Hands-On Red Team Tactics

Metasploit with slack

In this section, we will learn about a module called ShellHerder. This plugin is used to monitor all Metasploit/Meterpreter sessions. It was created with a basic idea in mind: to easily monitor new incoming sessions. In a red-team activity, this is useful as it can be used to monitor live phishing campaigns or a Rubber Ducky attack.

This plugin uses session subscriptions to monitor activity and send alerts to slack. Let's take a look at how to set it up.

We clone ShellHerder and copy it to our Metasploit plugins directory using the following commands. In our case, we saved the file as notify.rb in the destination folder:

 git clone https://github.com/chrismaddalena/ShellHerder.git cp ShellHerder/ShellHerder.rb /opt/metasploit-framework/embedded/framework/plugins/notify.rb ...