How to Use the overflow toolkit metasploit

Metasploit is a good thing. I can't think of any other way. Maybe it can help you. metasploit contains a lot of Exploit. I can't say I can use a few more computers to create a few bots.

Download metasploit and double-click it to install it. It is very simple. Just press Enter. After installation, check msfconsole. BAT and msfweb. bat in the installation directory. The first is the console under the command. The second is the program under the graphic interface. Now let's take a look at how to use the command line. After running the command, we will see the welcome interface of metasploit and enter "?". View help,
1

Let's explain a lot of commands.

"?" Help

"Cd": this command is familiar to everyone. Just like win, switch the directory.

"Exit" indicates exit.

"Info" displays the current program information

"Quit" to exit the program

"Reload" to load exploit and payloads

Save settings

"Setg" sets an environment variable

"Show" displays the currently available Exploit

"Use" select an exp

"Version" displays the program version

So many commands seem to be a bit dizzy. Actually, the three commands "show" "info" "use" are used. Let's see how they are used.

This program is a big toolkit, integrated with N multiple exploit, we can use show exploits to see which exploit programs are available, 2

See it? If you want to use so many overflow programs, you can use them all day long. How can we use so many things ?? For example, if you want to use an overflow program, you must first read its help to learn how to use it. This requires the info command. This command displays the detailed information of the overflow program. For example, if you want to see the usage of the overflow program iis50_webdav_ntdll, enter info exploit iis50_webdav_ntdll on the command line and you will see Figure 3.

Here we only view the exploit information. We can also view the shellcode information. In this toolkit, you can define the desired shellcode. Enter "show payloads" in the command line to see the list of available shellcodes. 4, the name on the left and the description on the right. We can use the info command to view the specific information of shellcode, and enter the command info payload cmd_generic5
Note that only required and options are available. Here, required indicates that the required options indicates that the options are optional and the shellcode for Linux systems is started with Linux, starting with cmd and win is for all win systems. In the overflow process, You must select the corresponding shellcode to succeed.

Now let's take a look at the actual situation. Let's take the WebDAV overflow program as an example. input use iis50_webdav_ntdll in the command, and then enter show options to view the content to be entered, 6. Then, enter SET rHost 192.168.1.223 set rHost 80 7 in the command line. Specify shellcode and enter the following command: after set payload winexec is finished, press enter and then enter SET cmd net user hack520/Add 8. Now we can attack 192.168.1.223. Enter show targets to see the operating system code, we all know that WebDAV is applicable to the 2000 system. If set targets 0 9 is input, you can enter exploit. If the other server has this vulnerability, it will get shell metasploit download: http://www.metasploit.com/tools/framework-2.7.exe
Http://www.securitycode.cn/framework-3.0.exe
Use metasploit in Gui
The usage of metasploit GUI is not much different from that of command line, except that the operation method is different: Find msfweb in the installation directory of metasploit. double-click the BAT file to run it. After a while, the program prompts that the execution is successful, as shown in 10:

Figure 10

Open IE and enter http: // 127.0.0.1: 55555 in the address bar. Then, the IE window shown in Figure 11 is displayed:

Figure 11

Click the left mouse button on the overflow toolkit to enter the Basic settings window. We still use iis50_webdav_ntdll as an example, as shown in 12:

Figure 12

Click Select payload to go to the payload selection page, as shown in Figure 13:

Figure 13

Select the appropriate payload to go to the basic information setting page, as shown in figure 14:

Figure 14

The settings here are basically the same as those described in the command line. After setting them, you can click vulnerability check to check whether the target system has any vulnerabilities or click launch exploit to launch attacks!

From the above operations, we can see that metasploit is very simple to use and has powerful functions. It is a very practical tool for our daily penetration. Of course, you may not be satisfied with these overflow tools that come with the software. You can add any overflow toolkit that you think is useful to you. I believe that with your efforts, this Toolkit can be improved! Original article address: Workshop. But the above may be just the tip of the iceberg, at least: the code in the http://www.honkwin.com/show/1606.html seems to be using metasploit.