Databases
Metasploit has built-in support for the PostgreSQL database system.
msf > help database
Database Backend Commands
=========================
Command Description
------- -----------
db_connect Connect to an existing database
db_disconnect Disconnect from the current database instance
db_export Export a file containing the contents of the database
db_import Import a scan result file (filetype will be auto-detected)
db_nmap Executes nmap and records the output automatically
db_rebuild_cache Rebuilds the database-stored module cache
db_status Show the current database status
hosts List all hosts in the database
loot List all loot in the database
notes List all notes in the database
services List all services in the database
vulns List all vulnerabilities in the database
workspace Switch between database workspacesSetup
In Kali, you will need to start up the postgresql server before using the database.
After starting postgresql you need to create and initialize the msf database with msfdb init.
DB_STATUS
Run db_status to confirm that Metasploit is successfully connected to the database.
Workspaces
Use the -h switch with the workspace command to see the command’s capabilities.
Listing Workspaces
Workspaces give us the ability to save different scans from different locations/networks/subnets.
The ‘default‘ workspace is selected when connecting to the database.
Switching Workspace
Creating/Deleting a Workspace
DB_IMPORT
Import an nmap scan by using db_import followed by the path to our file.
Once completed we can confirm the import by issuing the hosts command.
DB_NMAP
Scan a host directly from the console using the db_nmap command.
Scan results will be saved in our current database.
DB_EXPORT
Using the db_export command all our gathered information can be saved in a XML file.
2 output formats
xml will export all of the information currently stored in our active workspace.
pwdump exports everything related to used/gathered credentials.
Hosts
Use the hosts command to view a list of hosts that the database contains.
Selecting Columns (-c)
Filtering by String (-S)
Setting RHOSTS (-R)
We take the tcp scan auxiliary module, which has the RHOSTS option, as an example.
Add the -R switch to the hosts command to set the RHOSTS option and run the module.
It works if the outcome of the hosts command contains more than one address.
CSV Export (-o)
To save our query results into a file, run the hosts command followed by the -o with path and filename.
The file format is a comma separated value (CSV).
Services
Use the services command to view a list of services that the database contains.
Selecting Columns (-c)
Filtering by String (-s, -S)
-s: Full service name search.
-S: Partial service name search.
Filtering by Host
Filtering by Port (-p)
Use the -p switch to search specific ports or port ranges.
CSV Export (-o)
To save our query results into a file, run the services command followed by the -o with path and filename.
The file format is a comma separated value (CSV).
Credentials
The creds command is used to manage found and used credentials for targets in our database.
When trying credentials successfully, Metasploit saves them automatically in our database for future reference.
Running the creds command without any options will display currently saved credentials.
Adding a Credential (-a)
During post-exploitation of a host, gathering user credentials is an important activity in order to further penetrate a target network.
We can add them to our database with the creds -a command.
Hashdump
Once having compromised a system, the objective may be to retrieve hash dumps.
The hashdump post module will dump the contents of the SAM (Security Account Manager) database, where user and group account information stored. This module only works when you are root or have root permisions.
Use the loot command to view a list of hash dumps that the database contains.
References
Last updated