### View msfrpc-client example scripts

Source: https://docs.rapid7.com/metasploit/rpc-api

Locate and list the example scripts provided with the msfrpc-client gem installation.

```bash
# cd `gem env gemdir`/gems/msfrpc-client-*/examples
# ls
```

--------------------------------

### Launch Pro Console on Windows

Source: https://docs.rapid7.com/metasploit/about-the-pro-console

Navigate to the installation directory and execute the batch file to start the console.

```bash
$ cd /metasploit
$ console.bat
```

--------------------------------

### Install and Run MSFRPC-Client

Source: https://docs.rapid7.com/metasploit/running-metasploit-remotely

Installs the required gem and executes the example IRB script with specific RPC credentials.

```bash
gem install msfrpc-client
cd `gem env gemdir`/gems/msfrpc-client-[tab]/examples
ruby ./msfrpc_irb.rb --rpc-user [USER] --rpc-pass [PASS] --rpc-port 50505 --rpc-token [API KEY] --rpc-ssl false
```

--------------------------------

### Execute Metasploit Installer

Source: https://docs.rapid7.com/metasploit/installing-metasploit-pro

Run the installer with root privileges to begin the installation process.

```bash
sudo ./metasploit-latest-linux-x64-installer.run
```

--------------------------------

### Install Metasploit on Linux

Source: https://docs.rapid7.com/metasploit/installing-the-metasploit-framework

Download and execute the installation script to set up the framework on Linux systems.

```bash
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall
```

--------------------------------

### Start Metasploit Services

Source: https://docs.rapid7.com/metasploit/managing-metasploit

Starts the Metasploit service suite.

```bash
'/opt/metasploit/ctlscript.sh start'
```

--------------------------------

### Execute Metasploit Installer

Source: https://docs.rapid7.com/metasploit/installing-metasploit-pro

Run the installer with or without root privileges.

```bash
$ sudo ./metasploit-latest-linux-x64-installer.run
or
$ ./metasploit-latest-linux-x64-installer.run
```

--------------------------------

### Launch msfconsole on Windows

Source: https://docs.rapid7.com/metasploit/installing-the-metasploit-framework

Execute the batch file from the command line to start the Metasploit console after installation.

```bash
$ msfconsole.bat
```

--------------------------------

### Start Specific Service

Source: https://docs.rapid7.com/metasploit/managing-metasploit

Starts an individual service component.

```bash
'/opt/metasploit/ctlscript.sh start worker'
```

--------------------------------

### Download Metasploit Installer

Source: https://docs.rapid7.com/metasploit/installing-metasploit-pro

Use wget to download the latest Linux installer package.

```bash
$ wget https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run
```

--------------------------------

### Metasploit Console Startup Output

Source: https://docs.rapid7.com/metasploit/installing-the-metasploit-framework

Example output displayed when the Metasploit console initializes successfully.

```text
Creating database at /Users/joesmith/.msf4/db
Starting Postgresql
Creating database users
Creating initial database schema
 
** Metasploit Framework Initial Setup Complete **
 
[*] Starting the Metasploit Framework console...-[*] The initial module cache will be built in the background, this can take 2-5 minutes...
/
 
Metasploit Park, System Security Interface
Version 4.0.5, Alpha E
Ready...
> access security
access: PERMISSION DENIED.
> access main security grid
access: PERMISSION DENIED....and...
YOU DIDN'T SAY THE MAGIC WORD!
YOU DIDN'T SAY THE MAGIC WORD!
=[ metasploit v4.11.0-dev [core:4.11.0.pre.dev api:1.0.0]]
+ -- --=[ 1454 exploits - 827 auxiliary - 229 post ]
+ -- --=[ 376 payloads - 37 encoders - 8 nops ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
msf >
```

--------------------------------

### Install librex and msfrpc-client gem

Source: https://docs.rapid7.com/metasploit/rpc-api

Install the required dependencies and the msfrpc-client gem to enable RPC communication.

```bash
# gem install librex --no-rdoc --no-ri
```

```bash
# gem install msfrpc-client
```

--------------------------------

### Launch Metasploit on Windows

Source: https://docs.rapid7.com/metasploit/managing-metasploit

Navigate to the installation directory and execute the console batch file.

```bash
$ msf > cd /metasploit $ msf > console.bat
```

--------------------------------

### Initiate Data Collection Request

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Example of the RPC request structure for starting a collection task with specific parameters.

```ruby
[ "pro.start_collect", "<token>",
  {
  "workspace" => "Project1",
  "DS_SESSIONS" => "100 101 102",
  "DS_COLLECT_SYSINFO" => true,
  "DS_COLLECT_PASSWD" => true,
  "DS_COLLECT_SCREENSHOTS" => true,
  "DS_COLLECT_SSH" => true,
  "DS_COLLECT_FILES" => false
  }
]
```

--------------------------------

### Set Installer Permissions

Source: https://docs.rapid7.com/metasploit/installing-metasploit-pro

Change the file mode to make the installer executable.

```bash
user@ubuntu:~4 chmod +x ./metasploit-latest-linux-x64-installer.run
```

--------------------------------

### Launch Pro Console on Linux

Source: https://docs.rapid7.com/metasploit/about-the-pro-console

Navigate to the installation directory and execute the console with root privileges.

```bash
$ cd /opt/metasploit
$ sudo msfpro
```

--------------------------------

### Start Database Using Configuration File

Source: https://docs.rapid7.com/metasploit/managing-the-database

Use the -y flag to point to your custom configuration file when connecting to the database.

```bash
msf > db_connect -y /opt/metasploit/config/database.yml
```

--------------------------------

### Set Installer Permissions

Source: https://docs.rapid7.com/metasploit/installing-metasploit-pro

Change the file mode to make the downloaded installer executable.

```bash
$ chmod +x ./metasploit-latest-linux-x64-installer.run
```

--------------------------------

### Launch Metasploit on Linux

Source: https://docs.rapid7.com/metasploit/managing-metasploit

Navigate to the installation directory and execute the console with root privileges.

```bash
$ msf > cd /opt/metasploit $ msf > sudo msfpro
```

--------------------------------

### Workspaces Index Request Example

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

A sample URL for fetching all workspaces from a local Metasploit instance.

```text
https://localhost:3790/rest_api/v2/workspaces
```

--------------------------------

### Initiate a Nexpose scan

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Example request structure for starting a new Nexpose scan using the pro.start_nexpose method.

```ruby
[ "pro.start_nexpose", "<token>",
  {
  "workspace" => "Project1",
  "DS_WHITELIST_HOSTS" => "192.168.0.0/24",
  "DS_NEXPOSE_HOST" => "127.0.0.1",
  "DS_NEXPOSE_PORT" => 3780,
  "DS_NEXPOSE_USER" => "nxadmin",
  "nexpose_pass" => "s3cr3t",
  "DS_SCAN_TEMPLATE" => "pentest-audit"
  }
]
```

--------------------------------

### Power on Metasploitable 3

Source: https://docs.rapid7.com/metasploit/setting-up-a-vulnerable-target

Use this command within the workspace directory to start the virtual machine.

```bash
cd metasploitable3-workspace
vagrant up
```

--------------------------------

### Start msfconsole on Linux

Source: https://docs.rapid7.com/metasploit/installing-the-metasploit-framework

Run the console executable from the terminal.

```bash
$ ./msfconsole
```

--------------------------------

### Host JSON Response Example

Source: https://docs.rapid7.com/metasploit/rest-api

Example of the JSON object returned when querying for host details within a workspace.

```json
{
"id":1,
"created_at":"2015-04-07T13:02:26-07:00",
"address":"10.20.33.22",
"mac":"",
"comm":null,
"name":"host2",
"state":"alive",
"os_name":"",
"os_flavor":"",
"os_sp":"", "os_lang":null,
"arch":null, "workspace_id":1,
"updated_at":"2015-04-07T13:02:26-07:00",
"purpose":"", "info":null,
"comments":null,
"scope":null,
"virtual_host":null,
"note_count":0,
"vuln_count":0,
"service_count":0,
"host_detail_count":0,
"exploit_attempt_count":0,
"cred_count":0,
"nexpose_data_asset_id":null,
"history_count":0,
"detected_arch":null
}
```

--------------------------------

### Download Metasploit Linux Installer

Source: https://docs.rapid7.com/metasploit/installing-metasploit-pro

Use wget to download the latest Metasploit installer for Linux x64 systems.

```bash
wget https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run
```

--------------------------------

### Example log file output

Source: https://docs.rapid7.com/metasploit/find-recently-changed-logs

Sample output showing the file paths returned after running the search command.

```text
/opt/metasploit/apps/pro/engine/prosvc_stdout.log
/opt/metasploit/apps/pro/engine/license.log
/opt/metasploit/apps/pro/engine/log/audit.log
/opt/metasploit/apps/pro/engine/log/production.log
```

--------------------------------

### Start Metasploit services via control script

Source: https://docs.rapid7.com/metasploit/restarting-metasploit-services

Commands to start the entire Metasploit suite or a specific service using the control script.

```bash
 /opt/metasploit/ctlscript.sh start
```

```bash
  /opt/metasploit/ctlscript.sh start worker
```

--------------------------------

### Install updates with pro.update_install

Source: https://docs.rapid7.com/metasploit/pro-updates-api

Initiates the download and installation of a specific update version. Requires a subsequent call to pro.restart_service to finalize the update.

```json
[ "pro.update_install", "<token>", { "version" => "20120125000001" } ]
```

```json
{
"status" => "success",
"result" => "Downloading",
"error" => ""
}
```

--------------------------------

### Start MSFRPCD Utility

Source: https://docs.rapid7.com/metasploit/running-metasploit-remotely

Executes the RPC daemon directly from the Framework directory.

```bash
$ ruby msfrpcd -U <USERNAME> -P <PASSWORD> -f
```

--------------------------------

### Workspace Show Request Example

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

A sample URL for fetching workspace details for ID 1.

```text
https://localhost:3790/rest_api/v2/workspaces/1
```

--------------------------------

### Workspace JSON Response Example

Source: https://docs.rapid7.com/metasploit/rest-api

Example of the JSON object returned when querying for workspace details.

```json
{
"id":1,
"name":"default",
"boundary":null,
"description":null,
"owner_id":null,
"limit_to_network":false,
"created_at":"2015-04-07T11:51:23-07:00",
"updated_at":"2015-04-07T11:51:23-07:00"
}
```

--------------------------------

### Start Metasploit Daemon

Source: https://docs.rapid7.com/metasploit/running-metasploit-remotely

Launches the msfd utility to enable remote daemon access.

```bash
$ ruby msfd -a 0.0.0.0
```

--------------------------------

### Install Xvfb on Linux

Source: https://docs.rapid7.com/metasploit/social-engineering-campaigns-report-image-broken

Commands to install the virtual frame buffer package required for generating report image previews.

```bash
$ sudo apt-get install xvfb
```

```bash
$ sudo yum install xorg-x11-server-xvfb
```

--------------------------------

### Start the Metasploit RPC server

Source: https://docs.rapid7.com/metasploit/rpc-api

Run the msfrpcd tool from the framework directory to initialize the RPC interface with specified credentials.

```bash
# ruby msfrpcd -U <username> -P <username> -f
```

```bash
# ruby msfrpcd -U user -P pass123
```

--------------------------------

### pro.import_file

Source: https://docs.rapid7.com/metasploit/pro-import-api

Starts a new import task with the supplied server-local path.

```APIDOC
## pro.import_file

### Description
The pro.import_file method starts a new import task with the supplied server-local path.

### Request Example
[ "pro.import_file", "<token>", "Project1", "/home/data/report.xml",
  {
  'blacklist_hosts' => '',
  'preserve_hosts' => false
  }
]

### Response
#### Success Response
- **task_id** (string) - The ID of the started import task.

#### Response Example
{ "task_id" => "109" }
```

--------------------------------

### Initiate a report generation task

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Example of calling the pro.report_start method with required parameters including workspace, name, report type, creator, and file format.

```ruby
[ "pro.report_start", "<token>",
  {
  workspace: workspace_name,
  name: "default_#{Time.now.to_i}",
  report_type: :audit,
  created_by: 'whoareyou',
  file_formats: [:pdf]
  }
]
```

--------------------------------

### Install Missing Dependencies

Source: https://docs.rapid7.com/metasploit/msf-overview

Run this command if the console fails to launch due to missing Ruby gems.

```bash
$ bundle install
```

--------------------------------

### Credential List Syntax Example

Source: https://docs.rapid7.com/metasploit/bruteforce-attacks

Demonstrates the required format for credential pairs, including blank usernames and multiple passwords per user.

```text

username
`<BLANK>` password
username password
username password1 password2
```

--------------------------------

### Hosts Index Request Example

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

A sample URL for fetching all hosts associated with workspace ID 1.

```text
https://localhost:3790/rest_api/v2/workspaces/1/hosts
```

--------------------------------

### Request pro.revert_license

Source: https://docs.rapid7.com/metasploit/pro-license-api

Example request format for the pro.revert_license method.

```json
[ "pro.license", "<token>"]
```

--------------------------------

### MessagePack Encoding Example

Source: https://docs.rapid7.com/metasploit/rpc-api

Demonstrates the binary representation of a MessagePack encoded array.

```ruby
["ABC", 1, 2, 3].to_msgpack()
 "\x94\xA3\x41\x42\x43\x01\x02\x03"
```

--------------------------------

### Request pro.modules

Source: https://docs.rapid7.com/metasploit/pro-module-api

Example of the JSON-RPC request format for retrieving modules of a specific type.

```json
[ "pro.modules", "<token>", "post" ]
```

--------------------------------

### Response pro.modules

Source: https://docs.rapid7.com/metasploit/pro-module-api

Example of the JSON response structure containing module metadata.

```json
{"modules" =>
{ "post/linux/gather/checkvm" =>
  {"type" => "post",
  "name" => "Linux Gather Virtual Environment Detection",
  "rank" => 300,
  "description" => "Long description…",
  "license" => "Metasploit Framework License (BSD)",
  "filepath" => "[…]post/linux/gather/checkvm.rb",
  "version" => "13173",
  "arch" => [],
  "platform" => ["Msf::Module::Platform::Linux"],
  "references" => [],
  "authors" => ["Carlos Perez <carlos_perez[at]darkoperator.com>"],
  "privileged" => false}, …
  }
}
}
```

--------------------------------

### Manage Reports via RPC

Source: https://docs.rapid7.com/metasploit/sample-usage-of-the-rpc-api

Provides examples for listing report types, downloading report artifacts, and initiating report generation.

```ruby
# Examples of report listing, download, and generation via RPC API.
#
# Usage:
# ruby report_api_test.rb <SERVICE KEY> <MSPro instance> '<WorkspaceName>'
#
# Service key: Generate an API token from Global Settings, requires
# Pro licensed instance.
# MSPro instance: 127.0.0.1 if running locally
#
#
 
require_relative 'metasploit_rpc_client'
 
# Setup stuff from CLI
api_token = ARGV[0]
host = ARGV[1]
workspace_name = ARGV[2]
 
# Make the client
client = MetasploitRPCClient.new(host:host, token:api_token, ssl:false, port:50505)
 
## Reports
# List report types
type_list = client.call('pro.list_report_types')
puts "Allowed Report types: \n#{type_list}"
 
# List current reports
# report_list = client.call('pro.report_list', workspace_name)
# puts "\n\nExisting Reports: #{report_list}\n"
 
# Download report artifact
# report_artifact_id = 1
# artifact = client.call('pro.report_artifact_download', report_artifact_id)
# tmp_path = "/tmp/report_#{report_artifact_id}#{File.extname(artifact['file_path'])}"
# File.open(tmp_path, 'w') {|c| c.write artifact['data']}
# puts "Wrote report artifact #{report_artifact_id} to #{tmp_path}"
 
# Create a report
# report_hash = {workspace: workspace_name,
# name: "SuperTest_#{Time.now.to_i}",
# report_type: :audit,
# #se_campaign_id: 1,
# created_by: 'whoareyou',
# file_formats: [:pdf]
# }
# report_creation = client.call('pro.start_report', report_hash)
# puts "\n\nCreated report: \n#{report_creation}"
 
## Download report and child artifacts
# report_id = 1
# report = client.call('pro.report_download', report_id)
# report['report_artifacts'].each_with_index do |a, i|
# tmp_path = "/tmp/report_test_#{i}_#{Time.now.to_i}#{File.extname(a['file_path'])}"
# File.open(tmp_path, 'w') {|c| c.write a['data']}
# puts "Wrote report artifact #{report_id} to #{tmp_path}"
# end
```

--------------------------------

### Perform Import Request

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Example of initiating an import task for a Nexpose Export XML file.

```ruby

[ "pro.start_import", "<token>",
  {
  "workspace" => "Project1",
  "DS_PATH" => "/tmp/nexpose.xml"
  }
]
```

--------------------------------

### Response pro.revert_license

Source: https://docs.rapid7.com/metasploit/pro-license-api

Example response object returned after a successful license revert operation.

```json
{
"result" => "success",
"product_key" => "XXXX-XXXX-XXXX-XXXX",
"product_serial" => "4dde9e80-c0b2cb0b-6d31b554",
"product_type" => "Metasploit Pro",
"product_version" => "4.11.0",
"product_revision" => "1",
"registered" => true,
"activated" => true,
"expiration" => 1325376000,
"person" => "Licensed Person",
"organization" => "Licensed Organization",
"email" => "bob_admin@example.org",
"users" => 5,
"hardware" => false
}
```

--------------------------------

### Requesting Hosts via cURL

Source: https://docs.rapid7.com/metasploit/rest-api

Example of a GET request to retrieve a list of hosts, requiring a valid API token in the header.

```bash
$ curl -H "token:6bde125560088033c618c2app234" https://localhost:3790/rest_api/v2/workspaces/1/hosts
```

--------------------------------

### Initialize RPC Client

Source: https://docs.rapid7.com/metasploit/rpc-api

Sets up the client connection by requiring the necessary library and instantiating the MetasploitRPCClient with connection parameters.

```ruby
# Set up client
 
require_relative 'metasploit_rpc_client'
client = MetasploitRPCClient.new(host:host, token:api_token, ssl:false, port:50505)
```

--------------------------------

### pro.update_install

Source: https://docs.rapid7.com/metasploit/pro-updates-api

Installs an update package by specifying the version. The process is asynchronous and can be tracked via pro.update_status.

```APIDOC
## pro.update_install

### Description
Installs an update package by name. The download and installation process is completed as a single step. Note that pro.restart_service must be called to finalize the update.

### Parameters
- **InstallOptions** (hash) - Required - Must include 'version' element. Optionally includes proxy settings: 'proxy_host', 'proxy_port', 'proxy_user', and 'proxy_pass'.

### Request Example
[ "pro.update_install", "<token>", { "version" => "20120125000001" } ]

### Response
#### Success Response
- **status** (string) - Indicates success status.
- **result** (string) - Current status of the installation.
- **error** (string) - Error message if applicable.
```

--------------------------------

### Perform Discovery Scan Requests

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Examples of initiating a discovery scan with default settings versus a custom port range.

```ruby

[ "pro.start_discover", "<token>",
  {
  "ips" => [ "192.168.0.0/24" ],
  "workspace" => "Project1"
  }
]
```

```ruby

[ "pro.start_discover", "<token>",
  {
  "ips" => [ "192.168.0.0/24" ],
  "workspace" => "Project1",
  "DS_PORTS_CUSTOM" => "1-65535"
  }
]
```

--------------------------------

### MSGRPC Service Response

Source: https://docs.rapid7.com/metasploit/running-metasploit-remotely

Example output showing the connection details after successfully loading the msgrpc plugin.

```text
[*] MSGRPC Service: 127.0.0.1:55552
[*] MSGRPC Username: msf
[*] MSGRPC Password: abc123
[*] Successfully loaded plugin: msgrpc
```

--------------------------------

### pro.activate

Source: https://docs.rapid7.com/metasploit/pro-license-api

Activates the Metasploit Pro installation using the previously registered product key. Supports optional proxy configuration.

```APIDOC
## pro.activate

### Description
Attempts an online activation of the Metasploit Pro installation. If a product_key is provided in the options, it will be registered before activation.

### Parameters
- **token** (string) - Required - Authentication token.
- **ActivationOptions** (hash) - Optional - Configuration for activation, including optional proxy settings ('proxy_host', 'proxy_port', 'proxy_user', 'proxy_pass') or 'product_key'.

### Request Example
[ "pro.activate", "<token>", { "proxy_host" => "1.2.3.4", "proxy_port" => 80 } ]

### Response
- **result** (string) - Status of the activation (success or failure).
- **reason** (string) - Reason for failure if result is failure.
- **activated** (boolean) - Final activation status.
```

--------------------------------

### Import File with pro.import_file

Source: https://docs.rapid7.com/metasploit/pro-import-api

Starts an import task using a server-local file path. Ensure the file is accessible by the server.

```ruby
[ "pro.import_file", "<token>", "Project1", "/home/data/report.xml",
  {
  'blacklist_hosts' => '',
  'preserve_hosts' => false
  }
]
```

```json
{ "task_id" => "109" }
```

--------------------------------

### Add a Workspace via RPC

Source: https://docs.rapid7.com/metasploit/sample-usage-of-the-rpc-api

Demonstrates how to initialize the RPC client and add a new workspace with specific network boundaries and descriptions.

```ruby
#
# NOTE: Workspace and Project are the same thing.
#
require_relative 'metasploit_rpc_client'
workspace_attrs = {
 
name: "FooCorp Pentest",
limit_to_network: true,
boundary: "10.2.3.1-10.2.3.24",
description: "A test of FooCorp's mission-critical internal Quake LAN."
}
 
# Setup stuff from CLI
api_token = ARGV[0]
host = ARGV[1]
 
# Make the client - set ssl to true in install environments
client = MetasploitRPCClient.new(host:host, token:api_token, ssl:false, port:50505)
client.call "pro.workspace_add", workspace_attrs
```

--------------------------------

### Define Database Configuration Settings

Source: https://docs.rapid7.com/metasploit/managing-the-database

Add these parameters to your database.yml file. Ensure the attributes match your specific PostgreSQL installation details.

```yaml
development:
adapter: "postgresql"
database: "msf_database"
username: "msf_user"
password: "123456"
port: 5432
host: "localhost"
pool: 256
timeout: 5

production:
adapter: "postgresql"
database: "msf_database"
username: "msf_user"
password: "123456"
port: 5432
host: "localhost"
pool: 256
timeout: 5
```

--------------------------------

### Load MSGRPC Plugin with Custom Configuration

Source: https://docs.rapid7.com/metasploit/rpc-api

Command to initialize the MSGRPC server with specific host, port, and authentication credentials.

```text
msf > load msgrpc ServerHost=192.168.1.0 ServerPort=55553 User=user Pass='pass123'
```

--------------------------------

### Web Vulnerability Show Example

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

An example URL for requesting a specific web vulnerability by ID.

```text
https://localhost:3790/rest_api/v2/workspaces/1/hosts/1/services/1/web_sites/1/web_pages/web_vulns/1
```

--------------------------------

### Create a project

Source: https://docs.rapid7.com/metasploit/working-with-projects

Use the -a option with the pro_project command to create a new project. The newly created project automatically becomes the active project.

```bash
msf-pro > pro_project -a HR
msf-pro > pro_project -a IT
msf-pro > pro_project -a ACC
 
default
HR
IT
*ACC
```

--------------------------------

### Show Module Options

Source: https://docs.rapid7.com/metasploit/manual-exploitation

Lists available configuration options for the currently loaded module.

```text
msf-pro > use exploit/windows/wins/ms04_045_wins
msf-pro exploit (ms04_045_wins) > show options
```

--------------------------------

### Display getsystem Help

Source: https://docs.rapid7.com/metasploit/meterpreter-getsystem

Displays the help menu and available options for the getsystem command.

```bash
meterpreter > getsystem -h
Usage: getsystem [options]
Attempt to elevate your privilege to that of local system.
OPTIONS:
 
    -h        Help Banner.
    -t  The technique to use. (Default to '0').
  0 : All techniques available
  1 : Service - Named Pipe Impersonation (In Memory/Admin)
  2 : Service - Named Pipe Impersonation (Dropper/Admin)
  3 : Service - Token Duplication (In Memory/Admin)
```

--------------------------------

### Install Offline Update Package

Source: https://docs.rapid7.com/metasploit/pro-updates-api

Installs an update package from the local filesystem. Requires a subsequent call to pro.restart_service to finalize.

```json
[ "pro.update_install_offline", "<token>", "/tmp/metasploit_pro_update.zip" ]
```

```json
{
"status" => "success",
"result" => "Installing",
"error" => ""
}
```

--------------------------------

### Initiate Bruteforce Task Request

Source: https://docs.rapid7.com/metasploit/pro-feature-api

A sample JSON-RPC style request to start a new brute force task with specific configuration parameters.

```json
[ "pro.start_bruteforce", "<token>",
  {
  "workspace" => "Project1",
  "DS_WHITELIST_HOSTS" => "192.168.0.0/24",
  "DS_BRUTEFORCE_SCOPE" => "defaults",
  "DS_BRUTEFORCE_SERVICES" => "SSH HTTP",
  "DS_BRUTEFORCE_SPEED" => "TURBO",
  "DS_INCLUDE_KNOWN" => normal,
  "DS_BRUTEFORCE_GETSESSION" => true
  }
]
```

--------------------------------

### pro.start_discover

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Launches a discovery scan against a range of IP addresses, identifying active hosts and services.

```APIDOC
## pro.start_discover

### Description
This method drives the scan action within the Metasploit Pro user interface. It launches a discovery scan against a range of IP addresses and stores the results in the backend database.

### Parameters
- **ips** (array) - Required - IP addresses and/or IP ranges to include in the scan.
- **workspace** (string) - Required - The project name that this scan should be part of.
- **username** (string) - Optional - The Pro username this scan task should be attributed to.
- **DS_BLACKLIST_HOSTS** (string) - Optional - Addresses within the ips range to exclude from the scan.
- **DS_PORTSCAN_SPEED** (string) - Optional - Scan speed (Paranoid, Sneaky, Polite, Normal, Aggressive, or Insane).
- **DS_PORTS_EXTRA** (string) - Optional - Additional TCP ports to include in the scan.
- **DS_PORTS_BLACKLIST** (string) - Optional - List of ports to always exclude.
- **DS_PORTS_CUSTOM** (string) - Optional - Overrides the built-in port list to only scan these ports.
- **DS_PORTSCAN_TIMEOUT** (integer) - Optional - Maximum time in seconds to spend on a single host.
- **DS_PORTSCAN_SOURCE_PORT** (integer) - Optional - Configures the source port for the scan.
- **DS_CustomNmap** (string) - Optional - Overrides the Nmap command line.
- **DS_UDP_PROBES** (boolean) - Optional - Set to false to disable UDP service probes.
- **DS_FINGER_USERS** (boolean) - Optional - Set to false to disable finger service username harvesting.
- **DS_SNMP_SCAN** (boolean) - Optional - Set to false to disable the SNMP scanner.
- **DS_IDENTIFY_SERVICES** (boolean) - Optional - Set to false to disable the service identification phase.
- **DS_SMBUser** (string) - Optional - Username for SMB service information extraction.
- **DS_SMBPass** (string) - Optional - Password for the SMB user.

### Response
- **task_id** (string) - The ID of the task that can be monitored using the Pro task API.
```

--------------------------------

### Web Vulnerabilities Index Example

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

An example URL for requesting web vulnerabilities for a specific workspace, host, service, and web site.

```text
https://localhost:3790/rest_api/v2/workspaces/1/hosts/1/services/1/web_sites/1/web_pages/web_vulns
```

--------------------------------

### pro.import_data

Source: https://docs.rapid7.com/metasploit/pro-import-api

Starts a new import task with the supplied data.

```APIDOC
## pro.import_data

### Description
The pro.import_data method starts a new import task with the supplied data.

### Request Example
[ "pro.import_data", "<token>", "Project1", "<DATA>",
  {
  'blacklist_hosts' => '',
  'preserve_hosts' => false
  }
]

### Response
#### Success Response
- **task_id** (string) - The ID of the started import task.

#### Response Example
{ "task_id" => "109" }
```

--------------------------------

### pro.start_bruteforce

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Launches a new Bruteforce task using the provided configuration options.

```APIDOC
## pro.start_bruteforce

### Description
The pro.start_bruteforce method is used to launch a new Bruteforce task. It takes a hash of options and returns a task ID that can be monitored using the Pro task API.

### Parameters
- **workspace** (string) - Required - The project name.
- **username** (string) - Optional - The Pro username to attribute the task to.
- **DS_WHITELIST_HOSTS** (string) - Required - Addresses and network ranges to test.
- **DS_BLACKLIST_HOSTS** (string) - Optional - Addresses and network ranges to exclude.
- **DS_STOP_ON_SUCCESS** (boolean) - Required - Whether to stop testing a service after cracking the first account.
- **DS_VERBOSE** (boolean) - Optional - Whether to show diagnostic information.
- **DS_INCLUDE_KNOWN** (boolean) - Required - Whether to use previously found credentials.
- **DS_DRY_RUN** (boolean) - Optional - Whether to skip the attack and only show what would be tested.
- **DS_BRUTEFORCE_SCOPE** (string) - Required - Bruteforce mode (quick, defaults, normal, deep, known, imported, 50k).
- **DS_BRUTEFORCE_SPEED** (string) - Required - Speed setting (Glacial, Slow, Stealthy, Normal, Fast, Turbo).
- **DS_BRUTEFORCE_SERVICES** (string) - Required - Protocols to test (e.g., SMB, SSH, HTTP).
- **DS_BRUTEFORCE_GETSESSION** (boolean) - Required - Whether to use cracked accounts to gain access.
- **DS_QUICKMODE_CREDS** (string) - Optional - Additional credentials to use.
- **DS_PAYLOAD_METHOD** (string) - Optional - Connection method (auto, reverse, bind).
- **DS_PAYLOAD_TYPE** (string) - Optional - Session type (meterpreter, shell).
- **DS_PAYLOAD_PORTS** (string) - Optional - Port range for connections.
- **DS_SMB_DOMAINS** (string) - Optional - Domains for NTLM protocols.
- **DS_PRESERVE_DOMAINS** (boolean) - Optional - Whether to use original domain names.
- **DS_CRED_FILE_IDS** (integer) - Optional - IDs of imported credential files.
- **DS_MAXGUESSESPERSERVICE** (integer) - Optional - Max authentication attempts per service.
- **DS_MAXMINUTESPERSERVICE** (integer) - Optional - Max time in minutes per service.
- **DS_MAXGUESSESPERUSER** (integer) - Optional - Max guesses per unique user account.
- **DS_MAXMINUTESOVERALL** (integer) - Optional - Max time in minutes for the entire task.
```

--------------------------------

### pro.license

Source: https://docs.rapid7.com/metasploit/pro-license-api

Retrieves the current license details for the Metasploit Pro installation.

```APIDOC
## pro.license

### Description
The pro.license method returns a hash indicating the current Metasploit Pro license status and details.

### Request Example
[ "pro.license", "<token>"]

### Response
#### Success Response
- **result** (string) - Status of the operation
- **product_key** (string) - The product key
- **product_serial** (string) - The product serial number
- **product_type** (string) - The product type
- **product_version** (string) - The product version
- **product_revision** (string) - The product revision
- **registered** (boolean) - Registration status
- **activated** (boolean) - Activation status
- **expiration** (integer) - Expiration timestamp
- **person** (string) - Licensed person name
- **organization** (string) - Licensed organization name
- **email** (string) - Licensed email address
- **users** (integer) - Number of licensed users
- **hardware** (boolean) - Hardware binding status

#### Response Example
{
"result" => "success",
"product_key" => "XXXX-XXXX-XXXX-XXXX",
"product_serial" => "4dde9e80-c0b2cb0b-6d31b554",
"product_type" => "Metasploit Pro",
"product_version" => "4.11.0",
"product_revision" => "1",
"registered" => true,
"activated" => true,
"expiration" => 1325376000,
"person" => "Licensed Person",
"organization" => "Licensed Organization",
"email" => "bob_admin@example.org",
"users" => 2,
"hardware" => true
}
```

--------------------------------

### pro.start_import

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Drives the import action within Metasploit Pro to ingest data from local files or configured Nexpose consoles.

```APIDOC
## pro.start_import

### Description
Imports data into a workspace. Requires a file path or Nexpose console configuration.

### Parameters
- **token** (string) - Required - Authentication token
- **options** (hash) - Required - Configuration hash
  - **workspace** (string) - Required - Project name
  - **username** (string) - Optional - User attribution
  - **DS_PATH** (string) - Optional - Server-local file path
  - **DS_BLACKLIST_HOSTS** (string) - Optional - Excluded addresses
  - **DS_PRESERVE_HOSTS** (boolean) - Optional - Prevent modifications to existing hosts
  - **DS_REMOVE_FILE** (boolean) - Optional - Delete file after import
  - **DS_ImportTags** (boolean) - Optional - Import tags
  - **DS_NEXPOSE_CONSOLE** (string) - Optional - Nexpose console name
  - **DS_NEXPOSE_SITE** (string) - Optional - Nexpose site name

### Request Example
[ "pro.start_import", "<token>", { "workspace" => "Project1", "DS_PATH" => "/tmp/nexpose.xml" } ]

### Response
- **task_id** (string) - The ID of the created task

### Response Example
{ "task_id" => "109" }
```

--------------------------------

### GET /rest_api/v2/workspaces/:workspace_id/hosts/:host_id/sessions/:id

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

Returns a session by ID.

```APIDOC
## GET /rest_api/v2/workspaces/:workspace_id/hosts/:host_id/sessions/:id

### Description
Returns a session by ID.

### Method
GET

### Endpoint
/rest_api/v2/workspaces/:workspace_id/hosts/:host_id/sessions/:id

### Parameters
#### Path Parameters
- **workspace_id** - Required
- **host_id** - Required
- **id** - Required

### Response
#### Success Response (200)
- **id** - Session ID
- **host_id** - Host ID
- **stype** - Session type
- **via_exploit** - Exploit used
- **via_payload** - Payload used
- **desc** - Description
- **port** - Port
- **platform** - Platform
- **datastore** - Datastore
- **close_reason** - Reason for closing
- **local_id** - Local ID
- **module_run_id** - Module run ID
- **last_seen** - Last seen timestamp
- **campaign_id** - Campaign ID
- **opened_at** - Opened timestamp
- **closed_at** - Closed timestamp
```

--------------------------------

### Connect to the Database in msfconsole

Source: https://docs.rapid7.com/metasploit/managing-the-database

Use this command to establish a connection to your PostgreSQL instance. Replace the placeholder credentials and connection details with your specific database configuration.

```bash
msf > db_connect your_msfdb_user:your_msfdb_pswd@127.0.0.1:5432/msf_database
```

--------------------------------

### GET /rest_api/v2/workspaces

Source: https://docs.rapid7.com/metasploit/rest-api

Retrieves a list of all workspaces available on the Metasploit server.

```APIDOC
## GET /rest_api/v2/workspaces

### Description
Retrieves all workspaces and their details from the Metasploit server.

### Method
GET

### Endpoint
https://<Metasploit server>:3790/rest_api/v2/workspaces

### Response
#### Success Response (200)
- **id** (integer) - The unique identifier for the workspace
- **name** (string) - The name of the workspace
- **created_at** (string) - Timestamp of creation
- **updated_at** (string) - Timestamp of last update

#### Response Example
{
"id": 1,
"name": "default",
"boundary": null,
"description": null,
"owner_id": null,
"limit_to_network": false,
"created_at": "2015-04-07T11:51:23-07:00",
"updated_at": "2015-04-07T11:51:23-07:00"
}
```

--------------------------------

### Connect to the Database

Source: https://docs.rapid7.com/metasploit/managing-the-database-from-the-pro-console

Use the db_connect command to establish a connection to the database instance.

```bash
msf-pro > db_connect username:password@host:port/db
```

```bash
msf-pro > db_connect -y /opt/metasploit/config/database.yml
```

--------------------------------

### Create Initial User Account

Source: https://docs.rapid7.com/metasploit/installing-metasploit-pro

Run the createuser script from the Linux console to initialize the first user account.

```bash
user@ubuntu:~? sudo /opt/metasploit/createuser
```

--------------------------------

### API Versioning Request

Source: https://docs.rapid7.com/metasploit/rpc-api

Example of an HTTP request specifying the API version.

```http
POST /api/1.1 HTTP/1.1
Host: RPC Server
Content-Length: 128
Content-Type: binary/message-pack
<128 bytes of encoded data>
```

--------------------------------

### Error Response Format

Source: https://docs.rapid7.com/metasploit/rpc-api

Example of an error response containing error details.

```json
{
"error" => true,
"error_class" => "ArgumentError",
"error_message" => "Unknown API Call"
}
```

--------------------------------

### Successful Response Format

Source: https://docs.rapid7.com/metasploit/rpc-api

Example of a successful API response returned as a hash.

```json
{
"version" => "4.0.0-release",
"ruby" => "1.9.1 x86_64-linux 2010-01-10"
}
```

--------------------------------

### Initialize the Metasploit Database

Source: https://docs.rapid7.com/metasploit/installing-the-metasploit-framework

Use this command to configure PostgreSQL for the local user and initialize the database storage directory.

```bash
$ msfdb init
```

--------------------------------

### GET /rest_api/v2/workspaces/:workspace_id/hosts/:host_id/services

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

Returns a list of services for a particular host.

```APIDOC
## GET /rest_api/v2/workspaces/:workspace_id/hosts/:host_id/services

### Description
Returns a list of services for a particular host.

### Method
GET

### Endpoint
/rest_api/v2/workspaces/:workspace_id/hosts/:host_id/services

### Parameters
#### Path Parameters
- **workspace_id** - Required
- **host_id** - Required

### Response
#### Success Response (200)
- Returns a JSON object containing a list of services.
```

--------------------------------

### GET /rest_api/v2/workspaces/:workspace_id/hosts/:host_id/sessions

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

Returns a list of sessions for a particular host.

```APIDOC
## GET /rest_api/v2/workspaces/:workspace_id/hosts/:host_id/sessions

### Description
Returns a list of sessions for a particular host.

### Method
GET

### Endpoint
/rest_api/v2/workspaces/:workspace_id/hosts/:host_id/sessions

### Parameters
#### Path Parameters
- **workspace_id** - Required
- **host_id** - Required

### Response
#### Success Response (200)
- Returns a JSON object containing a list of sessions.
```

--------------------------------

### Chain Metasploit Pro Commands

Source: https://docs.rapid7.com/metasploit/managing-metasploit

Executes multiple commands at startup using the -x flag. Requires the -- separator to avoid option parsing errors.

```bash
$ sudo /opt/metasploit/msfpro -- -x 'setg lhost 1.2.3.4'
$ sudo /opt/metasploit/msfpro -x 'use multi/handler; set lport 3333; set lhost eth0'
```

--------------------------------

### GET /rest_api/v2/workspaces/:id

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

Returns details for a specific workspace identified by its ID.

```APIDOC
## GET /rest_api/v2/workspaces/:id

### Description
Returns a workspace by ID.

### Method
GET

### Endpoint
/rest_api/v2/workspaces/:id

### Parameters
#### Path Parameters
- **id** (string) - Required - The unique identifier of the workspace.

### Response
#### Success Response (200)
- **id** (integer)
- **name** (string)
- **boundary** (string)
- **description** (string)
- **owner_id** (integer)
- **limit_to_network** (string)
- **created_at** (string)
- **updated_at** (string)
```

--------------------------------

### Manage Metasploit Pro Projects

Source: https://docs.rapid7.com/metasploit/managing-metasploit

Commands for creating and viewing the current project context.

```bash
msf-pro > pro_project -a HR
```

```bash
msf-pro > pro_project
```

--------------------------------

### Stop Update Process

Source: https://docs.rapid7.com/metasploit/pro-updates-api

Forcibly terminates any active update download or installation process.

```json
[ "pro.update_stop", "<token>" ]
```

```json
{ "status" => "success" }
```

--------------------------------

### View msfrpc_irb.rb help options

Source: https://docs.rapid7.com/metasploit/rpc-api

Display the available command-line configuration options for the msfrpc_irb.rb script.

```bash
# ./msfrpc_irb.rb --rpc-help
```

--------------------------------

### Navigate to Metasploit Directory

Source: https://docs.rapid7.com/metasploit/backing-up-and-restoring-metasploit-data

Change the current working directory to the Metasploit installation path.

```bash
$ cd /opt/metasploit
```

--------------------------------

### List Users

Source: https://docs.rapid7.com/metasploit/managing-metasploit

Displays a list of all configured users.

```bash
msf-pro > pro_user -l
```

--------------------------------

### pro.start_discover

Source: https://docs.rapid7.com/metasploit/pro-feature-api

Initiates a discovery scan task within a specified workspace. Supports various configuration options for scan behavior.

```APIDOC
## pro.start_discover

### Description
Initiates a discovery scan task. Returns a task ID that can be monitored.

### Parameters
- **token** (string) - Required - Authentication token
- **options** (hash) - Required - Configuration hash
  - **ips** (array) - Required - List of IP ranges to scan
  - **workspace** (string) - Required - Project name
  - **DS_SMBDomain** (string) - Optional - SMB domain
  - **DS_DRY_RUN** (boolean) - Optional - If true, simulates the task without sending traffic
  - **DS_SINGLE_SCAN** (boolean) - Optional - If true, scans hosts sequentially
  - **DS_FAST_DETECT** (boolean) - Optional - If true, limits scan to a small set of TCP ports
  - **DS_PORTS_CUSTOM** (string) - Optional - Custom port range

### Request Example
[ "pro.start_discover", "<token>", { "ips" => [ "192.168.0.0/24" ], "workspace" => "Project1" } ]

### Response
- **task_id** (string) - The ID of the created task

### Response Example
{ "task_id" => "109" }
```

--------------------------------

### GET /rest_api/v2/workspaces/:workspace_id/hosts/:host_id/notes

Source: https://docs.rapid7.com/metasploit/rest-api-endpoints

Retrieves a list of notes associated with a specific host.

```APIDOC
## GET /rest_api/v2/workspaces/:workspace_id/hosts/:host_id/notes

### Description
Returns a list of notes for a particular host.

### Method
GET

### Endpoint
/rest_api/v2/workspaces/:workspace_id/hosts/:host_id/notes

### Parameters
#### Path Parameters
- **workspace_id** - Required
- **host_id** - Required

### Response
#### Success Response (200)
- Returns a JSON object.
```

--------------------------------

### GET /rest_api/v2/workspaces/:workspace_id/hosts

Source: https://docs.rapid7.com/metasploit/rest-api

Retrieves a list of all hosts associated with a specific workspace ID.

```APIDOC
## GET /rest_api/v2/workspaces/:workspace_id/hosts

### Description
Requests the host index from a specific workspace.

### Method
GET

### Endpoint
https://<Metasploit server>:3790/rest_api/v2/workspaces/:workspace_id/hosts

### Parameters
#### Path Parameters
- **workspace_id** (integer) - Required - The ID of the workspace to query

### Response
#### Success Response (200)
- **id** (integer) - The unique identifier for the host
- **address** (string) - The IP address of the host
- **name** (string) - The name of the host
- **state** (string) - The current state of the host

#### Response Example
{
"id": 1,
"address": "10.20.33.22",
"name": "host2",
"state": "alive",
"workspace_id": 1
}
```

--------------------------------

### Connect using RPC configuration file

Source: https://docs.rapid7.com/metasploit/rpc-api

Command line usage for pointing the client to a specific YAML configuration file.

```bash
# ruby ./msfrpc_irb.rb --rpc-config ./sample.yml
```

--------------------------------

### Create a new console instance

Source: https://docs.rapid7.com/metasploit/standard-api-methods-reference

Allocates a new console and returns an ID, prompt, and busy status. Treat Console IDs as unique strings.

```json
[ "console.create", "<token>"]
```

```json
{
"id" => "0",
"prompt" => "msf > ",
"busy" => false
}
```

--------------------------------

### GET /rest_api/v2/workspaces/:workspace_id/hosts

Source: https://docs.rapid7.com/metasploit/rest-api

Retrieves a list of hosts associated with a specific workspace ID.

```APIDOC
## GET /rest_api/v2/workspaces/:workspace_id/hosts

### Description
Retrieves a list of hosts for a specified workspace.

### Method
GET

### Endpoint
https://<Metasploit server>:3790/rest_api/v2/workspaces/:workspace_id/hosts

### Parameters
#### Path Parameters
- **workspace_id** (string) - Required - The unique identifier for the workspace.

### Response
#### Success Response (200)
- **id** (integer) - Host ID
- **address** (string) - IP address of the host
- **name** (string) - Host name
- **state** (string) - Current state of the host
- **workspace_id** (integer) - Associated workspace ID

#### Response Example
{
"id": 2,
"created_at": "2015-04-07T13:02:26-07:00",
"address": "10.20.33.22",
"name": "host2",
"state": "alive",
"workspace_id": 1
}
```

--------------------------------

### Configure Datastore Options

Source: https://docs.rapid7.com/metasploit/msf-overview

Commands to set configuration values in the global or module-specific datastores.

```text
setg
```

```text
set
```