[SIM-2015410]

Hello Hf,

Welcome to my first hacking tutorial. Hopefully this will not be my last though 🙂

When you start out in hacking, you will soon run across the word "exploit". An exploit is an attack on a computer system, especially one that takes advantage of a particular vulnerability that the system offers to intruders. It can take advantage of both weaknesses in an operating system or vended application programs.

What Is Metasploit?
Metasploit is one of the best, most widely used exploitation tools in both white hat and black hat hacking. It can be used by both beginning n00bs and more advanced hax0rs 🙂.

Metasploit was developed in 2003 as an open source project by H.D. Moore. Originally developed in PERL, the developer team rewrote Metasploit in Ruby in 2007. This is critical, because you need to have Ruby on your system in order to run Metasploit and to develop your own exploits. Metasploit was then purchased by rapid7 in 2009, which still offers "metasploit community edition" as a free, open source download for anyone to use.

Metasploit is an "exploitation framework". As a framework, it eases the effort to exploit known vulnerabilities in networks, operating systems and applications, and to develop new exploits for new or unknown vulnerabilities. The metasploit framework contains hundreds of exploits and "payloads" and makes it easy to use them. My current version of metasploit contains 1161 exploits and 310 payloads!

In this tutorial, i will be using linux. There are numerous advantages to using linux when hacking. Linux is free, and open source. There is a Windows version of Metasploit, but many of the features such as raw IP packet injection, wireless driver exploitation, SMB relaying attacks, etc. are unavailable on windows. There is also a GUI developed for metasploit by independent developers, but we will be using the command line. All hackers should be familiar and comfortable using the command line.

Download and Installation
First we need to download and install Metasploit (obviously 🙂).
One of the best distros for hacking is Kali Linux. this distro comes with metasploit framework pre-installed, so if you want to use kali, skip the next few steps. Here, I'll walk you through downloading and installing on one of the most popular Linux distros: Ubuntu.
Spoiler (Click to View)
AS I STATED EARLIER, ENSURE RUBY IS INSTALLED!

Code

sudo apt-get install ruby1.9.1 build-essential

First open a terminal window and type this for the 32 bit version:

Code

wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x32-installer.run

Or this, for the 64 but version:

Code

wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run

This uses the wget command to download the latest version of the Metasploit framework.

Next, we need to make the installer executable so we can run it. In the terminal, use the following command to change the mode to execute (x) for Metasploit:

Code

chmod +x metasploit-latest-linux-x*-installer.run

And now execute the installer (using superuser or root via the sudo command. You will need to enter your root password in order to use this command):

Code

sudo ./metasploit-latest-linux-x*-installer.run

Follow the prompts in the installer, clicking forward and agreeing to the license agreement. Select yes to allow metasploit to automatically update itself. Accept the default service script, and wait for the installer to finish


After you have metasploit installed, you are ready to run it! To start up the metasploit framework console, type this into terminal:

Code

msfconsole

NOTE: On kali, you first need to start the metasploit framework service using:

Code

service metasploit start

You should see the beautiful text art "Metasploit" if it runs correctly, and be prompted for a command. Feel free to experiment and research, or wait loyally for my next tutorial on some basic usage of metasploit.

Now that you have successfully installed Metasploit you can start doing some l33t hacks!

Manual Updates:
Spoiler (Click to View)
Because the exploit databases is always being added to, you should periodically update your version of Metasploit. to do this, simply type:

Code

sudo msfupdate

LIST OF BASIC COMMANDS:Spoiler (Click to View)
Basic commands
? - help menu
background - moves the current session to the background
bgkill - kills a background meterpreter script
bglist - provides a list of all running background scripts
bgrun - runs a script as a background thread
channel - displays active channels
close - closes a channel
exit - terminates a meterpreter session
help - help menu
interact - interacts with a channel
irb - go into Ruby scripting mode
migrate - moves the active process to a designated PID
quit - terminates the meterpreter session
read - reads the data from a channel
run - executes the meterpreter script designated after it
use - loads a meterpreter extension
write - writes data to a channel

File System Commands
cat - read and output to stdout the contents of a file
cd - change directory on the victim
del - delete a file on the victim
download - download a file from the victim system to the attacker system
edit - edit a file with vim
getlwd - print the local directory
getwd - print working directory
lcd - change local directory
lpwd - print local directory
ls - list files in current directory
mkdir - make a directory on the victim system
pwd - print working directory
rm - delete a file
rmdir - remove directory on the victim system
upload - upload a file from the attacker system to the victim

Networking Commands
ipconfig - displays network interfaces with key information including IP address, etc.
portfwd - forwards a port on the victim system to a remote service
route - view or modify the victim routing table

System Commands
clearav - clears the event logs on the victim's computer
drop_token - drops a stolen token
execute - executes a command
getpid - gets the current process ID (PID)
getprivs - gets as many privileges as possible
getuid - get the user that the server is running as
kill - terminate the process designated by the PID
ps - list running processes
reboot - reboots the victim computer
reg - interact with the victim's registry
rev2self - calls RevertToSelf() on the victim machine
shell - opens a command shell on the victim machine
shutdown - shuts down the victim's computer
steal_token - attempts to steal the token of a specified (PID) process
sysinfo - gets the details about the victim computer such as OS and name

User Interface Commands
enumdesktops - lists all accessible desktops
getdesktop - get the current meterpreter desktop
idletime - checks to see how long since the victim system has been idle
keyscan_dump - dumps the contents of the software keylogger
keyscan_start - starts the software keylogger when associated with a process such as Word or browser
keyscan_stop - stops the software keylogger
screenshot - grabs a screenshot of the meterpreter desktop
set_desktop - changes the meterpreter desktop
uictl - enables control of some of the user interface components

Privilege Escalation Commands
getsystem - uses 15 built-in methods to gain sysadmin privileges

Password Dump Commands
hashdump - grabs the hashes in the password (SAM) file
Note that hashdump will often trip AV software, but there are now two scripts that are more stealthy, "run hashdump" and "run smart_hashdump".

Timestomp Commands
timestomp - manipulates the modify, access, and create attributes of a file


Thanks for reading, please reply with your thanks if you enjoyed this and/or found it useful.

I am hoping to make another tutorial soon that will teach you how to use Metasploit for a real hack!

Written by MeshCollider 🤝

[The Wizard of Dos]

Pretty neat tutorial 👍 You might want to change the title to "[TUTORIAL] Metasploit Intallation Tutorial", but other than that it was great.

[SIM-2015410]

Pretty neat tutorial 👍 You might want to change the title to "[TUTORIAL] Metasploit Intallation Tutorial", but other than that it was great.

Thanks for your quick reply!
I will change the title now, thanks for that 🙂

[pikachu123]

hello! thanks for the tut. its awsome ! I just installed kali linux, im trying to run some comands listed up here and every single one says " command not found " ( on kali terminal ), even ipconfig. should I reinstal it?

[SIM-2015410]

hello! thanks for the tut. its awsome ! I just installed kali linux, im trying to run some comands listed up here and every single one says " command not found " ( on kali terminal ), even ipconfig. should I reinstal it?

You should be using ifconfig not ipconfig on Linux. Try running SET from the menu at the top, not from terminal. That will fix it 🤝

[pikachu123]

sorry but, what you mean by SET? :P

[SIM-2015410]

sorry but, what you mean by SET? :P

Social engineering toolkit 😝

[p_h_p]

i wanna use backtrack. Will be that Good One. And i heard a lot's a exploit. as you said in your thread but i also heard exploit about web. what is that..
Thank You for this thread. waiting for the next one.

[Anubhavr]

Nice TuT man...... i have been waiting for such tutorial since a long time which is noob -friendly like me......

Cant wait for ur next thread......

[SIM-2015410]

Hey guys, I have already made a lot more tutorials! check them out, and I'd appreciate it if you could reply to those too 🙂. Thanks for the great feedback 🙂.
"An exploit is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). "
Basically, it is something we use to get control of their computer.

[if not true then false]

Code

chmode +x metasploit-latest-linux-x*-installer.run

And now execute the installer (using superuser or root via the sudo command. You will need to enter your root password in order to use this command):

Should probably fix that typo on chmod to be

Code

chmod +x metasploit-latest-linux-x*-installer.run

🤝

Otherwise, nice tutorial.

[SIM-2015410]

Should probably fix that typo on chmod to be

Code

chmod +x metasploit-latest-linux-x*-installer.run

🤝

Otherwise, nice tutorial.

Thanks but what is the typo? I can't see anything wrong with it....

[if not true then false]

Thanks but what is the typo? I can't see anything wrong with it....

It didn't put it in the quote for some reason.

[SIM-2015410]

Oh I see, but i cant edit the thread anymore...

[Meeko420]

man ... wheres the rest of the tutorial...i was all excited because i thaught i was gonna be able to use the exploits...damn😵😵😵