What is Metasploit | The Beginner’s Guide

Introduction :

Metasploit is the most widely used exploitation framework in pen testing or red teaming. Metasploit is ruby ruby-based exploitation tool that is used to check for vulnerabilities in networks, and systems, in order to fix them before bad guys.

Metasploit had two versions: Metasploit Pro, Metasploit framework

• Metasploit Pro: Had many benefits including facilitating the automation and management of tasks by using the Graphical User Interface (GUI)
• Metasploit Framework: It is an open source that uses only a command line interface (CLI).

The Metasploit Framework has multiple tools that allow information gathering, scanning, exploitation, exploit development, post-exploitation, and more. The main usage of the Metasploit Framework focuses on penetration, vulnerability research, and exploit development.

Component of Metasploit :

Msfconsole

It is a command line interface for Metasploit which allows us to access and control various modules, payloads, and exploits.

Armitage

It is a graphical user interface of Metasploit that interface provides a more user-friendly way to interact with Metasploit and perform multiple tasks including managing targets and launching post exploitation attacks.

Exploits

exploits are malicious code that take over a target system by taking advantage of a vulnerability.

├── aix
├── android
├── apple_ios
├── bsd
├── bsdi
├── dialup
├── firefox
├── freebsd
├── hpux
├── irix
├── linux
├── mainframe
├── multi
├── netware
├── openbsd
├── osx
├── qnx
├── solaris
├── unix
└── windows

Payloads

Payloads are small pieces of code that are injected into a compromised system after an exploit is successful. They serve an attacker with countless options such as remote control, data exfiltration, and so on.

Metasploit can offer plenty of its payloads, including setting up reverse shells and interpreter sessions.

── adapters
├── singles
├── stagers
└── stages

Auxiliary Modules:

Auxiliary modules are used for scanning, fingerprinting, information gathering, and brute force attacks over networks, services, and software in Linux, windows, and Mac

├── admin
├── analyze
├── bnat
├── client
├── cloud
├── crawler
├── docx
├── dos
├── fileformat
├── fuzzers
├── gather
├── parser
├── pdf
├── scanner
├── server
├── sniffer
├── spoof
├── sqli
├── voip
└── vsploit

Post Exploitation

Once a system is compromised, this module allows attackers and pen testers to perform many tasks like privilege escalation, lateral movement, and data exfiltration with high-privilege

├── admin
├── analyze
├── bnat
├── client
├── cloud
├── crawler
├── docx
├── dos
├── fileformat
├── fuzzers
├── gather
├── parser
├── pdf
├── scanner
├── server
├── sniffer
├── spoof
├── sqli
├── voip
└── vsploit

Shellcode

It is a small piece of code that is injected into the vulnerable and exploited system’s memory as part of a payload. It is responsible for executing specific actions on the compromised system, such as spawning a shell, privilege escalation, post-exploitation, and so on.

Encoders

Encoders are typically a method, tools, or scripts used to obfuscate or encode malicious code like payloads and shellcodes in order to evade detection by antivirus software, and IDS “Intrusion detection system”

├── cmd
├── generic
├── mipsbe
├── mipsle
├── php
├── ppc
├── ruby
├── sparc
├── x64
└── x86

Hands-on practice

Awesome now that we know the component of Metasploit and how it works let’s apply it to this vulnerable machine.

Enumeration :

What enumeration means is to scan or gather information about any target we had permission to by using Nmap, if you don’t know what Nmap is just complete the Nmap room in Tryhackme.

We run in our terminal the following : nmap -sS -sC -Pn 10.10.90.251

• Nmap is used to scan for open ports on the target machine in this case is a Windows server
• -sS Tells Nmap to perform a SYN scan.
• -sC allow Nmap to run the default script
• -Pn 10.10.90.251 tells Nmap to scan our target without DNS checking

Starting Nmap 7.93 ( https://nmap.org ) at 2023-10-27 00:46 +01
Stats: 0:00:06 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 35.57% done; ETC: 00:47 (0:00:09 remaining)
Nmap scan report for 10.10.90.251
Host is up (0.11s latency).
Not shown: 991 closed tcp ports (reset)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3389/tcp  open  ms-wbt-server
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49159/tcp open  unknown

Host script results:
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_nbstat: NetBIOS name: JON-PC, NetBIOS user: , NetBIOS MAC: 02b850a3d2ef (unknown)
| smb2-time: 
|   date: 2023-10-26T22:45:32
|_  start_date: 2023-10-26T22:40:57
|_clock-skew: mean: 38m26s, deviation: 2h53m12s, median: -1h01m34s
| smb2-security-mode: 
|   210: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: Jon-PC
|   NetBIOS computer name: JON-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2023-10-26T17:45:32-05:00

Nmap done: 1 IP address (1 host up) scanned in 93.57 seconds

As you see we have a lot of information including ports and their version and type of operation system. you may ask what Metasploit does with this, the answer is to find a vulnerability on the Windows server right 🙂

Now to start the Metasploit firmware just run msfconsole in your terminal and run the following command :

So basically eternalblue is a vulnerability in samba share in Windows which was exploited in 2017 by hackers used to create ransomware called wannacry which affected more than 200,000 Windows in the world Wilde.

As you see we use the options to see the choices we have in order to exploit this vulnerability

• RHOSTS: Is the target machine in this case, it is a Windows server
• RPORT : The port that vulnerable software runs through, in this case, is the Samba server
• SMBUser: The username of samba share
• SMBPass: The password obviously
• LHOST: The attacker IP address, in this case, is tun0 because we use the Tryhackme VPN
• LPORT: Our desired prot the spawn the shell through

Now type exploit to start the exploit in order to get the Meterpreter shell

Boom now you can do whatever you want in this Windows client, for example, you can run sysinfo to get more information about the user and his operating system like the following :

Or your moves from Meterpreter session into running the cmd.exe command by running the shell

(Meterpreter 1)(C:\Windows\system32) > shell 
Process 2948 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>

The funny is you can take screenshots from dark-pc by running screenshot in Meterpreter session

The Screenshot :