All about Metasploit

What is Metasploit ?   This is just a exploit framework which have many many modules that can be used for exploitation, pivoting,scanning, etc etc   What is Meterpreter ? This is the feature of metasploit, it's have payload that offers a shell connection on the victim's computer but with extra features   Approach Privilege Escalation in windows/Linux ⇒   goal is -> to become super admin of system , so from restricted/low shell to administrator/high shell For Linux we check for :-> Kernel exploits Programs running as root Installed software Weak/reused/plaintext passwords Inside service Suid misconfiguration Abusing sudo-rights World writable scripts invoked by root Bad path configuration Cronjobs Unmounted filesystems For windows  we check for -> First is checking software version 2nd checking for their network [domain or workgroup] Checking for Active Directory related things Checking for their SMB,Kerberos, their SAM etc etc Finding files Checking registry Checking what services available Trying to run some exploits like hotpotato etc What is Pivoting ?   In simple words, when you gain command execution on one box, then you can try pivot on that box to explore the networks from same box which can lead to give you access to additional areas of network   So , you actually try to gain into the internal network access   EXAMPLE ⇒   Suppose you gain the shell on victim machine which having ip like -> 192.168.1.12   After checking their network you see there is another network range is open like 10.10.10.2,   so just checking the whole network of 10.10.10.x and if you got the one ip range is open then you try to pivoting that network[10.10.10.3 suppose open] using 192.168.1.12 because directly 10.10.10.3 network is not accessible from your own network[hackers], so we now use pivoting technique     Steps for stack based buffer overflow →   Here are the steps ->   First fuzzing service's parameter and the locate EIP Then finding bad characters Then finding return address and exploitation   Limited shell to full root shell ⇒ [Mean from Restricted Shell to Full Root Shell]   Common Restricted Shell ⇒ rbash, rzsh, rksh   Step 1 ⇒ Gathering Environment Information Check available commands either by trying them out by hand, hitting TAB key twice or listing files and directories Check for commands configured with SUID permissions, specially if they are owned by root user. Check the list of commands you can use with sudo. This will let us execute commands with other user’s permissions by using our own password. Check what languages are at your disposal, such as python, expect, perl, ruby, etc Check if redirect operators are available, such as '|' (pipe), “>”, “>>”, “<” Check for escape characters and execution tags such as: “;” (colon), “&” (background support), “’” (single quotes), “” (double-quotes), “$(“ (shell execution tag), “${“ Step 2 ⇒ Common Initial Techniques Console Editors ⇒ ed,ne,nano,pico,vim ⇒ we can try ⇒ in vim ⇒ :set shell=/bin/bash :shell :!/bin/bash Pager Commands ⇒ more or less man and pinfo Commands find command nmap command Step 3 ⇒ Programming Techniques awk, expect, python, ruby, perl, php In these above techniques , we need to use shell things and other techniques to get root shell

To Your Success, ~meetcipher