search
LinkedInExploit ADHackTheBox

Databases

Databases in msfconsole are used to keep track of your results. It is no mystery that during even more complex machine assessments, much less entire networks, things can get a little fuzzy and complicated due to the sheer amount of search results, entry points, detected issues, discovered credentials, etc.

This is where Databases come into play. Msfconsole has built-in support for the PostgreSQL database system. With it, we have direct, quick, and easy access to scan results with the added ability to import and export results in conjunction with third-party tools.

hashtag
Setting up the Database

First, we must ensure that the PostgreSQL server is up and running on our host machine. To do so, input the following command:

[!bash!]$ sudo service postgresql status

● postgresql.service - PostgreSQL RDBMS
     Loaded: loaded (/lib/systemd/system/postgresql.service; disabled; vendor preset: disabled)
     Active: active (exited) since Fri 2022-05-06 14:51:30 BST; 3min 51s ago
    Process: 2147 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
   Main PID: 2147 (code=exited, status=0/SUCCESS)
        CPU: 1ms

May 06 14:51:30 pwnbox-base systemd[1]: Starting PostgreSQL RDBMS...
May 06 14:51:30 pwnbox-base systemd[1]: Finished PostgreSQL RDBMS.
[!bash!]$ sudo systemctl start postgresql

After starting PostgreSQL, we need to create and initialize the MSF database with msfdb init.

[!bash!]$ sudo msfdb init

[i] Database already started
[i] The database appears to be already configured, skipping initialization

If the initialization is skipped and Metasploit tells us that the database is already configured, we can recheck the status of the database.

After the database has been initialized, we can start msfconsole and connect to the created database simultaneously.

hashtag
To reinitiate the database

We can issue the help command to get more options on the database

hashtag
Using the Database

After confirming that the database is successfully connected, we can organize our Workspaces.

We can think of Workspaces the same way we would think of folders in a project. We can segregate the different scan results, hosts, and extracted information by IP, subnet, network, or domain.

To view the current Workspace list, use the workspace command. Adding a -a or -d switch after the command, followed by the workspace's name, will either add or delete that workspace to the database.

Here we see the default workspace called default and has * symbol meaning it is running:

Lets add another workspace

To see what else we can do in workspace use -h

hashtag
Importing Scan Results

Next, let us assume we want to import a Nmap scan of a host into our Database's Workspace to understand the target better. We can use the db_import command for this. After the import is complete, we can check the presence of the host's information in our database by using the hosts and services commands. Note that the .xml file type is preferred for db_import.

hashtag
Using Nmap inside MSFconsole

Alternatively, we can use Nmap straight from msfconsole! To scan directly from the console without having to background or exit the process, use the db_nmap command.

This will run nmap similarly.

hashtag
Data Backup

After finishing the session, make sure to back up our data if anything happens with the PostgreSQL service. To do so, use the db_export command.

It can then be imported back in msf db

hashtag
The Database

hashtag
Hosts

The hosts command displays a database table automatically populated with the host addresses, hostnames, and other information we find about these during our scans and interactions. Tools like Nessus, NexPose, or Nmap will help us in these cases.

Hosts can also be manually added as separate entries in this table. After adding our custom hosts, we can also organize the format and structure of the table, add comments, change existing information, and more.

hashtag
Services

The services command functions the same way as the previous one. It contains a table with descriptions and information on services discovered during scans or interactions. In the same way as the command above, the entries here are highly customizable.

hashtag
Credentials

The creds command allows you to visualize the credentials gathered during your interactions with the target host. We can also add credentials manually, match existing credentials with port specifications, add descriptions, etc.

hashtag
Loot

The loot command works in conjunction with the command above to offer you an at-a-glance list of owned services and users. The loot, in this case, refers to hash dumps from different system types, namely hashes, passwd, shadow, and more.

PreviousEncodersNextPlugins & Mixins

Last updated