MSF RCP flashcards
MSF RCP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Metasploit module types
- Exploit, auxiliary, payload, encoder, nop, and post modules are the core types; each is a Ruby class stored under modules/ and loaded by the framework at startup.
- Staged vs stageless payload
- Staged payloads use a small stager to download the main stage, reducing initial size. Stageless payloads embed the full payload, avoiding a second network connection but increasing file size.
- Handler module
- exploit/multi/handler listens for reverse payload connections; configure PAYLOAD, LHOST, and LPORT, then run to receive sessions from targets.
- msfdb init
- Initializes the PostgreSQL database used by Metasploit, creating the database, user, and configuration; required before using db_* commands and workspace features.
- setg command
- Sets a global variable that persists across module contexts in the console; useful for RHOSTS, LHOST, or LPORT that apply to multiple modules.
- Workspace
- A logical container in the MSF database that isolates engagement data such as hosts, services, and credentials; switch with 'workspace <name>' and create with 'workspace -a <name>'.
- db_nmap
- Runs Nmap from within msfconsole and imports the results directly into the MSF database, populating hosts, services, and notes for the current workspace.
- RHOSTS syntax
- Specifies target hosts; accepts single IPs, CIDR (192.168.1.0/24), ranges (192.168.1.1-254), and file input (file:/path). THREADS controls concurrency.
- check method
- A module function that tests whether a target is vulnerable without exploiting it; available in many auxiliary and exploit modules; returns vulnerable, safe, or unknown.
- Vulnerability references
- Module metadata lists CVE, BID, and URL references; cross-reference with vendor advisories to confirm applicability and patch status before exploitation.
- LHOST setting
- The local host address the target connects back to for reverse payloads; must be reachable from the target; can be an interface name (e.g., eth0) in recent MSF versions.
- ExitOnSession
- A handler option; when set to false, the handler continues listening after a session is established, allowing multiple incoming connections.
- migrate command
- Moves the Meterpreter process into another process on the target for stability and stealth; choose a process with matching architecture and sufficient privileges.
- getsystem
- A Meterpreter command that attempts privilege escalation to SYSTEM on Windows using techniques such as named pipe impersonation and token duplication; success depends on target configuration.
- Pivoting with route
- Use 'route add <subnet> <session_id>' to route traffic through a compromised session, enabling scanning and exploitation of internal networks reachable from the target.
- msfvenom
- A standalone payload generator replacing msfpayload and msfencode; syntax: msfvenom -p <payload> LHOST=x LPORT=y -f <format> -o <file>; list payloads with -l payloads.
- Client-side exploit
- Targets user applications (browsers, Office, PDF readers) and requires user interaction; modules reside under exploit/*/browser/ and exploit/*/fileformat/.
- Metasploit Pro project
- A container for an engagement in Metasploit Pro; isolates hosts, services, vulnerabilities, credentials, and reports; created from templates for repeatability.
- Pro reporting formats
- Metasploit Pro generates reports in PDF, HTML, XML, and other formats; report types include audit, executive summary, and compliance; customize sections and evidence.
- Rules of Engagement
- A written document defining scope, targets, time windows, allowed techniques, and emergency contacts; must be signed before testing to ensure legal authorization.
- Coordinated disclosure
- A process where vulnerabilities are reported privately to the vendor and disclosed publicly after a agreed period or patch release; respects NDAs and client consent.
- Auxiliary scanner modules
- Modules under auxiliary/scanner/ that discover hosts, ports, and services (e.g., smb_version, ssh_version); results populate the MSF database.
- Database schema tables
- MSF database stores hosts, services, vulns, creds, loot, notes, and workspaces; modules query and update these tables via ActiveRecord.
- Resource script
- A .rc file containing console commands; run with 'resource <file>' or 'msfconsole -r <file>'; automates repetitive setup and post-exploitation tasks.
- show targets
- Displays the target list for an exploit module; each target defines offsets and return addresses for a specific OS/version; selecting the wrong target can crash the service.
- hashdump
- A Meterpreter command that extracts password hashes from the SAM database on Windows; requires SYSTEM privileges; output can be cracked or used for pass-the-hash.
- web_delivery module
- exploit/multi/script/web_delivery serves a payload via HTTP and provides a command for the target to execute; relies on user interaction; useful for social engineering.
- Automated exploitation
- A Metasploit Pro feature (formerly Autopwn) that automatically selects and runs exploits against discovered services; configure allowed modules and concurrency.
- CFAA
- Computer Fraud and Abuse Act (US) criminalizes unauthorized access to protected computers; penalties include fines and imprisonment; testing without written authorization may violate it.
- msfconsole search
- Finds modules by keyword, CVE, platform, or type; e.g., 'search cve:2021-44228' or 'search type:auxiliary smb'; results show module names and descriptions.
- Payload naming convention
- Format: <platform>/<arch>/<type>/<name>, e.g., windows/x64/meterpreter/reverse_tcp; type indicates single, stager, or stage; helps select compatible payloads.
- db_import
- Imports scan results from external tools (Nmap XML, Nexpose, etc.) into the MSF database; use after running nmap -oX to populate hosts and services.