Metasploit-SMB-Exploitation-Lab

🔴 End-to-End Metasploit Attack Lab (SMB Pivoting & Client-Side Exploitation)

📌 Overview

This lab demonstrates a full attack lifecycle including pivoting, exploitation, post-exploitation, and client-side attacks.

---

🧠 Attack Chain

• SMB Pivoting
• Metasploit Exploitation (psexec)
• Meterpreter Access
• Post-Exploitation
• File Upload
• Event Log Detection
• Payload Creation
• Client-Side Attack
• Reverse Shell

---

🌐 Lab Environment

Machine	Role
Kali Linux	Attacker
Ubuntu	Pivot
Windows 10	Target

---

🚀 Step 1: SMB Pivoting using Netcat

✔ Created a Netcat listener on Ubuntu to forward SMB traffic to Windows (port 445).
✔ Established a pivot tunnel between Kali → Ubuntu → Windows.

---

🚀 Step 2: Metasploit Exploitation Setup

✔ Configured exploit/windows/smb/psexec
✔ Used credentials and pivot port (3333) to authenticate
✔ Successfully triggered exploitation

---

🚀 Step 3: Meterpreter Session

✔ Meterpreter session opened on Windows target
✔ Confirmed SYSTEM-level access

---

🚀 Step 4: Post-Exploitation Enumeration

✔ Executed:

• sysinfo
• getuid
• ps
• pwd
• shell

✔ Verified system details and running processes

---

🚀 Step 5: File Upload to Target

✔ Uploaded file to C:\tools directory
✔ Verified successful transfer on target machine

---

🚀 Step 6: Detection via Event Logs

✔ Observed:

• Event ID 7045 → Service creation (psexec)
• Event ID 4672 → Privileged login

✔ Demonstrates detection capability from logs

---

🚀 Step 7: Payload Creation (msfvenom)

✔ Generated malicious executable using msfvenom
✔ Configured reverse shell payload

---

🚀 Step 8: Hosting Payload

✔ Started Python HTTP server on port 8080
✔ Hosted payload for download

---

🚀 Step 9: Client-Side Execution

✔ Target downloaded and executed malicious file
✔ Triggered reverse shell callback

---

🚀 Step 10: Reverse Shell (Handler)

✔ Configured Metasploit multi/handler
✔ Successfully received reverse connection

---

🚀 Step 11: System Control Verification

✔ Executed:

• whoami
• tasklist

✔ Confirmed full system compromise

---

🔍 Key Learnings

• Pivoting enables lateral movement across networks
• Metasploit simplifies exploitation workflows
• Post-exploitation is critical for control and persistence
• Windows logs provide strong detection indicators
• Client-side attacks are highly effective

---

🛡️ Mitigation Strategies

• Disable SMB where unnecessary
• Monitor Event IDs (7045, 4672)
• Use EDR solutions
• Enforce strong authentication
• Restrict unknown executable execution

---

⚠️ Disclaimer

This project was performed in a controlled lab environment for educational purposes only.

---

👨‍💻 Author

Hitesh Chowdary
Aspiring Penetration Tester | Cybersecurity Enthusiast