INSTALLATION
UPDATE
root@oco:~$ sudo apt update && sudo apt install metasploit-framework
...
(Reading database ... 414458 files and directories currently installed.)
Preparing to unpack .../metasploit-framework_6.0.2-0parrot1_amd64.deb ...
Unpacking metasploit-framework (6.0.2-0parrot1) over (5.0.88-0kali1) ...
Setting up metasploit-framework (6.0.2-0parrot1) ...
Processing triggers for man-db (2.9.1-1) ...
Scanning application launchers
Removing duplicate launchers from Debian
Launchers are updated
* the old method of updating MSF is to issue the cmd "msfupdate" in the OS CLI
outside of msfconsoleBASE FILE
All of these locations provide easy reference and can be quickly used when the need arises to import new modules or create new ones from scratch.
BASE PATH
MODULES
These are scripts with a specific purpose and corresponding functions that have already been developed and tested in the wild.
EXPLOITS
These consists of PoCs that can be used to exploit existing vulnerabilities in a largely automated manner
PAYLOADS
A payload is a module that assist the exploit module typically to return a shell. Payloads are sent together with the exploit itself to bypass standard functioning procedures of the vulnerable service (exploits job) and then run on the target OS to typically return a reverse connection to the attacker and establish a foothold (payload's job). An exploit utilizes weakness on the target service while a payload establishes a foothold.
Payload modules: whether or not a payload is staged is represented by / in the payload name
PLUGINS
Plugins provides added flexibility by allowing extra features and automation to be loaded either manually or automatically whenever needed during an assessment.
SCRIPTS
This contains Meterpreter functionality and other useful scripts.
TOOLS
This contains command-line utilities that can be called directly from the msfconsole menu.
PAYLOADS
A payload is a module that assist the exploit module typically to return a shell. They are sent together with the exploit itself to bypass standard functioning procedures of the vulnerable service (exploits job) and then run on the target OS to typically return a reverse connection to the attacker and establish a foothold (payload's job).
PAYLOAD STAGE PROCESS
Stage0 is the small initial shellcode sent to a vulnerable service whose sole job is to establish a stable channel between the victim and attacker (commonly seen as reverse_tcp, reverse_https, or bind_tcp) and then read in a larger payload. Once the connection is up, the attacker sends the Stage1 payload which is a bigger, feature-rich payload (e.g., a shell or Meterpreter). This is loaded into memory and executed to provide the attacker with interactive access.
TYPES
Some exploits cannot deliver a large payload inline, so attackers use a small, reliable stager to bootstrap a larger stage: the stager’s job is simply to create a stable channel back to the attacker (or open a port) and then fetch and execute the full-featured payload. This separation enables flexibility. Stages such as Meterpreter offer rich post-exploitation capabilities without the strict size limits that would break an inline payload while keeping the initial exploit lightweight. It also improves reliability against modern protections: Windows “NX” vs “NO-NX” stagers differ in how they allocate and execute memory under DEP/NX constraints, and Metasploit selects the most appropriate stager for the target OS and protections to maximize the chance of successful execution.
SINGLES
These are self-contained payloads that contains the exploit and the entire shellcode for the selected task; it doesn't require follow-up download.
windows/shell_bind_tcp is a single payload with no stage
non-staged payloads (singles) have the format "meterpreter_reverse_tcp" without the "/" separator
STAGERS
These are payloads that work with Stage payloads to perform a specific task. Think of it as a small code that runs on the target to set up communications (connect back or bind) and then fetch/launch a larger stage. Metasploit will use the best one and fall back to a less-preferred one when necessary.
Windows NX vs. NO-NX Stagers
Reliability issue for NX CPUs and DEP
NX stagers are bigger (VirtualAlloc memory)
Default is now NX + Win7 compatible
STAGES
These are payload components that are downloaded by stager's modules. This is the full featured payload (Meterpreter, VNC, etc.) that the stager downloads (w/o size limits) and runs.
windows/shell/bind_tcp consists of a stager (bind_tcp) and a stage (shell)
staged payloads have the format "meterpreter/reverse_tcp"
payload stages automatically use middle stagers
A single recv() fails with large payloads
The Stager receives the middle stager
The middle Stager then performs a full download
Also better for RWX
SPECIAL PAYLOAD
Meterpreter is an advanced in-memory payload that uses DLL injection to create a stealthy, stable session on a compromised host. It runs entirely in RAM (leaving minimal disk artifacts), supports dynamic loading/unloading of scripts and plugins, and provides an interactive command interface focused on post-exploitation tasks. Once executed it opens a Meterpreter session offering capabilities like keystroke capture, credential harvesting, process token impersonation, microphone/screenshot capture, and many other post-compromise actions. It is designed to be flexible, stealthy, and powerful for assessment or exploitation workflows.
COMMON WINDOWS PAYLOADS
Critical payload frameworks used by professional penetration testers include tools like Empire and Cobalt Strike, which deliver powerful post‑exploitation capabilities and are frequently employed in red‑team engagements against high‑value targets to emulate realistic adversary behavior. Beyond those flagship frameworks, there's a wide ecosystem of payloads targeted at specific platforms and vendors (Cisco, Apple, industrial PLCs, etc.) and many custom payloads that can be generated with msfvenom. Payloads trade off delivery method, platform compatibility, stealth, and reliability. Always pick the payload that matches the objective (initial access, persistence, credential harvesting, lateral movement) and the target’s defenses.
Last updated