Earlier in the course, we discussed searching for exploits.
Now let's take that knowledge, expand on it, and show you how to do it.
Finding the right exploit module in Metasploit can be challenging.
As we mentioned previously, there are more than 2000 of them. With the
search command, there are parameters that allow you to tailor your
search to narrow down your exploit options.
You can search by a name or a matching description, the
author that wrote the exploit code,
the disclosure date or the date when the vulnerability was announced, the
operating system platform or the processor architecture,
the network service port number,
the exploitability ranking, an identifier such a CVE ID, bug track ID or
exploit DB ID, and also by whether the exploit has a check function to
see if the target has the vulnerability.
Remember, the search command isn't limited to just exploits.
It applies to all modules available in Metasploit. Once
we narrow down our exploit search,
we can view more information about the exploits.
We used the info command to show us the information about the exploit module.
It will show basic information such as its name,
operating system,
platform, processor architecture, whether it requires privileges for execution,
the license for the code, it's exploitability rank,
disclosure date, and the author of the module.
Available targets is a listing of some variations of exploitable targets,
such as operating system version numbers.
The availability of the check function is usually yes or no.
Basic options are a list of those options needed
for the operation of the exploit.
Payload information is typically the amount of space
available for the payload and any limitations.
The description is a narrative explanation of the exploit module and how it
operates against the vulnerability on the target system.
References are collection of links to CVEs, vulnerability database records,
security vendor write‑ups, and vendor vulnerability disclosures.
After finding the exploit module and reviewing its available information,
we select it for use. We do that with the use command.
We provide the full path and name that uniquely identifies it,
or we can select from the output from a search by using the search index number.
Once the use command selects the module,
it becomes the current context in Metasploit. We can examine more
information about it with the show command.
If we want to see all information about it, add the info parameter.
If we only need to see the configurable options, use options.
And if we just want to see what payloads are available for this exploit,
use payloads.
Now for a demonstration of search and selection of exploit
modules. We will look at how to find documentation from inside
the Metasploit console with the help command, and then the
search command and its parameters,
and then how to select a specific exploit and look at its available information.
Here we are in the Metasploit Framework console.
The built‑in help command shows you documentation as needed.
As you can see, there are quite a few topics here.
If we want to know more about this load command, just use help load.
You can also use the question mark character as well
or the ‑h option using the command.
Since we are here to learn more about searching
through available exploit modules,
it's good to understand how to use the search command.
Here's the documentation for it.
Notice that there are keywords.
Let's look at how we might use some of these keywords.
Since we're searching for exploits,
we should use the type keyword to limit our search to exploit modules.
We can combine that keyword with others.
We can use the date keyword to look for exploits based on
the disclosure date of the vulnerability.
In this case,
we want to see all of the exploits with disclosure dates of
April of 2020. We can use the name keyword to look for exploits
for a particular piece of software.
For example,
Apache Tomcat exploits. The port keyword is useful in finding
exploits on port 80 for web servers. You can search for common
vulnerabilities and exposures or CVE identifiers in a specific
year or by the exact CVE identifier.
There are also keywords to search by bug track ID or exploit DB ID.
Let's assume that our vulnerability scanner identified a
target with a service that has cve:2010‑2075 We select that
exploit module with the use command.
You can either type the full path of the exploit or use the search index number.
Notice that the prompt changes to reflect that are working with
the exploit we selected. With the info command, you can see all
of the information about the module.
I would encourage you to experiment with searching and selecting.
Here are a few more things to try.
You can negate specific search parameters with the dash character.
For example,
you can search for any module that is not an exploit module for Apache.
The use command will also work as a search command if you provide only a search
parameter. It selects the only module to match that search.
Finally, if you run the search command again with no options,
it will show you the cache results from the previous search.
Have fun.