How to Install Metasploit Framework on Debian 12

Choose a different version or distribution

Introduction

Before we discuss how to install Metasploit Framework on Debian 12, let's first understand-What is Metasploit Framework?

Metasploit Framework is a powerful open-source penetration testing tool used for identifying vulnerabilities and conducting security assessments. You can use the vast array of tools and modules that Metasploit Framework offers for system security and testing on Debian 12.

This tutorial will walk you through the process of installing Metasploit Framework on Debian 12. We will also address a few FAQs on how to install Metasploit Framework on Debian 12.

Advantages

Powerful Penetration Testing: Metasploit Framework provides a comprehensive set of tools and modules essential for conducting penetration testing, aiding in identifying vulnerabilities and assessing the security of systems and networks.
Exploit Development: Metasploit Framework allows for the development and testing of custom exploits, facilitating the evaluation of system weaknesses and the creation of effective countermeasures.
Vulnerability Management: With Metasploit, organizations can identify and prioritize vulnerabilities, enabling them to implement necessary security measures and reduce the risk of exploitation.
Security Awareness and Training: Metasploit is a valuable resource for security professionals and students to enhance their understanding of potential threats, learn about real-world attack scenarios, and develop defensive strategies.
Active Community and Updates: Metasploit has a large active community of contributors and researchers, ensuring regular updates, new exploits, modules, and improvements to keep up with the evolving threat landscape.

Install Metasploit Framework on Debian 12 via APT

Step 1: Install Initial Required Packages For Metasploit on Debian

Make sure your Debian system is up-to-date and has all required dependencies installed before beginning the Metasploit installation.

Update and Upgrade Debian:

Run the following commands to maintain the updates for your Debian system:

sudo apt update
sudo apt upgrade

Install Required Dependencies:

After the system has been updated, install the necessary dependencies for Metasploit:

sudo apt install curl ca-certificates apt-transport-https software-properties-common lsb-release postgresql -y

Step 2: Import Metasploit APT Repository on Debian

Importing the Metasploit repository is the next step after setting up the dependencies. This guarantees that the packages you're receiving are authentic and unaltered.

Import the GPG Key:

The packages' authenticity is guaranteed by the GPG key. Bring it in using:

curl -fsSL https://apt.metasploit.com/metasploit-framework.gpg.key | sudo gpg --dearmor | sudo tee /usr/share/keyrings/metasploit.gpg > /dev/null

Add the Metasploit Repository:

After importing the GPG key, add the Metasploit repository as follows:

echo "deb [signed-by=/usr/share/keyrings/metasploit.gpg] https://apt.metasploit.com/ buster main" | sudo tee /etc/apt/sources.list.d/metasploit.list

Step 3: Install Metasploit on Debian via APT Command

Now that the repository is set up, the Metasploit Framework needs to be installed.

Refresh APT Cache:

To make sure the most recent version of the Metasploit Framework is available, update your package list:

sudo apt update

Install Metasploit Framework:

Start the installation procedure using:

sudo apt install metasploit-framework

First-Time Setup Process:

After installation is complete, Metasploit needs to be configured for the first time.

msfconsole

Throughout this configuration, you may receive multiple prompts:

Configuring a New Database: For Metasploit, it is recommended that a new database be created. Enter "yes" when asked to continue.

Would you like to use and set up a new database (recommended)?

Initializing the Web Service: This is not a required step. The response is usually "no". To activate the web service, enter "yes".

Would you like to init the webservice? (Not Required) [no]:

Final Configurations: Once the prompts are addressed, the system will complete setups. This could require many minutes. Details about the configuring procedure will be shown to you.

Your Metasploit Framework is now operational after completion. You'll learn how to fully utilize this effective cybersecurity tool on your Debian system as we go deeper into the following sections.

Metasploit Framework Terminal Commands on Debian 12

A solid understanding of the Metasploit Framework's terminal commands is necessary for navigating it. An example of how to use these commands on Debian efficiently is given in this section. At the conclusion, a thorough table with every command that is available will be shown.

Step 1: Launching Metasploit Framework

To launch the Metasploit Framework, open a terminal window and type:

msfconsole

A banner with information about the latest version, contributors, and some helpful Metasploit Framework usage advice will show up after execution.

Step 2: Keeping Metasploit Updated

New modules, features, and bug patches are frequently added to the ever-evolving Metasploit Framework. To make sure you're utilizing the most recent version:

msfupdate

With this command, the latest version of the Metasploit Framework is fetched and installed.

Step 3: Searching for Exploits

The Metasploit Framework's exploit search feature is one of its main features. To search for particular exploits:

search <search-term>

Substitute <search-term > with appropriate terms or keywords. To locate exploits linked to the Apache Struts vulnerability, for example:

search struts

A list of exploits related to the Apache Struts vulnerability is returned by this.

Step 4: Engaging with Exploits

Once an exploit has been identified, you can activate its module:

use <exploit-name>

Substitute the precise name of the exploit module for <exploit-name>. In case you want to make use of the Apache Struts exploit module:

use exploit/windows/http/struts2_rest_xstream

By doing this, you can reveal information about the exploit module, including its name, author, target platform, and payload.

Step 5: Configuring Exploit Parameters

It is frequently essential to modify certain parameters, including the target IP, port, or payload selection, prior to executing an exploit. To see the programmable parameters of an exploit:

show options

The current exploit module's adjustable settings are listed using this command.

To change a certain parameter:

set <option-name> <value>

For example, to assign the IP address of a target machine to the RHOST parameter:

set RHOST 192.168.1.100

Step 6: Executing Exploits

Once every parameter is configured, you can start the exploit:

exploit

A confirmation message confirming a successful operation and session setup will show up if the exploit is successful.

Leveraging Metasploit’s Meterpreter on Debian 12

One of the more sophisticated post-exploitation tools in the Metasploit Framework is Meterpreter. It makes communication with compromised systems easier in real time. An active session is required before you can fully utilize its potential.

Step 1: Managing Sessions

View every session that is currently in progress:

sessions -l

With their corresponding ID numbers, all sessions are listed using this command.

To participate in a particular session:

sessions -i <session-id>

To engage with the first session, for example:

sessions -i 1

With the help of this command, you can perform numerous tasks on the compromised system by starting a Meterpreter shell for the selected session.

Step 2: Extracting System Data

The natural initial step after establishing a Meterpreter session is to gather information about the hacked system:

Upon securing a Meterpreter session, a logical first step is to collect data about the compromised system:

System Overview:

sysinfo

With regard to the operating system version, CPU type, and system architecture, this command offers a snapshot of the system.

User Identification:

getuid

This displays the system's current user ID.

User Privileges:

getprivs

This enumerates the current user’s system privileges.

Step 3: File Transfers

File transfers between your computer and the infected system are made easier by Meterpreter:

Uploading Files:

upload <local-file> <remote-file>

For example, to move a local file called data.txt to the C:\Temp directory of the infected system:

upload /localpath/data.txt C:\Temp\data.txt

Downloading Files:

download <remote-file> <local-file>

To get a file called data.txt to your local computer from the C:\Temp directory of the compromised system:

download C:\Temp\data.txt /localpath/data.txt

Step 4: Probing WordPress Vulnerabilities with Metasploit

WordPress is typically a target for possible attacks due to its widespread use as a content management system. You may check your WordPress installations for known vulnerabilities with Metasploit. Keep in mind that abusing systems without authorization is against the law and immoral.

To determine which Metasploit modules are linked to vulnerabilities in WordPress:

search wordpress

WordPress vulnerability-specific Metasploit modules are listed using this command.

To engage with a specific module, for instance, the WP Paid Pro CODE SQLI vulnerability:

Search for the Exploit: You can check if the exploit is accessible in your Metasploit version by searching for it once Metasploit has started:

search wp_paid_membership_pro_code_sqli

Use the Exploit: Use the command to load the exploit if it is accessible:

use auxiliary/scanner/http/wp_paid_membership_pro_code_sqli

Set the Options: Prior to executing the exploit, a few settings need to be established. Setting the RHOSTS option, which indicates the target IP address or domain, is a minimum need:

set RHOSTS target_website_or_IP

By typing, you may see every option for the exploit that is available:

show options

Make sure you set up any additional settings required by your particular situation.

Run the Exploit: After configuring every option, you can launch the exploit:

run

Metasploit will try to exploit any vulnerabilities in the target and report back to you the results.

Metasploit Command Overview for Debian 12

Exploit Commands

The use of exploit commands is essential for taking advantage of holes in a target system.

Command	Description
`search`	Locate a specific exploit or payload.
`use`	Choose an exploit or payload for deployment.
`show options`	Display available options for the chosen exploit or payload.
`set`	Define a value for a particular option.
`exploit`	Launch the selected exploit.
`sessions`	Oversee active Meterpreter sessions.
`back`	Depart from the current exploit or payload context.

Auxiliary Commands

Auxiliary commands handle a wide range of functions, from fuzzing and scanning to obtaining vital data.

Command	Description
`search`	Find a specific auxiliary module.
`use`	Activate a desired auxiliary module.
`show options`	Enumerate current options for the selected auxiliary module.
`set`	Assign a value to a specific option.
`run`	Initiate the chosen auxiliary module.
`back`	Exit the current auxiliary module context.

Post-Exploitation Commands

Post-exploitation commands enable different operations on the compromised system once access to it has been secured.

Command	Description
`sysinfo`	Retrieve detailed system data.
`getuid`	Identify the active user ID.
`getprivs`	Enumerate the privileges of the current user.
`shell`	Access a system command shell.
`ps`	List active processes.
`migrate`	Transition to a different process.
`download`	Retrieve a file from the compromised system.
`upload`	Transfer a file to the compromised system.

Database Commands

These commands make it easier to interface with the integrated database of the Metasploit Framework.

Command	Description
`db_status`	Verify the database’s operational status.
`db_rebuild_cache`	Refresh the database cache.
`db_nmap`	Incorporate an nmap scan result into the database.
`hosts`	Enumerate all hosts registered in the database.
`services`	List all services documented in the database.
`vulns`	Detail all vulnerabilities recorded in the database.

Module Management Commands

These commands make managing modules in the Metasploit Framework easier.

Command	Description
`load`	Integrate a module into the console.
`reload_all`	Refresh all modules.
`unload`	Remove a module from the console.
`info`	Provide details about a specific module.
`edit`	Modify a module’s parameters.

FAQs to Install Metasploit Framework on Debian 12

Can I install Metasploit on Debian 12 from a package manager, like apt?

There is no official package available via apt for Metasploit on Debian. It is recommended to install it directly from the source.

How can I download and install Metasploit Framework on Debian 12?

You can download Metasploit Framework from the Rapid7 website and follow their installation guide to install it on Debian 12.

Is it possible to update Metasploit Framework on Debian 12?

Yes, Metasploit Framework can be updated using the msfupdate command, which pulls the latest updates from the official Metasploit repository.

Can I use Metasploit Framework for ethical hacking purposes only?

Metasploit Framework is a versatile tool used by both ethical hackers and malicious actors. It is essential to ensure that you use it legally and responsibly for authorized security testing purposes.

Does installing Metasploit Framework require any additional dependencies on Debian 12?

Yes, Metasploit Framework has several dependencies that need to be installed. Refer to the Metasploit documentation for a list of required dependencies and instructions on installing them.

Can I use Metasploit Framework on remote systems or only on the local machine?

Metasploit Framework can be used on both local and remote systems. Its remote exploitation capabilities allow security professionals to assess the security of remote systems.

Does Metasploit Framework support scripting and automation?

Yes, Metasploit Framework supports scripting using the Metasploit Scripting Language (MSFvenom) and automation through the use of auxiliary modules and Metasploit automation features.

Conclusion and Final Thoughts

We have installed the Metasploit Framework on Debian 12 in this tutorial. We've gone over the fundamentals, delved into command summaries, and investigated Meterpreter's possibilities in Metasploit. It is essential to use the Metasploit Framework with a thorough grasp of its ramifications and capabilities, just like with any sophisticated tool.

Please use the comments section to ask any questions you may have, and we would be pleased to respond.