Metasploit Operations Notes

These notes cover using Metasploit in test environments such as HTB. Resource scripts (.rc) automate connection setup, while target-specific values live in separate profiles. Do not keep credentials or tickets in Git.

The reference code is in the repository’s packages/metasploit-framework directory. The referenced upstream commit is:

• Repository: rapid7/metasploit-framework
• Commit: 2d664636002d3bfee1451c6832469f2756c54d4a (short form: 2d66463600; 2026-10-08)

Changes after this commit are not included in the referenced version. When using commands or APIs, also check the bundled tree’s update history.

These commands include credential extraction, relay, remote execution, persistence, and other features that can have a substantial impact on target systems. Use them only in a test environment or one for which you have explicit authorization.

Operations

#	Purpose	Page
0	Workspaces, msfdb, db_nmap, setg, and the working directory	Basics and the Database
1	Placement and reuse of .rc files	Resource Scripts
2	SSH / WinRM login and Meterpreter upgrade	SSH / WinRM Login
3	Reverse-shell listeners and upgrading to Meterpreter	Handlers and Listeners
4	Shells, PowerShell, and port forwarding from Meterpreter	Meterpreter Operations
5	A full TTY for vim / tmux outside Meterpreter	Fully Interactive TTY
—	Misidentified options, failed upgrades, reachability, and PTY failures	Troubleshooting

Writing Modules

Purpose	Page
Starting point and decision table	Writing Modules
Shared steps, one at a time	Shared Steps
Exploit	Exploit
Auxiliary	Auxiliary
Post	Post
Mixins and APIs	Mixins and APIs
Helper functions	Helper Functions
Using send_request_cgi	send_request_cgi

Working conventions

• rc/: Templates tracked in Git. Do not put secrets here.
• profiles/: Per-target values such as RHOSTS and LHOST. Do not track in Git.
• logs/: Destination for spool output.
• loot/: Storage for important files collected manually or moved from Metasploit loot.
• Write readable, multiline .rc files. For commands pasted into msfconsole, run one line such as run verbose=true option=value.

~/lab/
├── msf/
│   ├── rc/
│   ├── profiles/
│   ├── logs/
│   └── loot/
└── notes/

Metasploit’s own database, configuration, and loot are mixed under ~/.msf4. Keeping custom scripts and per-target records under ~/lab makes them easier to find after SSH login and gives rsync one location to copy to the host OS.

Minimal startup example

msfconsole -q -r ~/lab/msf/profiles/target.local.rc

After startup, run show options for each module. Option names and defaults, including CreateSession, DOMAIN, RPORT, and payload options, may vary by Metasploit version.

Boundaries when in doubt

• Do not save SSH / WinRM credentials in .rc files.
• In Meterpreter, treat listeners and upgrades from existing sessions as separate tasks.
• Avoid automating too much enumeration or privilege escalation at once. On difficult targets, important output can get buried.
• Treat a bind shell as a payload that listens on the target and is contacted from Kali.
• Inspect Kerberos tickets with klist first, then use a separate procedure if needed. Do not force ticket operations into WinRM / SSH login scripts.