The Metasploit Database

While it is not required when interacting with a single target on TryHackMe, an actual penetration testing engagement will likely have several targets.

Metasploit has a database function to simplify project management and avoid possible confusion when setting up parameter values.

You will first need to start the PostgreSQL database, which Metasploit will use with the following command:

systemctl start postgresql

Then you will need to initialize the Metasploit Database using the msfdb init command.

Starting Postgresql
root@attackbox:~# systemctl start postgresql 
root@attackbox:~# msfdb init
[i] Database already started
[+] Creating database user 'msf'
[+] Creating databases 'msf'
[+] Creating databases 'msf_test'
[+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml'
[+] Creating initial database schema
/usr/share/metasploit-framework/vendor/bundle/ruby/2.7.0/gems/activerecord-4.2.11.3/lib/active_record/connection_adapters/abstract_adapter.rb:84: warning: deprecated Object#=~ is called on Integer; it always returns nil
root@attackbox:~#

You can now launch msfconsole and check the database status using the db_status command.Checking the database status

msf6 > db_status
[*] Connected to msf. Connection type: postgresql.
msf6 >

The database feature will allow you to create workspaces to isolate different projects. When first launched, you should be in the default workspace. You can list available workspaces using the workspace command. Listing workspaces

You can add a workspace using the -a parameter or delete a workspace using the -d parameter, respectively. The screenshot below shows that a new workspace named "tryhackme" was created.Adding a workspace

You will also notice that the new database name is printed in red, starting with a * symbol.You can use the workspace command to navigate between workspaces simply by typing workspace followed by the desired workspace name. Changing workspaces

You can use the workspace -h command to list available options for the workspace command. Workspace help menu

Different from regular Metasploit usage, once Metasploit is launched with a database, the help command, you will show the Database Backends Commands menu.Database backend commands

If you run a Nmap scan using the db_nmap shown below, all results will be saved to the database. The db_nmap command

You can now reach information relevant to hosts and services running on target systems with the hosts and services commands, respectively. Hosts and services

The hosts -h and services -h commands can help you become more familiar with available options. Once the host information is stored in the database, you can use the hosts -R command to add this value to the RHOSTS parameter.

Example Workflow

  1. We will use the vulnerability scanning module that finds potential MS17-010 vulnerabilities with the use auxiliary/scanner/smb/smb_ms17_010 command.

  2. We set the RHOSTS value using hosts -R.

  3. We have typed show options to check if all values were assigned correctly. (In this example, 10.10.138.32 is the IP address we have scanned earlier using the db_nmap command)

  4. Once all parameters are set, we launch the exploit using the run or exploit command.

If there is more than one host saved to the database, all IP addresses will be used when the hosts -R command is used.

In a typical penetration testing engagement, we could have the following scenario:

  • Finding available hosts using the db_nmap command

  • Scanning these for further vulnerabilities or open ports (using a port scanning module)

The services command used with the -S parameter will allow you to search for specific services in the environment.

You may want to look for low-hanging fruits such as:

  • HTTP: Could potentially host a web application where you can find vulnerabilities like SQL injection or Remote Code Execution (RCE).

  • FTP: Could allow anonymous login and provide access to interesting files.

  • SMB: Could be vulnerable to SMB exploits like MS17-010

  • SSH: Could have default or easy to guess credentials

  • RDP: Could be vulnerable to Bluekeep or allow desktop access if weak credentials were used.

As you can see, Metasploit has many features to aid in engagements such as the ability to compartmentalize your engagements into workspaces, analyze your results at a high level, and quickly import and explore data.

PreviousScannerNextVulnerability Scanning

Last updated