Metasploit: The Basics (THM) Tryhackme Walkthrough

Description : Navigate msfconsole, search for modules, configure exploits, and manage sessions on target systems.

Difficulty : Medium

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/metasploitthebasics

Enjoy.

Task 1 Introduction to Metasploit Framework

Imagine you have just been brought onto a penetration testing engagement for Stratford Systems, a mid-sized financial services company. Your team has completed the reconnaissance phase. You have a list of IP addresses, open ports, and a handful of services that look promising. You even spotted what appears to be an outdated SMB implementation on one of their servers. The vulnerability is right there, documented in a public advisory with a CVE number and everything.

Now what?

You could write your own exploit from scratch, but that takes time, specialized skill, and careful testing to avoid crashing the target. In a real engagement, the clock is ticking, and the client expects results. What you need is a framework: a structured toolkit that organizes thousands of known exploits, pairs them with the right payloads, and gives you a consistent interface to configure, launch, and manage attacks across an entire network.

That framework is Metasploit.

What Is the Metasploit Framework?

The Metasploit Framework is the most widely used open-source exploitation framework in the penetration testing industry. Originally created by H.D. Moore in 2003 as a portable networking tool, Metasploit was acquired by Rapid7 in 2009 and has grown into an ecosystem containing over 2,600 exploits and more than 6,100 modules in total.

One analogy for understanding Metasploit would be a well-organized workshop. You would not build a house with a single hammer; you need saws, drills, levels, measuring tapes, and fasteners, all organized so you can find the right tool for each job. Metasploit works the same way. Instead of forcing you to hunt for individual exploit scripts scattered across the internet, it provides a centralized library of exploits, scanners, payloads, and post-exploitation tools, all accessible through a single command-line interface called msfconsole.

In technical terms, Metasploit supports the full penetration testing lifecycle:

• Information gathering: Scanning targets and fingerprinting services
• Vulnerability identification: Detecting known flaws in target systems
• Exploitation: Delivering exploit code to take advantage of those flaws
• Post-exploitation: Maintaining access, gathering data, and pivoting to other systems
• Reporting: Logging findings for documentation and client deliverables

While Metasploit’s primary audience is penetration testers, security researchers, and exploit developers also rely on the framework for vulnerability research and proof-of-concept development.

Two Versions: Pro vs. Framework

Metasploit comes in two main editions:

• Metasploit Pro: The commercial version, maintained by Rapid7. It includes a graphical user interface (GUI), automated workflows, team collaboration features, and reporting capabilities. It is licensed software designed for professional security teams.
• Metasploit Framework: The open-source, community-driven version. It runs entirely from the command line. This is the version installed on Kali Linux, Parrot OS, and the TryHackMe AttackBox, and it is the version we will use throughout this module.

Every technique you learn with the Metasploit Framework translates directly to Metasploit Pro. The underlying modules, commands, and concepts are identical; Pro simply adds a GUI and automation layer on top.

The Three Pillars of the Framework

The Metasploit Framework is built around three core components. Understanding what each one does will help you navigate the tool effectively as we move through the remaining tasks.

1. Msfconsole

msfconsole is the primary command-line interface for the Metasploit Framework. It is where you will spend the vast majority of your time. From msfconsole, you can search for modules, configure parameters, launch exploits, and manage sessions on compromised targets. Consider it the cockpit of the framework; everything else is accessed through it.

2. Modules

Modules are the building blocks of Metasploit. Each module is a self-contained piece of code designed to perform a specific task. There are seven categories of modules (exploits, auxiliary, payloads, post-exploitation, encoders, NOPs, and evasion), and we will explore each of these in the next task. For now, the key takeaway is that Metasploit’s power comes from its library of thousands of modules, not from any single tool.

3. Tools

Beyond msfconsole and its modules, the framework ships with a set of standalone command-line tools. The most important one for this module is msfvenom, which generates payloads outside of msfconsole for use in scenarios where you need a standalone file (an executable, a web shell, or raw shellcode). We will cover msfvenom in depth in the fourth room of this module. Other tools like pattern_create and pattern_offset are used in exploit development, which is beyond the scope of this Learning Path.

What This Module Covers

This is the first of four rooms in the Metasploit module:

1. Metasploit: The Basics (this room) — Navigating the framework, understanding modules, configuring and launching exploits, managing sessions
2. **Metasploit: Scanning and Exploitation** — Scanning targets, using the Metasploit database, identifying vulnerabilities, and exploiting live systems
3. **Metasploit: Post-Exploitation** — Using Meterpreter for credential harvesting, privilege escalation, and target exploration
4. **Metasploit: Payload Generation** — Generating custom payloads, understanding encoding, and delivering payloads to targets

By the end of all four rooms, you will have the skills to take a target from initial discovery through exploitation and post-exploitation using the Metasploit Framework.

Let’s get started.

Prerequisites

Before starting this room, you should be comfortable with:

• Basic Linux command-line navigation (cd, ls, cat, pwd)
• Fundamental networking concepts (IP addresses, ports, client-server communication)
• A general understanding of what a vulnerability is (a flaw in software that can be exploited)

Learning Objectives

By the end of this room, you will be able to:

• Explain what the Metasploit Framework is and identify its core components
• Navigate msfconsole to search for, select, and inspect modules
• Configure module parameters and launch an exploit against a target
• Manage active sessions on compromised systems

Answer the questions below

Q1.) Ready to start!

Answer : No answer needed

Task 2 Core Concepts and Module Types

You have identified a vulnerable service running on one of Stratford Systems’ web servers. The scan results show an outdated version of Apache with a known remote code execution flaw. You have the CVE number, you have the target IP, and you have Metasploit open in front of you. But before you start searching for modules, you need to understand three foundational concepts that the entire framework is built around: vulnerabilities, exploits, and payloads.

These three terms will appear in every room of this module, in every engagement report you write, and in virtually every security conversation you have. Let’s define them precisely.

The Exploit Chain: Vulnerability, Exploit, Payload

Consider a physical security analogy. A vulnerability is a broken lock on a warehouse door. An exploit is the act of pulling that door open. A payload is what the intruder does once they are inside: whether they steal inventory, plant a listening device, or simply take a photograph to prove the break-in was possible.

In technical terms:

• Vulnerability: A design, coding, or configuration flaw in a target system. The flaw itself does not cause harm; it creates an opportunity for harm. A vulnerability might allow an attacker to execute arbitrary code, read files they should not have access to, or bypass authentication entirely.
• Exploit: A piece of code that takes advantage of a specific vulnerability. The exploit is the mechanism of attack. It targets the flaw and triggers it in a controlled way.
• Payload: The code that runs on the target system after the exploit succeeds. The exploit opens the door; the payload is what walks through it. A payload might open a reverse shell back to the attacker, create a new user account, or execute a command on the target.

This three-part chain is fundamental. An exploit without a payload can trigger a vulnerability but produce no useful result for the attacker. A payload without an exploit has no way to reach the target. Metasploit’s architecture is built around pairing the right exploit with the right payload for a given vulnerability.

The Seven Module Categories

Metasploit organizes its entire library into seven categories of modules. Each category serves a distinct role in the penetration testing workflow.

Exploits

Exploit modules target a specific vulnerability on a specific platform. They are organized by target operating system and service (e.g., exploits/windows/smb/, exploits/linux/http/). With over 2,600 exploit modules in the current framework, this is the largest category. When you hear someone say "I used a Metasploit module," they are almost always referring to an exploit.

Auxiliary

Auxiliary modules handle everything that is not direct exploitation. This includes port scanners, service fingerprinters, brute-force login modules, fuzzers, and network sniffers. If you need to gather information about a target or test credentials without delivering an exploit, you are looking for an auxiliary module. We will use several of these in the next room when we scan Stratford Systems’ network.

Payloads

Payload modules contain the code that executes on the target after a successful exploit. Metasploit ships nearly 1,700 payload modules covering a wide range of operating systems, architectures, and connection methods. We will look at the different payload types (singles, stagers, and stages) in a moment.

Post-Exploitation

Post modules run after you have already gained access to a target through an active session. They automate common post-exploitation tasks: dumping password hashes, enumerating system information, capturing screenshots, pivoting to other network segments, and more. These modules are organized by target OS (e.g., post/windows/gather/, post/linux/manage/). We will use them extensively in the Post-Exploitation room.

Encoders

Encoder modules transform payload data into a different format. The most well-known encoder is x86/shikata_ga_nai, which applies polymorphic XOR encoding. An important clarification: encoding is not encryption, and it is not a reliable antivirus evasion technique on its own. Modern endpoint detection solutions look far beyond simple signature matching. Encoders still have legitimate uses (removing bad characters from shellcode, for example), but treating them as a stealth mechanism is a common beginner misconception. We will discuss this honestly in the Payload Generation room.

NOPs

NOP (No Operation) modules generate NOP sleds, sequences of instructions that do nothing. On x86 processors, the classic NOP instruction is 0x90, which tells the CPU to skip to the next instruction. NOP sleds serve as padding to ensure payloads land at predictable memory addresses during buffer overflow exploitation. You will rarely interact with NOP modules directly; Metasploit handles NOP sled generation automatically when needed.

Evasion

Evasion modules are purpose-built attempts to bypass specific security controls, such as Windows Defender or AppLocker. Unlike encoders (which simply re-encode data), evasion modules implement actual evasion techniques like process herpaderping or living-off-the-land binary abuse. This is the smallest module category, currently containing around a dozen modules. Their effectiveness varies and depends heavily on the target environment’s security configuration.

Payload Types: Singles, Stagers, and Stages

Within the payload category, Metasploit distinguishes between three types. This is a brief conceptual introduction; we will explore staged and stageless payloads in depth in the Payload Generation room.

Singles (also called inline payloads) are self-contained. The entire payload is delivered in a single package. A single payload might add a user account, execute a system command, or open a bind shell. Because everything is in one piece, singles tend to be larger but more reliable; there is no second download that could fail or be blocked.

Stagers are small, lightweight payloads whose only job is to establish a communication channel between the attacker and the target. Once connected, the stager downloads the second component.

Stages are the larger payload components downloaded by a stager. Together, a stager and its stage form a staged payload. The advantage is a smaller initial footprint; the disadvantage is that the connection must remain stable long enough for the stage to download.

Reading the Naming Convention

Metasploit uses the payload’s path to tell you whether it is staged or single. The separator between the shell type and the connection method is the key:

• windows/x64/shell_reverse_tcp — The underscore (_) between shell and reverse means this is a single (stageless) payload. Everything is in one package.
• windows/x64/shell/reverse_tcp — The forward slash (/) between shell and reverse means this is a staged payload. A small stager connects first, then downloads the full shell stage.

This naming pattern is consistent across the entire framework. Once you recognize it, you can identify any payload’s type at a glance.

The general structure of a payload path is:

<platform>/<architecture>/<payload_type><separator><connection_method>

Consider another example: linux/x86/meterpreter/reverse_tcp is a staged Meterpreter payload for 32-bit Linux systems. The / between meterpreter and reverse_tcp confirms the staged delivery. Its single-payload counterpart would be linux/x86/meterpreter_reverse_tcp, with an underscore instead.

Answer the questions below

Q1.) What is the name of the code that takes advantage of a flaw on the target system?

Answer : Exploit

Q2.) What is the name of the code that runs on the target system after a successful exploit?

Answer : Payload

Q3.) What type of payload is self-contained and does not require a second download?

Answer : Singles

Q4.) What symbol in a payload’s path name indicates it is a staged payload?

Answer : /

Task 3 Navigating Msfconsole

A Quick Note on EternalBlue

You will see the EternalBlue exploit (exploit/windows/smb/ms17_010_eternalblue) referenced throughout this room as a teaching example. Here is the brief backstory: EternalBlue exploits CVE-2017-0144, a critical buffer overflow vulnerability in Microsoft's Server Message Block version 1 (SMBv1) protocol. The exploit was originally developed by the U.S. National Security Agency (NSA) and was leaked publicly by a group called the Shadow Brokers in April 2017. One month later, the WannaCry ransomware campaign weaponized EternalBlue to spread across hundreds of thousands of systems worldwide.

We use it as an example because it is well-documented, reliable in lab environments, and illustrates the full exploit workflow clearly. In a real engagement, you would obviously not limit yourself to a single exploit from 2017.

Answer the questions below

Q1.) How would you search for all exploit modules related to Apache?

Answer : search type:exploit apache

Q2.) You found an interesting module in your search results listed as index number 3. What command would you use to view detailed information about it?

Answer : info 3

Q3.) What command would you use to go back from a module’s context to the main msf6 > prompt?

Answer : back

Task 4 Configuring and Running Modules

Checking Before Exploiting

Some modules support the check command, which probes the target to determine if it is vulnerable without sending the exploit payload:

AttackBox Terminal

msf6 exploit(windows/smb/ms17_010_eternalblue) > check

[*] MACHINE_IP:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] MACHINE_IP:445 - Host is likely VULNERABLE to MS17-010!
[*] MACHINE_IP:445 - Scanned 1 of 1 hosts (100% complete)

Not all modules support check (recall the Check column in search results). When it is available, running check before exploit is good practice, especially in production environments where a failed exploit could crash a service or trigger alerts.

Answer the questions below

Q1.) How would you set the LPORT value to 6666?

Answer : set LPORT 6666

Q2.) How would you set the global value for RHOSTS to 10.10.19.23?

Answer : setg RHOSTS 10.10.19.23

Q3.) What command would you use to clear a set payload?

Answer : unset PAYLOAD

Q4.) What command do you use to launch an exploit module?

Answer : exploit

Q5.) You want to exploit a target but continue working in msfconsole immediately after the session opens. What flag do you add to the exploit command?

Answer : -z

Task 5 Managing Sessions

The exploit landed. You see Meterpreter session 1 opened scroll across your terminal. In a simple lab exercise with a single target, you might dive straight into that session and start exploring. But real engagements are rarely that simple. Consider the Stratford Systems scenario: your scope includes a dozen hosts across two subnets. Over the course of the engagement, you may open sessions on multiple machines, some through direct exploitation, others through pivoting from already-compromised hosts. If you cannot keep track of which session connects to which target, or if you lose a session because you did not background it before launching your next exploit, you are wasting time and potentially alerting defenders.

Session management is a small set of commands, but it is a critical operational skill. Let’s walk through the workflow.

What Is a Session?

A session in Metasploit is an active communication channel between your attacking machine and a compromised target. When an exploit succeeds and the payload executes, the payload connects back to (or accepts a connection from) your machine. That connection is registered as a session with a unique numeric ID.

Sessions can be different types depending on the payload that created them:

• Meterpreter sessions provide a rich, interactive environment with built-in commands for file system access, privilege escalation, pivoting, and more. These are the most common and most capable session types.
• Shell sessions provide a basic operating system command line (e.g., cmd.exe on Windows, /bin/sh on Linux). These are simpler but less feature-rich.
• Protocol-specific sessions (newer in Metasploit 6.4) provide interactive access to services like SMB, MSSQL, MySQL, and PostgreSQL. These are specialized and used for targeted enumeration rather than general access.

Regardless of type, the commands for managing sessions are the same.

Backgrounding a Session

When you are in an active session (you see meterpreter > or a shell prompt from the target), you can return to the msfconsole prompt without closing the session. This is called backgrounding.

Use the background command (or its shortcut, CTRL+Z):

AttackBox Terminal

meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(windows/smb/ms17_010_eternalblue) >

The session is still alive; you have simply moved your focus back to msfconsole. The target connection remains open in the background, and you can return to it at any time.

This is essential during multi-target engagements. Without backgrounding, you would need to close your current session (losing access) before you could load and run a different module. With backgrounding, you can maintain multiple simultaneous connections while continuing to work in msfconsole.

Listing Active Sessions

The sessions command (with no arguments) displays all active sessions. You can run this from the msf6 > prompt or from within any module context:

AttackBox Terminal

msf6 > sessions

Active sessions
===============

 Id  Name  Type                  Information            Connection
  --  ----  ----                  -----------            ----------
  1         meterpreter x64/wind  NT AUTHORITY\SYSTEM @  10.81.117.184:4444 ->
            ows                    STRATFORD-WS01         10.81.162.215:49159
                                                         (10.81.162.215)
  2         meterpreter x64/wind  NT AUTHORITY\SYSTEM @  10.81.117.184:4445 ->
            ows                    STRATFORD-WS01         10.81.162.215:49161
                                                         (10.81.162.215)

Let’s break down the columns:

• Id: The session’s unique numeric identifier. You will use this number to interact with, kill, or route traffic through a specific session.
• Name: An optional label you can assign with sessions -n <name> -i <id>. Useful for keeping track of which session is which during complex engagements.
• Type: The session type and architecture (e.g., meterpreter x64/windows, shell x64/linux).
• Information: For Meterpreter sessions, this shows the user context and hostname. This tells you at a glance whether you landed as NT AUTHORITY\SYSTEM (full privileges) or as a regular user. Shell sessions may leave this column blank.
• Connection: The local and remote IP:port pair, showing exactly which machine and port each session is connected through.

In this example we’ve run the exploit twice against the target machine. Each session connects back to a different port on our attacking machine (4444, 4445), which is why setting unique LPORT values for each exploit matters when running multiple simultaneous attacks.

Interacting with a Session

To drop back into a specific session, use sessions -i followed by the session ID:

AttackBox Terminal

msf6 > sessions -i 1
[*] Starting interaction with 1...

meterpreter >

You are now back inside session 1, interacting directly with the STRATFORD-WS01 machine. Any command you type executes in the context of that session.

To switch to a different session, background the current one first (background or CTRL+Z), then interact with the other:

AttackBox Terminal

meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(windows/smb/ms17_010_eternalblue) > sessions -i 2
[*] Starting interaction with 2...

Closing Sessions

To terminate a specific session, use sessions -k followed by the session ID:

AttackBox Terminal

msf6 > sessions -k 2
[*] Killing session 2
[*] MACHINE_IP - Meterpreter session 2 closed. Reason: User exit

To kill all active sessions at once (use with caution):

AttackBox Terminal

msf6 > sessions -K
[*] Killing all sessions...
[*] MACHINE_IP - Meterpreter session 1 closed. Reason: User exit

Note the difference: lowercase -k <id> kills a single session; uppercase -K kills all sessions. In a real engagement, losing all your sessions simultaneously is a setback, so use -K deliberately and only when you intend to clean up.

Sessions and Post-Exploitation Modules

Sessions are not just interactive terminals; they are also the bridge to Metasploit’s post-exploitation modules. Many post/ modules require a SESSION parameter that points to an existing session. For example, a module that dumps password hashes on a Windows target needs a Meterpreter session on that target to operate through.

The workflow looks like this:

1. Exploit a target and open a Meterpreter session
2. Background the session
3. Load a post-exploitation module with use
4. Set the SESSION parameter to the relevant session ID
5. Run the module

We will practice this workflow in depth in the Post-Exploitation room. For now, the key takeaway is that sessions are not just for interactive access; they are reusable connections that other modules can leverage.

Answer the questions below

Q1.) What command do you use to background a Meterpreter session and return to the msfconsole prompt?

Answer : background

Q2.) What flag do you use with the sessions command to interact with a specific session by ID?

Answer : -i

Q3.) You have three active sessions. You need to terminate session 2 without affecting the others. What full command do you use?

Answer : sessions -k 2

Task 6 Conclusion

In this room, we covered the foundations of the Metasploit Framework. Let’s recap the core workflow you have learned:

1. Understand the building blocks: Metasploit organizes its capabilities into seven module categories (exploits, auxiliary, payloads, post, encoders, NOPs, evasion). Every engagement uses a combination of these modules, and the exploit → payload chain is the fundamental mechanism for gaining access to a target.
2. Find the right module: The search command, combined with filters like type:, platform:, and cve:, lets you locate relevant modules across a library of over 6,100 options. The info command gives you the technical details you need to decide whether a module fits your target.
3. Configure and launch: The use, set, setg, and show options commands let you load a module, assign its parameters, and verify your configuration. The exploit (or run) command sends it downrange, and the check command lets you verify vulnerability without firing the full exploit.
4. Manage your sessions: The background, sessions, and sessions -i commands let you maintain and switch between multiple active connections across an engagement. Sessions are not just interactive terminals; they are reusable connections that post-exploitation modules operate through.

It is time to move on to the next room: Metasploit: Scanning and Exploitation.

Answer the questions below

Q1.) Done!

Answer : No answer needed

I hope you enjoyed reading this post as much as I enjoyed writing it. Thanks for reading my blog sir ;) Lawvye