In this lecture will see what is the common Metasploit workflow.
The first step is to discover the target in the vulnerability services that are running.
There are lots of vulnerability scanners, but most of the time and map is the tool of choice.
From Linux is what I'm skinning the exploitable VM using and map and the minus capital option which
enables OS inversion detection.
Script skinning entails good.
And MIP is a scanning metasploit able.
And there are many vulnerabilities because this VM was especially designed for penetration and exploitation
testing in a real case scenario.
Hackers will do the same.
They will skin four vulnerabilities.
And if there are any, they will try to exploit those vulnerabilities.
Let's take a look at this one.
On path.
Six, six, six, seven.
I RCD is listening.
A hacker would search for exploits for that service information on Google or on specific forums.
And the first result takes us to the Rapid7 website and we can see that there's a backdoor command execution
available for that service.
This version contains a backdoor that went unnoticed for months.
By the way, Rapid7 is the company that develops the Metasploit.
And if we scroll down, we notice that there is also a Metasploit module that exploits the vulnerability.
They even show us how to use it.
Let's return to Kali and the start.
Metasploit.
I'm running.
MSF canceled.
Once it has started.
I'm searching for I rcd.
So search.
I are sidi.
And there is one module available to find more information about it.
Execute the info in the name with the full path.
So info.
Exploit Unix.
I rc.
Unreal.
I asked vector.
To select a specific module type use.
And the full path to the module.
And if you want to go back or to exit the module, execute back.
The next step is to see what are the options of the module.
Show options.
Our host comes from a remote host and is the target IP address.
I'm setting it set.
Our host and the target's IP address bambaataa 0.2.7.
The appearance of metasploit upon.
Next will have to select a payload.
A payload is a piece of code to be executed for the exploit.
In fact, what to do after the target is exploited to see all compatible payloads for this exploit run
show payload.
Most of the time, a hacker would like to get the shell to the machine so that he can further install
malware or on other comings or consolidate his position on the machine or on the network.
I am setting up reverse shell as payload.
So set payload and the path to the payload payload.
CMD unix reverse.
This one.
After sitting the pilot, you can forget about a check.
What are the payload available options?
I'm running show options again.
And there are two options for the payload.
L host and L port l host is the local listening address and I am setting it to the IP address of Metasploit.
So said l host and the IP address of Metasploit.
Let's see IP address again.
Remember that you can run Shell Comics directly in MSF console.
And by morning the exploit.
The exploit is running and the machine was hacked.
I am locked in assault and I can execute any comment in the reverse shell.
Earth Station was opened.
I'm on Metasploit double.
On the hacked machine.
Take a look here.
This is the IP address of Metasploit double.
The command was run on the hacked machine.
Honor this machine.
I'm locked in, is what?
Now we are in the phase of the epic called post exploitation.
It refers to any action taken after a session is opened.
A session is an open shell from successful exploitation.
Like in this case, after successfully hacking the target, the attacker will be asking himself what
to do next.
In general, he wants to gain further access to the target's internal network or to cover his tracks
as he progresses from system to system.
Or maybe he wants to set up a backdoor to maintain more permanent system access.
In this example, if the victim machine is restarted, the access will be lost.
Of course, the hacker could run the exploit again, but the admin could pick or uninstall the valuable
service.
So utilizing these techniques will ensure that some level of access is maintained.
And next, why post exploitation is so important.
Okay.
Thank you, vixen.