Setup and Work with MSF
Although the Metasploit Framework comes preinstalled on Kali Linux,
it’s not starting a database service in its default configuration.
While using a database is not mandatory to run Metasploit,
there are various compelling reasons to do so,
such as storing information about target hosts
and keeping track of successful exploitation attempts.
Metasploit uses PostgreSQL as a database service,
which is neither active nor enabled on boot time on Kali.
We can start the database service as well as create and initialize the MSF database
with msfdb init.
To enable the database service at boot time we can use systemctl.
Now, let’s launch the Metasploit command-line interface with msfconsole.
To hide the banner and version information while starting up,
we can add the -q option to the msfconsole command.
Once the Metasploit command-line interface is started,
we can verify database connectivity with db_status.
Our database is connected and we are all set up.
Now, let’s get familiar with the command-line interface of Metasploit
and how to use it.
The command-line interface of Metasploit provides numerous commands to navigate
and use the framework, divided into categories.
These categories consist of Core Commands,
Module Commands,
Job Commands_, Resource Script Commands, Database Backend Commands,
and finally Credentials Backend Commands and Developer Commands.
Throughout this Topic, we’ll use commands from most of these categories.
Before we jump into performing operations within Metasploit,
let’s discuss one important concept first: workspaces.
Let’s assume we have performed a penetration test and Metasploit stored all
information about our target and its infrastructure in the database.
When we start the next penetration test,
this information still exists in the database.
To address this and avoid mixing each results
from different assessments, we can use workspaces.
The Metasploit workspace command lists all previously-created workspaces.
We can switch to a workspace by adding the name to the command.
To create a new workspace,
we have to provide the workspace name as an argument to -a.
We’ll create a workspace named pen200
where we’ll store the results of this section and the next one.
Once created, Metasploit will use it as a current workspace.
Now, let’s populate the database and get familiar with some of the
Database Backend Commands.
For this, we’ll scan BRUTE2 with db_nmap
which is a wrapper to execute Nmap inside Metasploit
and save the findings in the database.
The command has identical syntax to Nmap.
The output shows the results of the port scan performed with Nmap.
As stated before, if the database service is running,
Metasploit will log findings and information about discovered hosts,
services, or credentials in a convenient, accessible database.
To get a list of all discovered hosts up to this point, we can enter hosts.
In addition, we can enter services to display the discovered services
from our port scan.
We can also filter for a specific port number by providing it as argument for -p.
The output shows all discovered services up to this point.
As we can filter for specific port numbers,
we can quickly identify all hosts with a specific service running.
When working on an assessment with numerous target systems,
the Database Backend Commands are invaluable in identifying important
information and discovering potential attack vectors.
We can also use the results stored in the database as input to modules,
which we’ll discuss in the next section.
Before we head into the next section, let’s briefly review modules again.
As stated, modules are used to perform tasks in Metasploit
such as scanning or exploiting a target.
The framework includes several thousand modules, divided into categories.
The categories are displayed on the splash screen summary,
but we can also view them with the show -h command.
The output shows the categories of Metasploit’s modules.
To activate a module, we need to enter use with the module name.
The modules all follow a common slash-delimited hierarchical syntax,
which makes it easy to explore and use the modules.
We’ll begin by exploring auxiliary modules in the next section and then dive
into exploit modules.