Basics and the Database

The essentials: workspaces, PostgreSQL (msfdb), db_nmap, the global datastore (setg), and a working directory.

Working directory

Keep HTB work under ~/lab.

~/lab/
├── msf/
│   ├── rc/             # Templates tracked in Git
│   ├── profiles/       # Per-target settings; not tracked in Git
│   ├── logs/
│   └── loot/
└── notes/              # Enumeration results, hypotheses, and procedure notes

If ~/lab is tracked in Git, these are example exclusions.

msf/profiles/*.local.rc
msf/logs/
msf/loot/
*.kirbi
*.ccache
*.pfx
*.pem
*.key

PostgreSQL and msfdb

msfconsole works without a database, but hosts, services, creds, loot, workspace, and db_nmap require a connection. The bundled msfdb provides the simplest startup path.

# From the Metasploit installation root or packages/metasploit-framework
./msfdb init
./msfdb start
./msfdb status

init creates a PostgreSQL data directory under ~/.msf4/db and writes ~/.msf4/database.yml. Check the connection after starting msfconsole.

db_status

An example of the expected output:

[*] Connected to msf. Connection type: postgresql.

Common msfdb subcommands:

Command	Purpose
msfdb init	Initialize the database and, if needed, the web service
msfdb start / stop / restart	Start, stop, or restart the database
msfdb status	Check status
msfdb reinit	Reinitialize; watch for the prompt confirming data deletion
msfdb delete	Delete the database

If the connection drops, reconnect from msfconsole.

db_connect -y ~/.msf4/database.yml
db_status

With msfdb --component webservice init, a token and certificate are issued for web service access. In a typical test environment, you can connect directly to local PostgreSQL.

Workspaces

Use a separate workspace for each target.

workspace -a paperwork
workspace paperwork
workspace

Command	Meaning
workspace	List workspaces and show the current one
workspace -a NAME	Create and switch to a workspace
workspace NAME	Switch to an existing workspace
workspace -d NAME	Delete a workspace
workspace -D	Delete all workspaces (destructive)

hosts, services, creds, vulns, loot, and notes belong to the current workspace. Switch workspaces at the start of a task to keep results from different targets separate.

db_nmap

Save nmap results directly to the Metasploit database. Keep raw output in ~/lab/notes as well.

db_nmap -sV -sC -oA ~/lab/notes/paperwork/nmap/tcp 10.10.11.123
hosts
services
services -p 22,5985,5986

To import an existing XML file:

db_import ~/lab/notes/paperwork/nmap/tcp.xml
hosts; services

After finding credentials, check the database too.

creds
vulns
loot

Reduce repeated input with setg

set applies only to the current module. setg sets a default for the whole msfconsole process, and its value persists when you switch modules.

Here is an example per-target profile at ~/lab/msf/profiles/target.local.rc. It contains no password.

workspace -a paperwork
workspace paperwork
setg RHOSTS 10.10.11.123
setg RHOST 10.10.11.123
setg LHOST 10.10.16.10
setg LPORT 4444
setg EXITFUNC thread
spool ~/lab/msf/logs/paperwork-msfconsole.log

Example startup command:

msfconsole -q -r ~/lab/msf/profiles/target.local.rc

After startup, run show options for the module selected with use, then supply only missing values through set or run arguments.

use auxiliary/scanner/ssh/ssh_login
show options
run verbose=true username=svc-user password=PASSWORD_HERE createsession=true

When moving to another target, restart msfconsole or explicitly clear the settings.

unsetg RHOSTS; unsetg RHOST; unsetg LHOST; unsetg LPORT
getg LHOST

setg values remain in the framework datastore rather than the module datastore. Using set with the same name overrides the value for that module.

Roles of spool and loot

Location	Purpose
spool	Save msfconsole input and output as-is
Database / workspace	Store and search hosts, services, credentials, and vulnerabilities as structured data
loot	Index artifacts retrieved by modules
~/lab/notes	Hypotheses, evidence, and next steps

spool ~/lab/msf/logs/paperwork-msfconsole.log
# ... work ...
spool off

spool also records input such as set PASSWORD .... Handle logs started before entering credentials with care.

If Metasploit’s default loot is stored in ~/.msf4/loot, move only important files to ~/lab/msf/loot/<target>/ and record their origin in notes/.

Next page

Move recurring operations into Resource Scripts.