## Nmap and Metasploit

A good starting point for network scanning is the nmap tool, which is also built into the Metasploit Framework as its own module. By using the built-in nmap module, the results are saved to a database so they can be used later in attacks. However, this requires a database to be set up first, so let's start with that.

---

## Starting Metasploit Database

If you want Metasploit to save data to a database (this is required when using db\_nmap), you must first start the postgresql database and create the Metasploit database schema and user. You can do this with the following commands:

```sh
service postgresql start
msfdb init
```

---

## Starting Metasploit

When the database is running, we can launch Metasploit with the following command.

```sh
msfconsole
```

---

## Using Nmap in Metasploit

In Metasploit, Nmap is used within msfconsole with the command **db\_nmap**.

```sh
msf6 > db_nmap -h
[*] Nmap 7.93 ( https://nmap.org )
[*] Usage: nmap [Scan Type(s)] [Options] {target specification}
[*] TARGET SPECIFICATION:
[*] Can pass hostnames, IP addresses, networks, etc.
[*] Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
[*] -iL <inputfilename>: Input from list of hosts/networks
[*] -iR <num hosts>: Choose random targets
[*] --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
[*] --excludefile <exclude_file>: Exclude
...
```

The Nmap's results are automatically saved to the Metasploit's database, from where they can be viewed and used within Metasploit. Let's take a practical example of this before you start practicing yourself.

---

## Exercise

Start the lab now and perform the following steps along.

@exercise 38eacd998a75

### 

### msfdb init

Let's start by launching and initializing the metasploit database. Don't worry about the systemd error message, it doesn't matter.

```sh
service postgresql start
msfdb init
...
[+] Starting database
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
[+] Creating database user 'msf'
[+] Creating Databases 'msf'
[+] Creating Databases 'msf_test'
[+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml'
[+] Creating initial database schema
```

### msfconsole

Let's open Metasploit console:

```sh
root@b0trac0a9r-student:~# msfconsole
                                                  
#cowsay++
 ____________
< Metasploit >
 ------------
       \ ,__,
        \ (oo)____
           (__) )\
              ||--|| *

       =[ Metasploit v6.3.4-dev ]
+ -- --=[ 2294 Exploits - 1201 auxiliary - 409 post ]
+ -- --=[ 968 payloads - 45 Encoders - 11 nops ]
+ -- --=[ 9 evasion ]

Metasploit tip: Start commands with a space to avoid saving
them to history
Metasploit Documentation: https://docs.metasploit.com/
msf6 >
```

### msf6 -> db\_status

Check that the database connection has been established.

```
msf6 > db_status
[*] Connected to msf. Connection type: postgresql.
```

### 

### msf6 -> db\_nmap <ip>

Check the section "Internal Network Targets" to find the IP address of your target.

![](sanity:image-e6ef9f23fac186b3d4f68b920096863b927e7809-408x99-png)

Starting an nmap scan that performs a basic scan on the IP address.

```sh
msf6 > db_nmap 10.0.2.22
[*] Nmap: Starting Nmap 7.94 ( https://nmap.org )...
[*] Nmap: Nmap scan report for 10.0.2.22
[*] Nmap: Host is up (0.000020s latency).
[*] Nmap: Not shown: 992 closed tcp ports (reset)
[*] Nmap: PORT STATE SERVICE
[*] Nmap: 22/tcp open ssh
[*] Nmap: 25/tcp open smtp
[*] Nmap: 53/tcp open domain
[*] Nmap: 111/tcp open rpcbind
[*] Nmap: 139/tcp open netbios-ssn
[*] Nmap: 445/tcp open microsoft-ds
[*] Nmap: 2121/tcp open ccproxy-ftp
[*] Nmap: 3306/tcp open mysql
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds
```

Basic scan found quite a few open ports, but we have not yet identified the services behind those ports (the displayed services are Nmap guesses based solely on the port number).

### msf6 -> hosts

Run the "hosts" command to see what devices nmap has found on the network.

```sh
msf6 > hosts

Hosts
=====

address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- ---- ----
10.0.2.22 Unknown device
```

As expected, only one device is displayed in the list because we have only scanned one IP address. The operating system has also not been identified yet.

### msf6 -> services

Run the "services" command to see which ports and services nmap has found on the network.

```sh
msf6 > services
Services
========

host port proto name state info
---- ---- ----- ---- ---- ---- ----
10.0.2.22 22 tcp ssh open
10.0.2.22 25 tcp smtp open
10.0.2.22 53 tcp domain open
10.0.2.22 111 tcp rpcbind open
10.0.2.22 139 tcp netbios-ssn open
10.0.2.22 445 tcp microsoft-ds open
10.0.2.22 2121 tcp ccproxy-ftp open
10.0.2.22 3306 tcp mysql open
```

The ports are listed and named according to Nmap's best guess of what service is usually found behind each port. However, no actual services have been identified and there is no additional information about them.

### msf6 -> db\_nmap -A

Next, we will scan the operating system version, open ports, and try to identify the services behind those ports. All of this can be done using the -A flag. This scan takes a bit longer.

```sh
msf6 > db_nmap -A 10.0.2.22
[*] Nmap: Starting Nmap 7.94 ( https://nmap.org )...
[*] Nmap: Nmap scan report for 10.0.2.22
[*] Nmap: Host is up (0.000085s latency).
[*] Nmap: Not shown: 992 closed tcp ports (reset)
[*] Nmap: PORT STATE SERVICE VERSION
[*] Nmap: 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
[*] Nmap: | ssh hostkey:
[*] Nmap: | 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
[*] Nmap: |_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
[*] Nmap: 25/tcp open smtp Postfix smtpd
...
```

Nmap finally finished. And now there is a lot more information!

### msf6 -> hosts

Let's look at hosts again, have we received more information.

```sh
msf6 > hosts

Hosts
=====

address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- ---- ----
10.0.2.22 Linux 3.X server
```

A little more, now we know at least that it is a Linux server.

### msf6 > services

Next, let's look at the identified services:

```sh
msf6 > services
Services
========

host port proto name state info
---- ---- ----- ---- ---- ---- ----
10.0.2.22 22 tcp ssh open OpenSSH 4.7p1 Debian 8ubuntu1 protocol 2.0
10.0.2.22 25 tcp smtp open Postfix smtpd
10.0.2.22 53 tcp tcpwrapped open
10.0.2.22 111 tcp rpcbind open 2 RPC #100000
10.0.2.22 139 tcp netbios-ssn open Samba smbd 3.X - 4.X workgroup: WORKGROUP
10.0.2.22 445 tcp netbios-ssn open Samba smbd 3.0.20-Debian workgroup: WORKGROUP
...
```

---

## Exercises

@exercise 72d3d85d53e1

@exercise 43f17ce73f6d


In this lab, there are several different vulnerable web services that you can search for with Metasploit.

Metasploit Practice

Using nmap in metasploit

Metasploit is a popular attack framework that helps professionals identify and exploit security holes. In this course, you will go through the use of Metasploit and learn how it can be used to carry out attacks and find security holes.

Metasploit, the Swiss Army Knife of Penetration Testing

Welcome to the wonderful world of Metasploit! Metasploit is a penetration testing framework used by cybersecurity professionals throughout the world.

In this context, a framework refers to a codebase. More specifically, it refers to a stack of reusable Ruby code that makes it convenient to create more Ruby code that does cyber stuff. Particularly, the framework is designed for penetration testing.

You don't need to know how to code in Ruby to use Metasploit. In the course, we will also explore customization and building our own modules, but Metasploit already has thousands of these modules ready for you to get started. Besides, Metasploit now also supports Python extensions.

Module is a Ruby file in the Metasploit directory that serves a specific purpose.

There are different types of modules for different purposes. For example, the 

 modules (located in the exploits directory) are attacks that exploit a vulnerability and typically open a command channel to the compromised device, such as a server.

Modules are not used directly from files, but with tools of the Metasploit framework such as 

The flagship command-line tool of Metasploit is 

. With the tool, it is easy to search for and use Metasploit modules.

In the course, you progress step by step and practice using various techniques using Metasploit in the Hakatemian lab environment. After that, you will move on to exercises where you will no longer receive assistance, you only know the target's IP address, and you have access to Nmap and Metasploit, as well as the goal of breaking into the server by applying the skills you have learned in the course.

Using nmap in metasploit

Learn to hack — start here