archiveJun 5, 2020

Metasploit architecture and filesystem layout

Where Metasploit lives on Kali, what each top-level directory holds, and how modules, plugins, scripts, and tools fit together.

Metasploit architecture

Metasploit is written in Ruby and has grown for years. The tree looks large at first glance, but you do not need to memorize every library. Once the filesystem and libraries make sense, writing and loading modules gets easier.

On Kali, the metasploit-framework package installs under /usr/share/metasploit-framework.

root@kali:/usr/share/metasploit-framework# ls -lt
total 148
drwxr-xr-x  3 root root  4096 May 26 08:57 config
lrwxrwxrwx  1 root root    27 Feb 11  2019 documentation -> ../doc/metasploit-framework
drwxr-xr-x 11 root root  4096 Feb 11  2019 tools
drwxr-xr-x  3 root root  4096 Feb 11  2019 vendor
drwxr-xr-x  6 root root  4096 Feb 11  2019 scripts
drwxr-xr-x  2 root root  4096 Feb 11  2019 plugins
drwxr-xr-x  9 root root  4096 Feb 11  2019 modules
drwxr-xr-x 14 root root  4096 Feb 11  2019 lib
drwxr-xr-x  3 root root  4096 Feb 11  2019 db
drwxr-xr-x 21 root root  4096 Feb 11  2019 data
drwxr-xr-x  4 root root  4096 Feb 11  2019 app
-rw-r--r--  1 root root  9359 Jan 25  2019 Gemfile.lock
-rw-r--r--  1 root root  8652 Jan 25  2019 metasploit-framework.gemspec
-rwxr-xr-x  1 root root  1263 Jan 25  2019 msfconsole
-rwxr-xr-x  1 root root  2813 Jan 25  2019 msfd
-rwxr-xr-x  1 root root  5326 Jan 25  2019 msfdb
-rw-r--r--  1 root root   635 Jan 25  2019 msf-json-rpc.ru
-rwxr-xr-x  1 root root  2229 Jan 25  2019 msfrpc
-rwxr-xr-x  1 root root  9677 Jan 25  2019 msfrpcd
-rwxr-xr-x  1 root root   166 Jan 25  2019 msfupdate
-rwxr-xr-x  1 root root 12921 Jan 25  2019 msfvenom
-rw-r--r--  1 root root   551 Jan 25  2019 msf-ws.ru
-rwxr-xr-x  1 root root   604 Jan 25  2019 ruby
-rwxr-xr-x  1 root root   140 Jan 25  2019 script-exploit
-rwxr-xr-x  1 root root   141 Jan 25  2019 script-password
-rwxr-xr-x  1 root root   138 Jan 25  2019 script-recon
-rwxr-xr-x  1 root root  1209 Jan 24  2019 Gemfile
-rwxr-xr-x  1 root root  1299 Jan 24  2019 Rakefile

Metasploit filesystem

The layout is mostly intuitive.

Data

Editable assets the framework uses: wordlists, images, binaries tied to specific modules, and related support files.

oot@kali:/usr/share/metasploit-framework/data# ls -lt
total 1172
drwxr-xr-x   2 root root   4096 Feb 11  2019 wordlists
drwxr-xr-x   2 root root   4096 Feb 11  2019 wmap
drwxr-xr-x   2 root root   4096 Feb 11  2019 webcam
drwxr-xr-x   4 root root   4096 Feb 11  2019 templates
drwxr-xr-x   3 root root   4096 Feb 11  2019 sounds
drwxr-xr-x   3 root root   4096 Feb 11  2019 snmp
drwxr-xr-x   4 root root   4096 Feb 11  2019 post
drwxr-xr-x   2 root root   4096 Feb 11  2019 php
drwxr-xr-x   2 root root   4096 Feb 11  2019 meterpreter
drwxr-xr-x   2 root root   4096 Feb 11  2019 msfcrawler
drwxr-xr-x   2 root root   4096 Feb 11  2019 passivex
drwxr-xr-x   2 root root   4096 Feb 11  2019 logos
drwxr-xr-x   2 root root   4096 Feb 11  2019 markdown_doc
drwxr-xr-x   2 root root   4096 Feb 11  2019 lab
drwxr-xr-x   2 root root   4096 Feb 11  2019 ipwn
drwxr-xr-x 132 root root  12288 Feb 11  2019 exploits
drwxr-xr-x   2 root root   4096 Feb 11  2019 flash_detector
drwxr-xr-x   3 root root   4096 Feb 11  2019 headers
drwxr-xr-x  10 root root   4096 Feb 11  2019 SqlClrPayload
-rwxr-xr-x   1 root root     68 Jan 24  2019 eicar.com
-rwxr-xr-x   1 root root    963 Jan 24  2019 eicar.txt
-rwxr-xr-x   1 root root   1288 Jan 24  2019 emailer_config.yaml
-rwxr-xr-x   1 root root  29548 Jan 24  2019 isight.bundle
-rwxr-xr-x   1 root root  63031 Jan 24  2019 john.conf
-rwxr-xr-x   1 root root  10628 Jan 24  2019 mime.yml
-rwxr-xr-x   1 root root 475136 Jan 24  2019 vncdll.x64.dll
-rwxr-xr-x   1 root root 401920 Jan 24  2019 vncdll.x86.dll
-rw-r--r--   1 root root 108964 Jan 24  2019 ysoserial_payloads.json

Documentation

Framework docs live here.

root@kali:/usr/share/metasploit-framework/documentation# ls -lt
total 404
drwxr-xr-x 7 root root   4096 Feb 11  2019 modules
drwxr-xr-x 3 root root   4096 Feb 11  2019 api
-rw-r--r-- 1 root root   7496 Jan 25  2019 changelog.Debian.gz
-rw-r--r-- 1 root root  23006 Jan 25  2019 copyright
-rw-r--r-- 1 root root   2509 Jan 24  2019 CODE_OF_CONDUCT.md
-rw-r--r-- 1 root root   2408 Jan 24  2019 CONTRIBUTING.md.gz
-rw-r--r-- 1 root root 358142 Jan 24  2019 developers_guide.pdf.gz
-rw-r--r-- 1 root root   1597 Jan 24  2019 README.md

Lib

Core libraries that the framework and modules depend on.

root@kali:/usr/share/metasploit-framework/lib# ls -lt
total 112
drwxr-xr-x  2 root root  4096 Feb 11  2019 sqlmap
drwxr-xr-x  2 root root  4096 Feb 11  2019 tasks
drwxr-xr-x  2 root root  4096 Feb 11  2019 telephony
drwxr-xr-x  2 root root  4096 Feb 11  2019 snmp
drwxr-xr-x 13 root root  4096 Feb 11  2019 rex
drwxr-xr-x  2 root root  4096 Feb 11  2019 rabal
drwxr-xr-x  2 root root  4096 Feb 11  2019 rbmysql
drwxr-xr-x  4 root root  4096 Feb 11  2019 net
drwxr-xr-x  3 root root  4096 Feb 11  2019 postgres
drwxr-xr-x  7 root root  4096 Feb 11  2019 msf
drwxr-xr-x  3 root root  4096 Feb 11  2019 metasploit
drwxr-xr-x  6 root root  4096 Feb 11  2019 anemone
-rw-r--r--  1 root root   143 Jan 24  2019 anemone.rb
-rw-r--r--  1 root root  2217 Jan 24  2019 enumerable.rb
-rw-r--r--  1 root root   722 Jan 24  2019 msfenv.rb
-rw-r--r--  1 root root   367 Jan 24  2019 postgres_msf.rb
-rw-r--r--  1 root root 23897 Jan 24  2019 rbmysql.rb
-rw-r--r--  1 root root  3824 Jan 24  2019 rex.rb
-rw-r--r--  1 root root  4322 Jan 24  2019 robots.rb
-rw-r--r--  1 root root   294 Jan 24  2019 snmp.rb
-rw-r--r--  1 root root    71 Jan 24  2019 telephony.rb
-rw-r--r--  1 root root  1660 Jan 24  2019 windows_console_color_support.rb

Modules

Module types shipped with the framework: auxiliary, encoders, evasion, exploits, nops, payloads, and post.

root@kali:/usr/share/metasploit-framework/modules# ls -lt
total 28
drwxr-xr-x 14 root root 4096 Feb 11  2019 post
drwxr-xr-x  5 root root 4096 Feb 11  2019 payloads
drwxr-xr-x 11 root root 4096 Feb 11  2019 nops
drwxr-xr-x 21 root root 4096 Feb 11  2019 exploits
drwxr-xr-x  3 root root 4096 Feb 11  2019 evasion
drwxr-xr-x 12 root root 4096 Feb 11  2019 encoders
drwxr-xr-x 21 root root 4096 Feb 11  2019 auxiliary

Module kinds

Metasploit groups modules by role:

Exploits — modules that drive a vulnerability path and typically pair with a payload.
Auxiliary — scanners, fuzzers, sniffers, fingerprinting, and other host/network tasks that do not deliver a payload the same way.
Payloads — code meant to run on a target after a successful module path (for example, open a session or install a helper).
Encoders — reshape payload bytes so they pass through filters that reject obvious patterns.
Nops — produce no-op padding so payload size stays consistent across tries.
Evasion — stronger bypass helpers related to encoding/detection avoidance.
Post — follow-on helpers used after a session exists, often to gather more host context.

Loading external modules in msfconsole

msf > loadpath
Usage: loadpath </path/to/modules>
 
Loads modules from the given directory which should contain subdirectories for
module types, e.g. /path/to/modules/exploits
 
msf > loadpath /usr/share/metasploit-framework/modules/
Loaded 399 modules:
    399 payloads

msf5 > load 
load aggregator        load db_tracker        load lab               load nexpose           load sample            load sqlmap            load wmap
load alias             load event_tester      load libnotify         load openvas           load session_notifier  load thread            
load auto_add_route    load ffautoregen       load msfd              load pcap_log          load session_tagger    load token_adduser     
load beholder          load ips_filter        load msgrpc            load request           load socket_logger     load token_hunter      
load db_credcollect    load komand            load nessus            load rssfeed           load sounds            load wiki

Plugins

External plugins that extend the console.

root@kali:/usr/share/metasploit-framework/modules# cd ../plugins/
root@kali:/usr/share/metasploit-framework/plugins# ls -lt
total 392
-rw-r--r-- 1 root root 16977 Jan 24  2019 aggregator.rb
-rw-r--r-- 1 root root 12581 Jan 24  2019 alias.rb
-rw-r--r-- 1 root root  1052 Jan 24  2019 auto_add_route.rb
-rw-r--r-- 1 root root  9515 Jan 24  2019 beholder.rb
-rw-r--r-- 1 root root  2726 Jan 24  2019 db_credcollect.rb
-rw-r--r-- 1 root root  1655 Jan 24  2019 db_tracker.rb
-rw-r--r-- 1 root root  1119 Jan 24  2019 event_tester.rb
-rw-r--r-- 1 root root  2213 Jan 24  2019 ffautoregen.rb
-rw-r--r-- 1 root root  2456 Jan 24  2019 ips_filter.rb
-rw-r--r-- 1 root root  4841 Jan 24  2019 komand.rb
-rw-r--r-- 1 root root 16815 Jan 24  2019 lab.rb

Scripts

Meterpreter and related scripts.

root@kali:/usr/share/metasploit-framework/scripts# ls -lt
total 16
drwxr-xr-x 2 root root 4096 Feb 11  2019 meterpreter
drwxr-xr-x 2 root root 4096 Feb 11  2019 ps
drwxr-xr-x 2 root root 4096 Feb 11  2019 resource
drwxr-xr-x 2 root root 4096 Feb 11  2019 shell

Tools

Command-line utilities used alongside module work (pattern helpers, recon helpers, and similar).

root@kali:/usr/share/metasploit-framework/scripts# cd ../tools/
root@kali:/usr/share/metasploit-framework/tools# ls -lt
total 36
drwxr-xr-x 2 root root 4096 Feb 11  2019 modules
drwxr-xr-x 2 root root 4096 Feb 11  2019 password
drwxr-xr-x 3 root root 4096 Feb 11  2019 payloads
drwxr-xr-x 2 root root 4096 Feb 11  2019 recon
drwxr-xr-x 2 root root 4096 Feb 11  2019 memdump
drwxr-xr-x 2 root root 4096 Feb 11  2019 exploit
drwxr-xr-x 2 root root 4096 Feb 11  2019 hardware
drwxr-xr-x 2 root root 4096 Feb 11  2019 dev
drwxr-xr-x 2 root root 4096 Feb 11  2019 context

Paths that matter most

lib, modules, plugins, tools, and scripts are the directories you touch most often.

lib — heart of the framework; libraries used to build modules.
modules — every shipped module type, from scanners to deeper development samples.

Zer0Luck@Zer0Luck:/usr/share/metasploit-framework/modules$ ls
auxiliary  encoders  evasion  exploits  nops  payloads  post
Zer0Luck@Zer0Luck:/usr/share/metasploit-framework/modules$ cd exploits/
Zer0Luck@Zer0Luck:/usr/share/metasploit-framework/modules/exploits$ ls
aix      apple_ios  bsdi    example.rb                 example_webapp.rb  freebsd  irix   mainframe  netware  osx  solaris  windows
android  bsd        dialup  example_linux_priv_esc.rb  firefox            hpux     linux  multi      openbsd  qnx  unix
Zer0Luck@Zer0Luck:/usr/share/metasploit-framework/modules/exploits$ cd windows/
Zer0Luck@Zer0Luck:/usr/share/metasploit-framework/modules/exploits/windows$ ls -lt
drwxr-xr-x 2 root root 16384  5월  2 06:35 http
drwxr-xr-x 2 root root  4096  5월  2 06:35 ibm
drwxr-xr-x 2 root root  4096  5월  2 06:35 iis
...

tools — CLI helpers that support lab work (pattern generation, address lookup utilities, and related tooling).
plugins — optional integrations (OpenVAS, Nexpose, Nessus, and others) loaded with load.
scripts — Meterpreter and related scripts used in later stages of a lab session.

Zer0Luck@Zer0Luck:/usr/share/metasploit-framework/scripts$ ls -lt
합계 16
drwxr-xr-x 2 root root 4096  5월  2 06:35 meterpreter
drwxr-xr-x 2 root root 4096  5월  2 06:35 ps
drwxr-xr-x 2 root root 4096  5월  2 06:35 resource
drwxr-xr-x 2 root root 4096  5월  2 06:35 shell