I85PREP
⌘ K
MSF RCP study materials
MSF RCP study resources

MSF RCP: Metasploit Framework Fundamentals and Architecture

MSF RCP · Work through your exam, one topic at a time.

All guide sections

Metasploit Framework Fundamentals and Architecture

The Metasploit Framework fundamentals domain tests whether you know what each module type is for, how the framework finds and ranks modules, and how an exploit, payload, and handler fit together. Questions often probe file layout, module metadata, staged versus stageless payloads, and the object names shown in the console.

Core rules

  • Installed modules live under /usr/share/metasploit-framework/modules; personal modules belong in ~/.msf4/modules. The PostgreSQL database, logs, loot, history, and saved configuration also live under ~/.msf4.
  • Module types are not interchangeable. Exploit modules deliver a payload; auxiliary modules scan, fuzz, or administer without a session; post modules run inside an existing session; encoders transform byte patterns; NOP generators pad buffers; evasion modules target endpoint defenses.
  • info shows rank, disclosure date, references, targets, and default options. Ranks run from excellent down to manual; rank reflects reliability and stability, not a guarantee.
  • A staged payload such as windows/meterpreter/reverse_tcp fetches a second stage; a stageless payload such as windows/meterpreter_reverse_tcp contains everything in one file. The names differ by one underscore and are easy to confuse.
  • The database is not required to run a module, but it is required for hosts, services, vulns, and workspace-scoped results.

Worked example

You need a Windows SMB exploit. Run search cve:2017-0144; the result includes exploit/windows/smb/ms17_010_eternalblue. Run info and inspect Rank, Targets, and References. Use the module, run show payloads, and select windows/x64/meterpreter/reverse_tcp because the target is 64-bit. The reasoning is: confirm the module matches the vulnerability, confirm the target architecture, then choose a compatible payload and set LHOST/LPORT before running.

Traps

  • Treating a high rank as proof that the target is vulnerable.
  • Assuming an encoder is an antivirus bypass; it only changes byte patterns.
  • Mixing staged and stageless names, then wondering why the handler never receives a session.
  • Editing files in the system module path instead of ~/.msf4/modules.