Hack Like a Pro: Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!I have written many tutorials on hacking usingMetasploit, includingleaving no evidence behindandexploring the inner architecture. Also, there are my Metasploit cheat sheets forcommandsandhacking scripts.With this guide, I'm starting a sequential and cumulativeseriesfor learning and using Metasploit. This first part will cover the very basics of Metasploit for those of you who are new to Null Byte, and as a refresher for those of you who are not. With that in mind, this will be quick and dirty first lesson on using one of the most powerful hacking platforms on planet Earth.Metasploit Background & InstallationMetasploit was developed by HD Moore as an open source project in 2003. Originally written in Perl, Metasploit was completely rewritten in Ruby in 2007. In 2009, it was purchased by Rapid7, an IT security company that also produces the vulnerability scanner Nexpose.Metasploit is now in version 4.9.3, which is included in ourKali Linux. It's also built intoBackTrack. For those of you using some other version ofLinuxor Unix (including Mac OS), you can download Metasploit fromRapid7's website.For those of you using Windows, you can also grab it from Rapid7, but I do not recommend running Metasploit in Windows. Although you can download and install it, some of the capabilities of this hacking framework do not translate over to the Windows operating system, and many of my hacks here on Null Byte will not work on the Windows platform.Metasploit now has multiple products, including Metasploit Pro (the full commercial version) and the Community edition that is built into Kali and remains free. We will focus all of our efforts on the Community edition, as I am well aware that most of you will not be buying the $30,000 Pro edition.Ways to Use MetasploitMetasploit can be accessed or used in multiple ways. The most common method, and the one I use, is theinteractive Metasploit console. This is the one that is activated by typingmsfconsoleat the command line in Kali. There are several other methods as well.MsfcliFirst, you can use Metasploit from the command line, or inmsfclimode. Although it appears that when we are in the console that we are using the command line, we are actually using an interactive console with special keywords and commands. From the msfcli, we ARE actually using a Linux command line.We can get the help screen for msfcli by typing:kali > msfcli -hNow to execute an exploit from the msfcli, the syntax is simply:kali > msfcli <the exploit> payload = <the payload> rhost = <IP> lhost = <IP> EWhereEis short for execute.In my tutorial oncreating payloads to evade AV software, we are using themsfencodeandmsfpayloadcommand in the command line (msfcli) mode.The drawback to using the msfcli is that it is not as well-supported as the msfconsole, and you are limited to a single shell, making some of the more complex exploits impossible.ArmitageIf you want to use Metasploit with a GUI (graphical user interface), at least a couple of options are available. First, Raphael Mudge has developed the Armitage (presumably a reference to a primary character in the seminal cyberhacking science fiction work,Neuromancer—a must read for any hacker with a taste for science fiction).To start Armitage in Kali, simply type:kali > armitageIf Armitage fails to connect, try these alternative commands:kali > service start postgresqlkali > service start metasploitkali > service stop metasploitArmitage is a GUI overlay on Metasploit that operates in a client/server architecture. You start Metasploit as a server and Armitage becomes the client, thereby giving you full access to Metasploit's features through a full featured—thought not completely intuitive—GUI. If you really need a GUI to feel comfortable, I don't want to discourage you from using Armitage, but mastering the command line is a necessity for any self-respecting hacker.ModulesMetasploit has six different types of modules. These are:payloadsexploitspostnopsauxiliaryencodersPayloadsare the code that we will leave behind on the hacked system. Some people call theselisteners, rootkits, etc. In Metasploit, they are referred to as payloads. These payloads include command shells,Meterpreter, etc. The payloads can be staged, inline, NoNX (bypasses the No execute feature in some modern CPUs), PassiveX (bypasses restricted outbound firewall rules), and IPv6, among others.Exploitsare the shellcode that takes advantage of a vulnerability or flaw in the system. These are operating system specific and many times, service pack (SP) specific, service specific, port specific, and even application specific. They are classified by operating system, so a Windows exploit will not work in a Linux operating system and vice versa.Postare modules that we can use post exploitation of the system.Nopsare short forNoOPerationS. In x86 CPUs, it is usually indicated by the hex 0x90. It simply means "do nothing". This can be crucial in creating a buffer overflow. We can view the nops modules by using theshowcommand.msf > show nopsAuxiliaryincludes numerous modules (695) that don't fit into any of the other categories. These include such things are fuzzers, scanners, denial of service attacks, and more. Check outmy article on auxiliary modulesfor more in-depth information for this module.Encodersare modules that enable us to encode our payloads in various ways toget past AVan other security devices. We can see the encoders by typing:msf > show encodersAs you can see, there are numerous encoders built into Metasploit. Once of my favorites isshikata_ga_nai, which allows us to to XOR the payload to help in making it undetectable by AV software and security devices.SearchingEver since Metasploit 4 was released, Metasploit has added search capabilities. Previously, you had to use the msfcli andgrepto find the modules you were looking, but now Rapid7 has added the search keyword and features. The addition of the search capability was timely as Metasploit has grown dramatically, and simple eyeball searches and grep searches were inadequate to search over 1,400 exploits, for instance.The search keyword enables us to do simple keyword searches, but it also allows us to be a bit more refined in our search as well. For instance, we can define what type of module we are searching for by using the type keyword.msf > search type:exploitWhen we do so, Metasploit comes back with all 1,295 exploits. Not real useful.If we know we want to attack a Sun Microsystems machine running Solaris (Sun's UNIX), we may want may to refine our search to only solaris exploits, we can then useplatformkeyword.msf > search type:exploit platform:solarisNow we have narrowed our search down to only those exploits that will work against a Solaris operating system.To further refine our search, let's assume we want to attack the Solaris RPC (sunrpc) and we want to see only those exploits attacking that particular service. We can add the keyword "sunrpc" to our serach like below:msf > search type:exploit platform:solaris sunrpcAs you can see, this narrows are results down to just five exploit modules!Metasploit has many capabilities that are still untapped by us, so I will continue thisMetasploit seriesto explore the simplest to the most complex. In the meantime, try some of my Metasploit hacks outlined in many Null Byte posts and keep coming back to this series on Metasploit to learn to hack like a pro!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaWeakNet LabsRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 11 (Post-Exploitation with Mimikatz)Hack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerMac for Hackers:How to Install the Metasploit FrameworkHack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 3 (Payloads)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)How To:Simplify Payload Creation with MSFPC (MSFvenom Payload Creator)News:What to Expect from Null Byte in 2015Hack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker Training