網路安全人員一定要知道的Metasploit滲透框架！-有解無憂

簡介

Metasploit是一款開源安全漏洞檢測工具，附帶數百個已知的軟體漏洞，并保持頻繁更新，被安全社區冠以“可以黑掉整個宇宙”之名的強大滲透測驗框架，

Metasploit官網：https://www.metasploit.com/

Metasploit的Github倉庫地址：https://github.com/rapid7/metasploit-framework

在這里插入圖片描述

框架和相關術語簡介：

Vulnerability：允許攻擊者入侵或危害系統安全性的弱點稱為漏洞，漏洞可能存在于作業系統，應用軟體甚至網路協議中，

Exploit：攻擊代碼或程式，它允許攻擊者利用易受攻擊的系統并危害其安全性，每個漏洞都有對應的漏洞利用程式，Metasploit有超過 1700 個漏洞利用程式，

Payload：攻擊載荷，它主要用于建立攻擊者和受害者機器直接的連接，Metasploit有超過 500個有效攻擊載荷，

Module：模塊是一個完整的構件，每個模塊執行特定的任務，并通過幾個模塊組成一個單元運行，這種架構的好處是可以很容易的將自己寫的利用程式和工具集成到框架中，

使用方法

在MSF里面msfconsole可以說是最流行的一個介面程式，很多人一開始碰到msfconsole的時候就害怕了，那么多復雜的命令陳述句需要學習，但是msfconsole真的是一個強大的介面程式，Msfconsole提供了一個一體化的集中控制臺，通過msfconsole，你可以訪問和使用所有的metasploit的插件，payload，利用模塊，post模塊等等，Msfconsole還有第三方程式的介面，比如nmap，sqlmap等，可以直接在msfconsole里面使用，

大家可以直接在命令列視窗輸入msfconsole，然后回車，這樣就打開了msfconsole，Msfconsole的系統檔案和用戶檔案位于/usr/share/metasploit-framework/目錄下，

msf5 > help
Core Commands
=============

    Command       Description
    -------       -----------
    ?             Help menu
    banner        Display an awesome metasploit banner
    cd            Change the current working directory
    color         Toggle color
    connect       Communicate with a host
    exit          Exit the console
    get           Gets the value of a context-specific variable
    getg          Gets the value of a global variable
    grep          Grep the output of another command
    help          Help menu
    history       Show command history
    load          Load a framework plugin
    quit          Exit the console
    repeat        Repeat a list of commands
    route         Route traffic through a session
    save          Saves the active datastores
    sessions      Dump session listings and display information about sessions
    set           Sets a context-specific variable to a value
    setg          Sets a global variable to a value
    sleep         Do nothing for the specified number of seconds
    spool         Write console output into a file as well the screen
    threads       View and manipulate background threads
    tips          Show a list of useful productivity tips
    unload        Unload a framework plugin
    unset         Unsets one or more context-specific variables
    unsetg        Unsets one or more global variables
    version       Show the framework and console library version numbers


Module Commands
===============

    Command       Description
    -------       -----------
    advanced      Displays advanced options for one or more modules
    back          Move back from the current context
    clearm        Clear the module stack
    info          Displays information about one or more modules
    listm         List the module stack
    loadpath      Searches for and loads modules from a path
    options       Displays global options or for one or more modules
    popm          Pops the latest module off the stack and makes it active
    previous      Sets the previously loaded module as the current module
    pushm         Pushes the active or list of modules onto the module stack
    reload_all    Reloads all modules from all defined module paths
    search        Searches module names and descriptions
    show          Displays modules of a given type, or all modules
    use           Interact with a module by name or search term/index


Job Commands
============

    Command       Description
    -------       -----------
    handler       Start a payload handler as job
    jobs          Displays and manages jobs
    kill          Kill a job
    rename_job    Rename a job
    
Database Backend Commands
=========================

    Command           Description
    -------           -----------
    analyze           Analyze database information about a specific address or address range
    db_connect        Connect to an existing data service
    db_disconnect     Disconnect from the current data service
    db_export         Export a file containing the contents of the database
    db_import         Import a scan result file (filetype will be auto-detected)
    db_nmap           Executes nmap and records the output automatically
    db_rebuild_cache  Rebuilds the database-stored module cache (deprecated)
    db_remove         Remove the saved data service entry
    db_save           Save the current data service connection as the default to reconnect on startup
    db_status         Show the current data service status
    hosts             List all hosts in the database
    loot              List all loot in the database
    notes             List all notes in the database
    services          List all services in the database
    vulns             List all vulnerabilities in the database
    workspace         Switch between database workspaces

search引數

你使用msfconsole的時候，你會用到各種漏洞模塊、各種插件等等，所以search命令就很重要，

先查看search的幫助資訊

msf5 > search -h
Usage: search [<options>] [<keywords>:<value>]

Prepending a value with '-' will exclude any matching results.
If no options or keywords are provided, cached results are displayed.

OPTIONS:
  -h                Show this help information
  -o <file>         Send output to a file in csv format
  -S <string>       Regex pattern used to filter search results
  -u                Use module if there is one result

Keywords:
  aka         :  Modules with a matching AKA (also-known-as) name
  author      :  Modules written by this author
  arch        :  Modules affecting this architecture
  bid         :  Modules with a matching Bugtraq ID
  cve         :  Modules with a matching CVE ID
  edb         :  Modules with a matching Exploit-DB ID
  check       :  Modules that support the 'check' method
  date        :  Modules with a matching disclosure date
  description :  Modules with a matching description
  fullname    :  Modules with a matching full name
  mod_time    :  Modules with a matching modification date
  name        :  Modules with a matching descriptive name
  path        :  Modules with a matching path
  platform    :  Modules affecting this platform
  port        :  Modules with a matching port
  rank        :  Modules with a matching rank (Can be descriptive (ex: 'good') or numeric with comparison operators (ex: 'gte400'))
  ref         :  Modules with a matching ref
  reference   :  Modules with a matching reference
  target      :  Modules affecting this target
  type        :  Modules of a specific type (exploit, payload, auxiliary, encoder, evasion, post, or nop)

Examples:
  search cve:2009 type:exploit
  search cve:2009 type:exploit platform:-linux