‫So now open your terminal and.
‫Start the MSF console.
‫The first command of this part is show.
‫Now, when you work with a module, it helps you to display the variables and properties of that module.
‫So the help screen is for showing us that.
‫Type the show command and then the name of the object, so let's have a look at knob generators by typing
‫show knob's.
‫And as you see the generators list.
‫Appears so there's no plug in for this phase and here are the encoders.
‫And also, he exploits.
‫But it might take a little while to list all the exploits if you try to list them.
‫And then here are all the exploits in Métis Point.
‫Now, when you need to use an exploit, you can search these exploits, for example, if you want to
‫exploit a Java RMI server code execution.
‫You can search for terms like RMI, RMI registry, so, yeah, let's perform a search just like that
‫search RMI registry.
‫And you see, it brings me the appropriate XPoint.
‫So I want to make an important point here, when you are conducting a test, you should perform an extensive
‫enumeration on the target to choose the right boy.
‫That's how you know what to search for.
‫Although Métis Point has many exploits, it doesn't mean that you can use every single one in every
‫circumstance.
‫First, you need to find the vulnerability.
‫And then if Métis Boyd has a suitable exploit, you can use that.
‫Otherwise, you may have a headache if you randomly run exploits and it's a waste of time.
‫OK, so back to the RMI registry XPoint, so now you have the name of the XPoint.
‫And if you recall from the previous videos, how do you use this exploit?
‫Type views and then the name of the boy.
‫Now, you can work with that XPoint.
‫If you want to be sure about the XPoint or if you want to configure the details, you can use the info
‫command to get detailed information about whether he exploits going to do.
‫And in this case.
‫This is an XPoint, but for sure it can be any other Métis flight module.
‫So read the description, examine the variables, or follow the reference link to get additional information
‫about that particular exploit.
‫So the options to view the variables.
‫And these are the basic variables.
‫And yes, you can set some advance variables to have more control over the exploit code.
‫How do you do that show advanced?
‫So.
‫Here are the other variables of the XPoint to make some of the advanced configurations.
‫Some X boys only work with a specific operating system or software versions, whatever.
‫Now, to send the target, the right exploit code, you've got to know the version of what you're trying
‫to exploit makes sense, right?
‫I'll assume here that you have made enumeration and you know your target well.
‫So that's what you tell Metters boy.
‫You specify the available targets by the show Targets Command.
‫As I hope you see on the screen, there's only five types of target.
‫So this means that this exploit can't be utilized on environment other than these particular five.
‫For the most part.
‫In a production environment, your exploit may fail due to IPPs IDs or firewall rules.
‫So I think it's good practice to evade the security measures.
‫For each XPoint, there are different evasion techniques and Métis Point.
‫So let's use the show Evasion Command to display the available techniques.
‫And if you want, you can choose these.
‫And these are the payloads that I listed by the show, Payloads Command.
‫Now, like evasion for each exploit, there are different pelote.
‫So this means you can't use a Linux payload for Windows system.
‫And for this point, there are these available paillard.
‫Now, I'll show you these variables again and let's set them.
‫You may remember from some of the previous videos how to set a variable, so we'll do that now, use
‫this at command just like that.
‫That's why I like the Linux console.
‫Setting the value a variable means you can get the value of the same variable.
‫I simply typing get as a command and then the variable name.
‫This is the medicine voidable to IP address in my lab environment.
‫Now, you can also unset a variable value by using the unset command.
‫And I just unset our host value, as you see here.
‫So you may come across a situation that you need to use the same value in every XPoint.
‫So you can just set the variable to the same value in each exploit again.
‫If you use set command, you can globally set a variable value.
‫And by using the get G- command, you can get the global value of a variable.
‫And then simply, you can unset a global variable by using the unset G command.
‫Now, after setting all the variables, you can get the exploit to execute by either using the run or
‫the exploit commands.
‫It actually doesn't matter.
‫So these messages here show what's going on in the background.
‫And you will also be informed by Métis boy if a session is open.
‫So now I have this session, and by taping the Sessions command, I will list my available sessions.
‫And as expected, I have only this one now to interact with that session type sessions as your command
‫with the eye parameter and then.
‫An index of this session appears.
‫In my case, it's three.
‫OK, so now I'm in the Metro Operator Show.
‫Later, you're going to have your deep dive in an interpreter, I promise.
‫But for now, I'm going to only show you that I have exploited them at exploitable to.
‫Then let's type in background to turn back to the MSF console again.