X-MET
Metasploit
Open-source exploitation framework for developing and running exploits, generating payloads, and running post-exploitation modules.
OVERVIEW
The Metasploit Framework (github.com/rapid7/metasploit-framework, maintained by Rapid7) is the standard open-source exploitation platform: thousands of maintained exploit, auxiliary, and post-exploitation modules, a payload/encoder library, and the msfconsole interface that ties them together with target/option handling, session management, and scripting via Ruby. Given a matching vulnerability and target, it turns 'this service is vulnerable to CVE-X' into a working session in a handful of commands rather than a custom exploit written from scratch.
Its Meterpreter payload is the framework's signature post-exploitation tool: an in-memory agent with file system, process, network, and privilege-escalation modules that operates without touching disk in its default form, making it the usual next step after an exploit lands during an authorized engagement.
USE CASES
Practical use cases
- 01
Running a matching exploit module against a vulnerability confirmed during enumeration.
- 02
Generating and delivering a payload as part of a phishing or physical-access engagement scenario.
- 03
Using Meterpreter for post-exploitation: privilege escalation, lateral movement, and evidence collection.
- 04
Validating that a patched or mitigated vulnerability is actually no longer exploitable (regression testing).
QUICK START
Once a vulnerability has been identified and exploitation is authorized, to run a matching module, deliver a payload, and pivot into post-exploitation.
- Confirm exploitation of the specific target and vulnerability is explicitly authorized in the rules of engagement.
- Launch msfconsole and search for a module matching the identified service/CVE.
- Set the required options (RHOSTS, target, payload) and review them before running.
- Run the module and, on success, interact with the resulting session (Meterpreter or shell).
- Document the exact module, options, and outcome for the report, and clean up any dropped artifacts.
msfconsole -q -x "search type:exploit cve:2021-XXXX; exit"BEFORE YOU RUN IT
What to check before running it
Every exploit and payload module runs against a live target — confirm the specific host, port, and module are in scope before executing, since some modules can crash or destabilize the service they target.
Public Metasploit modules and default Meterpreter payloads are heavily signatured by mainstream AV/EDR — expect detection/blocking on a hardened target and treat a lack of detection as a separate finding worth noting, not an assumption to rely on.
Sessions and any files/persistence dropped during post-exploitation need to be tracked and cleaned up at the end of the engagement per the agreed rules of engagement.