Metasploit Framework
MAIN COMPONENTS
Auxiliary: Scanners, crawlers, fuzzers, etc.
Encoders: Signature AV Evasion
Evasion: Better than encoders
Exploits
NOPs (No Operation): Used as a buffer to achieve consistent payload sizes
PAYLOADS
1) Singles
2) Stagers
3) Stages
Singles = Self-contained payloads that do not need to download an additional component to run
Stages = Downloaded by the stager. Tis will allow you to use larger sized payloads
Stagers = Responsible for setting up a connection channel between Metasploit and the target system. Useful when working with staged payloads.
"Staged payloads" will first upload a stager on the target system then download the rest of the payload (stage). This provides some advantages as the initial size of the payload will be relatively small compared to the full payload sent at once.
Single payloads format: shell_reverse
Staged payloads format: shell/reverse
POST = Post exploitation modules for privilege escalation/lateral movement
USING AN EXPLOIT
Example:
SESSIONS
METASPLOIT DATABASE
How to use:
1) service postgresql start
2)
3)
PROTIP: Metasploit also has vulnerability scanners for each service.
MISCELLANEOUS TRICKS
1) Searches for a specific CVE within the Metasploit framework
Last updated