Overview

Metasploit is the most widely used exploitation framework. Is a powerful tool that can support all phases of a penetration testing engagement, from information gathering to post-exploitation.

Main components:

msfconsole: The main command-line interface.
Modules: supporting modules such as exploits, scanners, payloads, etc.
Tools: Stand-alone tools that will help vulnerability research, vulnerability assessment, or penetration testing.

# Welcome screen
~# msfconsole
Metasploit tip: View a module's description using info, or the enhanced 
version in your browser with info -d


                 _---------.
             .' #######   ;."
  .---,.    ;@             @@`;   .---,..
." @@@@@'.,'@@            @@@@@',.'@@@@ ".
'-.@@@@@@@@@@@@@          @@@@@@@@@@@@@ @;
   `.@@@@@@@@@@@@        @@@@@@@@@@@@@@ .'
     "--'.@@@  -.@        @ ,'-   .'--"
          ".@' ; @       @ `.  ;'
            |@@@@ @@@     @    .
             ' @@@ @@   @@    ,
              `.@@@@    @@   .
                ',@@     @   ;           _____________
                 (   3 C    )     /|___ / Metasploit! \
                 ;@'. __*__,."    \|--- \_____________/
                  '(.,...."/


       =[ metasploit v6.4.144-dev-                              ]
+ -- --=[ 2,668 exploits - 1,342 auxiliary - 2,581 payloads     ]
+ -- --=[ 435 post - 57 encoders - 14 nops - 12 evasion         ]

Metasploit Documentation: https://docs.metasploit.com/
The Metasploit Framework is a Rapid7 Open Source Project

msf >

Exploit : Piece of code that uses a vulnerability present on a system.
Vulnerability: A design, coding, or logic flaw affecting a system.
Payload: Are the code that will run on a target system.

Auxiliary

Any supporting module, such as scanners, crawlers and fuzzers

~# /opt/metasploit-framework/embedded/framework/modules# tree -L 1 auxiliary/

auxiliary/
├── admin
├── analyze
├── bnat
├── client
├── cloud
├── crawler
├── docx
├── dos
...

Encoders

Allow me to encode the exploit and payload in the hope that a signature-based antivirus solution may miss them.

~# /opt/metasploit-framework/embedded/framework/modules# tree -L 1 encoders/
encoders/
├── cmd
├── generic
├── mipsbe
├── mipsle
...

Exploits

Exploits, neatly organized by target system.

#command
~# /opt/metasploit-framework/embedded/framework/modules# tree -L 1 exploits/

exploits/
├── aix
├── android
├── apple_ios
├── bsd
├── bsdi
├── dialup
├── example_linux_priv_esc.rb
├── example.py
├── example.rb
├── example_webapp.rb
├── firefox
...

e.g commands

msf > use exploit/windows/smb/ms17_010_eternalblue
msf exploit(windows/smb/ms17_010_eternalblue) > show options
msf6 exploit(windows/smb/ms17_010_eternalblue) > show payloads
msf6 exploit(windows/smb/ms17_010_eternalblue) > info
msf6 exploit(windows/smb/ms17_010_eternalblue) > back
msf6 > search ms17-010

The show command can be used in any context followed by a module type (auxiliary, payload, exploit, etc.) to list available modules.

search This command will search the Metasploit Framework database for modules relevant to the given search parameter. I can conduct searches using CVE numbers, exploit names (eternalblue, heartbleed, etc.), or target system.

Documentation Metasploit

Working with Modules

Parameters are set using the same command syntax:

set PARAMETER_NAME VALUE

example

set rhosts IP_TARGET

Main parameters:

RHOSTS: “Remote host”, the IP address of the target system. A single IP address or a network range can be set. This will support the CIDR (Classless Inter-Domain Routing) notation (/24, /16, etc.) or a network range (10.10.10.x – 10.10.10.y). I can also use a file where targets are listed, one target per line using file:/path/of/the/target_file.txt.
RPORT: “Remote port”, the port on the target system the vulnerable application is running on.
PAYLOAD: The payload I will use with the exploit.
LHOST: “Localhost”, the attacking machine (My AttackBox or Kali Linux) IP address.
LPORT: “Local port”, the port I will use for the reverse shell to connect back to. This is a port on my attacking machine, and I can set it to any port not used by any other application.
SESSION: Each connection established to the target system using Metasploit will have a session ID. I will use this with post-exploitation modules that will connect to the target system using an existing connection.
unset: Override any set parameter.
setg: To set values that will be used for all modules