Metasploit Framework

v6.4.9Rapid7

The best-known exploitation framework: a module library, payload generator (msfvenom), handlers and post modules. Defenders use it to reproduce an attack and confirm a detection fires. The range simulates the console, module search and the telemetry a run would produce — the artifacts a SOC would then hunt for.

Category: Exploitation frameworks
Package: metasploit-framework
Runs on: Linux · Windows
Commands: msfconsole, msfvenom, msfdb, searchsploit

Non-interactive: modules and payloads are described and their telemetry is generated. Nothing is compiled, launched or delivered.

Install it

The scripts below install the real Rapid7 package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-metasploit.sh

Windows installer (PowerShell)

Install-metasploit.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```

Install Metasploit Framework

sudo apt install -y metasploit-framework

RHEL, Fedora (dnf)

Install Metasploit Framework
```
sudo dnf install -y metasploit-framework
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Metasploit Framework

sudo pacman -S --noconfirm metasploit-framework

Alpine (apk)

Install Metasploit Framework
```
sudo apk add metasploit-framework
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which msfconsole
```
Check the version
```
msfconsole --version
```
The range reports 6.4.9.

Remove it

Take it off again

sudo apt remove --purge metasploit-framework

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search metasploit-framework
```
Install Metasploit Framework
```
winget install --id metasploit-framework -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install Metasploit Framework
```
choco install metasploit-framework -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where msfconsole
```
Check the version
```
msfconsole --version
```
The range reports 6.4.9.

Remove it

Take it off again

winget uninstall --id metasploit-framework

Inside the range

Tick it on the launch screen
Under Metasploit Framework's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y metasploit-framework
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Metasploit Framework

Reps: Seeded Payload DropBreak into the Tomcat panel with Metasploit, drop the seeded payload, then take the artifact into Forge Triage. Grade on SHA-256, imphash and a YARA rule that fires on this sample.
Pentest: External Recon to FootholdEnumerate a customer's public perimeter from an approved scan window, chain a stale service to a foothold, and file the first finding with CVSS and remediation before you touch anything else.
Pentest: Read the AD Attack GraphUse the /pentest/attack-graph view to spot the shortest path from a helpdesk account to Domain Admin, walk it end-to-end with the simulated Kerberoast/DCSync tools, and file the delegation finding.
Pentest: Cloud Privilege EscalationGiven an access key with s3:GetObject only, walk a chain of over-permissive roles and trust policies to end up in a shell on a build server. File the trust-policy finding — the fix is one JSON edit.
Pentest: Purple-Team EmulationPlay both seats. Fire five ATT&CK techniques from the C2 console, check the SIEM after each one, and file a detection-gap finding for the two that produced nothing. Score is the ratio of techniques with a signal.
Pentest: Authorized Phishing SimulationClone the customer's SSO portal, send a hundred lures against a pre-agreed roster, watch clicks and credentials land in the C2, and file a template-plus-training finding without ever holding a real password.
Pentest: Defense Evasion and EDR SidestepOn an authorized workstation, land a payload past an EDR that is watching AMSI, ETW and the usual hooked syscalls. Every step files an evidence line and a matching detection ask, so the report reads as both an attack write-up and a purple-team gap register.
Pentest: C2 Operations and TunnelingStand up a small beacon fleet in the /pentest/c2 console, run it over jittered HTTPS and a DNS fallback, stage a compressed collection and file the tunnel-and-egress finding — beacon fingerprints, jitter, callback cadence, all in the report.
Pentest: Ransomware Adversary EmulationEmulate a named ransomware crew end-to-end against the simulated estate: scheduled-task persistence, token-theft privilege escalation, WinRM lateral hop, benign fixture-swap impact, then hand the recovery team a per-stage detection-gap table linked to the RAN track.