> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/the-metasploit-framework-msf/metasploit/metasploit-framework-overview.md). # Metasploit Framework Overview ### The Metasploit Framework (MSF) * The Metasploit Framework (MSF) is an open-source, robust penetration testing and exploitation framework that is used by penetration testers and security researchers worldwide. * It provides penetration testers with a robust infrasture required to automate every stage of penetration testing life cycle. * It is also used to develop and text exploits one of the world's largest database of public, tested exploits. * The Metasploit framework is designed to be modular, allowing for new functionality to be implemented with ease. Metasploit Framework source code is available on GitHub. **History of The Metasploit Framework** * Developed by HD Moore in 2003 * Originally developed in Perl * Rewritten in Ruby in 2007 * Acquired by Rapid7 in 2009 * Metasploit 5.0 released in 2019 * Metasploit 6.0 released in 2020 **Metasploit Editions** * Metasploit Pro (Commercial) * Metasploit Express (Commercial) * Metasploit Framework (Community) **Essential Terminology** * Interface - Methods of interacting with the Metasploit Framework. * Module - Pieces of code that perform a particular task, an example of a module is an exploit. * Vulnerability - Weakness or flaw in a computer system or network that can be exploited . * Exploit - Piece of code/module that is used to take advantage a vulnerability within a system, service or application. * Payload - Piece of code delivered to the target system by an exploit with the objective of executing arbitrary commands lor providing remote access to an attacker. * Listener - A utility that listens for an incoming from a target **Metasploit Framework Interface** The Metasploit framework console (MSFconsole) is an easy-to-use all in one interface that provides you with access to all the functionality of the Metasploit framework. * The Metasploit Framework Command Line Interface (MSFcli) is a command line utility that is used to faciitate the creation of automation scripts that utilize Metasploit modules. * It can be used to redirect output from other tools in msfcli and vice versa. Note" MSFcli was discontinued in 2015, however the same functionality can be leveraged through the MSFconsole. Metasploit Community Edition is a web based FUI front-end for the Metsaploit Framework that simplifies network discovery and vulnerability identification. **Armitage** * Armitage is a free java Based GUI front-end for the Metasploit Framework that simplifies network discovery, exploitation and post exploitation. *** ### Metasploit Framework Architecture

MSF Architecture

* A module in the context of MSF, is a piece of code that can be utilized by the MSF. * The MSF libraries facilitate the execution of modules without having to write the code necessary in order to execute them. **MSF Modules** 1. **Exploit** - A module that is used to take advantage of vulnerability and is typically paired with a payload. 2. **Payload** - Code that is delivered by MSF and remotely executed on the target after successful exploitation. An example of payload is a reverse shell that initiates a connection from the target system back to the attacker. 3. **Encode** - Used to encode payloads in order to avoid AV detection. For example, shikata\_ga\_nai is used to encode Windows payloads. 4. **NOPS** - Used to ensure that payloads sizes are consistent and ensure the stability of a payload when executed. 5. **Auxiliary** - A module that is used to perform additional functionality like port scanning and enumeration. **MSF Payload Types** When working with exploits, MSF provides you with two types of payloads that can be paired with an exploit: 1. **Non-Staged Payload** - Payload that is sent to the target system as is along with the exploit. 2. **Staged Payload** - A staged payload is sent to the target in two parts, whereby: * The first part (stager) contains a payload that is used to establish a reverse connection back to the attacker, download the second part of the payload (stage) and execute it. **Stager & Stages** * **Stagers** - Stagers are typically used to establish a stable communication channel between the attacker and target, after which a stage payload is downloaded and executed on the target system. * **Stage** - Payload components that are downloaded by the stager. **Meterpreter Payload** The Meterpreter (Meta-Interpreter) payload is an advanced multi-functional payload that is executed in memory on the target system making it difficult to detect. It communicates over a stager socket and provides an attacker with an interactive command interpreter on the target system that facilitates the execution of system commands, file system navigation, keylogging and much more. **MSF File System Structure** The MSF file system is organized in a simple and easy to understand format and is organized into various directories.
**MSF Module Locations** * MSF stores modules under the following directory on Linux systems: > /usr/share/metasploit-framework/modules * User specified modules are stored under the following directory on Linux systems: > \~/.ms4/modules **DEMO** ``` cd /usr/share/metasploit-framework/modules ``` *** ### Penetration Testing with The Metasploit Framework * The MSF can used to perform and automate various tasks that fall under the penetration testing life cycle. * In order to understand how we can leverage the MSF for penetration testing, we need to explore the various phases of a penetration test and their respective techniques and objectives. * We can adopt the PTES (Penetration Testing Execution Standard) as a roadmap to understanding the various phases that make up a penetration test and how Metasploit can be integrated in to each phase. **Penetration Testing Execution Standard** The Penetration Testing Execution Standard (PTES) is a penetration testing methodology that was developed by a team of information security practitioners with the aim of addressing the need for a comprehensive and up-to-date standard for penetration testing. PTES Phases
*Note: Clearing Tracks involves clearing Windows Event Logs or on Linux clearing the Bash History file and etc.*