网络安全人员一定要知道的Metasploit渗透框架！

简介

Metasploit是一款开源安全漏洞检测工具，附带数百个已知的软件漏洞，并保持频繁更新。被安全社区冠以“可以黑掉整个宇宙”之名的强大渗透测试框架。

Metasploit官网：www.metasploit.com/

Metasploit的Github仓库地址：github.com/rapid7/meta…

框架和相关术语简介：

Vulnerability：允许攻击者入侵或危害系统安全性的弱点称为漏洞，漏洞可能存在于操作系统，应用软件甚至网络协议中。

Exploit：攻击代码或程序，它允许攻击者利用易受攻击的系统并危害其安全性。每个漏洞都有对应的漏洞利用程序。Metasploit有超过 1700 个漏洞利用程序。

Payload：攻击载荷。它主要用于建立攻击者和受害者机器直接的连接，Metasploit有超过 500个有效攻击载荷。

Module：模块是一个完整的构件，每个模块执行特定的任务，并通过几个模块组成一个单元运行。这种架构的好处是可以很容易的将自己写的利用程序和工具集成到框架中。

使用方法

在MSF里面msfconsole可以说是最流行的一个接口程序。很多人一开始碰到msfconsole的时候就害怕了。那么多复杂的命令语句需要学习，但是msfconsole真的是一个强大的接口程序。Msfconsole提供了一个一体化的集中控制台。通过msfconsole，你可以访问和使用所有的metasploit的插件，payload，利用模块，post模块等等。Msfconsole还有第三方程序的接口，比如nmap，sqlmap等，可以直接在msfconsole里面使用。

大家可以直接在命令行窗口输入msfconsole，然后回车。这样就打开了msfconsole。Msfconsole的系统文件和用户文件位于/usr/share/metasploit-framework/目录下。

msf5 > help
Core Commands
=============Command       Description-------       -----------?             Help menubanner        Display an awesome metasploit bannercd            Change the current working directorycolor         Toggle colorconnect       Communicate with a hostexit          Exit the consoleget           Gets the value of a context-specific variablegetg          Gets the value of a global variablegrep          Grep the output of another commandhelp          Help menuhistory       Show command historyload          Load a framework pluginquit          Exit the consolerepeat        Repeat a list of commandsroute         Route traffic through a sessionsave          Saves the active datastoressessions      Dump session listings and display information about sessionsset           Sets a context-specific variable to a valuesetg          Sets a global variable to a valuesleep         Do nothing for the specified number of secondsspool         Write console output into a file as well the screenthreads       View and manipulate background threadstips          Show a list of useful productivity tipsunload        Unload a framework pluginunset         Unsets one or more context-specific variablesunsetg        Unsets one or more global variablesversion       Show the framework and console library version numbersModule Commands
===============Command       Description-------       -----------advanced      Displays advanced options for one or more modulesback          Move back from the current contextclearm        Clear the module stackinfo          Displays information about one or more moduleslistm         List the module stackloadpath      Searches for and loads modules from a pathoptions       Displays global options or for one or more modulespopm          Pops the latest module off the stack and makes it activeprevious      Sets the previously loaded module as the current modulepushm         Pushes the active or list of modules onto the module stackreload_all    Reloads all modules from all defined module pathssearch        Searches module names and descriptionsshow          Displays modules of a given type, or all modulesuse           Interact with a module by name or search term/indexJob Commands
============Command       Description-------       -----------handler       Start a payload handler as jobjobs          Displays and manages jobskill          Kill a jobrename_job    Rename a jobDatabase Backend Commands
=========================Command           Description-------           -----------analyze           Analyze database information about a specific address or address rangedb_connect        Connect to an existing data servicedb_disconnect     Disconnect from the current data servicedb_export         Export a file containing the contents of the databasedb_import         Import a scan result file (filetype will be auto-detected)db_nmap           Executes nmap and records the output automaticallydb_rebuild_cache  Rebuilds the database-stored module cache (deprecated)db_remove         Remove the saved data service entrydb_save           Save the current data service connection as the default to reconnect on startupdb_status         Show the current data service statushosts             List all hosts in the databaseloot              List all loot in the databasenotes             List all notes in the databaseservices          List all services in the databasevulns             List all vulnerabilities in the databaseworkspace         Switch between database workspaces

search参数

你使用msfconsole的时候，你会用到各种漏洞模块、各种插件等等。所以search命令就很重要。

先查看search的帮助信息

msf5 > search -h
Usage: search [<options>] [<keywords>:<value>]

Prepending a value with '-' will exclude any matching results.
If no options or keywords are provided, cached results are displayed.

OPTIONS:-h                Show this help information-o <file>         Send output to a file in csv format-S <string>       Regex pattern used to filter search results-u                Use module if there is one result

Keywords:aka         :  Modules with a matching AKA (also-known-as) nameauthor      :  Modules written by this authorarch        :  Modules affecting this architecturebid         :  Modules with a matching Bugtraq IDcve         :  Modules with a matching CVE IDedb         :  Modules with a matching Exploit-DB IDcheck       :  Modules that support the 'check' methoddate        :  Modules with a matching disclosure datedescription :  Modules with a matching descriptionfullname    :  Modules with a matching full namemod_time    :  Modules with a matching modification datename        :  Modules with a matching descriptive namepath        :  Modules with a matching pathplatform    :  Modules affecting this platformport        :  Modules with a matching portrank        :  Modules with a matching rank (Can be descriptive (ex: 'good') or numeric with comparison operators (ex: 'gte400'))ref         :  Modules with a matching refreference   :  Modules with a matching referencetarget      :  Modules affecting this targettype        :  Modules of a specific type (exploit, payload, auxiliary, encoder, evasion, post, or nop)

Examples:search cve:2009 type:exploitsearch cve:2009 type:exploit platform:-linux

通过名称查找

查找名称含有mysql的漏洞