Knowledge Hub

Metasploit

TryHackMe95 answered prompts

Metasploit TryHackMe walkthrough with 95 answered prompts and lab methodology notes.

Prompts and answers

  • We can start the Metasploit console on the command line without showing the banner or any startup information as well. What switch do we add to msfconsole to start it without showing this information? This will include the '**-**'
    -q
  • This will be shown in the connection status command output. Also, MSF5 only supports one type of database so you can also find this within the documentation on Rapid7's website.
    postgresql
  • msf6 > banner
    Neutrino_Cannon*PrettyBeefy*PostalTime*binbash*deadastronauts*EvilBunnyWrote*L1T*Mail.ru*() { :;}; echo vulnerable
  • *Neutrino_Cannon*PrettyBeefy*PostalTime*binbash*deadastronauts*EvilBunnyWrote*L1T*Mail.ru*() { :;}; echo vulnerable*
    Team sorceror*ADACTF*BisonSquad*socialdistancing*LeukeTeamNaam*OWASP Moncton*Alegori*exit*Vampire Bunnies*APT593
  • *Team sorceror*ADACTF*BisonSquad*socialdistancing*LeukeTeamNaam*OWASP Moncton*Alegori*exit*Vampire Bunnies*APT593*
    QuePasaZombiesAndFriends*NetSecBG*coincoin*ShroomZ*Slow Coders*Scavenger Security*Bruh*NoTeamName*Terminal Cult
  • *QuePasaZombiesAndFriends*NetSecBG*coincoin*ShroomZ*Slow Coders*Scavenger Security*Bruh*NoTeamName*Terminal Cult*
    edspiner*BFG*MagentaHats*0x01DA*Kaczuszki*AlphaPwners*FILAHA*Raffaela*HackSurYvette*outout*HackSouth*Corax*yeeb0iz
  • *edspiner*BFG*MagentaHats*0x01DA*Kaczuszki*AlphaPwners*FILAHA*Raffaela*HackSurYvette*outout*HackSouth*Corax*yeeb0iz*
    SKUA*Cyber COBRA*flaghunters*0xCD*AI Generated*CSEC*p3nnm3d*IFS*CTF_Circle*InnotecLabs*baadf00d*BitSwitchers*0xnoobs
  • *SKUA*Cyber COBRA*flaghunters*0xCD*AI Generated*CSEC*p3nnm3d*IFS*CTF_Circle*InnotecLabs*baadf00d*BitSwitchers*0xnoobs*
    ItPwns - Intergalactic Team of PWNers*PCCsquared*fr334aks*runCMD*0x194*Kapital Krakens*ReadyPlayer1337*Team 443
  • *ItPwns - Intergalactic Team of PWNers*PCCsquared*fr334aks*runCMD*0x194*Kapital Krakens*ReadyPlayer1337*Team 443*
    H4CKSN0W*InfOUsec*CTF Community*DCZia*NiceWay*0xBlueSky*ME3*Tipi'Hack*Porg Pwn Platoon*Hackerty*hackstreetboys
  • *H4CKSN0W*InfOUsec*CTF Community*DCZia*NiceWay*0xBlueSky*ME3*Tipi'Hack*Porg Pwn Platoon*Hackerty*hackstreetboys*
    ideaengine007*eggcellent*H4x*cw167*localhorst*Original Cyan Lonkero*Sad_Pandas*FalseFlag*OurHeartBleedsOrange*SBWASP
  • *ideaengine007*eggcellent*H4x*cw167*localhorst*Original Cyan Lonkero*Sad_Pandas*FalseFlag*OurHeartBleedsOrange*SBWASP*
    Cult of the Dead Turkey*doesthismatter*crayontheft*Cyber Mausoleum*scripterz*VetSec*norbot*Delta Squad Zero*Mukesh
  • *Cult of the Dead Turkey*doesthismatter*crayontheft*Cyber Mausoleum*scripterz*VetSec*norbot*Delta Squad Zero*Mukesh*
    x00-x00*BlackCat*ARESx*cxp*vaporsec*purplehax*RedTeam@MTU*UsalamaTeam*vitamink*RISC*forkbomb444*hownowbrowncow
  • *x00-x00*BlackCat*ARESx*cxp*vaporsec*purplehax*RedTeam@MTU*UsalamaTeam*vitamink*RISC*forkbomb444*hownowbrowncow*
    etherknot*cheesebaguette*downgrade*FR!3ND5*badfirmware*Cut3Dr4g0n*dc615*nora*Polaris One*team*hail hydra*Takoyaki
  • *etherknot*cheesebaguette*downgrade*FR!3ND5*badfirmware*Cut3Dr4g0n*dc615*nora*Polaris One*team*hail hydra*Takoyaki*
    Sudo Society*incognito-flash*TheScientists*Tea Party*Reapers of Pwnage*OldBoys*M0ul3Fr1t1B13r3*bearswithsaws*DC540
  • *Sudo Society*incognito-flash*TheScientists*Tea Party*Reapers of Pwnage*OldBoys*M0ul3Fr1t1B13r3*bearswithsaws*DC540*
    iMosuke*Infosec_zitro*CrackTheFlag*TheConquerors*Asur*4fun*Rogue-CTF*Cyber*TMHC*The_Pirhacks*btwIuseArch*MadDawgs
  • *iMosuke*Infosec_zitro*CrackTheFlag*TheConquerors*Asur*4fun*Rogue-CTF*Cyber*TMHC*The_Pirhacks*btwIuseArch*MadDawgs*
    HInc*The Pighty Mangolins*CCSF_RamSec*x4n0n*x0rc3r3rs*emehacr*Ph4n70m_R34p3r*humziq*Preeminence*UMGC*ByteBrigade
  • *HInc*The Pighty Mangolins*CCSF_RamSec*x4n0n*x0rc3r3rs*emehacr*Ph4n70m_R34p3r*humziq*Preeminence*UMGC*ByteBrigade*
    TeamFastMark*Towson-Cyberkatz*meow*xrzhev*PA Hackers*Kuolema*Nakateam*L0g!c B0mb*NOVA-InfoSec*teamstyle*Panic
  • *TeamFastMark*Towson-Cyberkatz*meow*xrzhev*PA Hackers*Kuolema*Nakateam*L0g!c B0mb*NOVA-InfoSec*teamstyle*Panic*
    B0NG0R3* *Les Cadets Rouges*buf
  • *B0NG0R3* *Les Cadets Rouges*buf*
    Les Tontons Fl4gueurs* *404 : Flag Not Found
  • *Les Tontons Fl4gueurs* *404 : Flag Not Found*
    ' UNION SELECT 'password* _________ __ *OCD247*Sparkle Pony
  • *' UNION SELECT 'password* _________ __ *OCD247*Sparkle Pony*
    burner_herz0g* \_ ___ \_____ _______/ |_ __ _________ ____ *Kill$hot*ConEmu
  • *burner_herz0g* \_ ___ \_____ _______/ |_ __ _________ ____ *Kill$hot*ConEmu*
    here_there_be_trolls* / \ \/\__ \ \____ \ __\ | \_ __ \_/ __ \ *;echo"hacked"
  • *here_there_be_trolls* / \ \/\__ \ \____ \ __\ | \_ __ \_/ __ \ *;echo"hacked"*
    r4t5_*6rung4nd4*NYUSEC* \ \____/ __ \| |_> > | | | /| | \/\ ___/ *karamel4e
  • *r4t5_*6rung4nd4*NYUSEC* \ \____/ __ \| |_> > | | | /| | \/\ ___/ *karamel4e*
    IkastenIO*TWC*balkansec* \______ (____ / __/|__| |____/ |__| \___ > *cybersecurity.li
  • *IkastenIO*TWC*balkansec* \______ (____ / __/|__| |____/ |__| \___ > *cybersecurity.li*
    TofuEelRoll*Trash Pandas* \/ \/|__| \/ *OneManArmy*cyb3r_w1z4rd5
  • *TofuEelRoll*Trash Pandas* \/ \/|__| \/ *OneManArmy*cyb3r_w1z4rd5*
    Astra*Got Schwartz?*tmux* ___________.__ *AreYouStuck*Mr.Robot.0
  • *Astra*Got Schwartz?*tmux* ___________.__ *AreYouStuck*Mr.Robot.0*
    \nls*Juicy white peach* \__ ___/| |__ ____ *EPITA Rennes
  • *\nls*Juicy white peach* \__ ___/| |__ ____ *EPITA Rennes*
    HackerKnights* | | | | \_/ __ \ *guildOfGengar*Titans
  • *HackerKnights* | | | | \_/ __ \ *guildOfGengar*Titans*
    Pentest Rangers* | | | Y \ ___/ *The Libbyrators
  • *Pentest Rangers* | | | Y \ ___/ *The Libbyrators*
    placeholder name*bitup* |____| |___| /\___ > *JeffTadashi*Mikeal
  • *placeholder name*bitup* |____| |___| /\___ > *JeffTadashi*Mikeal*
    UCASers*onotch* \/ \/ *ky_dong_day_song
  • *UCASers*onotch* \/ \/ *ky_dong_day_song*
    NeNiNuMmOk* ___________.__ *JustForFun!
  • *NeNiNuMmOk* ___________.__ *JustForFun!*
    Maux de tête*LalaNG* \_ _____/| | _____ ____ *g3tsh3Lls0on
  • *Maux de tête*LalaNG* \_ _____/| | _____ ____ *g3tsh3Lls0on*
    crr0tz*z3r0p0rn*clueless* | __) | | \__ \ / ___\ *Phở Đặc Biệt*Paradox
  • *crr0tz*z3r0p0rn*clueless* | __) | | \__ \ / ___\ *Phở Đặc Biệt*Paradox*
    HackWara* | \ | |__/ __ \_/ /_/ > *KaRIPux*inf0sec
  • *HackWara* | \ | |__/ __ \_/ /_/ > *KaRIPux*inf0sec*
    Kugelschreibertester* \___ / |____(____ /\___ / *bluehens*Antoine77
  • *Kugelschreibertester* \___ / |____(____ /\___ / *bluehens*Antoine77*
    icemasters* \/ \//_____/ *genxy*TRADE_NAMES
  • *icemasters* \/ \//_____/ *genxy*TRADE_NAMES*
    Spartan's Ravens* _______________ _______________ *BadByte*fontwang_tw
  • *Spartan's Ravens* _______________ _______________ *BadByte*fontwang_tw*
    g0ldd1gg3rs*pappo* \_____ \ _ \ \_____ \ _ \ *ghoti
  • *g0ldd1gg3rs*pappo* \_____ \ _ \ \_____ \ _ \ *ghoti*
    Les CRACKS*c0dingRabbits* / ____/ /_\ \ / ____/ /_\ \ *LinuxRiders
  • *Les CRACKS*c0dingRabbits* / ____/ /_\ \ / ____/ /_\ \ *LinuxRiders*
    2Cr4Sh*RecycleBin* / \ \_/ \/ \ \_/ \ *Jalan Durian
  • *2Cr4Sh*RecycleBin* / \ \_/ \/ \ \_/ \ *Jalan Durian*
    ExploitStudio* \_______ \_____ /\_______ \_____ / *WPICSC*logaritm
  • *ExploitStudio* \_______ \_____ /\_______ \_____ / *WPICSC*logaritm*
    Car RamRod*0x41414141* \/ \/ \/ \/ *Orv1ll3*team-fm4dd
  • *Car RamRod*0x41414141* \/ \/ \/ \/ *Orv1ll3*team-fm4dd*
    Björkson*FlyingCircus* *PwnHub*H4X0R*Yanee
  • *Björkson*FlyingCircus* *PwnHub*H4X0R*Yanee*
    Securifera*hot cocoa* *Et3rnal*PelarianCP
  • *Securifera*hot cocoa* *Et3rnal*PelarianCP*
    n00bytes*DNC&G*guildzero*dorko*tv*42*{EHF}*CarpeDien*Flamin-Go*BarryWhite*XUcyber*FernetInjection*DCcurity
  • *n00bytes*DNC&G*guildzero*dorko*tv*42*{EHF}*CarpeDien*Flamin-Go*BarryWhite*XUcyber*FernetInjection*DCcurity*
    Mars Explorer*ozen_cfw*Fat Boys*Simpatico*nzdjb*Isec-U.O*The Pomorians*T35H*H@wk33*JetJ*OrangeStar*Team Corgi
  • *Mars Explorer*ozen_cfw*Fat Boys*Simpatico*nzdjb*Isec-U.O*The Pomorians*T35H*H@wk33*JetJ*OrangeStar*Team Corgi*
    D0g3*0itch*OffRes*LegionOfRinf*UniWA*wgucoo*Pr0ph3t*L0ner*_n00bz*OSINT Punchers*Tinfoil Hats*Hava*Team Neu
  • *D0g3*0itch*OffRes*LegionOfRinf*UniWA*wgucoo*Pr0ph3t*L0ner*_n00bz*OSINT Punchers*Tinfoil Hats*Hava*Team Neu*
    Cyb3rDoctor*Techlock Inc*kinakomochi*DubbelDopper*bubbasnmp*w*Gh0st$*tyl3rsec*LUCKY_CLOVERS*ev4d3rx10-team*ir4n6
  • *Cyb3rDoctor*Techlock Inc*kinakomochi*DubbelDopper*bubbasnmp*w*Gh0st$*tyl3rsec*LUCKY_CLOVERS*ev4d3rx10-team*ir4n6*
    PEQUI_ctf*HKLBGD*L3o*5 bits short of a byte*UCM*ByteForc3*Death_Geass*Stryk3r*WooT*Raise The Black*CTErr0r
  • *PEQUI_ctf*HKLBGD*L3o*5 bits short of a byte*UCM*ByteForc3*Death_Geass*Stryk3r*WooT*Raise The Black*CTErr0r*
    Individual*mikejam*Flag Predator*klandes*_no_Skids*SQ.*CyberOWL*Ironhearts*Kizzle*gauti
  • *Individual*mikejam*Flag Predator*klandes*_no_Skids*SQ.*CyberOWL*Ironhearts*Kizzle*gauti*
    San Antonio College Cyber Rangers*sam.ninja*Akerbeltz*cheeseroyale*Ephyra*sard city*OrderingChaos*Pickle_Ricks
  • *San Antonio College Cyber Rangers*sam.ninja*Akerbeltz*cheeseroyale*Ephyra*sard city*OrderingChaos*Pickle_Ricks*
    Hex2Text*defiant*hefter*Flaggermeister*Oxford Brookes University*OD1E*noob_noob*Ferris Wheel*Ficus*ONO*jameless
  • *Hex2Text*defiant*hefter*Flaggermeister*Oxford Brookes University*OD1E*noob_noob*Ferris Wheel*Ficus*ONO*jameless*
    Log1c_b0mb*dr4k0t4*0th3rs*dcua*cccchhhh6819*Manzara's Magpies*pwn4lyfe*Droogy*Shrubhound Gang*ssociety*HackJWU
  • *Log1c_b0mb*dr4k0t4*0th3rs*dcua*cccchhhh6819*Manzara's Magpies*pwn4lyfe*Droogy*Shrubhound Gang*ssociety*HackJWU*
    asdfghjkl*n00bi3*i-cube warriors*WhateverThrone*Salvat0re*Chadsec*0x1337deadbeef*StarchThingIDK*Tieto_alaviiva_turva
  • *asdfghjkl*n00bi3*i-cube warriors*WhateverThrone*Salvat0re*Chadsec*0x1337deadbeef*StarchThingIDK*Tieto_alaviiva_turva*
    InspiV*RPCA Cyber Club*kurage0verfl0w*lammm*pelicans_for_freedom*switchteam*tim*departedcomputerchairs*cool_runnings
  • *InspiV*RPCA Cyber Club*kurage0verfl0w*lammm*pelicans_for_freedom*switchteam*tim*departedcomputerchairs*cool_runnings*
    chads*SecureShell*EetIetsHekken*CyberSquad*P&K*Trident*RedSeer*SOMA*EVM*BUckys_Angels*OrangeJuice*DemDirtyUserz
  • *chads*SecureShell*EetIetsHekken*CyberSquad*P&K*Trident*RedSeer*SOMA*EVM*BUckys_Angels*OrangeJuice*DemDirtyUserz*
    OpenToAll*Born2Hack*Bigglesworth*NIS*10Monkeys1Keyboard*TNGCrew*Cla55N0tF0und*exploits33kr*root_rulzz*InfosecIITG
  • *OpenToAll*Born2Hack*Bigglesworth*NIS*10Monkeys1Keyboard*TNGCrew*Cla55N0tF0und*exploits33kr*root_rulzz*InfosecIITG*
    superusers*H@rdT0R3m3b3r*operators*NULL*stuxCTF*mHackresciallo*Eclipse*Gingabeast*Hamad*Immortals*arasan*MouseTrap
  • *superusers*H@rdT0R3m3b3r*operators*NULL*stuxCTF*mHackresciallo*Eclipse*Gingabeast*Hamad*Immortals*arasan*MouseTrap*
    damn_sadboi*tadaaa*null2root*HowestCSP*fezfezf*LordVader*Fl@g_Hunt3rs*bluenet*P@Ge2mE
  • The help menu has a very short one-character alias, what is it?
    ?
  • Finding various modules we have at our disposal within Metasploit is one of the most common commands we will leverage in the framework. What is the base command we use for searching?
    search
  • Once we've found the module we want to leverage, what command we use to select it as the active module?
    use
  • How about if we want to view information about either a specific module or just the active one we have selected?
    info
  • Metasploit has a built-in netcat-like function where we can make a quick connection with a host simply to verify that we can 'talk' to it. What command is this?
    connect
  • The art we see at the start of of msfconsole is called a 'banner'
    banner
  • We'll revisit these next two commands shortly, however, they're two of the most used commands within Metasploit. First, what command do we use to change the value of a variable?
    set
  • Metasploit supports the use of global variables, something which is incredibly useful when you're specifically focusing on a single box. What command changes the value of a variable globally?
    setg
  • This has a global option similar to how set has set and setg
    get
  • This is also very similar to set
    unset
  • When performing a penetration test it's quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?
    spool
  • Leaving a Metasploit console running isn't always convenient and it can be helpful to have all of our previously set values load when starting up Metasploit. What command can we use to store the settings/active datastores from Metasploit to a settings file? This will save within your msf4 (or msf5) directory and can be undone easily by simply removing the created settings file.
    save
  • Easily the most common module utilized, which module holds all of the exploit code we will use?
    Exploit
  • Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation?
    Payload
  • Which module is most commonly used in scanning and verification machines are exploitable? This is not the same as the actual exploitation of course.
    Auxiliary
  • See my note below the image above
    Post
  • Commonly utilized in payload obfuscation, which module allows us to modify the 'appearance' of our exploit such that we may avoid signature detection?
    Encoder
  • Last but not least, which module is used with buffer overflow and ROP attacks?
    NOP
  • ```
    load
  • You might have to run the command 'services' to see the results of the scan again here.
    msrpc
  • Now that we've scanned our victim system, let's try connecting to it with a Metasploit payload. First, we'll have to search for the target payload. In Metasploit 5 (the most recent version at the time of writing) you can simply type `use` followed by a unique string found within only the target exploit. For example, try this out now with the following command `use icecast`. What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start
    exploit/windows/http/icecast_header
  • What is the name of the column on the far left side of the console that shows up next to 'Name'?
    #
  • I've included this example as the spool service is traditionally very stable and restarts pretty quickly in the case that we crash it.
    spoolsv.exe
  • Like birds, we've gotta migrate.
    migrate
  • Well that migration didn't work, let's find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?
    getuid
  • How about finding more information out about the system itself?
    sysinfo
  • The new version of mimikatz is referred to as 'kiwi' in metasploit.
    load kiwi
  • Let's go ahead and figure out the privileges of our current user, what command do we run?
    getprivs
  • What command do we run to transfer files to our victim computer?
    upload
  • Similar to how we ran the exploit previously
    run
  • There are two forms here, I'm looking for the option including the character 'p' and is otherwise a Windows command.
    ipconfig
  • One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?
    shell
  • Let's go ahead and run the command `run autoroute -h`, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: 172.18.1.0/24? Use the `-n` flag in your answer.
    run autoroute -s 172.18.1.0 -n 255.255.255.0
  • Additionally, we can start a socks5 proxy server out of this session. Background our current meterpreter session and run the command `search server/socks5`. What is the full path to the socks5 auxiliary module?
    auxiliary/server/socks5
  • Once we've started a socks server we can modify our _/etc/proxychains.conf_ file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks5 server with proxychains?
    proxychains