So now open your terminal and.
Start the MSF console.
The first command of this part is show.
Now, when you work with a module, it helps you to display the variables and properties of that module.
So the help screen is for showing us that.
Type the show command and then the name of the object, so let's have a look at knob generators by typing
show knob's.
And as you see the generators list.
Appears so there's no plug in for this phase and here are the encoders.
And also, he exploits.
But it might take a little while to list all the exploits if you try to list them.
And then here are all the exploits in Métis Point.
Now, when you need to use an exploit, you can search these exploits, for example, if you want to
exploit a Java RMI server code execution.
You can search for terms like RMI, RMI registry, so, yeah, let's perform a search just like that
search RMI registry.
And you see, it brings me the appropriate XPoint.
So I want to make an important point here, when you are conducting a test, you should perform an extensive
enumeration on the target to choose the right boy.
That's how you know what to search for.
Although Métis Point has many exploits, it doesn't mean that you can use every single one in every
circumstance.
First, you need to find the vulnerability.
And then if Métis Boyd has a suitable exploit, you can use that.
Otherwise, you may have a headache if you randomly run exploits and it's a waste of time.
OK, so back to the RMI registry XPoint, so now you have the name of the XPoint.
And if you recall from the previous videos, how do you use this exploit?
Type views and then the name of the boy.
Now, you can work with that XPoint.
If you want to be sure about the XPoint or if you want to configure the details, you can use the info
command to get detailed information about whether he exploits going to do.
And in this case.
This is an XPoint, but for sure it can be any other Métis flight module.
So read the description, examine the variables, or follow the reference link to get additional information
about that particular exploit.
So the options to view the variables.
And these are the basic variables.
And yes, you can set some advance variables to have more control over the exploit code.
How do you do that show advanced?
So.
Here are the other variables of the XPoint to make some of the advanced configurations.
Some X boys only work with a specific operating system or software versions, whatever.
Now, to send the target, the right exploit code, you've got to know the version of what you're trying
to exploit makes sense, right?
I'll assume here that you have made enumeration and you know your target well.
So that's what you tell Metters boy.
You specify the available targets by the show Targets Command.
As I hope you see on the screen, there's only five types of target.
So this means that this exploit can't be utilized on environment other than these particular five.
For the most part.
In a production environment, your exploit may fail due to IPPs IDs or firewall rules.
So I think it's good practice to evade the security measures.
For each XPoint, there are different evasion techniques and Métis Point.
So let's use the show Evasion Command to display the available techniques.
And if you want, you can choose these.
And these are the payloads that I listed by the show, Payloads Command.
Now, like evasion for each exploit, there are different pelote.
So this means you can't use a Linux payload for Windows system.
And for this point, there are these available paillard.
Now, I'll show you these variables again and let's set them.
You may remember from some of the previous videos how to set a variable, so we'll do that now, use
this at command just like that.
That's why I like the Linux console.
Setting the value a variable means you can get the value of the same variable.
I simply typing get as a command and then the variable name.
This is the medicine voidable to IP address in my lab environment.
Now, you can also unset a variable value by using the unset command.
And I just unset our host value, as you see here.
So you may come across a situation that you need to use the same value in every XPoint.
So you can just set the variable to the same value in each exploit again.
If you use set command, you can globally set a variable value.
And by using the get G- command, you can get the global value of a variable.
And then simply, you can unset a global variable by using the unset G command.
Now, after setting all the variables, you can get the exploit to execute by either using the run or
the exploit commands.
It actually doesn't matter.
So these messages here show what's going on in the background.
And you will also be informed by Métis boy if a session is open.
So now I have this session, and by taping the Sessions command, I will list my available sessions.
And as expected, I have only this one now to interact with that session type sessions as your command
with the eye parameter and then.
An index of this session appears.
In my case, it's three.
OK, so now I'm in the Metro Operator Show.
Later, you're going to have your deep dive in an interpreter, I promise.
But for now, I'm going to only show you that I have exploited them at exploitable to.
Then let's type in background to turn back to the MSF console again.