49.5 Metasploit Cheat Sheet (OWN lab only)
Metasploit = attacker framework awareness so Blue can detect, patch, and least-privilege. Workflow on Metasploitable 192.168.56.20 only. No exploit PoC recipes for phones, cafe, or client prod. check where available. Defensive takeaway: patch, close ports, monitor sessions. Aata pudhe jaauya.
High-level workflow (lab English)
| Step / command | Meaning | Blue note |
|---|---|---|
msfconsole | Start console | Only on Kali aimed at OWN lab VMs |
search name_or_cve | Find modules | Maps to “known vuln exists – patch” |
use path/to/module | Select module | — |
info / show options | Read required options | Understand what RHOSTS means before set |
set RHOSTS 192.168.56.20 | Target hosts | Must be OWN Metasploitable / authorised lab |
set LHOST 192.168.56.10 | Your Kali listener IP | Host-only IP – not public cafe IP |
set RPORT … | Target port when needed | Matches open service from Nmap |
check | Non-exploit probe when module supports it | Prefer check mindset before exploit in learning |
exploit / run | Launch module (lab only) | Success = prove patch / disable service afterward |
sessions / sessions -i N | List / interact | Blue: EDR / log odd processes; kill unneeded services |
background / exit | Bg session / leave | Document lab evidence; then FIX target |
msfvenom awareness (one line – not a phone recipe)
| Idea | Lab framing | Blue note |
|---|---|---|
msfvenom builds payloads |
OWN lab VMs only – never real phones, never classmates’ devices, never client laptops | App allow-listing mindset; do not run mystery binaries; mail/web filters; IR playbook |
Defensive takeaways after any successful lab exploit
- Patch / update (
sudo yum update -yon Amazon Linux targets you own). - Disable or uninstall the vulnerable service.
- Least privilege – app and OS users.
- Network – SG/firewalld; no needless bind-all.
- Monitor – auth logs, web logs, unexpected listeners (
ss -tulpn). - Re-verify with gentle Nmap from Kali host-only.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Runs Metasploit modules against cafe / neighbour IPs | Scope paper; host-only; refuses; IT Act awareness |
| Treats “got shell” as portfolio flex on real orgs | Caption OWN Metasploitable; shows FIX + re-scan |
| Skips patch after lab win | sudo yum update; service stop; prove closed ports |
| Builds payloads “for friend’s Android” | Never – OWN VM only; Blue: mobile MDM / store hygiene (ch44) |
Ravindra Bagale's Tip
Metasploit cheat sheet ≠ 0-day cookbook. Module names rattun interview madhe dump karu naka – sanga: “I used Metasploit only on Metasploitable in host-only, then patched / closed the service and re-scanned.” Employer ethics baghto. msfvenom phone payload = hard no. Lakshat theva.
Lab
On Kali against only 192.168.56.20: open msfconsole, search a known Metasploitable lab service you already studied in ch23, use + set RHOSTS 192.168.56.20 + set LHOST 192.168.56.10, run check if available, then if in-scope for your class lab, exploit once for learning. Immediately write FIX notes (patch/disable/firewall). Re-scan with Nmap -T2. No internet targets. No inventing new exploits.