Instructor: Before we get into Metasploit framework
and its structure inside of Kali Linux
let us first talk about reverse shells and bind shells.
As we already mentioned
shell is our access to the target machine.
With the help of shell
we execute commands and control the target system.
So shell is essentially our payload
that we drop on machine after exploiting it.
However, there are two different types of shells.
We got reverse shells and bind shells.
Now, reverse shells are something that you will use a lot.
It works on principle of target machine trying to connect
back to our Kali Linux machine.
For this to work on our Kali Linux machine
we must first listen
for the incoming connection over some port.
Then we exploit the target and drop a shell
which will tell that target machine to connect
to our port on Kali Linux that we're listening on.
After it completes the connection
we can then control that machine.
On the other hand, bind shell is when the target machine
opens their port for us to connect to.
In this case, it is the target machine that is listening
for the incoming connection on that port
and we are the ones that must connect to that port.
After we do it, we can control that target machine.
However, there is one problem with bind shell
and it is also one of the main reasons
why we want to use it that much
and that is because firewall can forbid target machines
to open a port.
Many firewalls could have a rule that says
don't open any random port for security reasons.
Therefore, our bind shell would not work even
after exploiting the target.
However, reverse shells will always work.
Why?
Well, because the target
in that case is just connecting to us.
It is the same process as when the target visits a website.
It connects to a port on that web server
and it gets the webpage of that website back.
Just in this case, it'll connect
to a port on our Kali Linux machine
and we will establish a shell like that.
That's why reverse shell is always a better option
if possible.
Alright, cool.
Now we are ready to start introducing ourselves
to the Metasploit framework,
the number one tool that we will use for exploitation.
It is as important as mmap and we will use it a lot
so it is important we get its basics down first.
It is not hard.
However, it will take some practice to get used to it.
Let's get straight into it.