So here we are in the lab and you can see that I have Cali pulled up for us
already.
And the real quick and easy way to be able to do this, there's one or two ways
you could do it,
as far as starting up Metasploico's. Very complex, very intricate, very
detailed. Yeah,
you could hit the start menu on the top and type in Metasploico, and you'll see
it up at the very
top. Matter of fact, I'll zoom in for you real quick. Metasploico framework.
Pretty straightforward.
Now it's going to ask for the actual Cali password because it has to be ran in
Cito because there's so many different things that we do inside of Metasploico,
that require elevated permissions. So after you type in Cali, it's going to do
its database
initialization. Now one thing I wanted to point out here is that the first time
that you run Metasploico,
be it MSF Venom, MSF Console, Metasploico framework overall, the first time
that you've fired up,
it's going to take a minute to do its actual database initialization. It's not
that it's going
through and check for updates or anything like that. It's just trying to get
everything loaded up
into running memory for you to be able to choose from with a reasonable respect
to the size of
the entirety of the database. Depending on the type of system, this can take
anywhere between
a minute or 15 minutes. A lot of it has to do with the amount of resources you
have on the actual
system overall. Now you can see that one of the first things that we get as it
's doing the
initialization is that the database appears to be already be configured,
skipping initialization.
If this is the very first time that you were firing up Metasploico, whether it
be on a fresh
install of Cali or Windows, POSIX-based system, Post-insol, however you decided
to do that,
this particular step right here can take a while. It will contact the actual
sources inside of
Etsy sources for the updates that Metasploico requires in order to be able to
populate that
database. Now all that being said, when we talk about actually updating Metaspl
oico as this is
loading for us, that it's done through the app update, app upgrade in the site
of Cali
as an operating system. So you don't have to go in and download anything
specific or definition
files or anything like that like you're dealing with NSSIS or anything. It will
through the
operating system and through the integration that it has inside of Cali, Metas
ploico will update
through traditional means, just like you're updating the operating system like
normal.
Now you can see here that we do get some fancy dancy artwork in the ASCII art,
and it varies every time that Metasploico fires up. And there's actually a
command later on if
you want to be able to have it do it again, but that's more of a side. But once
Metasploico started
up, there's really five things that we need to remember in terms of how we use
the actual Metasploico
framework console that we have up here on the screen inside of our virtual
machine.
That is first you actually start Metasploico. Again, very detailed, very
intricate, somehow we
managed. But then we move on to step two, which is actually searching for an
exploit. Step number
three is using the exploit. Step number four is configuring the exploit and
step number the next
one is using the exploit. It's just that simple. Now there is a lot to be able
to search from,
and as we continue going throughout the actual rest of the skill, you'll see
that we can actually
dive as deep as we want, or as broad as we want when it concerns using Metasplo
ico overall.
But because right now when it starts up, you could see right here as I zoom in
for us,
Metasploico already has 2,529 exploits, and it breaks it down how it's actually
broken up,
along with nine of those being evasions. Now it's good that we actually see
this number right here,
because as this skill and the following continue, you're going to get an
understanding of how these
get categorized in terms of what type of functionality or what type of payload
that we're actually using.
And seeing these numbers right here will further cement the fact that Metasplo
ico has a lot of
capabilities. But it's also going to reinforce the fact that when we look at
like knobs, for instance,
a knobsled is a knobsled is a knobsled. And as the course continues, you'll see
a couple of knobs
leads put into place, and they all do the same thing. They slid all the way to
the end of the
actual memory to be able to put something in that's not supposed to be there.
But don't you worry,
we'll be coming back to that here pretty soon as the course unfolds. Now there
's a couple of
different ways that we can do this. We can either do all five of the functions
inside of Metasploico
framework here, or we can split it up between MSF console and MSF venom.
However, you decide to do
this as the actual practitioner of Pintest is up to you. Now there's a couple
of reasons that you
would want to split these up. First and foremost, if you decide to use all of
it inside of the
Metasploico framework console as a whole, you can actually go through and do
beginning middle and end
and keep track of everything with relative ease. But let's say you have one
system dedicated for
the actual packaging of the payload of exploit and another system dedicated to
receiving the
response of exploit. You might want to be able to have MSF venom running on one
and MSF console on
the other to be able to split up that payload or that that work cycle. And
dependent on resources
as well too, because in terms of like using a reverse shell, that doesn't take
too many resources
to run and to execute because you're just receiving text back and ASCII text
back and forth over
the connection. But if you're receiving graphics or you're trying to push a
payload that's actually
substantially large for an exploit to leverage, it could be that you might want
to split that up to
also work on evasion tactics. The Pintester, yes, you're going to have a couple
of systems on hand
already. But as you're attacking the network, you want to make sure that you've
varied this up in
such a way to where you can't get caught. Because the moment you're caught,
that kind of unofficially
ends the Pintester, does it not? I did promise, here we are. Here's the other
way you can actually
start up Metasploit. If you wanted to inside of Kelly, you can actually use
that command right there.
But again, you can actually go through the start menu and select it through the
GUI. If you notice,
there's a dollar sign right there. So it does a shell change in accordance with
the Metasploit
framework dot SH. And I'm just pointing that out just as a trivial matter. So
that way,
you're aware, because the easiest way to do it is actually through the actual
start mid
you itself. But just in case, let's say you're using Kelly without a GUI and
doing it through
command line, this is your way to go. Now, can we do all of what we need to do
from MSF venom and
MSF console along with the vulnerability searching inside of this particular
menu and input right here? Absolutely. Will we know because I want to break
this up
into the different sections. So that way you at home could actually combine
them if you'd like
inside of the actual Metasploit framework console that you see here, or know
how to be able to
split them up and use them in the different sections to use sparingly if you so
desire.
And in the next portion of the skill, we're actually going to be taking a look
at MSF
venom to actually start using some of those exploits and cue them up and show
you how to
be able to search for them. Remember, all this ties in together to our main Met
asploit framework
console that we have right here.