[MUSIC PLAYING]
Automating Metasploit with resource scripts.
In the previous sections, we have explored the process
of utilizing the Metasploit framework for a wide variety
of tasks like information gathering,
port scanning, enumeration, as well as vulnerability scanning,
and now client side attacks.
And through that process or through that time,
you pretty much should have been able to identify
or been able to notice that there are a few commands that
can be quite repetitive, for example, like setting up
a multi handler for your payloads,
and that's where resource scripts come into play.
All right, so Metasploit essentially
provides you with the ability to set up
resource scripts to automate repetitive tasks and commands.
An example of this would be, again,
the process of setting up a multi handler
for your payloads.
And the process can be quite cumbersome,
because first and foremost, you need to start up the Metasploit
framework console.
You then need to set the payload,
or essentially specify that you want
to utilize the multi handler, then set the payload,
set the various options associated with the payload,
and then hit Run.
So we can automate this process by creating a resource script.
Now, resource scripts, in regards to the way
they operate, operate very closely or very similarly
to batch scripts.
So if you have ever utilized batch scripts on Windows,
you know that all you need to do is create the batch script,
and then within the script, you just specify
the commands that you'd like to run sequentially.
And then when you want to automate
or when you want to run all of these commands at once,
you just run the script and it'll
execute all of the commands that you
specified within the file sequentially, from the top
to the bottom.
So resource scripts work essentially in the same way.
Now, we can load the resource script with MSF console
and furthermore, or consequently,
execute or automate the execution of the commands
that we have specified within the resource script.
So we can utilize resource scripts
to automate a wide variety of tasks,
like setting up a multi handler, as well as
loading and executing payloads.
You can pretty much automate every command
that you can run within the Metasploit framework console,
from checking the status of the database to loading a module,
loading an exploit, running an exploit,
specifying the module options or the payload options, et cetera,
et cetera.
You really can automate almost every aspect of the Metasploit
framework console through a resource script.
So let's actually see how we can utilize
them to automate repetitive tasks like setting up
a multi handler.
So I'll switch back onto my Kali VM, and I will get started.
All right, so I'm back on my Kali VM
and we can get started with creating a resource script.
However, before we do that, we also
have a series or a collection of resource scripts
that actually come pre-packaged with Kali Linux,
so you can actually view them by listing out
the contents of the directory user share Metasploit
framework, after which you can head over into the scripts
directory and then specify the resource directory here.
And this is the list of resource scripts
that come pre-packaged with the Metasploit framework
on Kali Linux.
As you can see, the actual file structure and extension
is very simple to understand.
You have the name of the resource script, which
you can call whatever you want.
However, I would recommend giving it
a name that essentially provides it or essentially provides you
with the description of what the resource script does,
and then you provide the extension, RC.
So if we just open one of these files here,
so I'm just going to, again, modify the actual command here,
and we're just going to open one of these resource scripts
with Vim.
Vim is a text editor.
You can use whatever other terminal or graphical text
editor that you are comfortable with.
We can check one of them.
So let's check out the first one, which is autobrute.rc.
So this is quite an advanced resource script
in regards to the functionality that it actually performs,
and you can see that you can specify some documentation
and then you can also, again, insert or call
upon Ruby or some Ruby functionality, if you want.
And all you need to do is just specify all the commands
that you want to run sequentially,
and you'll be able to do that.
In our case, we are not really going
to be creating an advanced resource script like this.
We are going to try to automate the process of setting up
a handler for the payloads that we generated.
So again, if you remember, if I navigate into Windows payloads,
we can automate the process of setting up a multi handler
for any one of these payloads.
So the way we would do that, if traditionally speaking,
we could set up a handler here, and I'll
take you through that process.
So what you would typically do manually is say MSF console,
and then you would wait for MSF console to start up.
So again, that takes time.
And then once it started up, you then
specify the actual multi handler, set the payload.
So we would say use multi handler
and then set the payload to Windows Meterpreter,
reverse TCP, and then you would set
the L host option to the actual Kali Linux IP,
or the attacker's IP address, And then set the L port
to the one you specified when you were creating
the actual payload with MS Venom,
and then you would hit Run, or you could run it also
in the background as a job.
So we would hit Run, and that will start up the handler.
So you can see that that takes quite a lot of time.
What you can do in replacement of this is set up an RC script.
So let me just exit from MSF console,
and we'll head over to the first tab here.
So if I wanted to set up a handler resource
script to essentially set up a multi handler for the Windows
payloads, I would again create one.
So you can utilize a text editor.
In my case, I'll use Vim, so I'll call it handler.rc.
And within it, I can then specify the commands
that I would typically run when setting up a handler.
So I would say use, and then I would say multi handler,
so multi handler, and then I would set the payload option
and make sure that PAYLOAD is in all caps,
and I would say Windows Meterpreter reverse TCP,
and then I would set to the actual payload options,
like the L host value, so 10.10.10.5,
and then set L port to 1234, and then I typically would hit Run,
all right?
Now, the important thing to note here
is that you need to specify the commands sequentially,
from the first command all the way to the last command,
with the first command being at the topmost
and the last command being at the end of the actual script.
So once you're done, you can just save the script.
So I'm going to write and quit, and we have the Handler script
right over here.
So in order to load it and actually see how this works,
we need to type in MSF console and then use the R option,
and then specify the actual script or the path
to the script.
So if we say MSF console, our handler.rc, we hit Enter,
it is now going to automate that entire process.
So it's firstly going to start up the Metasploit framework
console.
So again, we're going to give that a few seconds.
There we are.
As you can see, it's handled or has essentially
automated that entire process.
So first and foremost, as you can see here,
it knows that this is a resource script.
So it starts executing the commands
from the topmost all the way to the end of the resource script.
So firstly, we say use multi handler.
It then sets the payload to Windows Meterpreter reverse
TCP.
It then sets the L host value, as well as the L port value,
and then it also executes the Run command, which then
starts the reverse TCP handler.
So you can see how useful this can be.
And this is just one example of what a resource script can
actually help you automate.
So if we terminate that and we then exit from MSF console,
we can take a look at another one, or another example.
So I can create another one called--
let's see, we can say or we can utilize
one called maybe portscan.rc.
And within this, we are simply going
to say we want to use a particular module.
So to get the name of the module,
we're just going to open up MSF console just
to make sure that we actually have the module name
or have it set correctly.
So we'll open up MSF console here,
and we'll give that a few seconds.
All right, so I'm going to search for the port scan module
that I want to use.
And we'll use the TCP port scan module,
so I'm just going to say use.
There we are.
And if we show the options here, the only option we need to set
is the R hosts option and maybe the ports range,
if you want to customize that.
So we can automate this process by firstly
adding the actual module here.
So we're going to say use and specify that.
We're then going to say set R hosts to maybe the target IP,
which in this case will be 10.10.10.7.
And then we can probably hit Run,
and this process will essentially automate
the port scanning process.
And of course, you can customize the R host's value
to whatever you want.
So if I write type in write and quit
and let me exit from this particular session here,
we can then say MSF console, R for resource script,
and then we can say port scan and hit Enter.
Again, that's going to start the Metasploit framework console
and it's then going to run all of those commands sequentially.
And this again is another example
of how you can automate somehow repetitive commands.
So there we are.
As you can see, it's going to perform
the port scan on the target system
and it'll then display the results here.
So let's see if there are any open ports of the target.
In this case, the target is the Windows 7 virtual machine,
and I don't expect there to be any open ports at this point.
So we only have NetBIOS and SMB currently
enabled, so yeah, that's the process you can go through.
And as I said, you can pretty much
run any command that you would like to automate.
So we can create another example or take
a look at another example here, so we
can say maybe MSF console, or rather, let's
create a new handler or a new resource script,
and I'm just going to call this probably we can say--
we can actually just call it db status, right?
And this will probably check the status of the database, which
again, I know this is a menial task,
but we can run other commands as well.
So we'll just call it dbstatus.rc,
and within this, we can then type in the db status command
and we can probably list of the current workspaces
that we have.
So we can say workspace, and then we
can switch 2 a particular workspace if we want or create
another workspace.
So we can say workspace and we can
create another one called maybe we can just call this test,
and we can then save and quit and say
MSF console, R, dbstatus.rc.
That'll start up MSF console and execute the commands,
and it should create the workspace for us.
So again, give that a few seconds.
All right, there we are.
As you can see, it executes the command.
It checks the database status, and it tells us
we are connected to MSF and the type is PostgreSQL.
It lists out the workspaces that we have.
In this case, you can see we have a few workspaces.
And then of course, it creates the new workspace here.
And of course, we can then just delete that workspace.
And you can probably also add this command, as well,
if you'd like to do that, the point being, again,
the point being to actually demonstrate
the functionality and the power of a resource script
and what it can be used for.
You can also load up resource scripts
from within the Metasploit framework console.
So let's say I'm already working within MSF console.
I can just open this up, and I'll
show you how to load up the resource scripts directly
from within MSF console.
So if I wanted to load up a new resource script from within,
I just say resource and then specify the actual path
to the resource script.
So I can say resources in desktop and maybe Windows
payloads, and then I can say handler.rc,
and that'll again start it up for us,
so you don't have to actually go through the process of spawning
a new MSF console session and then loading
the resource script that way.
So this is another way you can do that.
So if I terminate that, you can see
that's going to terminate or stop the reverse TCP handler.
You can also create a resource script automatically
from within MSF console.
And the way that works is if I just exit from the current MSF
console session, and I can open up a new MSF console
session here, I can essentially type in the commands
that I want to be in a resource script
and then export those commands into a resource script.
So for example, as we did previously,
if I wanted to say or utilize the port scan module,
I can essentially, again, search for it.
Or in this case, for example, let
me just specify that this is the module I want to use.
So if I say use the port scan module and then set the R
host's value to the target IP, which in this case is
10.10.10.7 and I hit Enter and then hit Run,
I can essentially hit Run, and that will perform the port
scan.
And then if I terminate this, I can essentially
export all of the commands that I typed in,
starting off from the Use command
to the actual configuration of the module,
as well as the Run command.
I can export all of these into a resource script.
If I don't want to create one and type out all
of the commands again, I can just say make RC, and then
specify the path to actually-- or the actual path
where you want to save the resource script.
So you can say desktop, and we can just call this test.rc,
or we can just call it portscan.rc and hit Enter.
As you can see, it's going to say
saving your last three commands to desktop portscan.rc.
So it'll actually save the commands
that you've typed in, which can be much more
helpful if you already have an idea of what
you want to automate.
So if I exit out of here, and let me take a step back
onto my desktop and I cut out the contents of portscan.rc,
we should be able to see the actual file here.
So let me list out the contents of my desktop.
You can see that it's not saved here.
That's because MSF console was started as a root user.
So if I say, let me switch to my root user here,
and hopefully I'll be able to do that, let me actually just
switch over to the root user.
All right, so I'm currently the root user.
So if I check the contents of the root directory
on the desktop, you can see that we should
have the portscan.rc file.
There we are.
And the reason it output or saved it within the root users
directory is because we didn't actually
specify the entire path, right?
So we should have specified the absolute path
or the relative path to the actual directory
where we wanted to save it.
So we should have saved it under home Kali desktop.
Because MSF console requires root privileges
in certain scenarios, it saved it
under the root user's desktop.
So again, we have it here.
And as you can see, it's exactly--
it essentially has the commands that we specified.
So that is the process of creating Metasploit RC
scripts to essentially automate repetitive tasks
or commands that you don't want to keep on running.
And as I said, you can customize them and utilize pretty much
all MSF console commands, as long as they make sense
sequentially.
So that's going to be it for the practical demonstration.
In the next section of this course,
we'll begin exploring the actual exploitation of Windows
and Linux services, as we have now explored client side
attacks, so we can now actually get
started with exploiting the services that
are running on both Linux and Windows systems,
and again, exploring how they can be exploited
through the use of various exploit Metasploit framework
modules.
So I'll see you there.