Introduction
Metasploit is a platform for penetration testing which allows the penetration testers to search, exploit and validate vulnerabilities present in target systems. It consists of the required infrastructure, contents and tools to perform penetration tests necessary for exploiting vulnerabilities. It has many executable and ready to use modules which is updated consistently.
Lab / Exercise
Background
In this lab, we utilize Metasploit tool in our Kali Linux VM to penetrate and exploit vulnerabilities of a target system.
Procedure
Firstly, set up the two VMs which both runs Kali Linux. One of them is used to execute Metasploit, attacking the other VM which is the target. Set both settings of the VMs to NAT network. Then, run both VMs.
Run ifconfig command in the command line of both VMs to find the IP of each VM.
Attacker VM commands
Run msfconsole in the attacker VM and these results below will be shown
Run search shellshock to display the matching modules in which one of them will be used.
Next, run the following code which enters the target’s IP
Enter show payloads to show the available payloads shown below
Run the following code to set the payload which will be used, the target IP address, check its vulnerability status, and run the code. The reverse TCP payload will execute on the target system.
Enter the following code to find out if you have successfully entered or penetrated into the target system. It will show the target’s system name. After entering ifconfig, it will show that the attacker has successfully hacked into the target system as the IP shown is the attackers’ IP.
Conclusion
By utilizing the modules in Metasploit, it is very convenient and useful for penetration testers to exploit and validate vulnerabilities of a target system. Metasploit still consists of many other modules and contents to aid a penetration tester. Just by knowing the target’s IP address, many vulnerabilities can be scanned and validated, which helps in the next step of penetration testing, which is privilege escalation.
Ethical Hacking and Penetration Testing Journal 