metasploit-framework
This skill guides you through Metasploit Framework operations for authorized security assessments, covering exploitation, payload generation, and post-exploitation activities. Navigate msfconsole, select from exploit and auxiliary modules, configure targets and payloads, and manage Meterpreter sessions for credential harvesting and system reconnaissance.
Metasploit Framework skill executes exploits and gains initial access to target systems during authorized penetration tests.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-26
Metasploit Framework skill executes exploits and gains initial access to target systems during authorized penetration tests. This skill guides you through Metasploit Framework operations for authorized security assessments, covering exploitation, payload generation, and post-exploitation activities. Navigate msfconsole, select from exploit and auxiliary modules, configure targets and payloads, and manage Meterpreter sessions for credential harvesting and system reconnaissance.
Use it when
- msfvenom is metasploit-framework's standalone payload generator.
- metasploit-framework handles Meterpreter reverse shells through a two-step process.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
zebbern/claude-code-guide/metasploit-framework · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I use metasploit-framework for penetration testing?
metasploit-framework is a comprehensive platform for authorized security assessments. Start by launching msfconsole, then search for relevant exploit or auxiliary modules using the search command. Select your target module, set required options (RHOST, LHOST, LPORT), configure your payload, and execute. The framework guides you through each phase: reconnaissance with auxiliary scanners, exploitation to gain access, payload delivery, and post-exploitation activities like credential harvesting.
What is msfvenom and how do I create payloads with it?
msfvenom is metasploit-framework's standalone payload generator. Use it to create custom malicious payloads for delivery to target systems. Specify your payload type (e.g., windows/meterpreter/reverse_tcp), set encoder options, and define output format. Generated payloads can be embedded in documents, executables, or scripts. Always pair payload generation with a corresponding metasploit-framework handler listener configured to receive and manage the resulting session.
How do I set up a meterpreter reverse shell in metasploit-framework?
metasploit-framework handles Meterpreter reverse shells through a two-step process. First, use msfvenom to generate a reverse shell payload specifying LHOST (your IP) and LPORT (listening port). Second, in msfconsole, set up a handler by selecting exploit/multi/handler, configuring the same payload type and ports, then running it. When the target executes the payload, metasploit-framework establishes the reverse connection and opens an interactive Meterpreter session for post-exploitation.
What post-exploitation modules does metasploit-framework provide?
metasploit-framework includes extensive post-exploitation modules for active Meterpreter sessions. Key capabilities include hashdump for credential harvesting, getsystem for privilege escalation, and auxiliary modules for system reconnaissance. Once you gain initial access through exploitation, these modules help you maintain persistence, extract sensitive data, and deepen system compromise during authorized assessments.
How do I search for and exploit vulnerabilities using metasploit-framework?
metasploit-framework organizes exploits by CVE, platform, and vulnerability type. Use the search command in msfconsole to find modules by CVE number or keyword. Once you identify a relevant exploit, set the target information (RHOST), select an appropriate payload, configure handler options, and execute. metasploit-framework automates vulnerability exploitation and payload delivery for authorized penetration testing engagements.
How do I set up metasploit-framework database and auxiliary scanning?
metasploit-framework uses PostgreSQL for storing scan results and managing workspaces. Configure the database connection in msfconsole, then use auxiliary modules for reconnaissance—such as SMB scanners, port scanners, and service enumeration tools. These auxiliary modules gather target information without exploitation, supporting the reconnaissance phase of authorized security assessments before you deploy exploits.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Metasploit Framework
Purpose
Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.
Prerequisites
Required Tools
```bash
Metasploit comes pre-installed on Kali Linux
For other systems:
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall chmod 755 msfinstall ./msfinstall
Start PostgreSQL for database support
sudo systemctl start postgresql sudo
(truncated - see the full file via the links below)
File tree — 1 file
skills/metasploit-framework/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Execute exploits and gain initial access to target systems”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Exploitation guides you through the full attack chain: finding public exploits via Exploit-DB, executing Metasploit modules against identified vulnerabilities, and crafting standalone payloads with msfvenom. Use it to move from vulnerability discovery to shell establishment during authorized security assessments.
Windows Token Impersonation helps penetration testers escalate privileges on Windows systems by leveraging dangerous token privileges like SeImpersonate and SeDebug. The skill guides you through obtaining a service account shell, checking for exploitable privileges, and using tools like JuicyPotato, PrintSpoofer, and GodPotato to reach SYSTEM.
This skill covers offensive techniques for compromising Active Directory environments, including reconnaissance with BloodHound, credential extraction via Kerberoasting and AS-REP roasting, ticket forgery, and lateral movement. Learn pass-the-hash, DCSync, NTLM relay, and exploitation of AD Certificate Services vulnerabilities alongside critical CVE tactics.
This skill covers systematic approaches to elevate from low-privilege shells to root or administrator access on compromised systems. It addresses both local escalation paths—such as exploiting misconfigured sudo, capabilities, and scheduled tasks on Linux—and Windows-specific vectors including token impersonation and service abuse. For domain environments, it includes Active Directory attacks like Kerberoasting, golden tickets, and credential harvesting via LLMNR poisoning.
This skill guides you through methodical privilege escalation assessments on Linux systems, covering enumeration of kernel exploits, sudo misconfigurations, SUID binaries, capabilities, cron jobs, PATH hijacking, and NFS weaknesses. It provides workflows for identifying attack vectors and executing exploitation techniques to achieve root-level access from a low-privilege shell.
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.