Hello everyone. Welcome back to the windows pentesting Essentials
course in this video. I'm going to be taking you through
Metasploit or the Metasploit framework. So this is just going
to cover the fundamentals of Metasploit. So first
of all, what exactly is Metasploit will Metasploit, is
an exploitation, and penetration testing framework that
is written in the Ruby programming language and
can perform everything specific to a penetration test all
the way from scanning and information gathering to
exploitation and privilege escalation. So it really
Is a lot and given that it is a comprehensive and
inclusive framework. When it comes down to penetration
testing. You can pretty much perform your entire penetration test
using Metasploit. Now, the aim of this video is
to get you up and started and running with
Metasploit and I'm going to be doing it, you
know, if two ways firstly, I'm going to be explaining the structure of
the framework and how it works. How everything is sorted out because it
is a fairly complex framework in regards to
the way it's been developed. It really is very simple to
use.
Use and again, because of this complexity and how it's been managed.
It really is beautiful to actually see and I'll be, I'll
be showing you that shortly. So, again, the
way Metasploit handles, its Funk handles,
its functionality. And the complexity is by
the use of modules, or segregating, various
pieces of functionality into modules,
and that will become clear in a very short period of
time. So, we are currently in the terminal and the Metasploit framework
comes prepackaged and
Pre-installed with Callie or any other pentesting distribution. So
you don't need to worry about installing. It just make sure your
distribution is up-to-date. The first thing we want to do is
let's first of all understand the structure of Metasploit as
I said, so if I list out the contents of
let me just say l here and
we say the user share, and
we're looking for the Metasploit directory here. So,
Metasploit, we just use Metasploit framework that we are. And I
list the contents of this directory.
And I'll just scroll all the way to the top here. You can see that
we have various files. Most of which are
not really important but we are various executables like
the Metasploit console, which will be using shortly. You
also have msf venom, which is used to create payloads,
which again will be covering in the next video. We will be talking about
creating payloads that we can then use to get a reverse
shell on or a meterpreter session on. But
let's do click a look at the modules folder, which is where
everything is everything.
Sort of comes into play in regards to the actual framework and
what will be interacting with. So if I say CD user
share,
And we're going to
the modules directory. I'll just clear that out and we list them.
You can. Now, see, this is the fundamental structure of
Metasploit and how its functionality sorted
out. So first of all, you have auxiliary modules, you
then have encoders which pretty much explain what they do. They
used for encoding, you then have evasion modules, you
then have exploits which again are pretty self-explanatory. These
are used for exploitation you then
have knobs payloads and post which is
For post exploitation so you can see that within each
of these folders. You'll have all the various modules that
deal with that particular piece of functionality or
that, that particular function. So
if I'm talking about auxiliary or scanners, you
can see if I enter the auxiliary folder here
and I just list out the, you can see we there then
further sorted out based on the actual functionality.
So again, you have fathers. We have a
scanner sniffers, etc. Etc. I'm not
really
We going to go deep down into the actual structure
of Metasploit. I'm just going to show you how this all comes into
play shortly. So if we take a look at exploits, for example, you
can see that in terms of exploits. They are sorted out in
terms of their operating system, right or the target operating system
or platform. So, for example, we have the Android platform.
We have Apple iOS, we have BSD bsdi.
We have Firefox FreeBSD, Linux,
we have net, where we also have Solaris Windows,
Unix, OS, X, all the operating systems that
- Blake only as exploits for. So again, if
we're looking for a particular exploit we can go into the into
that particular directory. We can say, hey, I'm
looking for Windows exploits. So, you know, enter the windows directory,
you can all see the are not based on a protocol or
the service that these exploits are primarily
targeted towards. So, for example, we have antivirus exploits
backdoors, email browser
firewall. We have my MySQL
mssql, we also
So have postgresql, etc. Etc. Etc.
We have POP3. We have all the various services that are
available. So now that we have an understanding of how its structures
and sorts out in its modules and how its able
to manage manage that level of complexity. We
can actually get started with a framework. So getting started with
the framework, is really, very simple. All we need to do is type in msf console
and then we'll start it up. But before we do that, we need
to ensure that if this is your first time running, the Metasploit
framework through the Metasploit console,
We need to do firstly is we need to ensure that we
start the postgresql database service which
comes again prepackaged and pre-installed with Kelly and
Metasploit uses the postgresql database to
store, all the relevant database file
names regarding the modules that are currently set up,
and this will reduce the amount of search time that that
you'll actually need when searching for module. So we
use system control, and we say, start,
And we're going to stop the service here. So we'll give that
a few seconds to stop the service and that should start it.
And then we want to launch the msf DB or the Metasploit
framework database. So we can hit enter. You
can see the minute the Metasploit framework database. These
are the options available to us. We can initialize the
database. We can reinitialize the database. If we so want
to, we can delete it starts stops. We can check
the status and we can
run it. So what we can do is we can initialize it.
So we say msf DB and we say in it and
hit enter and it's going to say we need to run into as root. So
I'm going to do that, hit enter. It's going to say database already started creating
the database, user msf and
creating the database msf as well. So this
will again with the reason why we have the Metasploit database or
the Metasploit framework database is because this database
is used to store all the various indexing for the modules
and you'll see how much faster searching for on Anna.
Floyd or a payload is in a few seconds. So
again, we're just going to let the database initialize here. And
then we're going to get started with the actual framework. I'll
just take you through some basic options that will be using. So, there
we are going to create the initial database, schema. And
don't worry. If you get any errors, those are perfectly fine
and really will not cause much of an issue at all.
So, again, we'll just wait for this to
complete, right? So
once the database is
Realized we can get started by typing an msf console.
Like so and that should start up the Metasploit console
for us the way it's going to tell us starting the Metasploit framework
console will give that a few seconds and
then we are. So this is the Metasploit framework console and
we can now get started with me explaining all
the various options. So, again, if I open up the help menu,
this will give us some general documentation regarding
all the commands that we can run. So this is a great place
to start with if you're a beginner. It really does
help.
It's a very, very well documented and simply documented
so that you really don't need to analyze exactly what
it's saying. So again, for example, if I type in Banner, it will
just display an awesome Metasploit Banner if I, you know,
click on connect or get or any of the other commands it explains
exactly what it does, right? So what I will do
now is I just want to show you the typical workflow when
you talk about exploitation using the
framework. So firstly, if I want to
show for example, exploits I can simply type
in
Exploits hit enter, right? And that's going to
show me all the exploits which is not something you typically do
prayer. What, what you do typically is
you'd search for the exploit that you're looking for, not demonstrated this
in the previous modules. However, we'll be
taking a look at it even more now. So again, this is going to
be a huge index which is why it's taking so much time because there's
like almost too many modules to
actually count in regards to exploits. So, you can see,
we have all of these exploits that are sorted out here.
And the key thing to take a look at first, Lee is
why just to reduce the I'll just reduce the
font size here so that I can explain a few things if I
search for an exploit. And let's say, I know the name of the exploit, let's
say, I'm looking for Eternal blue, right?
I can search for Eternal blue. You can see that it's
going to give us the matching modules. However, in
regards to the modules, you can see that there, these
are going to be different modules and they are structured as followed.
So again, you need to also understand
Directory structure, which I explained. So at
the top level, we have auxiliary modules, which are used primarily
to perform scan. So
you can see this is an auxiliary module of
type admin. It's an SMB module
and it's based off the the MS. 17 010,
command execution exploit,
right. And you just gives you
information regarding that particular module. So in
regards to the auxiliary scanner you
Can see it right over here. So this is an auxiliary module and
it's of types canler and it's based off the SMB
protocol and it's off. This particular exploit the
S mbms 17 2010 and
this is used to check, whether a system is vulnerable to
the Eternal blue to the Eternal blue one ability,
right? You then have the ones at the bottom here, which
are all exploits. Because you can see this exploit, exploit
exploit exploit and they're based on Windows, Windows, Windows
smbs and be essentially based on the
17:01 zero exploit. So this
one right here, is primarily designed to work on
Windows 7 systems and and older. You
then of this one which is designed to work on Windows Windows
8. You then I have, of course, your PS exact
right over here. And then you have your remote code
execution, and in, in regards to the disclosure
date and the other columns, you can see that the rank is going
to be very important because the rank essentially tells
you the the actual effectiveness of these particular.
Modules in regards to the results that you're likely to get. Now,
you can pretty much
search for the modules you're looking for, you know, performing research
and stuff like that. And then once you've identified the
module that you want to use, you can simply just copy the
name here. So you can just say copy selection or you
can type it out for yourself and just hit use and we say
use and we essentially paste that name here,
the module name and you can now see that when you've
selected a particular module, it will say it's an auxiliary module.
And it gives you the actual module right over
here and that's going to be highlighted in red. Now when you have specified the
module, you can show the various options associated
with this module. So if I say show options, it
will give you the various options that you can set for this
particular module, which in this case is an auxiliary module. So,
for example, we can set the command to run,
we can set the we can
set the SMB. Domain SMB password. There's ambition,
etc. Etc. More really going to get into this too
much.
I just going to explain how this works. And then when
you want to run the exploit or that particular module you just
type in run and of course in this case, it's going to tell us that
the auxiliary failed because we did not enter our Target address
which is fine. So if we want to set an
option in this case, it's telling us, we need to set our our hosts option,
which is our Target, we can say set, and
we type in the the actual we
type in the actual, the
actual option name. So if I'm setting the our hosts option
They've been set our host and then I set the value of
our host. So I said that to 10.0.0.0 X.
For example, I hit enter. Now, if I hit run,
you can see the exploit is going to run and of course, I have
not selected any valid Target here. So it's going to tell me that the
host was unreachable which is expected and
the auxiliary module execution completed and
we really did not get any results. So, again, setting
options is fairly simple, and this would become more
apparent when we move on to the next video.
When will actually be taking a look at creating our
payload with msf, Venom and I'll be taking
you through the exploitation of the windows, with
Windows Server, 2008 box, which is met exploitable 3,
and this will all become much clearer. So, when you
want to exit, you can type in back and you
can then hit exit and that will take you out of the framework and you should
be back into your normal terminal. So that's going to be it for this video and
I'll be seeing you in the next video.