Trabalhando com MSFCONSOLE

• Pesquisando exploits através do comando search
  

 msf> search dcom

Matching Modules
================

   Name                                       Disclosure Date  Rank   Description
   ----                                       ---------------  ----   -----------
   exploit/windows/dcerpc/ms03_026_dcom       2003-07-16       great  Microsoft RPC DCOM Interface Overflow
   exploit/windows/driver/broadcom_wifi_ssid  2006-11-11       low    Broadcom Wireless Driver Probe Response SSID Overflow
   exploit/windows/smb/ms04_031_netdde        2004-10-12       good   Microsoft NetDDE Service Overflow

• Comando RESOURCE , através dele é possível criar uma espécie de script com os comandos a serem executados, exemplo : criando um arquivo chamado comando.txt em /root, conteúdo do arquivo.txt > search ftp, a seguir a execução:
  

 msf> resource /root/comando.txt
[*] Processing /root/comando.txt for ERB directives.
resource (/root/comando.txt)> search ftp

 OpenTFTP SP 1.4 Error Packet Overflow
   exploit/windows/tftp/quick_tftp_pro_mode          2008-03-27       good                                          Quick FTP Pro 2.1 Transfer-Mode Overflow
   exploit/windows/tftp/tftpd32_long_filename        2002-11-19       average                                       TFTPD32

• Comando INFO, através dele é possível buscar mais informações a respeito de determinado exploit:
  

  msf> info exploit/windows/tftp/tftpdwin_long_filename

       Name: TFTPDWIN v0.4.2 Long Filename Buffer Overflow
     Module: exploit/windows/tftp/tftpdwin_long_filename
    Version: 14774
   Platform: Windows
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Great

Provided by:
  patrick 

Available targets:
  Id  Name
  --  ----
  0   Universal - tftpd.exe

Basic options:
  Name   Current Setting  Required  Description
  ----   ---------------  --------  -----------
  RHOST                   yes       The target address
  RPORT  69               yes       The target port

Payload information:
  Space: 284
  Avoid: 1 characters

Description:
  This module exploits the ProSysInfo TFTPDWIN threaded TFTP Server.
  By sending an overly long file name to the tftpd.exe server, the
  stack can be overwritten.

References:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4948
  http://www.osvdb.org/29032
  http://www.securityfocus.com/bid/20131
  http://www.milw0rm.com/exploits/3132

• Comando SHOW OPTIONS , utilizado para obter informações sobre a utilização de determinado exploit:
  

  msf  auxiliary(apache_userdir_enum) > show options

Module options (auxiliary/scanner/http/apache_userdir_enum):

   Name              Current Setting                                     Required  Description
   ----              ---------------                                     --------  -----------
   BRUTEFORCE_SPEED  5                                                   yes       How fast to bruteforce, from 0 to 5
   Proxies                                                               no        Use a proxy chain
   RHOSTS                                                                yes       The target address range or CIDR identifier
   RPORT             80                                                  yes       The target port
   THREADS           1                                                   yes       The number of concurrent threads
   URI               /                                                   yes       The path to users Home Page
   USERNAME                                                              no        A specific username to authenticate as
   USER_FILE         /opt/metasploit/msf3/data/wordlists/unix_users.txt  yes       File containing users, one per line
   VERBOSE           true                                                yes       Whether to print output for all attempts
   VHOST

• Comando SET , utilizado para setar opções a respeito de portas remotas ou locais RPORT / LPORT , payloads, THREADS, etc.
  

 msf  auxiliary(apache_userdir_enum) > set RHOSTS 192.168.30.1
RHOSTS => 192.168.30.1

• Comando UNSET , utilizado para desfazer opções a respeito de portas remotas ou locais RPORT / LPORT , payloads, THREADS, etc.
  

 msf  auxiliary(apache_userdir_enum) > unset RHOSTS 192.168.30.1
Unsetting RHOSTS...
Unsetting 192.168.30.1...

• Comando USE, utilizado para determinar qual módulo será utilizado
  

 msf> use exploit/windows/smb/ms03_049_netapi
msf  exploit(ms03_049_netapi) >

• Comando BACK, volta ao contexto anterior:
  

 msf> use exploit/windows/smb/ms03_049_netapi
msf  exploit(ms03_049_netapi)> back
msf >

• Comando VERSION, mostra versão atual:
  

 msf> version
Framework: 4.2.0-release.14784
Console  : 4.2.0-release.14649
msf >

• Comando BANNER, troca banner inicial:
  

 msf> banner

 _                                                      _
/  \  / \        __                          _   __    /_/ __
| |\ /  | _____  \ \            ___   _____ | | /   \  _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | | | |  || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | |_ \__/ | |  | |_
      |/  |____/  \___\/ /\  \___/   \/      \__|     |_\  \___\

       =[ metasploit v4.2.0-release [core:4.2 api:1.0]
+ -- --=[ 805 exploits - 451 auxiliary - 135 post
+ -- --=[ 246 payloads - 27 encoders - 8 nops
       =[ svn r15560 updated 147 days ago (2012.02.23)

Warning: This copy of the Metasploit Framework was last updated 147 days ago.
         We recommend that you update the framework at least every other day.
         For information on updating your copy of Metasploit, please see:
             http://community.rapid7.com/docs/DOC-1306

• Comando EXIT, sair do console:
  

 msf> exit
root@bt:~#