Msfconsole

@ Zhang zhiyang · Monday, Jan 1, 0001 · 3 minute read · Update at Monday, Jan 1, 0001

0x00 Introduction

location

• /usr/share/metasploit-framework/

interface

• msfconsole： 终端接口，非常常用，几乎能处理所有事情
• msfvenom： payload生成接口，用来生成木马,反弹shell
• msfcil： 命令行接口，已删除，通过msfconsole -x调用
• armitage： 图形化界面接口，使用前需启动数据库(systemctl start postgresql)

moudle

0x01 Database

postgresql

psql是msf框架的默认数据库，默认库名为msf，(配置文件：/etc/postgresql/11/main/pstgresql)

root@kali:~# service postgresql start    //启动postgresql
root@kali:~# service postgresql status   //检查状态
● postgresql.service - PostgreSQL RDBMS
   Loaded: loaded (/lib/systemd/system/postgresql.service; disabled; vendor pres
   Active: active (exited) since Thu 2020-03-19 11:40:37 CST; 1h 31min ago
  Process: 1546 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 1546 (code=exited, status=0/SUCCESS)

3月 19 11:40:37 kali systemd[1]: Starting PostgreSQL RDBMS...
3月 19 11:40:37 kali systemd[1]: Started PostgreSQL RDBMS.
root@kali:~# 
root@kali:~# sudo -u postgres psql      //赋予postgres用户root权限并执行psql
psql (11.5 (Debian 11.5-1))             //进入数据库
输入 "help" 来获取帮助信息.

postgres=# alter user postgres password '123456'  //更改密码为123456
postgres-# \q                           //退出

msfdb

0x02 msfconsole

elementary command

• help/?： 显示msfconsole可以使用的命令及用法
• connect：msf中的nc命令
• set|unset：设置|取消参数
• save：保存设置参数
• check：检查目标是否存在漏洞
• run/exploit(-j)：开始使用模块
• sessions(-i id)：查看当前已经建立的sessions(shell)
• load|unload：调用外部的扫描器
• back|exit：回到|退出msfconsole
• info：查看模块的信息

msf5 > info exploit/windows/smb/ms08_067_netapi

• use：使用模块

msf5 > use exploit/windows/smb/ms08_067_netapi

• search：查找模块具体位置，可指定关键字(name,path,author…)

msf5 > search name:mysql

Matching Modules
================

   #   Name                                               Disclosure Date  Rank       Check  Description
   -   ----                                               ---------------  ----       -----  -----------
   0   auxiliary/admin/mysql/mysql_enum                                    normal     No     MySQL Enumeration Module
   1   auxiliary/admin/mysql/mysql_sql                                     normal     No     MySQL SQL Generic Query
   2   auxiliary/analyze/jtr_mysql_fast                                    normal     No     John the Ripper MySQL Password Cracker (Fast Mode)
   3   auxiliary/scanner/mysql/mysql_authbypass_hashdump  2012-06-09       normal     Yes    MySQL Authentication Bypass Password Dump
   4   auxiliary/scanner/mysql/mysql_file_enum                             normal     Yes    MYSQL File/Directory Enumerator
   5   auxiliary/scanner/mysql/mysql_hashdump                              normal     Yes    MYSQL Password Hashdump
   6   auxiliary/scanner/mysql/mysql_login                                 normal     Yes    MySQL Login Utility
   7   auxiliary/scanner/mysql/mysql_schemadump                            normal     Yes    MYSQL Schema Dump
   8   auxiliary/scanner/mysql/mysql_version                               normal     Yes    MySQL Server Version Enumeration
   9   auxiliary/scanner/mysql/mysql_writable_dirs                         normal     Yes    MYSQL Directory Write Test
   10  auxiliary/server/capture/mysql                                      normal     No     Authentication Capture: MySQL
   11  exploit/linux/mysql/mysql_yassl_getname            2010-01-25       good       No     MySQL yaSSL CertDecoder::GetName Buffer Overflow
   12  exploit/linux/mysql/mysql_yassl_hello              2008-01-04       good       No     MySQL yaSSL SSL Hello Message Buffer Overflow
   13  exploit/multi/mysql/mysql_udf_payload              2009-01-16       excellent  No     Oracle MySQL UDF Payload Execution
   14  exploit/windows/mysql/mysql_mof                    2012-12-01       excellent  Yes    Oracle MySQL for Microsoft Windows MOF Execution
   15  exploit/windows/mysql/mysql_start_up               2012-12-01       excellent  Yes    Oracle MySQL for Microsoft Windows FILE Privilege Abuse
   16  exploit/windows/mysql/mysql_yassl_hello            2008-01-04       average    No     MySQL yaSSL SSL Hello Message Buffer Overflow
   17  exploit/windows/mysql/scrutinizer_upload_exec      2012-07-27       excellent  Yes    Plixer Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential

database command

show command

0x02 Msfvenom