Searching and Using Exploits

After scanning, you know the target's services and versions. The next step is finding an exploit module that matches a known vulnerability in those versions.

Metasploit's search command is your gateway to thousands of modules. Searching precisely saves time and avoids running the wrong code.

The search command queries the module index by keyword. You can search by software name, CVE, or service.

Refine results with filters:

• type: exploit, auxiliary, post.
• platform: windows, linux, unix.
• cve: a specific CVE identifier.
• rank: excellent, great, good (reliability).

Combining filters quickly narrows thousands of modules to a handful.

Search results list each module with a rank, a disclosure date, and a check indicator. The rank reflects exploit reliability and safety.

• excellent: unlikely to crash the target.
• great/good: reliable under common conditions.
• low/manual: risky or needs careful setup.

Prefer higher-ranked modules to avoid crashing production systems.

Use the module's index number or full path with use. The prompt changes to show the loaded module, and the datastore now holds that module's options.

Before running, read about the module. info shows the description, references (CVEs, advisories), required options, and supported targets.

Understanding what a module does is part of professional, responsible use; never fire an exploit you do not understand.

Configure the required options with set. Common ones for a remote exploit are the target address and your payload settings.

Many exploits support check, which safely tests whether the target appears vulnerable without actually exploiting it.

Running check first is good practice: it reduces the risk of crashing a system and confirms you are about to spend effort on a real opportunity.

An exploit needs a payload. Metasploit picks a default, but you can list and choose one suited to the target and your access needs.

Launch with exploit (or run). On success you get a session, an interactive connection to the target.

Manage multiple sessions with sessions -l to list and sessions -i N to interact. Background a session with background to keep working in the console.

Some settings, like LHOST, are reused across many modules. Set them globally with setg so you do not retype them each time you switch modules.

• set: applies only to the current module.
• setg: applies globally across modules.
• unsetg: clears a global value.

This saves time during long engagements with many modules.

Pick the responsible step before firing an exploit.

You learned to find and run exploits:

• Use search with filters (type, platform, cve, rank) to find modules.
• Prefer higher rank modules for reliability and safety.
• use to load, info/show options to inspect, set to configure.
• Run check first; then exploit to gain a session.
• Manage sessions with sessions -l/-i.

Next: payloads and the Meterpreter post-exploitation shell.