What is Metasploit?

The Metasploit Framework is an open-source penetration testing framework maintained by Rapid7 (the company behind InsightVM, Exposure Management, MDR and more). The official Metasploit docs can be found here.

Modules

Metasploit functionality is grouped into multiple modules, they can easily be seen via the filesystem under the metasploit-framework root directory.

kali@kali:~$ ls /usr/share/metasploit-framework/modules/
auxiliary  encoders  exploits  nops  payloads  post
  • Auxiliary - performs extra tasks such as administration, analysis, brute force, enumeration, DoS, scanning, server support. Does not exploit a target
  • Encoder - takes a raw payload and runs it through one of these encoding algorithms
  • Evasion - makes a payload more evasive to antivirus
  • NOPs - modules used for buffer overflows, generates a sequence of "No Operation" bytes
  • Payloads - generate shellcode to execute for exploitation
  • Post - modules to use after compromise for further enumeration or exfil

Helpful Commands

# launch the metasploit framework console
$ msfconsole
# display all modules in tool
msf > show
# ex. show all auxiliary options (over 1300)
msf > show auxiliary
# search for specific modules
msf > search windows ssh
# use a specific module returned from search / show
msf > use 24
# view settings required to configure for the specific module
msf > show options
# configure options listed
msf > set RHOSTS 10.120.10.10
# show advanced options that can be configured
msf > advanced
# run
msf > run

Database and Workspaces

Metasploit can be configured to store data in PostgreSQL to aggregate data for hosts in one place.

# configure postgres database for storing results
$ sudo msfdb init
# launch msfconsole with database
$ sudo msfdb run
# confirm db access
msf > db_status

# create new workspace to store results
msf > workspace -a target_name
# switch to new workspace
msf > workspace target_name
# import existing scan data into workspace
msf > db_import init_nmap.xml
# view tracked hosts in current workspace
msf > hosts
# view tracked services in current workspace
msf > services
# view tracked credentials
msf > creds
# Add a user, password and realm
msf > creds add user:admin password:notpassword realm:workgroup
# View loot (register of pwned users/services)
msf > loot
# nmap directly into database
msf > db_nmap -sV -sS 10.10.10.8

Post-Exploitation

For post-exploitation metasploit commands, go here