msfconsole

msfconsole is the primary command-line interface to the Metasploit Framework — a Ruby-based, modular penetration testing platform for writing, testing, and executing exploit code. It is the most commonly used Metasploit interface: you can scan targets, exploit vulnerabilities, run post-exploitation modules, and manage sessions from a single console. The basic flow is:

use $MODULE_NAME
set $OPTIONS
run

msfconsole can be used as a general shell (regular commands like ip and ls work), but there’s no output redirection. Ctrl+Z backgrounds the current session — Metasploit traps it, so you won’t accidentally background the whole console.

Core commands

Command	Purpose
use	select a module/exploit
back	exit the current module context
info	show module information (including exploit targets)
options / show options	show module options (advanced for advanced options)
set / unset	configure options (unset all resets the whole module)
setg / unsetg	global versions (= set -g / unset -g)
run / exploit	run the selected module (aliases)
run -j	run as a background job
check	test vulnerability without exploiting (when supported)
search	search modules; filter with type: (e.g. search type:exploit wordpress)
show auxiliary/exploits/payloads	list modules (filtered by relevancy inside a module context)
sessions	list open sessions; sessions -i $N interacts with session $N
jobs	status of background jobs
hosts / services / vulns	query the Metasploit database (hosts -d deletes)
db_nmap $FLAGS $IP	run nmap and import results into the DB (elevates if needed)
workspace	isolate DB results per engagement
spool	save all console output to a log file (record-keeping)
history / help	command history / help

Not every module has a check option — some pair with an auxiliary scanner instead, and many have no non-destructive verification at all. YMMV.

Module categories

• Auxiliary — scanners, fuzzers, odds-and-ends
• Encoders — re-encode exploits to thwart signature-based anti-malware
• Evasion — attempt to directly evade anti-malware solutions
• Exploits
• NOPs — no-op code to pad exploits to a needed size
• Payloads — what runs if the exploit succeeds (often, but not always, a shell)
• Post — post-exploitation tools

(Metasploit 6 documentation sometimes refers to these as framework components/plugins.)

Operational gotchas

• Open the firewall port first. The listener port (default 4444, set with LPORT) must be reachable before you run the exploit.
• Set LHOST (and SRVHOST) explicitly. Metasploit’s interface guesses aren’t always right; an explicit IP beats the device name or the 0.0.0.0 default.
• Exploiting through an ssh tunnel: LHOST is still your machine’s external address — the reverse connection won’t come back over the tunnel. When the listener needs to bind locally on a tunneled-into host, set the optional ReverseListenerBindAddress (typically 127.0.0.1 while LHOST is the remote system).
• RHOSTS is flexible: single IPs, ranges, CIDR networks, or file:/path/to/file.txt with one target per line.
• Hidden options: most modules support ARCH, PAYLOAD, and SESSION, but these are not shown by show options.

Payloads

Payloads divide into three families:

• Singles — self-contained; indicated by _ in the name (shell_reverse_tcp)
• Stagers — small stubs that connect back to download a larger payload
• Stages — payloads delivered by a stager; indicated by / (shell/reverse_tcp)

Naming follows OS/ARCHITECTURE/PAYLOAD (architecture omitted for 32-bit Windows payloads). See msfvenom for the staged-vs-stageless tradeoff table.

Metasploit defaults to 32-bit payloads, but many things don’t work on a 64-bit system from a 32-bit meterpreter shell. Explicitly set a 64-bit payload (e.g. windows/x64/meterpreter/reverse_tcp) unless you know the target is 32-bit.

List payloads with msfvenom --list payloads or show payloads; set one with set PAYLOAD full/path/to/payload. Upgrade a native shell to Meterpreter with post/multi/manage/shell_to_meterpreter — note it opens a new connection on a new port (default 4433).

Scanners

search portscan shows the built-in port scanners — msfconsole needs root for most (same as nmap), and the fancier TCP scans (SYN etc.) often break over VPNs, so nmap is usually the better tool. Targeted scanners are more useful:

• auxiliary/scanner/discovery/udp_sweep — probe common UDP services
• auxiliary/scanner/http/http_version — HTTP server versions
• auxiliary/scanner/smb/smb_login — brute-force / password spraying against SMB

There are many Samba/CIFS scanners (search scanner/smb), plus basic enumeration modules like smtp_version/smtp_enum and mysql_sql (a thin wrapper around the MySQL client). For MSSQL specifically, see metasploit-ms-sql-modules. CIFS user enumeration via SID cycling uses auxiliary/scanner/smb/smb_lookupsid (unreliable on UNIX-like targets, same as the nmap equivalent).

Exploits

• exploit/multi/handler — catch shells produced by msfvenom. You must set payload to match the artifact byte-for-byte (e.g. windows/x64/meterpreter/reverse_tcp); staged/stageless mismatch is the most common silent failure.
• exploit/windows/smb/psexec — PsExec over SMB (instantiates meterpreter by default). Only works if SMBUser has admin privileges on the target.
• exploit/multi/script/web_delivery — hosts a payload on a local HTTP(S) listener and generates a one-liner (PowerShell, Python, PHP, or Regsvr32) to paste into an existing shell. Useful when you already have a foothold and want to upgrade to meterpreter without uploading a binary. The module outputs an encoded script; set target 2 for PowerShell on Windows. The payload is served on SRVHOST/SRVPORT and calls back to LHOST/LPORT — set both explicitly. run -j backgrounds the listener.

Any Windows exploit taking a password also accepts an NT hash — replace the LM hash portion with 32 zeros if unavailable. That’s the pass-the-hash pattern central to ntlm-relay-attacks-adjacent lateral movement.

Post-exploitation modules

Useful modules to run from/beside a meterpreter session:

Module	Purpose
post/windows/gather/checkvm	VM detection
post/multi/recon/local_exploit_suggester	find local privesc exploits (slow/unreliable on x64; often returns only one result, and the “best” answer may not match the CTF flag — cross-check with manual enumeration)
post/windows/gather/enum_shares	enumerate shares
auxiliary/scanner/smb/smb_enumusers_domain	domain user enumeration (needs admin creds)
post/windows/gather/hashdump	dump hashes into the Metasploit DB
post/windows/gather/smart_hashdump GETSYSTEM=FALSE	hashdump ignoring system accounts
auxiliary/analyze/crack_windows	sic John the Ripper / Hashcat on DB-stored NTLM hashes
post/windows/manage/enable_rdp	enable RDP (needs admin)
post/multi/manage/autoroute	manipulate target routing for pivoting
auxiliary/server/socks_proxy	start a SOCKS proxy through a session
exploit/windows/local/persistence	persistent connection (set STARTUP SYSTEM; no password)

It’s generally better to background meterpreter and run these from the console — inside meterpreter all options must be specified inline on run, with no help output.

The autoroute + socks_proxy combination lets you route attacker tooling (via proxychains, with a custom proxychains.conf) through the compromised host to pivot deeper into the network.

Sources

• Rapid7 Docs — Metasploit Framework Overview
• Rapid7 Docs — Manual Exploitation
• OffSec — Metasploit Unleashed: Msfconsole Commands

Related

• msfvenom — payload generation companion tool
• metasploit-ms-sql-modules — MSSQL module deep-dive
• meterpreter — the flagship post-exploitation payload
• nmap — db_nmap integration and scanner comparison
• ms-sql-server — attack-primitive hub for the MSSQL module set