Metasploit

General Info

Metasploit is a penetration testing framework developed by Rapid7. It has built-in support for exploits, payloads and its own extended shell system called Meterpreter.

Commands

These commands are adapted from the Metasploit Cheat Sheet created by TunnelsUp. Check it out here!

General

Using the database

The Metasploit database saves data found during exploitation. Auxiliary scan results, hashdumps, and credentials show up in the database. For separate assignments, try using Workspaces (see below).

First Time Setup

Commands

Exploit handling

Finding an Exploit to use

First, gather information using db_nmap and auxiliary modules. Auxiliary modules have numerous scanners, gatherers, fuzzers, and tools that allow you to scan a CIDR block or single IP and will save the results in the database.

Once information is gathered on the host, look at the results: What OS is running, what services were found? Use the search command to find suitable exploits or modules for further enumeration.

Executing an Exploit

Sessions

Meterpreter

General commands

Privilege Escalation

Windows Access Token Theft

Port forwarding / pivoting

Enable port forwarding, opening port 3388 locally which forwards all traffic to 3389 on remote host:

portfwd [ADD|DELETE] -L <LHOST> -l 3388 -r <RHOST> -p 3389

Pivot through a session by adding a route within msf, it allows you to exploit or scan adjacent hosts

route add <SUBNET> <MASK> <SESSIONID>

Workspaces

Each workspace acts like a separate database. Need a fresh DB? Create a new workspace.

PreviousPython scripting NextRecon

Last updated 5 years ago