Metasploit Framework

Metasploit is the most widely used exploitation framework. It can support all phases of a penetration testing engagement, from information gathering to post-exploitation.

The primary usage of the Metasploit Framework focuses on penetration testing, but it is also useful for vulnerability research.

Components

msfconsole - main interface
Modules - supporting modules such as exploits, scanners, payloads, etc.
Tools - standalone tools that help with research, etc.

Main concepts

Exploit - a piece of code that uses a vulnerability present on the target system.
Vulnerability - a design, coding, or logic flaw affecting the target system.
Payload - the code an exploit will run once it has taken advantage of a vulnerability.

Module directory structure

To find any supporting modules:
cd /opt/metasploit-framework/embedded/framework/modules

Auxiliary: tree -L 1 auxiliary/
Encoders: tree -L 1 encoders/
Evasion: tree -L 2 evasion/
Exploits: tree -L 1 exploits/
NOPs: tree -L 1 nops/
Payloads: tree -L 1 payloads/

Payload directories

There are four different payload directories:
Adapters - wrap single payloads to convert them into different formats.
Singles - self-contained payloads.
Stagers - responsible for setting up a connection between Metasploit and the target system.
Stages - downloaded by the stager.

Metasploit has a subtle way to help you tell apart single (also called "inline") payloads and staged payloads:

generic/shell_reverse_tcp
windows/x64/shell/reverse_tcp

Both are reverse Windows shells. The former is an inline (or single) payload, as indicated by the "_" between "shell" and "reverse". The latter is a staged payload, as indicated by the "/" between "shell" and "reverse".

Post-exploitation modules: tree -L 1 post/

Console basics

Metasploit supports most Linux commands and tab completion.

A module is selected with the use command, for example:
use exploit/windows/smb/ms17_010_eternalblue
show options

To leave the context, use the back command.
To get more information on any module, use info.

One of the most useful commands is search - it is used to search the Metasploit database for modules relevant to the given parameter. Exploits are also ranked based on reliability.

Setting parameters

Exploits will require you to set:
RHOSTS - remote host, the IP address of the target system.
RPORT - remote port.
PAYLOAD - the payload you will use.
LHOST - localhost (the attacking machine).
LPORT - local port.
SESSION - each connection established to the target system using Metasploit will have a session ID.

To set a parameter, use set. To clear it, use unset.
To set/change a parameter for several modules at once, use setg and unsetg.
To start the exploit, use exploit -z or run.

Sessions

Some modules support the check option, to check the target system for vulnerabilities without exploiting them.

We can also use background to background the session prompt - or use CTRL+Z.
Use sessions to see the existing sessions.
To interact with a session, use sessions -i.