter commands of note:

Running any command inside a meterpreter session prefixed with an l (lowercase L) will run on the local system rather than the remote system.

Executable Payloads

Using msfvenom to list payloads with a filter:

Netcat does not know how to handle staged payloads. If running a staged payload, use Metasploit's multi/handler module.

Example usage of msfvenom:

Performing Post-Exploitation with Metasploit

Core Meterpreter Post-Exploitation Features

Post-Exploitation Modules

Getting integrity level and bypassing UAC starting from Meterpreter session:

Loading extensions in Metasploit:

Pivoting with Metasploit

Setting up a route through an open session:

Using credentials to pivot through our route:

Automated route creation:

Combining routes with the server/socks_proxy auxiliary module to configure a SOCKS proxy. This allows applications outside of the MSF to tunnel through the pivot on port 1080 by default:

We can also port forward inside a meterpreter session via the portfwd command:

Automating Metasploit

Resource Scripts

Creating a resource script to start a multi/handler listener for a non-staged Windows 64-bit Meterpreter payload:

Reading from the resource script via msfconsole:

If we don't want to use our own scripts, there are resource scripts provided from Metasploit as well! These can be found in the /usr/share/metasploit-framework/scripts/resource directory.

PreviousModule 19: Tunneling Through Deep Packet InspectionNextModule 21: Active Directory Introduction and Enumeration

Last updated