TryHackMe: Metasploit: The Basics

Room: https://tryhackme.com/room/metasploitthebasics

Executive Summary

The Metasploit: The Basics room provides an introduction to the fundamental concepts and practical usage of the Metasploit Framework, one of the most widely used penetration testing frameworks.

The room focuses on understanding how Metasploit is structured around exploits, payloads, modules, and sessions. It explains how an exploit takes advantage of a vulnerability in a target system, while a payload defines the code or functionality that executes after successful exploitation. The room also introduces the difference between self-contained single payloads and staged payloads, helping build a foundation for understanding how payload delivery works.

Task 2: Core Concepts and Module Types

Metasploit is a penetration testing framework that provides a structured way to discover, configure, and execute exploits against vulnerable systems. Understanding the relationship between exploits and payloads is essential when working with msfconsole.

Key Concepts

An exploit is code that takes advantage of a vulnerability or flaw in a target system.

A payload is the code that executes on the target after the exploit succeeds. Depending on the payload type, it can provide capabilities such as a command shell or Meterpreter session.

There are different types of payloads:

• Singles — Self-contained payloads that do not require another payload to be downloaded.
• Stagers — Small payloads that establish a connection and prepare the target for the larger payload.
• Stages — The larger payload that is transferred after the stager successfully establishes communication.

Answers

Q1. What is the name of the code that takes advantage of a flaw on the target system?

Answer: Exploit

Q2. What is the name of the code that runs on the target system after a successful exploit?

Answer: Payload

Q3. What type of payload is self-contained and does not require a second download?

Answer: Singles

Q4. What symbol in a payload’s path name indicates it is a staged payload?

Answer: /

For example, a payload path containing / between the platform and payload components indicates a staged payload structure.

Task 3: Navigate msfconsole

The Metasploit Framework is primarily accessed through msfconsole. It provides an interactive command-line interface where you can search for modules, inspect them, configure options, and execute them.

Searching for Modules

To search for all exploit modules related to Apache, use:

search type:exploit apache

This limits the search to modules classified as exploits and searches for Apache-related results.

If the search results display an interesting module at index 3, you can view its detailed information with:

info 3

This displays information such as:

• Module name
• Description
• Author
• References
• Target information
• Available options
• Payload information

Returning to the Main Console

When you are inside a module’s context, the prompt may look similar to:

msf6 exploit(...) >

To leave that module context and return to the main msf6 > prompt, use:

back

Answers

Q1. How would you search for all exploit modules related to Apache?

Answer:

search type:exploit apache

Q2. You found an interesting module in your search results listed as index number 3. What command would you use to view detailed information about it?

Answer:

info 3

Q3. What command would you use to go back from a module’s context to the main msf6 > prompt?

Answer:

back

Task 4: Configuring and Running a Module

Once a Metasploit module has been selected, it needs to be configured before it can be executed. Metasploit modules use options such as RHOSTS, LHOST, LPORT, and PAYLOAD.

Setting LPORT

To set the local port to 6666:

set LPORT 6666

This sets the value only within the current module context.

Setting a Global RHOSTS Value

To configure RHOSTS globally so that the value can be reused by other modules:

setg RHOSTS 10.10.19.23

The setg command means set global.

Clearing a Payload

If a payload has already been configured and you want to remove it:

unset PAYLOAD

Launching an Exploit

To execute the currently configured exploit module:

exploit

You can also use:

run

depending on the module and context.

Running an Exploit in the Background

If you want the exploit to run while immediately returning to the Metasploit console after a session opens, add the -z flag:

exploit -z

This allows you to continue working in msfconsole without automatically interacting with the newly opened session.

Answers

Q1. How would you set the LPORT value to 6666?

Get Sudoroot’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Answer:

set LPORT 6666

Q2. How would you set the global value for RHOSTS to 10.10.19.23?

Answer:

setg RHOSTS 10.10.19.23

Q3. What command would you use to clear a set payload?

Answer:

unset PAYLOAD

Q4. What command do you use to launch an exploit module?

Answer:

exploit

Q5. You want to exploit a target but continue working in msfconsole immediately after the session opens. What flag do you add to the exploit command?

Answer:

-z

The complete command would be:

exploit -z

Task 5: Managing Sessions

After successfully exploiting a target, Metasploit may open a session. Depending on the payload, this could be a command shell or a Meterpreter session.

Metasploit allows you to manage multiple sessions simultaneously.

Backgrounding a Session

If you are currently interacting with a Meterpreter session and want to return to the main Metasploit console without closing the session, use:

background

The session remains active and can be accessed again later.

Interacting with a Specific Session

To interact with a particular session by its ID, use the -i option:

sessions -i <session_id>

For example:

sessions -i 2

This connects you to session 2.

Terminating a Specific Session

If you have three active sessions and want to terminate only session 2, use:

sessions -k 2

The -k option kills the specified session without affecting the other active sessions.

Answers

Q1. What command do you use to background a Meterpreter session and return to the msfconsole prompt?

Answer:

background

Q2. What flag do you use with the sessions command to interact with a specific session by ID?

Answer:

-i

Example:

sessions -i 2

Q3. You have three active sessions. You need to terminate session 2 without affecting the others. What full command do you use?

Answer:

sessions -k 2

Conclusion

This room introduced the fundamental concepts and workflow of the Metasploit Framework. The key lessons covered the difference between exploits and payloads, the distinction between Singles and staged payloads, and the basic navigation of msfconsole.

The room also demonstrated how to:

• Search for specific Metasploit modules.
• Inspect module information.
• Move between the main console and module contexts.
• Configure module options using set and setg.
• Clear configured options with unset.
• Launch exploits with exploit.
• Run exploits in the background using exploit -z.
• Background active sessions.
• Interact with specific sessions using sessions -i.
• Terminate individual sessions using sessions -k.

These commands form the foundation for working with Metasploit during authorized penetration testing and security labs. Understanding how modules, payloads, options, and sessions work together makes it much easier to navigate the framework and perform structured security assessments.