Exploits are essentially the same as the auxiliary module. You still have to
use
the
module. You will have variables that need to be set. You will still need to set your tar‐
get, though with an exploit you are looking at only a single system, which makes the
variable
RHOST
rather than
RHOSTS
. Also,
with an exploit, you will likely have an
RPORT
variable to set. This is one that would typically have a default set based on the
service that is being targeted. However, services aren’t always run on the default port.
So, the variable is there if you need to reset it and it will be required, but you may not
need to touch it.
related to a vulnerability with the
distributed C compiler service,
distcc
.
Example 5-12. Options for distcc exploit
msf exploit
(
unix/misc/distcc_exec
)
> show options
Module
options
(
exploit/unix/misc/distcc_exec
)
:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT
3632
yes
The target port
(
TCP
)
Exploit target:
Id Name
-- ----
0
Automatic Target
You will see the target listed, which is the variation of the exploit to use in this case
rather than being a specific IP address to target. Some exploits will have different tar‐
gets, which you may see with Windows exploits. This is
because versions of Windows
such as Windows 7, 8, and 10 have different memory structures and the services may
behave differently. This may force the exploit to behave differently based on the ver‐
sion of the operating system targeted. You may get an automatic target with the abil‐
ity to change. Since this particular service isn’t impacted by differences in the
operating system, there is no need for different targets.
Importing Data
Metasploit can use outside resources to populate the database. The first thing we can
do is use
nmap
from within
msfconsole
. This will automatically
populate the database
with any hosts that are found and the services that are running. Rather than calling
nmap
directly, you use
db_nmap
, but you would still use the same command-line
parameters.
db_nmap
to do
a SYN scan with the highest
throttle rate possible, which will hopefully make it complete faster.
