Task 1: Metasploit Configuration

Step 1

• Ensure the Kali and pfSense machines are running.
• Note: Make sure all the boxes are on the internal network for pfSense to work as a DHCP.

Step 2

• From the command line in your Kali machine, enter the MSF with msfconsole

msfconsole

Step 3

• The MSF uses the search command to find the auxiliary module that scans for HSTS operational mode in msfconsole, which was introduced in EH-06.

Step 4

• Select the auxiliary/scanner/http/http_hsts module with the use command.

use auxiliary/scanner/http/http_hsts

Step 5

• Review the necessary options to run the module by typing show options.

Step 6

• Fill in the required data by using set [name] [description]. The scan should be performed on http://[metasploit IP]/dvwa/login.php.
• Note: You will only be setting the RHOSTS. If it is a Kali 2019, remove the path.

set RHOSTS http://192.168.1.102/dvwa/login.php

Step 7

• Once the necessary information is populated, run the module with the run command.

run

Task 2: SMB_Login Attack

Step 1

• Turn on the Windows 7 machine.

Step 2

• Search for SMB_login-related exploits.

Step 3

• Set Metasploit to use the SMB_login exploit and fill in the required data to attack the Windows 7 machine.

use auxiliary/scanner/smb/smb_login

Step 4

• Review the necessary options to run the module by typing show options.

show options

Step 5

• Fill in the following options for RHOSTS, SMBPass, and SMBUser.
• Note: SMBPass is the password to the Windows machine, and SMBUser is the username for the Windows machine. Remember to use set [option] [description]

Set RHOSTS [Windows 7 IP]
Set SMBPass [Windows 7 login password]
Set SMBUser [Windows 7 login username]

Step 6

• Use show options again to validate the changes, which can be seen under Current Setting.

show options

Step 7

• Run the payload with the exploit command.
• Note: The exploits in msfconsole can run with the run or exploit commands.

exploit