> ## Documentation Index > Fetch the complete documentation index at: https://hackbook.dudji.com/llms.txt > Use this file to discover all available pages before exploring further. # Metasploit Core > Modules, targeting, and workflow basics in msfconsole. ## Module Structure in msfconsole Once inside `msfconsole`, you can browse an extensive list of available Metasploit modules. Each module follows a path-like structure: ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} /// ``` Example: ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} 794 exploit/windows/ftp/scriptftp_list ``` ## Module Type Breakdown The `type` field is the first level of separation in the Metasploit module tree. It tells you what the module is designed to do. | Type | Description | | --------- | ------------------------------------------------------------------------------------------------------- | | Auxiliary | Scanning, fuzzing, sniffing, and admin capabilities. Offer extra assistance and functionality. | | Encoders | Ensure payloads arrive intact at their destination. | | Exploits | Modules that exploit vulnerabilities to allow payload delivery. | | NOPs | No-operation modules used to keep payload sizes consistent across exploit attempts. | | Payloads | Code that runs remotely and calls back to the attacker machine to establish a connection or shell. | | Plugins | Additional scripts/components that can be integrated within an assessment and used inside `msfconsole`. | | Post | Modules for post-exploitation tasks such as information gathering and pivoting. | Not all module types are directly "launchable" as an initial action. Some are supporting components within the framework's modular architecture. ### Interactable Module Types When using `use `, you generally work with initiator/interactable module types such as: | Type | Description | | --------- | ---------------------------------------------------------------- | | Auxiliary | Scanning, fuzzing, sniffing, and administration tasks. | | Exploits | Vulnerability exploitation modules used for payload delivery. | | Post | Post-exploitation modules for host/network actions after access. | ## Targeted Module Search To reduce noisy results, use scoped filters during search. Common filters include: * `cve:` * `platform:` * `type:` * `rank:` * `` (keyword) This returns modules matching all supplied conditions. ### MSF: Specific Search Example ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} msf6 > search type:exploit platform:windows cve:2021 rank:excellent microsoft Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/http/exchange_proxylogon_rce 2021-03-02 excellent Yes Microsoft Exchange ProxyLogon RCE 1 exploit/windows/http/exchange_proxyshell_rce 2021-04-06 excellent Yes Microsoft Exchange ProxyShell RCE 2 exploit/windows/http/sharepoint_unsafe_control 2021-05-11 excellent Yes Microsoft SharePoint Unsafe Control and ViewState RCE ``` ## Reading Module Details with `info` After selecting a module, `info` gives metadata, options, targets, references, and payload constraints. ### MSF: Module Information Example ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} msf6 exploit(windows/smb/ms17_010_psexec) > info Name: MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution Module: exploit/windows/smb/ms17_010_psexec Platform: Windows Arch: x86, x64 Privileged: No License: Metasploit Framework License (BSD) Rank: Normal Disclosed: 2017-03-14 Provided by: sleepya zerosum0x0 Shadow Brokers Equation Group Available targets: Id Name -- ---- 0 Automatic 1 PowerShell 2 Native upload 3 MOF upload Check supported: Yes Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- DBGTRACE false yes Show extra debug trace info LEAKATTEMPTS 99 yes How many times to try to leak transaction NAMEDPIPE no A named pipe that can be connected to (leave blank for auto) NAMED_PIPES /usr/share/metasploit-framework/data/wo yes List of named pipes to check rdlists/named_pipes.txt RHOSTS yes The target host(s), see https://github.com/rapid7/metasploit-framework/ wiki/Using-Metasploit RPORT 445 yes The Target port (TCP) SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing SERVICE_DISPLAY_NAME no The service display name SERVICE_NAME no The service name SHARE ADMIN$ yes The share to connect to, can be an admin share (ADMIN$,C$,...) or a nor mal read/write folder share SMBDomain . no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as Payload information: Space: 3072 Description: This module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where primitive. This will then be used to overwrite the connection session information with as an Administrator session. From there, the normal psexec payload code execution is done. Exploits a type confusion between Transaction and WriteAndX requests and a race condition in Transaction requests, as seen in the EternalRomance, EternalChampion, and EternalSynergy exploits. This exploit chain is more reliable than the EternalBlue exploit, but requires a named pipe. References: https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/MS17-010 https://nvd.nist.gov/vuln/detail/CVE-2017-0143 https://nvd.nist.gov/vuln/detail/CVE-2017-0146 https://nvd.nist.gov/vuln/detail/CVE-2017-0147 https://github.com/worawit/MS17-010 https://hitcon.org/2017/CMT/slide-files/d2_s2_r0.pdf https://blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis/ Also known as: ETERNALSYNERGY ETERNALROMANCE ETERNALCHAMPION ETERNALBLUE ``` ## Permanent Target Specification If you want a value available across modules, use `setg` to define a global option. ### MSF: Permanent Target Specification ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} msf6 exploit(windows/smb/ms17_010_psexec) > setg RHOSTS 10.10.10.40 RHOSTS => 10.10.10.40 msf6 exploit(windows/smb/ms17_010_psexec) > options Name Current Setting Required Description ---- --------------- -------- ----------- DBGTRACE false yes Show extra debug trace info LEAKATTEMPTS 99 yes How many times to try to leak transaction NAMEDPIPE no A named pipe that can be connected to (leave blank for auto) NAMED_PIPES /usr/share/metasploit-framework/data/wo yes List of named pipes to check rdlists/named_pipes.txt RHOSTS 10.10.10.40 yes The target host(s), see https://github.com/rapid7/metasploit-framework /wiki/Using-Metasploit RPORT 445 yes The Target port (TCP) SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing SERVICE_DISPLAY_NAME no The service display name SERVICE_NAME no The service name SHARE ADMIN$ yes The share to connect to, can be an admin share (ADMIN$,C$,...) or a no rmal read/write folder share SMBDomain . no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as Payload options (windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none) LHOST yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Automatic ``` ## Targets Targets are specific operating system profiles used by an exploit module to adapt execution to a vulnerable version. The `show targets` command behaves differently depending on context: * Inside an exploit module: lists available targets for that module. * In the root menu: reports that no exploit module is selected. ### MSF: Show Targets ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} msf6 > show targets [-] No exploit module selected. ``` When run inside the selected exploit module, options and target data are shown: ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} msf6 exploit(windows/smb/ms17_010_psexec) > options Name Current Setting Required Description ---- --------------- -------- ----------- DBGTRACE false yes Show extra debug trace info LEAKATTEMPTS 99 yes How many times to try to leak transaction NAMEDPIPE no A named pipe that can be connected to (leave blank for auto) NAMED_PIPES /usr/share/metasploit-framework/data/wo yes List of named pipes to check rdlists/named_pipes.txt RHOSTS 10.10.10.40 yes The target host(s), see https://github.com/rapid7/metasploit-framework /wiki/Using-Metasploit RPORT 445 yes The Target port (TCP) SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing SERVICE_DISPLAY_NAME no The service display name SERVICE_NAME no The service name SHARE ADMIN$ yes The share to connect to, can be an admin share (ADMIN$,C$,...) or a no rmal read/write folder share SMBDomain . no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as Payload options (windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none) LHOST yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Automatic ``` ## MSF: Target Selection ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} msf6 exploit(windows/browser/ie_execcommand_uaf) > info Name: MS12-063 Microsoft Internet Explorer execCommand Use-After-Free Vulnerability Module: exploit/windows/browser/ie_execcommand_uaf Platform: Windows Arch: Privileged: No License: Metasploit Framework License (BSD) Rank: Good Disclosed: 2012-09-14 Provided by: unknown eromang binjo sinn3r juan vazquez Available targets: Id Name -- ---- 0 Automatic 1 IE 7 on Windows XP SP3 2 IE 8 on Windows XP SP3 3 IE 7 on Windows Vista 4 IE 8 on Windows Vista 5 IE 8 on Windows 7 6 IE 9 on Windows 7 Check supported: No Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- OBFUSCATE false no Enable JavaScript obfuscation SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) URIPATH no The URI to use for this exploit (default is random) Payload information: Description: This module exploits a vulnerability found in Microsoft Internet Explorer (MSIE). When rendering an HTML page, the CMshtmlEd object gets deleted in an unexpected manner, but the same memory is reused again later in the CMshtmlEd::Exec() function, leading to a use-after-free condition. Please note that this vulnerability has been exploited since Sep 14, 2012. Also, note that presently, this module has some target dependencies for the ROP chain to be valid. For WinXP SP3 with IE8, msvcrt must be present (as it is by default). For Vista or Win7 with IE8, or Win7 with IE9, JRE 1.6.x or below must be installed (which is often the case). References: https://cvedetails.com/cve/CVE-2012-4969/ OSVDB (85532) https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2012/MS12-063 http://technet.microsoft.com/en-us/security/advisory/2757760 http://eromang.zataz.com/2012/09/16/zero-day-season-is-really-not-over-yet/ msf6 exploit(windows/browser/ie_execcommand_uaf) > options Module options (exploit/windows/browser/ie_execcommand_uaf): Name Current Setting Required Description ---- --------------- -------- ----------- OBFUSCATE false no Enable JavaScript obfuscation SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) URIPATH no The URI to use for this exploit (default is random) Exploit target: Id Name -- ---- 0 Automatic msf6 exploit(windows/browser/ie_execcommand_uaf) > show targets Exploit targets: Id Name -- ---- 0 Automatic 1 IE 7 on Windows XP SP3 2 IE 8 on Windows XP SP3 3 IE 7 on Windows Vista 4 IE 8 on Windows Vista 5 IE 8 on Windows 7 6 IE 9 on Windows 7 ``` Leaving the target as `Automatic` lets `msfconsole` perform service detection before launching the exploit. If you already know the target stack/version, manually select it: ```shellsession theme={"theme":{"light":"github-light","dark":"tokyo-night"}} msf6 exploit(windows/browser/ie_execcommand_uaf) > set target 6 target => 6 ``` ## Target Types Targets can vary by service pack, OS version, architecture, language pack, and other exploit-specific constraints. In practice, correct targeting often requires: 1. Obtaining a copy of the target binaries. 2. Using `msfpescan` to locate a suitable return address. Module source comments often describe the exact assumptions for each target, including return-address patterns and version-specific constraints.