Metasploit Framework Cheatsheet for Security Analysts

🤖 AI Prompts Cheatsheet

Daniel Osei — AI-Assisted Security Engineer

What is Metasploit Framework?

Metasploit Framework is a powerful penetration testing tool that provides the necessary tools and environment to develop and execute exploit code against a remote target machine. It is widely used by security analysts and pentesters for tasks including vulnerability assessment, exploitation, and post-exploitation actions.

Installation

Metasploit can be installed on various platforms. For instance, in Kali Linux, it comes pre-installed. For manual installation on a Debian-based system, use the following command:

sudo apt-get install metasploit-framework

Basic Syntax

The basic syntax to launch Metasploit is as follows:

msfconsole

Once in the Metasploit console, you can use various commands to interact with modules, targets, and payloads.

Discovery

Finding Vulnerabilities

To look for vulnerabilities, use:

search 

This command will help to find exploits related to specific keywords.

Scanning

Service Scanning

Use the following command to scan for services running on a target:

use auxiliary/scanner/portscan/tcp

After selecting the module, set the target and execute the scan.

Exploitation

Exploiting Vulnerabilities

To exploit a known vulnerability, load the specific exploit module:

use exploit/windows/smb/ms17_010_eternalblue

Then configure the necessary parameters, including RHOST and payload:

set RHOST 

Analysis

Post-Exploitation Analysis

After gaining access, you can use:

post/windows/gather/hashdump

This will extract hashed passwords from the compromised machine.

Evasion

Traffic Evasion Techniques

To evade detection, consider using the payload:

set Payload windows/meterpreter/reverse_https

This payload uses HTTPS for communication, reducing the chances of detection.

Reporting

Exporting Results

You can save your findings by exporting your session:

spool /path/to/report.txt

Quick Reference Table

Pro Tips

• Use the help command: Typing ‘help’ or ‘?’ in the console will provide guidance on commands and available modules.
• Stay organized: Use sessions and workspaces to manage multiple targets effectively.
• Leveraging Auto-Exploit: The ‘db_autopwn’ command can automate the exploitation of vulnerabilities.

Real-World Examples

Using Metasploit in a real-world scenario might look like the following:

1. Launch Metasploit:

msfconsole

2. Search for exploitable modules:

 search smb

3. Select the desired exploit:

 use exploit/windows/smb/ms17_010_eternalblue

4. Configure options and run the exploit.

Following these steps will set you up for a successful Metasploit session during your penetration testing or security assessments.