-
Notifications
You must be signed in to change notification settings - Fork 0
/
Metasploit
174 lines (97 loc) · 7.03 KB
/
Metasploit
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
#Task 2 Initializing...
- We can start the Metasploit console on the command line without showing the banner or any startup information as well. What switch do we add to msfconsole to start it without showing this information? This will include the '-'
hint:msfconsole --help
-q
- Cool! We've connected to the database, which type of database does Metasploit 5 use?
postgresql
#Task 3 Rock 'em to the Core [Commands]
- The help menu has a very short one-character alias, what is it?
?
- Finding various modules we have at our disposal within Metasploit is one of the most common commands we will leverage in the framework. What is the base command we use for searching?
search
- Once we've found the module we want to leverage, what command we use to select it as the active module?
use
- How about if we want to view information about either a specific module or just the active one we have selected?
info
- Metasploit has a built-in netcat-like function where we can make a quick connection with a host simply to verify that we can 'talk' to it. What command is this?
connect
- Entirely one of the commands purely utilized for fun, what command displays the motd/ascii art we see when we start msfconsole (without -q flag)?
banner
- We'll revisit these next two commands shortly, however, they're two of the most used commands within Metasploit. First, what command do we use to change the value of a variable?
set
- Metasploit supports the use of global variables, something which is incredibly useful when you're specifically focusing on a single box. What command changes the value of a variable globally?
setg
- Now that we've learned how to change the value of variables, how do we view them? There are technically several answers to this question, however, I'm looking for a specific three-letter command which is used to view the value of single variables.
get
- How about changing the value of a variable to null/no value?
unset
- When performing a penetration test it's quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?
spool
- Leaving a Metasploit console running isn't always convenient and it can be helpful to have all of our previously set values load when starting up Metasploit. What command can we use to store the settings/active datastores from Metasploit to a settings file? This will save within your msf4 (or msf5) directory and can be undone easily by simply removing the created settings file.
save
#Task 4 Modules for Every Occasion!
- Easily the most common module utilized, which module holds all of the exploit code we will use?
exploit
- Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation?
payload
- Which module is most commonly used in scanning and verification machines are exploitable? This is not the same as the actual exploitation of course.
auxiliary
- One of the most common activities after exploitation is looting and pivoting. Which module provides these capabilities?
post
- Commonly utilized in payload obfuscation, which module allows us to modify the 'appearance' of our exploit such that we may avoid signature detection?
encoder
- Last but not least, which module is used with buffer overflow and ROP attacks?
NOP
- Not every module is loaded in by default, what command can we use to load different modules?
load
#Task 5 Move that shell!
- What service does nmap identify running on port 135?
hint: db_nmap -sV 10.10.100.49
msrpc
- Now that we've scanned our victim system, let's try connecting to it with a Metasploit payload. First, we'll have to search for the target payload. In Metasploit 5 (the most recent version at the time of writing) you can simply type use followed by a unique string found within only the target exploit. For example, try this out now with the following command use icecast. What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start
hint: search ice
exploit/windows/http/icecast_header
- What is the name of the column on the far left side of the console that shows up next to 'Name'?
#
#Task 6 We're in, now what?
What service does nmap identify running on port 135?
- First things first, our initial shell/process typically isn't very stable. Let's go ahead and attempt to move to a different process. First, let's list the processes using the command ps. What's the name of the spool service?
hint: meterpreter>ps
spoolsv.exe
- Let's go ahead and move into the spool process or at least attempt to! What command do we use to transfer ourselves into the process? This won't work at the current time as we don't have sufficient privileges but we can still try!
hint: meterpreter>help
migrate
- Well that migration didn't work, let's find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?
hint: help
getuid
- How about finding more information out about the system itself?
hint: help
sysinfo
- This might take a little bit of googling, what do we run to load mimikatz (more specifically the new version of mimikatz) so we can use it?
hint: https://www.offensive-security.com/metasploit-unleashed/mimikatz/
load mimikatz
answer: load kiwi
- Let's go ahead and figure out the privileges of our current user, what command do we run?
hint: help
getprivs
- What command do we run to transfer files to our victim computer?
hint: help
upload
- How about if we want to run a Metasploit module?
run
- A simple question but still quite necessary, what command do we run to figure out the networking information and interfaces on our victim?
ipconfig
- One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?
shell
#Task 7 Makin' Cisco Proud
#Let's go ahead and run the command run autoroute -h, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: 172.18.1.0/24? Use the -n flag in your answer.
hint: meterpreter>run autoroute -h
run autoroute -s 172.18.1.0 -n 255.255.255.0
- Additionally, we can start a socks5 proxy server out of this session. Background our current meterpreter session and run the command search server/socks5. What is the full path to the socks5 auxiliary module?
hint: msf6>search server/socks5
auxiliary/server/socks5
- Once we've started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks5 server with proxychains?
proxychains
https://tryhackme.com/room/rpmetasploit
https://juliette1012.github.io/posts/THM-Metasploit/
https://medium.com/@CyberOPS.LittleDog/tryhackme-rp-metasploit-a270355e4640