search
githubEdit

Module 20: The Metasploit Framework

hashtag
Getting Familiar with Metasploit

hashtag
Setup and Work with MSF

Startin the database service and creating/initializing the MSF database:

kali@kali:~$ sudo msfdb init

Enabling the database server at boot:

kali@kali:~$ sudo systemctl enable postgresql

Launching the Metasploit Framework Console

kali@kali:~$ sudo msfconsole

Verifying the database connectivity:

msf6 > db_status
circle-exclamation

Use workspaces to keep your gathered data separate!

# Displaying current workspace
msf6 > workspace
* default
  demo

# Switching workspaces
msf6 > workspace demo
[*] Workspace: demo

# Creating a new workspace named pen200
msf6 > workspace -a pen200
[*] Added workspace: pen200
[*] Workspace: pen200

Populating the database:

Listing findings:

Viewing modules:

hashtag
Auxiliary Modules

Listing all auxiliary modules:

Searching for specific types of modules in the auxiliary category:

Selecting a module found for use:

Getting information about the currently activated module:

Listing Basic Options for the module:

Setting option values:

Launching an exploit:

Listing discovered vulnerabilities:

hashtag
Exploit Modules

Same kind of deal as the Auxiliary modules except you want to pick an exploit and then set a payload.

hashtag
Using Metasploit Payloads

hashtag
Staged vs Non-Staged Payloads

Non-staged: Sent in its entirety along with the exploit. These are generally more stable. The downside is the size will be bigger than other types.

Staged: Sent in two parts; the first contains a small primary payload that causes the victim machine to connect back to the attacker, transfer a larger secondary payload containing the rest of the shellcode, and then execute it.

Examples in Metasploit:

The two payloads above only differ in the character following shell before reverse_tcp. The /shell/reverse_tcp is a staged payload. The /shell_reverse_tcp is a non-staged payload.

hashtag
Meterpreter Payload

The Meterpreter payload is a multi-function payload that can be dynamically extended at run-time. It resides entirely in memory and communication is encrypted by default.

Useful Meterpreter commands of note:

Running any command inside a meterpreter session prefixed with an l (lowercase L) will run on the local system rather than the remote system.

hashtag
Executable Payloads

Using msfvenom to list payloads with a filter:

circle-info

Netcat does not know how to handle staged payloads. If running a staged payload, use Metasploit's multi/handler module.

Example usage of msfvenom:

hashtag
Performing Post-Exploitation with Metasploit

hashtag
Core Meterpreter Post-Exploitation Features

hashtag
Post-Exploitation Modules

Getting integrity level and bypassing UAC starting from Meterpreter session:

Loading extensions in Metasploit:

hashtag
Pivoting with Metasploit

Setting up a route through an open session:

Using credentials to pivot through our route:

Automated route creation:

Combining routes with the server/socks_proxy auxiliary module to configure a SOCKS proxy. This allows applications outside of the MSF to tunnel through the pivot on port 1080 by default:

We can also port forward inside a meterpreter session via the portfwd command:

hashtag
Automating Metasploit

hashtag
Resource Scripts

Creating a resource script to start a multi/handler listener for a non-staged Windows 64-bit Meterpreter payload:

Reading from the resource script via msfconsole:

If we don't want to use our own scripts, there are resource scripts provided from Metasploit as well! These can be found in the /usr/share/metasploit-framework/scripts/resource directory.

PreviousModule 19: Tunneling Through Deep Packet InspectionNextModule 21: Active Directory Introduction and Enumeration

Last updated