Now let's walk through a demonstration of how to see more information
about the exploits selected and how to configure them.
As always, it's useful to know how to find help.
Once we select an exploit,
we'll take a look at the information for the exploit itself,
potential payloads, and targets.
Then we'll walk through the configuration of an exploit.
We left off last time with the UnrealIRCd backdoor exploit
selected and some information about it displayed.
Notice that we have some details about the exploit here.
We have a description and some references.
This exploit has only one target type, automatic.
That makes sense because this is a backdoor inserted
into the code by a malicious attacker.
It's not an instruction‑specific buffer overflow that
varies between multiple targets.
Notice that this exploit does not implement a check function,
which means there's no mechanism inside this exploit to determine
if the target system has this vulnerability.
We would need to do that through another tool or some manual testing.
Here are the basic options.
Again, this is a simple problem on the target, so this is a simple exploit.
There are only a few options to configure here.
We have only two to worry about,
the target IP address with RHOSTS and the network service port number,
RPORT. On most targets, the RPORT option is unlikely to change.
However, IRC servers may be on other ports.
Let's suppose we have a target with that particular problem,
so let's set the RHOSTS.
Metasploit confirms that the value is set.
If we are unsure, we can look at the options again and we can see that it is.
At this point, we have a target.
We do not have a payload, though.
Let's see what our options are for this exploit.
The show command will display the available payloads for this module.
Just use show payloads.
With this list, we can see that there are a few options we can pick.
Notice that we can tell by the naming used here that
these are all single payloads.
Notice there's no my Meterpreter option.
We're limited here because of the nature of the vulnerability in this situation.
Let's select one.
For our purposes,
we want to interact with the remote system and execute commands.
For that we'll use cmd/unix/reverse.
You can also select the payload with the index number
instead of typing the path to the payload.
I could've used the number 5 in this situation.
Now that we have a payload, we have some additional options.
Let's look at those again.
Notice that we now have payload options.
We can see that LHOST,
the local IP address of our Metasploit system has no value yet.
We need to set one because we're using a reverse network
connection coming from our target system.
It needs to know where our system is by the IP address.
So let's figure out what it should be.
Here's a quick Linux command to get the assigned IP address.
I use eth1 because that interface is connected to my internal test network.
You may need to use eth0 or another interface to get your IP address.
I can see that it is 192.168.56.10, so let's set that for LHOST.
Let's check our options one last time.
It looks right.
So we have an exploit module loaded, a target selected,
a payload module configured.
We are ready to launch this attack.
Let's look at another example first.
So the UnrealIRCd problem was somewhat limited.
We had only a few options for payloads and only one target.
In 2019, the BlueKeep remote code execution vulnerability was found.
That one affected several Windows RDP implementations.
Let's take a look at the exploit module information for it.
Notice that when we selected this exploit module,
it picked them Meterpreter payload automatically.
We will look at other payload options in a moment.
The BlueKeep exploit module has a lot to it.
Notice the number of available targets. This exploit carries
exploit code that is target dependent.
Target 0 says it uses automatic target selection via fingerprinting.
Look at the other target options,
though. We have either Windows 7 SP1 or Windows Server 2008 R2
running on hardware or as a virtual machine.
I know that our target happens to run in a VirtualBox VM, so let's set
that as our target. For this one, use the index number.
Let's continue our configuration. As a shortcut, we will have Metasploit tell
us what is missing and needs configuration with the show missing command. For
the exploit module, we need to configure RHOSTS.
But first, what happens if we forget to set RHOSTS?
Let's see. We immediately get a failure saying that RHOSTS failed to validate.
It has no value, so let's give it one.
What about our payload?
We have Meterpreter as a default option.
What else could we use?
Turns out there are quite a few options, 45 of them, to be exact.
Let's look at a simple one, command execution.
With this command, we can pass a command to be executed,
defined in the CMD option.
When the target is exploited, the payload executes that command.
We could use it to create a user account or shut down the
system or any number of other things.
The command would run with the privileges of the exploited process.
Here's another very simple forward network connection into a command shell.
There's nothing fancy here other than being able to execute more
than one command, since we have a Windows shell.
As you can see,
there are lots of options for payloads that would apply to this target.
We could probably spend hours going through each one of these,
but let's get back to our original default payload, Meterpreter.
Notice that LHOST is already set.
That's not going to work.
Let's fix that.
We mentioned advanced options.
Here they are for this module and payload.
We have exploit module‑specific options at the top and
payload‑specific ones at the bottom, and there are a lot of them.
We aren't going to make any changes to these, in this case.
Now we're configured and ready to exploit this target.