What to do after
metasploit depends on where you are. I'm also around the "script kiddie" level but I'll list some tips I've seen from experience and others:
Before you connect to the box:
- Do some automated scans like
- Check the software versions. They often use out-of-date and unsecured software with known vulnerabilities
- Google. You should try to understand what those softwares do and how they may be exploited.
If you're on a WepApp (in a browser):
- Look at
sitemap.xml. Useful links and folders are sometimes in there.
- Crawl it (with zaproxy or Burp Suite or some other crawler) and brute force some directories and files (with dirb, dirbuster, gobuster, etc.) to look for interesting folders and files.
- Poke around. Just go around the app, learn about. You may find some prompts, boxes for user input, search boxes, file uploads, etc. that you can exploit.
- Use Developer Tools. You can probably access it by pressing
Inspect Element. The authors sometimes leave some helpful hints in the comments.
- In Developer Tools, look around at some
.js files. There may be some interesting functions.
If you're connected to the box with something like
- Go around and explore. Just
cd into folders. If you know the Linux or Windows file system (depending on the box you're trying to hack), you can quickly spot some "out of place" folders and files.
whoami to know your privileges.
history to look at, well,
history. Users sometimes enter credentials in commands and they get stored in
- Dump hashes.
/etc/shadow is an example. You can try and crack those hashes or "pass the hash".
python -m SimpleHTTPServer 8080. (Use whichever port you like). This can allow you to upload files from your local machine to the box.
nc -lvnp 8080. (Again, use a port you like). This will open a
nc listener. I'll leave you to explore how you can pop shells with this.
Those are just a few things you can do. One of the most important things is to "poke and explore". Look around for user input, unusual files and folders, implemented functions, etc. Also, document as much as you can. It'll be much easier to know "where that reverse shell script" was put in the box. It'll also help a lot when you do a write-up.