[MUSIC PLAYING]
MSFconsole Fundamentals.
Now that we've taken a look at how to install and configure
the Metasploit Framework, we can actually
begin exploring the process of utilizing or understanding
how to utilize the Metasploit Framework console.
Now, the reason we need to do this
is because the MSFconsole is going
to be our primary interface of choice
when it comes down to interacting with the Metasploit
Framework, and it is the de facto choice
for many penetration testers out there.
So having a good understanding of how the Metasploit Framework
works and the various commands that
can be utilized to essentially search
for modules, use modules, set module options,
et cetera is very, very important
if you want to be competent at utilizing the Metasploit
Framework for penetration testing.
Now, I've already explained what the Metasploit Framework
console is, but I can go over it again.
The Metasploit Framework console--
or also known as MSFconsole, and I'll be frequently referring
to it as MSFconsole--
is an easy-to-use, all-in-one interface
that provides you with access to all of the functionality
of the Metasploit Framework.
So this is going to be our command center.
Everything pertinent to penetration testing
can be done through the Metasploit Framework console.
So we can search for modules, we can load modules,
we can configure module options.
We can then execute modules directly
from the Metasploit Framework console.
So it's really, really important.
Now, when it comes down to what exactly
we need to know to be comfortable with the Metasploit
Framework console, this is a list
of all of, really, the most important things that you
should be able to do, especially after this video.
So the first thing you need to be able to, search for modules.
You need to know how to select modules or how to load modules.
You also need to know how to configure module options
and variables, and we'll get into that in a few seconds.
You also need to know how to search for payloads.
Because, as we've already explored previously, payloads
are a vital part or element of the exploitation process
and are typically paired with exploits.
So knowing how to choose the correct type of payload
based on the target operating system and infrastructure
is very, very important.
We'll also be exploring the process of managing sessions,
and I'll explore that.
But we will really be touching upon sessions
when we move on into exploitation
and post-exploitation.
We're also going to explore additional functionality that
is afforded to us by the Metasploit Framework
console that's really helpful.
And finally, we need to know how to save our configuration.
Because all of these options, or rather,
the various Metasploit Framework console variables
that we can configure or that we can change
can be saved into a configuration file that
is loaded whenever we start up the Metasploit Framework
console.
And this is useful so that you don't
have to keep on setting these options
whenever you restart the Metasploit Framework console.
So now that we have an idea of what
we need to know in order to be comfortable with MSFconsole,
let's take a look at MSF module variables,
or the Metasploit Framework module variables.
Now, when we talk about the Metasploit Framework modules,
it's very, very common to find that various modules,
like exploit modules and post-exploitation modules,
will require information like the target IP address and port
in order to initiate a remote exploit or a remote connection.
And this makes sense.
Because, for example, if I'm using a Windows exploit
module that is targeting a version of Windows
and is exploiting a vulnerability on a target
system--
let's say the service we're targeting is SMB--
we require the target IP address and port
to be configured in order for this exploit module
to run successfully.
And this is where the Metasploit Framework module
variables come into play.
They allow us to set the target IP address as well
as the target port, which in this case would be port 445.
So, again, all of these options can
be configured through the use of Metasploit Framework variables.
And we'll take a look at some of these variables
in a few seconds.
And we will also explore them practically.
Now, it's also important to note that the Metasploit Framework
console allows you to set both local variable values
and global variable values.
And again, this will really not make much sense right now.
But once we move on to the terminal,
it will make a whole lot more sense
when we start loading modules or start executing or running
various exploit modules.
So let's take a look at some of these variables
and what their purpose is in regards to the type of data
that they store.
So if you're familiar with the Metasploit Framework,
you should be familiar with these variables, variables
like the LHOST, LPORT, RHOST, RHOSTS, or RPORTs.
So the LHOST variable is used to stored
the IP address of the attacker system, which
is going to be our system.
The LPORT variable is used to store the port number
on the attacker system that will be used to receive
a reverse connection.
So the LHOST and LPORT variables are
really useful when it comes down to a particular module that
is going to provide us with a reverse shell.
The way a reverse shell works is that once the exploit is sent
or once it's executed on the target system,
the payload initiates a reverse connection back
to the attacker.
And in order for that to be done,
the payload requires the attacker's
IP as well as the port that is currently listening
on the attacker system.
And this is where the LHOST and LPORT variables come into play.
You then have the RHOST and RPORT variables,
which in the case of the RHOST is
used to store the IP address of the target system or server.
So this is going to be, again, the target's IP.
The RHOSTS option is used to store the IP
address of multiple targets.
So if you're targeting more than one system,
then you can specify various or multiple IP addresses as well
as an entire network range.
And that is what the RHOSTS variable is used to store.
The RPORT option is used to store the port number
that we are targeting on the target system.
So, for example, if we go back to the Windows exploit
module example, if we are targeting SMB,
then we would set the RPORT value to port 445,
because that is the port SMB is running on.
So, again, it's fairly simple to understand.
And it'll make sense once we get into the Metasploit Framework
console.
So let's get started with the practical demonstration.
So I'm going to see you back on my Kali VM.
All right, so I am back on my Kali VM.
And I'm just going to bring this into fullscreen
so we can see what's going on.
So the first thing I'm going to do
is, of course, initialize or start
up the Metasploit Framework console.
So msfconsole and we'll hit Enter.
Give that a few seconds to start it up.
Again, if this is your first time running it,
it will take more than a few seconds.
So in my case, there we are.
We can see starting the Metasploit Framework console.
And voila, so it started up and we get this really cool ASCII
banner.
All right, now, it's very important
to note that some key information is
displayed whenever you start up the Metasploit Framework
console.
That information is right over here.
So firstly, it prints out the version of Metasploit
that's running.
And then it prints out all the available modules
in their various categories.
So we have exploit modules, auxiliary modules,
post-exploitation modules, payloads, encoders, nops,
as well as evasion modules.
And, of course, the total amount in regards
to the number of these modules is also specified.
So there we are.
You can clear the terminal by typing in or using
the key binding Control and L. And that should clear up
your terminal-- or the Metasploit Framework console,
rather, as we are working within it right now.
So welcome to the Metasploit Framework console.
Now, getting started might be a little bit confusing
because you might be thinking to yourself,
well, what exactly do I do now?
Well, you really don't need to do much in regards
to essentially setting up various options.
The Metasploit Framework is very useful
when you essentially know what you're doing
and what system you're targeting.
However, there's a few important commands
that you should be aware of.
So let's open up the help menu, which
can be done by typing in help.
That's fairly simple.
So we type in help, and this will bring up
a list of commands and their descriptions in
regards to what they are used for.
So let's take a look at the core commands.
You can see it gives you an idea of all
of the commands available to you and what they are used for.
In our case, we're really not going
to go through the documentation.
I'm going to be taking you through
some practical demonstrations that
will explain how to utilize the Metasploit Framework.
You also have module commands.
So they are sorted based on category.
You have core commands, module commands, job commands,
resource script commands, as well as
database backend commands, which we will
be exploring in the next video.
You also have a few other commands here
and the relevant documentation.
And as you can see, it gives you some documentation
as to what the Metasploit Framework console is.
So now that we have accessed the help menu,
let's take a look at how to display some information
like the version.
So if we wanted to display the version of Metasploit that
is currently running, we type in version.
As you can see, it tells us that we're running the Framework
version 6.1.13-dev and the same for the console.
So that's very important when it comes down
to identifying issues with a particular release.
Or in the event you want to essentially roll back
to a previous version, you can always use this functionality
to find out what version you're currently on,
in regards to both the Framework and the console,
because they are separate elements, as we've already
explored.
OK, cool.
So we can also go through the process of showing
all the available modules.
So if we say show all, this will show us
all the available modules.
And, of course, we're talking about exploit modules,
payloads, and auxiliary modules, encoders,
all of that good stuff.
However, we can also show or limit the results
to maybe something like exploits.
So we say show exploits.
This will show us a list of all available exploits.
And we'll go through the structure
under which the Metasploit Framework console
displays modules.
For now, you can see that the total number of exploit modules
is 2,177.
All right, if we open up the help menu
for the show command, which you can do by using the show -h
option here, this will open up the help menu
for that particular command.
And this also works with other commands.
In the event you want to learn more
about a particular command, that's the way you can do it.
As you can see, the parameters for the show command
are all, encoders, nops, exploits, payloads, et cetera.
So we can use the show command to essentially
display exploits, payloads, auxiliary modules, et cetera.
So that's really not that important,
but it will be in a few seconds.
So let's take a look at a practical example.
Let's say we want to perform some port scanning.
Well, how do we get started?
We can get started by searching for a port-scanning module.
That can be done by typing in search.
And then we can say portscan, hit Enter.
And as you can see, it will display
a list of matching modules.
And the way the Metasploit Framework
console displays or sorts out the modules
is firstly through an index number.
That's a unique identifier for each of these modules.
You then have the name.
So this is the name of a module and this
is how you will reference it whenever you're
trying to use it or to load it.
And then you have the disclosure date.
This is pertinent to exploit modules.
You then have the rank in regards to the functionality
or chances of success.
You then have the description, which
gives you a description of what this module is designed to do.
So if we take a look at this module right over here,
we can see that this is a TCP portscanner module,
and it's an auxiliary module at that.
And in order to use it, we can copy the name of the module.
So we can copy that there.
And then we can say use--
and paste in the name of the module and hit Enter.
Now, you'll see something interesting happen here.
Instead of just getting a simple prompt here,
we can now see that the Metasploit Framework console
prompt now adds the actual module name here.
And in this case, it says we're using an auxiliary module
and then refers to the specific auxiliary module we're using.
And it's highlighted in red, which means it's active.
So that means that we're currently using this module.
Now, when it comes down to using a module,
we need to configure the options.
In order to display the options, we type in show options.
Once we hit show options, you can
see it's going to show you the module options
for this particular module.
And then the options are sorted into name,
the current setting, whether they're required,
and the description.
In this case, you can see that almost all of the options
have been set apart from the RHOSTS option, which,
as we already know, is used to specify the target
IP or various IPs.
So as you can see, the description is provided here.
This is used to specify the target hosts.
So let's talk about setting the variables here or setting
the module options.
If we want to set the RHOSTS option to our target IP,
we can do that by saying set RHOSTS--
and then we provide the value.
In this case, I'm just going to provide the IP address
of my router, so 192.168.2.1.
Once I hit Enter, it's going to give you
the confirmation saying RHOSTS has been set to this value
here.
And now we can confirm that this setting or this option
has been set by clearing our terminal
and then saying show options.
And as you can see here, the RHOSTS value
has been added that we specified.
And we pretty much can customize any of these other values
by simply saying set and then specifying the option name.
So let's say we wanted to change the target
port to scan because this is a portscanner module.
We can say set PORTS.
And in this case, we can specify one port or an entire range
of ports, and it provides you with the syntax for doing so.
So in this case, let's say we want to scan ports 1 to 1,000.
And, of course, these are TCP ports.
We hit Enter.
You can see we get a confirmation of that.
And then we can clear our terminal
and show the options again, just to make sure that is set.
And you can see that that is set correctly.
And you can go ahead and customize the other options
here.
But for now, this looks fine.
So all we're going to do is type run.
And that is going to execute this particular module.
And it'll begin the portscanning process.
So, again, give that a few seconds.
As you can see, it's starting to discover various open ports
on my router.
So the port 53 is open for DNS.
We can also see that the router has a web interface running
on port 80.
And it gives you, essentially, the results here.
And the module is currently running.
Once it is done running, it should terminate and take you
back to your Metasploit Framework console.
In this case, you can see that it's still running.
If you want to terminate a particular module,
you can use the Control-C key binding.
That will terminate it, as you can see.
It catches the interrupt from the console
and then it takes us back to the module here.
Now, let's say we actually want to go back or essentially stop
using this particular module.
We can do that by typing in back.
And as you can see, now we are not
using that particular module.
So that is the process of searching for using a module
and then setting the various module options that
are required in order for it to run.
OK, let's take a look at a few other search options
that we can utilize.
If we open up the search documentation
by typing in search -h, you can see that at the bottom,
we also have the ability to search
for specific CVEs and the actual platform
as well as the type of module that we are looking for.
So let's use a simple example.
Let's say we are looking for CVEs or modules that exploit
a particular vulnerability.
And we want to sort it by the CVE code,
or rather, the CVE year.
We can specify CVE and then maybe the year, maybe 2017.
And then the type is going to be an exploit.
And then the platform, we can say Windows.
So essentially, what we're saying here
is look for all exploit modules for the Windows operating
system that were released in the year 2017.
So we hit Enter.
And as you can see, it lists or provides us with about 60
of them.
And these are various--
and in this case, you can see, well, it's
actually provided us with various operating systems here.
If we can just change that to Windows,
the platform is Windows, and hit Enter, there we are.
So these are the Windows exploits released in 2017,
as you can see.
Their disclosure date may be a little bit earlier.
But, again, it essentially provides you
with all of these modules.
So you can search for modules really, really easily.
And, again, we'll be exploring how
to utilize the search command as we move along
through this course.
So that is how to search for modules, load modules,
as well as set the various module options.
Now let's take a look at some advanced commands
when it comes down to specific modules,
and we'll also take a look at payloads.
So let's say we want to search or we
want to use the EternalBlue exploit module.
We can search for it by saying search eternalblue.
That is the name of the exploit itself.
We hit Enter.
You can see that it's going to be the first option.
This is a Windows SMB exploit module
that targets SMB and essentially provides us-- or essentially
takes advantage of a vulnerability
within an older version of SMB and allows for remote code
execution.
So we can just highlight that.
We can copy that there.
Additionally, you can also load or use a module
by specifying the identifier.
So instead of saying use and then typing
in the exploit name, we can also just say use 0 and hit Enter.
And that is going to select the exploit module here.
Now, you can see that this particular module gives us
an error message or, rather, a notice saying,
No payload is configured, defaulting
to windows/x64/meterpreter/reverse
tcp.
So this is, as I said, where the type of payload
is very important.
Now, based on the target system you are targeting
and its architecture, is it 32-bit or 64-bit,
you're going to need to change or reconfigure
the payload for this particular exploit to something else.
And, again, based on the type of connection you want back,
you can change this from a Meterpreter
to maybe a simple reverse shell if you want to.
But in this case, as it says, the default
is set to this particular module.
So if we clear that out and say show options,
you can see that we now have more options than normal.
And this is not a mistake.
This is very, very important.
So you can see that we firstly have the module options.
We then have the payload options,
and this is where the Metasploit Framework module
variables come into play.
As you can see, we have the ability
to set the RHOSTS option as well as the RPORT option.
We then need to set the payload options
for the reverse connection, and this will include
the LHOST and the LPORT.
So this is where we specify our attacker IP address--
as it's called here, the listen IP address--
and then the LPORT, or the listen port,
for the reverse connection.
So, again, this is how you can do it.
If we want to change the payload for a particular exploit
module, we can always say set payload,
and then we need to specify the name of the payload, which
in this case, we can say Windows.
And then we can just say Meterpreter.
So we're using a 32-bit Meterpreter
version, so windows/meterpreter and so on and so forth.
And you can then change the payload.
And, again, don't worry about this.
We will be exploring it as we move along.
So that is essentially how to load a module
and how payloads can be set for a particular exploit module.
And of course, you can set up the options really simply.
So, for example, we can do that right now.
We can set the RHOSTS to--
I'll set up my router IP.
Although it's not running Windows,
it should be fine because we're not going to run it.
We can then set our LHOST and LPORT options.
So, again, in our case, that's already been set for us.
That is my attacker IP or my Kali Linux IP.
And this particular port is currently available.
So if we say show options, you can
see that a change has been highlighted here.
And then once you're ready to launch an exploit module,
all you need to do is type in exploit or you can type in run.
And it will exploit or run that particular exploit module.
So we can hit run.
As you can see, it's going to begin the exploit process.
And it's going to fail.
It's going to fail, sorry.
And there we are.
The target is not vulnerable.
And then we can terminate that.
And as you can see, exploit completed
but no session was created.
And that is essentially how to search for and load
a module, how to configure the options, et cetera, et cetera.
We also have a few other options or commands that we can run.
As I mentioned, we have the ability
to set sessions or essentially monitor or manage sessions.
We can view the sessions by typing in sessions.
And as you can see, we have no active sessions.
Don't worry about that.
We will have active sessions after the exploitation phase
once we have established initial access on our target systems.
For now, just know that this will
display a list of all your active sessions
and their session IDs so that we can navigate
or we can change between them.
All right, another interesting piece
of functionality that we have access to
is the connect command.
Now, the connect command is essentially--
if I bring up the help menu here--
is essentially, as it says here, provides you
with the ability to communicate with a host,
similar to interacting with or via netcat,
taking advantage of any configured session pivoting.
So this allows you to essentially perform
banner-grabbing.
So if I say connect--
and all I need to do is specify the target IP as well as
the target port.
It will essentially connect to the IP and the port,
similar to netcat, and will display the banner.
So if I say connect to 192.168.2.1 on port 80, which
is my router IP address, and connect to port 80
and I hit Enter, you can see it's going to connect.
And it tells you what address it actually--
what port it used to connect to from the attacker's IP
or from the attacker system.
And there we are.
Now, in this case, it's not displaying a banner
because this is a web server, which is perfectly fine.
But this, again, will be very useful
as we move into information gathering.
So we'll take a look at that when we get there.
So, yeah, that is pretty much all that is required in
regards to using the Metasploit Framework for penetration
testing.
As I said, we'll be getting into the nitty-gritty
as we progress through this course,
and everything will start making sense and most of the commands
will start becoming demystified.
And we'll take a look at how to use
the Meterpreter, a Meterpreter session
and the various commands that fall under that.
So do not be alarmed if this may seem overwhelming.
Don't worry.
Everything is going to make sense as we progress.
So I'll see you back on the slides.
All right, so you should be familiar with the Metasploit
Framework console and how to navigate around it,
how to search for modules, how to use them, how to set
module options, how to execute them, so on and so forth.
We will now be taking a look at how
to manage workspaces within the Metasploit Framework console.
And this, of course, will entail the interaction
with the Metasploit Framework database.
So do stay tuned for that, and I'll be seeing you
in the next video.