Metasploit windows

In this article we will be going through on How to install the Metasploit Framework on windows and as an added bonus there will be a guide on How to install the Metasploit Framework on Linux as well but before diving in on the process let’s talk about what is Metasploit?Metasploit-LogoCybercriminals and ethical hackers can both use the sophisticated Metasploit framework to scan servers and networks for systemic weaknesses. It may be used with most operating systems and is highly customizable because it is an open-source framework. The pen testing team can employ ready-made or bespoke code with Metasploit to introduce it into a network and probe for vulnerabilities. Once faults are discovered and recorded, a different variation of threat hunting can be used to prioritize fixes and address systemic issues.Now without wasting anytime let us go through the process on How to install the Metasploit Framework on Windows first, then we will move on to the process on How to install the Metasploit Framework on Linux. installing the Metasploit Framework on windows Prerequisites Installation ProcessDownloading the Metasploit FrameworkInstallation ProcessSteps for Installationinstall the Metasploit Framework On LinuxIn order to install Metasploit Framework on Windows there are few prerequisites that need to be done which will ensure smooth and hassle free installation. Prerequisites If the requirement are not met before downloading the Metasploit Framework, you may face the issue shown in the image above. So to dodge the issue follow the following steps:As shown in the images above we need to turn off the Windows security off as the Metasploit Framework is seen as a threat by the Windows Security System. Follow the steps below which will make sure you done face any errors during the installation.Go to Control Panel\System and Security\Windows Defender Firewall\Customize SettingsTurn offGo to Windows Defender > Virus & Threat Protection and under manage settings turn off all the available options. Although it’s enough if we just turn off Real Time Protection but let’s just turn off all the options just to ensure smooth installation.Installation ProcessOk now that we have all the firewall and protection turned off we can finally move on to the installation process.Downloading the Metasploit FrameworkGo to the version you want to install or simply download the latest release from the list.Wait for the download to complete, the downloaded file will be .msi which is a executable file format for the Windows OSInstallation ProcessSetup GuideLicense

AgreementSelect the installation driveInstallation ProcessWaiting InstallingInstallation CompletedSteps for InstallationRun the .msi file that you have downloaded. To run the file double click the file or right click on it and click run as administrator.You will see a Welcome Page, Click next.Read the license agreement and accept it then click Next.Then select the installation drive, we recommend leaving it C:/ as the default. Click NextClick Install. Wait for the installation to be completed then click finish.That’s it the installation process is completed. But wait we are not done yet.Adding to Metasploit to exclusionsTo make sure that you don’t face error in the future we recommended adding the installation folder to the exclusions, this will exclude Microsoft Defender Antivirus from scanning the folder and marking it as a threat. That’s all there is on How to install the Metasploit Framework on Windows. To run the Metasploit Framework go to the installation folder then go to “bin” folder and type “./msfconsole.bat”. If you have followed the steps as shown open a PowerShell then type C:\metasploit-framework\bin./msfconsole.batRunning the Metasploit FrameworkWell now that we have finished with the installation of Metasploit Framework on Windows, as promised now we will see How to install the Metasploit Framework on Linux. So let’s just dive right in.install the Metasploit Framework On LinuxUnlike on Windows the installation process on Linux is pretty straight forward. Here is the step by step guide.Open a terminal then enter the following command (Use sudo if required)curl > msfinstallchmod +x msfinstall./msfinstallAfter installation has been completed use “msfconsole” to run the Metasploit FrameworkDownloading the Metasploit FrameworkStarting the Metasploit FrameworkUpdate Metasploit FrameworkSearch for Module

Were able to compromise and control a Windows 7 system using the infamous and notorious EternalBlue exploit. In the remaining 25 chapters of this book, we will build upon this foundation of knowledge and show you how to compromise systems through a variety of exploits and attacks as well as what you can do after you have exploited the system (post-exploitation), such as taking web cam snapshots, streaming video, recording from the systems microphone, capturing credential and many more. Exercises 1. Compromise a Windows 7 system with the EternalBlue exploit 2. Enter “sysinfo” to confirm you are in the Windows 7 system 3. Enter ifconfig to confirm you are in the Windows 7 system 4. Review the meaning and functionality of the following commands in Metasploit a. set b. exploit c. show d. search e. info 5. Review the meaning of RHOSTS and LHOST2627 Section 2: Under the Hood In this section of “Metasploit Basics for Hackers,” we will look under the hood of Metasploit to expand your understanding of this powerful tool. We will examine the directory structure underlying Metasploit to aid your understanding of how Metasploit is structured. This is intended to help you understand where the tools you need are located and where to place new modules. In addition, we take a deep dive into the Payloads modules of Metasploit, a subject ignored by most other books covering this subject. Then we will set up the Metasploit database in postgresql, a key tool for tracking and automating your pentest. Finally, we will examine Armitage, an easy-to-use GUI for using Metasploit28 Chapter 3 Under the Hood of Metasploit In Chapter 2, I introduced you to some of the key commands in Metasploit and walked you through your first successful exploit of a target operating system. In this chapter, I want to take a look “under the hood” of Metasploit to provide you with a more thorough understanding of this key hacking/pentesting tool. When you start Metasploit into the msfconsole, you are greeted by an opening splash screen similar to that below. Notice near the bottom of the screen that the interactive console opens with a msf > and slightly above there, Metasploit lists the number of modules by type. Metasploit has seven (7) types of modules. These are; (1) exploits (2) payloads29 (3) auxiliary (4) encoders (5) post (6) nops (7) evasion (new in Metasploit 5) We will examine each of these types of modules so that we might better utilize them in our Metasploit pentesting/hacking. Metasploit Inner Architecture The better you understand Metasploit, the more productive you will be with it. Although it is really unnecessary to understand the inner architecture of this powerful tool to get

Isn't necessary, and Metasploit is perfectly functional without it. When the setup is complete, you'll see a message reading, "Metasploit Framework Initial Setup Complete". Once the Metasploit framework is up and running, you'll find yourself in the Metasploit console, and have a new command prompt, which, depending on the version you're using, will be "msf6", "msf7", or similar. If you've never used Metasploit before, you'll want to input: help ...to see all the commands available to you. Metasploit is a framework for tools, and to use a particular tool, you need to employ the "use" command. If for some reason, you want to deploy a payload through the AOL browser onto a Windows XP system, you would run: use /exploit/windows/browser/aol_ampx_convertfile When the module is loaded, type the following to get information and options for the tool: show Metasploit is a tool that you can use for good and evil purposes. We shouldn't need to remind you that accessing computer systems without authorization is a crime in most of the world, and you can end up in jail for a very long time. On the other hand, if you're exploring Metasploit as preparation for a career in cybersecurity, consider supplementing your independent learning with an online course.

The commands we want in the script, we simply use the keyword makerc followed by the name of the script. For instance, here, I named the script handler_http.rc (a multi/handler for HTTP followed by the Metasploit extension for resource files, rc). msf 5> makerc handler_http.rc Metasploit now saves each of those commands into that script file.41 Checking the Script Contents If we want to see want commands are in a script file, we can use one of the many commands in Linux to display the contents of a file, such as cat, less, and more. Here, I used more followed by the resource file name. msf 5> more handler_http.rc Notice that Metasploit now displays the commands in my script file, handler_http.rc. Executing Our New Script File When we want to execute this script, we simply precede the script name with the keyword resource such as: msf5 > resource handler_http.rc42 Metasploit will now run each of the commands in our script automatically. Now simply enter “exploit” to start our handler. msf5 > exploit Checking Whether It Was Saved If we go back to the location where the scripts are stored, we can see that our new script, handler_http.rc, is now stored with the other Metasploit prepackaged scripts.43 Starting the Script Automatically with Metasploit If we know before starting Metasploit that we will be using a particular script, we can have Metasploit automatically execute the script upon starting. We do this by starting Metasploit with the msfconsole command, the -r switch, and followed by the name of the resource file we want to execute upon opening, such as: kali > msfconsole -r handler_http.rc44 Now, when Metasploit starts, it will automatically execute the handler_http.rc script, and you are ready to go.45 Chapter 5 Payloads Metasploit enables us to use pre-written exploits against known vulnerabilities in operating systems, browsers, and other applications and place a rootkit/listener/payload on the target system. These payloads are what enable us to connect to the victim system and use it as our own after we have exploited a vulnerability in its system. In this tutorial, we will look exclusively at the payloads built into Metasploit. Metasploit has many types of payloads we can leave on the target system. In Chapter 2, we used the powerful windows/meterpreter/reverse_tcp payload to own the Windows 7 system. This is among the most common and stable payloads in the Metasploit arsenal. In this chapter, we will look at such things as how the payloads work, how Metasploit categorizes the payloads, and what the types of payloads are. I hope this understanding will help you to wisely choose the appropriate payload for your hack. Let's take a closer look at these payloads in Metasploit. Open

Auxiliary (4) nops15 (5) post (6) encoders (7) evasion (new in Metasploit5) A word about terminology before we start. In Metasploit terminology, an exploit is a module that takes advantage of a system or application vulnerability. It usually will attempt to place a payload on the system. This payload can be a simple command shell or the all-powerful Meterpreter. In other environments, these payloads might be termed listeners or rootkits. You can read more about the different types of payloads in Chapter 3, Metasploit Payloads Let's take a look at some of those keyword commands. We can get a list of commands by entering help at the metasploit (msf5>) prompt. msf5 > help Metasploit displays multiple panels of help. In the above screenshot, you see the “core” commands, and in the screenshot below, the module commands. In addition, you should see “Job commands, Resource Script Commands, Database Backend Commands, Credential Backend commands Developer commands, 16 and then some verbiage about the msfconsole. For now, we will focus on just the Core and Module commands. Note that we can access this same help menu with the "?" as well as "help." You can access a majority of the functionality of Metasploit by learning just a few key commands, namely; 1. search 2. use 3. show 4. set 5. info 6. exploit 7. options 8. exit 9. sessions The search command Let’s assume you were looking to exploit a Windows 7 system with the notorious EternalBlue exploit (for more on the EternalBlue exploit developed by the US NSA and stolen and released by the ShadowBrokers and utilized in multiple ransomware attacks, see my book “Getting Started Becoming a Master Hacker” in the History of Hacking section in Chapter 1); you would first do a search for the Metasploit exploit module. 17 Metasploit has a rudimentary search function that enables you to search by keyword, type of module, and the platform (roughly, a synonym for operating system with a few exceptions, as we will see)it is applicable to. For instance, to find all modules with the keyword “eternalblue” in them, you can simply enter; msf5> search eternalblue Metasploit then displays all the modules containing that keyword with the keyword highlighted (the highlighting is a new feature in Metasploit 5). Note that there are several modules containing the keyword “eternalblue.” Here we are looking for the “exploit” that works against Windows platforms, so we can refine our search by adding the platform and module type criteria, such as; msf5 > search platform:windows type:exploit eternalblue As you can see, our search results have been refined to only displaying exploit modules that work against windows operating systems and contain the keyword “eternalblue.” The first one, exploit/windows/smb/ms17_0101_eternalblue,