Many tutorials about Metasploit are available on internet (as well many books and trainings), but most of them confusing beginners. My intention with the following content is to create a simple environment (via Docker) and to show the use of this. In order not to make it too boring, I also show some important basics for Metasploit itself.
Objective
Learn how to create and use a simple training environment as well as learn first basic metasploit commands.
Precondition
Docker (latest) installed
Prepare environment
As mentioned already we will use Docker. The benefits here are this does not need installations and no local installed Anti-virus tool does disturb and complain.
# create working directory and change location
$ mkdir -p ~/Projects/Metasploit/msf && cd ~/Projects/Metasploit
# list directories/files (optional)
$ tree .
|__msf
# create network
$ docker network create --subnet=172.18.0.0/16 metasploit
# check created network (optional)
$ docker network ls --filter driver=bridge --no-trunc
# run postgres container
$ docker run -d --name postgres --ip 172.18.0.2 --network metasploit -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres -e POSTGRES_DB=msf -v "$(pwd)/msf/database:/var/lib/postgresql/data" postgres:11-alpine
# show logs (optional)
$ docker logs postgres
# run metasploit container
$ docker run --name metasploit --ip 172.18.0.3 --network metasploit -it -v "$(pwd)/msf/user:/home/msf/.msf4" -p 8443-8500:8443-8500 metasploitframework/metasploit-framework ./msfconsole
# list latest created containers (optional in different tty)
$ docker ps -n 2Connect database
In this environment we need to connect the Postgres database manually.
# check database status (optional)
msf5 > db_status
# connect (if broken)
msf5 > db_connect postgres:postgres@172.18.0.2:5432/msfPrepare Metasploit workspace
This is an very important step! It gets often forgotten in other tutorials. Without this steps you will have later many problems/confusions and may don’t understand why.
# list all workspaces
msf5 > workspace
# create new workspace
msf5 > workspace -a hackthissite.org
# list all hosts (optional)
msf5 > hosts
# list all services (optional)
msf5 > servicesSome scanner actions
As promised here some other basics.
# search for scanner with name:tcp
msf5 > search auxiliary name:tcp
# select tcp portscanner module
msf5 > use auxiliary/scanner/portscan/tcp
# show detailed information (optional)
msf5 auxiliary(scanner/portscan/tcp) > info
# show options
msf5 auxiliary(scanner/portscan/tcp) > options
# set needed values
msf5 auxiliary(scanner/portscan/tcp) > set RHOSTS hackthissite.org
msf5 auxiliary(scanner/portscan/tcp) > set PORTS 20-100
msf5 auxiliary(scanner/portscan/tcp) > set THREADS 6
# execute scan
msf5 auxiliary(scanner/portscan/tcp) > run
# move out of the current context
msf5 auxiliary(scanner/portscan/tcp) > back
# list all hosts
msf5 > hosts
# list all services
msf5 > servicesStop and restart the environment
# stop metasploit container
msf5 > exit
# stop postgres container
$ docker stop postgres
# check container status (optional)
$ docker ps -a# change directory (if not done already)
$ cd ~/Projects/Metasploit
# start postgres container (first)
$ docker start postgres
# start metasploit container
$ docker start metasploit
# run msfconsole (without banner)
$ docker exec -ti metasploit ./msfconsole -q
# connect to postgres (if broken)
msf5 > db_connect postgres:postgres@172.18.0.2:5432/msf
Connected to Postgres data service: 172.18.0.2/msf
# list workspaces
msf5 > workspace
hackthissite.org
* default
# select specific workspace
msf5 > workspace 'hackthissite.org'
[*] Workspace: hackthissite.orgNow you have everything you need for the next tutorials.
