网络空间安全之一个WH的超前沿全栈技术深入学习之路(13-1）白帽必经之路——Metasploit 渗透测试框架

msfadmin@metasploitable:~$ sudo passwd root
[sudo] password for msfadmin:msfadmin #注：需要提权输入 msfadmin 用户的密码

Enter new UNIX password: 123456
Retype new UNIX password: 123456
passwd: password updated successfully

msfadmin@metasploitable:~$ su root
Password:123456

root@metasploitable:/home/msfadmin# vim /etc/network/interfaces #修改 eth0 配置
如下
auto eth0
iface eth0 inet static
address 192.168.1.180
netmask 255.255.255.0
gateway 192.168.1.1
：wq 保存退出
root@metasploitable:/home/msfadmin# /etc/init.d/networking restart
* Reconfiguring network interfaces...
root@metasploitable:/home/msfadmin# ifconfig

root@xuegod53:~# systemctl start postgresql
root@xuegod53:~# systemctl enable postgresql #设置成开机启动数据库，我们要经常用

┌──(root㉿kali-2024)-[/home/ljs/Desktop]
└─# msfconsole                       
Metasploit tip: Use the resource command to run commands from a file
                                                  

      .:okOOOkdc'           'cdkOOOko:.
    .xOOOOOOOOOOOOc       cOOOOOOOOOOOOx.
   :OOOOOOOOOOOOOOOk,   ,kOOOOOOOOOOOOOOO:
  'OOOOOOOOOkkkkOOOOO: :OOOOOOOOOOOOOOOOOO'
  oOOOOOOOO.    .oOOOOoOOOOl.    ,OOOOOOOOo
  dOOOOOOOO.      .cOOOOOc.      ,OOOOOOOOx
  lOOOOOOOO.         ;d;         ,OOOOOOOOl
  .OOOOOOOO.   .;           ;    ,OOOOOOOO.
   cOOOOOOO.   .OOc.     'oOO.   ,OOOOOOOc
    oOOOOOO.   .OOOO.   :OOOO.   ,OOOOOOo
     lOOOOO.   .OOOO.   :OOOO.   ,OOOOOl
      ;OOOO'   .OOOO.   :OOOO.   ;OOOO;
       .dOOo   .OOOOocccxOOOO.   xOOd.
         ,kOl  .OOOOOOOOOOOOO. .dOk,
           :kk;.OOOOOOOOOOOOO.cOk:
             ;kOOOOOOOOOOOOOOOk:
               ,xOOOOOOOOOOOx,
                 .lOOOOOOOl.
                    ,dOd,
                      .                                                      

       =[ metasploit v6.3.55-dev                          ]
+ -- --=[ 2397 exploits - 1232 auxiliary - 422 post       ]
+ -- --=[ 1391 payloads - 46 encoders - 11 nops           ]
+ -- --=[ 9 evasion                                       ]

Metasploit Documentation: https://docs.metasploit.com/

msf6 > help 

msf6 > help                                                                            
                                                                                       
Core Commands                                                                          
=============                                                                          
                                                                                       
    Command       Description                                                          
    -------       -----------                                                          
    ?             Help menu                                                            
    banner        Display an awesome metasploit banner                                 
    cd            Change the current working directory                                 
    color         Toggle color                                                         
    connect       Communicate with a host                                              
    debug         Display information useful for debugging                             
    exit          Exit the console                                                     
    features      Display the list of not yet released features that can be opted in to    
    get           Gets the value of a context-specific variable                            
    getg          Gets the value of a global variable                                      
    grep          Grep the output of another command                                       
    help          Help menu                                                                
    history       Show command history                                                     
    load          Load a framework plugin
    quit          Exit the console
    repeat        Repeat a list of commands
    route         Route traffic through a session
    save          Saves the active datastores
    sessions      Dump session listings and display information about sessions
    set           Sets a context-specific variable to a value
    setg          Sets a global variable to a value
    sleep         Do nothing for the specified number of seconds
    spool         Write console output into a file as well the screen
    threads       View and manipulate background threads
    tips          Show a list of useful productivity tips
    unload        Unload a framework plugin
    unset         Unsets one or more context-specific variables
    unsetg        Unsets one or more global variables
    version       Show the framework and console library version numbers


Module Commands
===============

    Command       Description
    -------       -----------
    advanced      Displays advanced options for one or more modules
    back          Move back from the current context
    clearm        Clear the module stack
    favorite      Add module(s) to the list of favorite modules
    favorites     Print the list of favorite modules (alias for `show favorites`)
    info          Displays information about one or more modules
    listm         List the module stack
    loadpath      Searches for and loads modules from a path
    options       Displays global options or for one or more modules
    popm          Pops the latest module off the stack and makes it active
    previous      Sets the previously loaded module as the current module
    pushm         Pushes the active or list of modules onto the module stack
    reload_all    Reloads all modules from all defined module paths
    search        Searches module names and descriptions
    show          Displays modules of a given type, or all modules
    use           Interact with a module by name or search term/index


Job Commands
============

    Command       Description
    -------       -----------
    handler       Start a payload handler as job
    jobs          Displays and manages jobs
    kill          Kill a job
    rename_job    Rename a job


Resource Script Commands
========================

    Command       Description
    -------       -----------
    makerc        Save commands entered since start to a file
    resource      Run the commands stored in a file


Database Backend Commands
=========================

    Command       Description
    -------       -----------
    analyze       Analyze database information about a specific address or address range
    db_connect    Connect to an existing data service
    db_disconnec  Disconnect from the current data service
    t
    db_export     Export a file containing the contents of the database
    db_import     Import a scan result file (filetype will be auto-detected)
    db_nmap       Executes nmap and records the output automatically
    db_rebuild_c  Rebuilds the database-stored module cache (deprecated)
    ache
    db_remove     Remove the saved data service entry
    db_save       Save the current data service connection as the default to reconnect on
                   startup
    db_stats      Show statistics for the database
    db_status     Show the current data service status
    hosts         List all hosts in the database
    klist         List Kerberos tickets in the database
    loot          List all loot in the database
    notes         List all notes in the database
    services      List all services in the database
    vulns         List all vulnerabilities in the database
    workspace     Switch between database workspaces


Credentials Backend Commands
============================

    Command       Description
    -------       -----------
    creds         List all credentials in the database


Developer Commands
==================

    Command       Description
    -------       -----------
    edit          Edit the current module or a file with the preferred editor
    irb           Open an interactive Ruby shell in the current context
    log           Display framework.log paged to the end if possible
    pry           Open the Pry debugger on the current module or Framework
    reload_lib    Reload Ruby library files from specified paths
    time          Time how long it takes to run a particular command


msfconsole
==========

`msfconsole` is the primary interface to Metasploit Framework. There is quite a
lot that needs go here, please be patient and keep an eye on this space!

Building ranges and lists
-------------------------

Many commands and options that take a list of things can use ranges to avoid
having to manually list each desired thing. All ranges are inclusive.

### Ranges of IDs

Commands that take a list of IDs can use ranges to help. Individual IDs must be
separated by a `,` (no space allowed) and ranges can be expressed with either
`-` or `..`.

### Ranges of IPs

There are several ways to specify ranges of IP addresses that can be mixed
together. The first way is a list of IPs separated by just a ` ` (ASCII space),
with an optional `,`. The next way is two complete IP addresses in the form of
`BEGINNING_ADDRESS-END_ADDRESS` like `127.0.1.44-127.0.2.33`. CIDR
specifications may also be used, however the whole address must be given to
Metasploit like `127.0.0.0/8` and not `127/8`, contrary to the RFC.
Additionally, a netmask can be used in conjunction with a domain name to
dynamically resolve which block to target. All these methods work for both IPv4
and IPv6 addresses. IPv4 addresses can also be specified with special octet
ranges from the [NMAP target
specification](https://nmap.org/book/man-target-specification.html)

### Examples

Terminate the first sessions:

    sessions -k 1

Stop some extra running jobs:

    jobs -k 2-6,7,8,11..15

Check a set of IP addresses:

    check 127.168.0.0/16, 127.0.0-2.1-4,15 127.0.0.255

Target a set of IPv6 hosts:

    set RHOSTS fe80::3990:0000/110, ::1-::f0f0

Target a block from a resolved domain name:

    set RHOSTS www.example.test/24
msf6 > 

msf6 > connect 
Usage: connect [options] <host> <port>

Communicate with a host, similar to interacting via netcat, taking advantage of
any configured session pivoting.

OPTIONS:

    -c, --comm <comm>               Specify which Comm to use.
    -C, --crlf                      Try to use CRLF for EOL sequence.
    -h, --help                      Help banner.
    -i, --send-contents <file>      Send the contents of a file.
    -p, --proxies <proxies>         List of proxies to use.
    -P, --source-port <port>        Specify source port.
    -S, --source-address <address>  Specify source address.
    -s, --ssl                       Connect with SSL.
    -u, --udp                       Switch to a UDP socket.
    -w, --timeout <seconds>         Specify connect timeout.
    -z, --try-connection            Just try to connect, then return.
msf6 > 

msf6 > connect  www.huawei.com 80   #连接上后在另一行，直接输入 get /
[*] Connected to www.huawei.com:80 (via: 192.168.79.135:33673)



/get   #提交一个 get 请求，可以查看到服务器版本号
HTTP/1.1 400 Bad Request
Server: openresty
Date: Wed, 27 Nov 2024 14:17:46 GMT
Content-Type: text/html
Content-Length: 154
Connection: close

<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>openresty</center>
</body>
</html>
msf6 > 

msf6 > show exploits   #列出 metasploit 框架中的所有渗透攻击模块。该命令列出数据较多，较为耗费时间。

msf6 > show payloads 

msf6 > show auxiliary 

msf6 > show auxiliary 

Usage: search [ options ] <keywords> #search 后主要加选项和关键字

msf6 > search  mysql

msf6 > search  ms08_067

Search Keywords 参数：关键字

msf6 > search path:mysql

msf6 > search platform:mysql