Base Classes and Mixins

Once you choose a type, select the class to inherit from and the mixins to include (or prepend). The base class defines the kind of module; mixins define how it communicates and runs.

Base classes

class MetasploitModule < Msf::Exploit::Remote
  # Or Msf::Exploit::Local / Msf::Auxiliary / Msf::Post
end

Task	Base class
Deliver a payload over the network	Msf::Exploit::Remote
Use local privilege escalation in an existing session to get a new session	Msf::Exploit::Local
Operate or enumerate without opening a session	Msf::Auxiliary
Collect or administer through an existing session	Msf::Post

The current class name is MetasploitModule.

What is a mixin?

Mixins add methods and datastore options by include-ing Ruby modules. They let you use framework implementations instead of writing your own socket or HTTP client from scratch.

class MetasploitModule < Msf::Exploit::Remote
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  include Msf::Exploit::FileDropper
end

This example adds:

• HttpClient → send_request_cgi, RHOST, RPORT, SSL, etc.
• CmdStager → execute_cmdstager (requires execute_command)
• FileDropper → register_file_for_cleanup

Order of decisions

1. Communication method (HTTP / TCP / SSH / SMB / existing session)
2. Execution model (single run / multi-host scanner / authentication brute force)
3. Delivery method (CmdStager, HttpServer, FileDropper)
4. Storage (Report is often already included by HttpClient)

Communication method reference

Communication	Mixin	Typical API
HTTP(S) client	Msf::Exploit::Remote::HttpClient	send_request_cgi
Raw TCP	Msf::Exploit::Remote::Tcp	connect / sock
SSH	Msf::Exploit::Remote::SSH	SSH connection helpers
SMB	Msf::Exploit::Remote::SMB::Client and others	Shares and pipes
Malicious HTTP server	Msf::Exploit::Remote::HttpServer	Delivery to browsers
Existing session	(Inherit from Msf::Post for Common/File and others)	cmd_exec / read_file

Details: HttpClient / Tcp / SSH / SMB / HttpServer / Post mixins

Execution model reference

Model	Mixin	Entry point
Single host	(Optional)	run / exploit
Parallel multi-host	Msf::Auxiliary::Scanner	run_host(ip)
Dictionary login	Msf::Auxiliary::AuthBrute	Authentication loop + LoginScanner
Run check automatically before exploit	prepend Msf::Exploit::Remote::AutoCheck	Requires check

Combination examples

HTTP RCE exploit

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  include Msf::Exploit::FileDropper
end

HTTP banner scanner

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
end

Linux post gather

class MetasploitModule < Msf::Post
  include Msf::Post::File
  include Msf::Post::Unix
  include Msf::Auxiliary::Report
end

SSH login attempts

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::SSH
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Report
end

What to avoid

• Writing only run and omitting run_host for a Scanner module.
• Building HTTP manually using only Tcp when HttpClient is needed (hard to maintain).
• Using include for AutoCheck (use prepend).
• Registering RHOSTS / THREADS again when mixins already register them.

Next, write the metadata shown in msfconsole with update_info.