Instructor: Welcome back.
In the previous video we talked
about Metasploit framework structure.
We explained all of the modules
and what they are for,
but we haven't really ran the framework itself.
In this video, we're going to run it
and cover some of the basic commands for it.
Okay, I already mentioned in the last video
that to open this framework,
what we must do
is open up our terminal and type msfconsole, press Enter.
And keep in mind
that it might take some time to open,
especially if you're running it for the first time.
And here it is, it already open for me.
And what we get right here is we get the banner
of Metasploit framework,
which changes every time you start this program.
And down here, we get these seven modules
that we talked about.
And we also get the exact number of modules
that we have available to us.
So here we can see 2043 exploits,
1105 auxiliary modules,
344 post exploitation modules, over 500 payloads,
and a little bit of encoders, nops, and evasion modules.
As in every other tool that we covered
to see all the available commands we can use,
we can run the help command.
This will open the help menu
which will give us all the available options
as well as some of the examples
of how we can use Metasploit.
But for now, this is not necessary
as I will show you a few of these commands
that you will use every time.
And by the way, before we get into those commands,
what you can do inside of the Metasploit framework,
you can also run the normal commands
such as ls, such as changing directories,
such as, for example, running ifconfig.
So if I type sudo ifconfig and type in my password,
it'll give me the output of ifconfig.
So you can also run regular terminal commands from this.
But as far as the metal plate framework goes,
let's start with listing some of the modules.
For example, we can use the show command
to list out any type of modules we want.
So we know that there are over 500 payload.
We saw the number once we started the Metasploit.
In order to list all of those 500 payloads,
we can type show and then payloads.
If I press Enter,
it'll take just a few seconds
and it'll list out all of the available payloads
that we have.
Now right here, this is not really that good of an output
because I have my terminal a little bit
more zoomed in than I should have.
So I will just go to the preferences
and lower the font of my letters.
So I'll click on OK, Apply, OK.
Clear the screen and I will type show payloads once again.
It's still not that good.
Let me just go and lower it a little bit more.
So I will just go to 13, Apply and click on OK.
Clear the screen, run the command again.
And here it is, we get a better output.
So let's explain what we see right here.
If I scroll all the way up to the beginning,
we can see this is the number of the payload.
It goes from zero to over 500.
And this right here is the name of the payload.
So as we already know, there are bind shelves
and reverse shells.
So we get different types of them.
We can see the payloads for Android,
the payloads for Apple iOS.
We can see all types of payloads command shells,
we can see Java payloads, Linux payloads.
If I go all the way down,
OSX payloads, PHP payloads,
Python, ruby, and bunch of others as well.
Here's also Windows payloads.
So we get a lot of them.
Under the Rank, they're all manual
because they have to get executed on the target machine.
And in the Description,
we can see for what this payload is.
For example, if we check out this one
Apple meterpreter_reverse_http,
this is the Apple_iOS Meterpreter shell
or Reverse HTTP Inline.
So this means you would use this payload
if you were, for example, attacking an Apple device.
Now we can do the same thing with exploits.
If we want to list all of the 2000 exploits,
we can type show exploits.
And this might take a little bit longer
because there is a lot more exploits than there is payloads.
And here they are.
Here are all 2041 exploits.
You can see the output is pretty much the same
as with the payloads.
We get the number right here.
We get the exploit name.
And these exploit names are really well written.
As we can see,
the first part tells us for what is this exploit.
Currently we are inside the Windows exploits.
And if we scroll all the way up,
we should see some other exploits as well.
Let's go and scroll all the way up.
Well, it seems that we can only go up to here
because there is a lot of them.
But nonetheless, we can see for what the exploits are.
For example, this one is for windows and for browser.
And here, it specifies exactly what does it exploit.
If I go down here, and for example,
check out these ones.
Here we can see this is also Windows exploit for the FTP.
So they're very well organized.
And this is the structure that we saw in the previous video,
just this is how the Metasploit framework outputs it for us.
These exploits that belong to Windows FTP
are all located inside the FTP directory
of the Windows exploits directory.
If I go all the way down,
and what we can do right here
is we can choose one of these exploits
just to see how we can select them and run them.
Of course, we are not going to be attacking any target.
We just want to see how we can select one of these exploits.
So let's go with this one.
For example, windows/smb/ms06-040_netapi.
And by the way, to check out
more information about exploits,
we can go onto the right.
So this exploit came out in 2006.
And in the right column, right here,
it tells us what exactly does this exploit do.
So for this particular one,
we get that it is an exploit
for Microsoft Server Service
and it overflows this function.
Now the good part about this
is that you don't really need to know how these work
in order to be able to run them.
Let me show you.
If you copy this exploit name right here,
so copy windows/smb/ms06_040_netapi.
In order to select it,
let us clear the screen.
We can type the command use.
And you type use
and then the module name that you want to use.
In our case, we want to use an exploit.
And after it, all we have to do
is paste the exploit name.
So use exploit/windows/smb/,
and then the name of the exploit, press Enter.
And we will see that this exploit configured payload
windows/meterpreter/reverse_tcp.
And we will talk about this in just a second.
For now, we can see that it is currently
using the module that we selected,
because it is printed out in red right here
and it also tells us that it is an exploit.
So let's check out all the information
that we can get for this exploit.
The first thing that I always like to do
is type the command show info.
And this show info command tells us more
about this particular exploit.
So if you go down here to the description,
it'll tell us this module exploits
a stack buffer overflow.
So this is a buffer overflow exploit
in the NetApi32 CanonicalizePathName function
using this RPC.
And you can read about any exploit that you select.
Another information that we get right here
are some of the references.
So you can visit these links right here
to read more about this particular exploit.
Besides this, another command that we can do
is show options.
And this is the important part.
Let me just clear the screen
and type it once again
just so we can see only the options part.
Here is where you select your options for the exploit.
First thing we see is module options
and it asks us for three different things.
And keep in mind, different exploits
will want different things.
Usually they will all have these RHOSTS and RPORT,
which is just the remote host and the remote port.
Or in our case, the targets IP address
and the targets port that we are attacking.
So we can see two of these are already automatically set.
The RPORT is already set to be 445
and the SMBPIPE is already set to be the browser.
All we are left to specify right here is the RHOSTS
or the IP address of the target machine.
So if we were attacking a Windows Server
that was vulnerable to this attack,
we would specify here the IP address
of that Windows Server machine.
And in this column right here,
you will notice that some of these things will be required
and some of these things will not be required.
In our case, in this particular exploit,
all of these three things are required to specify
in order for exploit to work.
In the description,
it tells us exactly what it wants from us.
So the RHOSTS is the target host
or the target's IP address.
The RPORT is the SMB service port on the target machine.
And the SMBPIPE is the pipe name to use.
So these are the exploit options.
And down here we get payload options.
Now what does this mean?
Well, remember, after exploiting the target,
we drop a payload.
So by the default,
remember once we ran the command to use this exploit,
it gave us windows/meterpreter/reverse_tcp by default.
This means that we're using a payload for Windows.
It is a Meterpreter shell,
which remembers it is the best shell that we can get.
And it is a reverse shell over TCP connection.
You can change this if you want to.
And down here, we get the options
that we need to set for payload.
Remember, once using reverse shell,
we must listen on our Kali Linux machine
for the incoming connection.
And that's the information that it asks us right here.
The LHOST is our own IP address.
the IP address of Kali Linux machine,
or as it says right here the listening address.
We specify our IP address right here.
So you just need to type sudo ifconfig
and we can see 192.168,1.9.
Usually the Metasploit framework will set it by default.
So let me just clear the screen,
run show options once again,
and the LPORT is the listening port
or Kali Linux port that we want to listen
for the incoming connections.
And it is usually set by default to be 4444.
And all of these options you can change.
For example, if you notice that Metasploit framework
set the incorrect IP address
for a Kali Linux machine, you can type set
and then the parameter name, in our case LHOST
to be a different IP address.
For example, 192.168.1.15.
And it'll set the LHOST parameter
to be a different IP address
as we can see right here.
Inside of these RHOSTS
as we can see this is also required,
we would set the IP address of our target machine.
So let's say we had a Windows Server
and its IP address was 192.168.1.20.
We would type it right here, so 192.168.1.20.
And if I type show options once again,
now we got this set as well.
Now payload is something that you can change.
Usually you want to leave it what Metasploit framework
already gave you
because the default one is usually the best one.
But sometimes, some of the payloads
will not work and others will work.
So in order to see all of the available payloads
that you can use for this particular exploit,
you can type show payloads once again.
Just this time, it'll not list out
all the 500 possible payloads,
it'll only list out the possible payloads
for this particular exploit.
And this will be all the Windows payloads.
Since we are attacking a Windows machine
with this exploit, the Windows payloads
will be something that we can use.
So we can see some bind shells, reverse shells,
we can see some of the Meterpreter shells.
So for example, let us say that
you don't want to use our reverse shell,
you want to use a bind shell.
How would you change the payload?
Well, you would copy the bind shell.
Let's say we want to use the Meterpreter bind shell.
So copy its name.
And go all the way down
and type set payload
and then paste the payload name.
So Paste Selection, press Enter,
and it'll tell us the payload has been changed.
If we clear the screen, show options,
we will see different payload.
We no longer have the meterpreter/reverse_tcp,
we now have the bind_tcp Meterpreter.
And it'll also ask us
for different information about the payload.
We no longer get the LHOSTS,
since remember with bind_tcp,
it is not our Kali Linux machine that is listening
for the connection,
it is the target machine
that is listening for the connection
and we are the ones that connect to it.
So in this case, it is asking us for RHOSTS
or the remote host.
Or as the description says, the target IP address.
So we would select right here the same IP address
that we select right here,
because it is the target that has to open the port.
And the local port will be the local port
on the target machine
that will open for us to connect to.
And you would select here whatever you want.
So what is important to get out all of this
is that we can change different options using set command.
So you just type set.
And then for example, we want to change the LPORT,
we type LPORT and then make it whatever we want.
And if we type show options,
it'll be changed right here.
And the last part that we see down here are the targets.
And these targets right here
are all of the vulnerable targets
for this particular exploit.
To list all of them out, we can type show and then targets.
This will give us a list of all the targets
that we can exploit using this attack.
So we get Windows NT, Windows XP,
and now different versions of Windows XP,
and Windows 2003.
So this is an older exploit
that attacks Windows XP machines.
Now you can either, if you know exactly which version
of Windows is the target running,
you can select it right here by specifying set target
and then the number,
for example, let's say the target
is using Windows XP SP1 English.
You could type it like this.
So set target three,
because the ID for that particular version is three.
Or if you didn't know exactly which version,
you would just leave it on automatic,
which means that Metasploit framework
will figure it out on its own.
So we don't need to specify it.
The only important thing
is that it is one of these versions.
If it is, for example, a Windows 7 machine,
this exploit will not work.
And once you set all of these options,
the last thing you need to do is type exploit.
In our case, this will not work
because we don't really have a vulnerable
Windows XP machine,
so it'll give us an exploit failed error.
In this case, it is unreachable,
because this IP address right here
on my local network is not even online.
That's why this will not work.
And this is pretty much it.
Now there are other commands as well
that could be useful,
but these are the main ones that we always use
to choose exploits and payloads
and to set their options.
Finally, the time has come.
In the next video, we are going to apply
what we've learned for now to perform our first exploit
on the Metasploitable machine.
See you in the next video.