Metasploit is best known for its exploit modules. This unit deliberately never opens that drawer. What it drives instead is the framework's quieter half: scanning and enumerating, without taking control of anything.
Analogy: The labelled toolbox
A good toolbox has labelled drawers: one for drill bits, one for screwdrivers, one for measuring tools. Metasploit is organised the same way. Its modules fall into labelled drawers: exploits that take advantage of a specific flaw, auxiliary modules that scan and enumerate without exploiting, and payloads that run after an exploit succeeds. This unit opens only the auxiliary and scanner drawers, because the goal here is information gathering and reporting, not launching an exploit.
| Module type | What it does | Used here? |
|---|---|---|
| Auxiliary | Scans, enumerates, checks versions, without exploiting | Yes |
| Scanner | An auxiliary module focused on discovery across hosts | Yes |
| Exploit | Takes advantage of a specific vulnerability | No |
| Payload | Code that runs on a target after an exploit succeeds | No |
Caution: This unit stops at auxiliary and scanner modules, on purpose
Running an exploit module with a live payload crosses from assessing a system to taking control of it, which demands explicit, written, scope-bound authorisation and is beyond what this course sets out to teach. Keep to the information-gathering drawers.
Connecting to the framework
Tool in focus: the Metasploit RPC interface
Metasploit's RPC daemon, msfrpcd, exposes the framework over a network connection that Python talks to through the pymetasploit3 package. It lets a script list modules, set their options, and run them, all without touching the interactive console.
metasploit_client.py
# metasploit_client.py
from pymetasploit3.msfrpc import MsfRpcClient
msf_client = MsfRpcClient(password="your-msf-password", port=55553, ssl=True)
print(f"Metasploit version: {msf_client.core.version['version']}")
# list auxiliary scanner modules matching a keyword
matches = [name for name in msf_client.modules.auxiliary if "smb" in name.lower()]
print(f"SMB-related auxiliary modules: {matches[:5]}")
msf_client.modules.auxiliary is a list of every auxiliary module name the framework ships, several hundred of them, so filtering it down to the handful mentioning "smb" is an ordinary list comprehension, nothing Metasploit-specific at all.
Running a scanner module
run_auxiliary_scan.py
# run_auxiliary_scan.py: run a safe, non-exploiting scanner module
module = msf_client.modules.use("auxiliary", "scanner/smb/smb_version")
module["RHOSTS"] = "10.0.0.0/24"
module["THREADS"] = 20
job = module.execute()
print(f"Scanner running as job {job['job_id']}")
Caution: These two scripts need a running msfrpcd this course cannot ship
Both scripts assume a Metasploit instance with msfrpcd already started, reachable on port 55553. That is a real, separately installed framework, not something bundled with a course, so neither script has been run against a live instance here. The pattern they show, modules.use() to select a module, assign its options like dictionary keys, then .execute(), is exactly how every other auxiliary module in the framework is driven; the lab exercise at the end of this unit walks through setting msfrpcd up yourself.
scanner/smb/smb_version connects to each host in RHOSTS and reports the SMB version and operating system it finds, without exploiting anything. The same msf_client.modules.use() pattern works for any other auxiliary module the framework ships: set RHOSTS, set whatever other options that module defines, then .execute().
Real incident: The exact flaw one line away
Among the hundreds of SMB-related auxiliary modules is one named scanner/smb/smb_ms17_010. It checks for the precise flaw EternalBlue exploited, the same MS17-010 behind the WannaCry outbreak you have already met in this course. A scanner module reports whether a host is vulnerable to it without touching the host beyond a version check, which is as far as this unit goes, and as far as an authorised assessment should go without separate, written permission to exploit what it finds.
Check your understanding
Question 1: Name Metasploit's module types and which ones this unit works with.
Exploit, payload, auxiliary and scanner. This unit works only with auxiliary and scanner modules, the information-gathering drawers that scan and enumerate without exploiting anything.
Question 2: What does module["RHOSTS"] = "10.0.0.0/24" actually do, and why does it look like setting a dictionary key?
It sets the target host range the module will run against. pymetasploit3 represents a module's options as a dictionary-like object, so assigning a value to a named option, RHOSTS here, uses ordinary Python item assignment rather than a method call.
Question 3: This unit uses only Metasploit's auxiliary and scanner drawers. What changes, technically and in terms of authorisation, if an exploit module with a live payload is used instead?
Technically, an exploit module attempts to take advantage of a specific vulnerability to run code on the target, rather than merely checking for or reporting it, and a payload module then runs on the target after that succeeds. In terms of authorisation, this moves from assessing a system to actually taking control of it, which demands explicit, written, scope-bound permission well beyond what an ordinary vulnerability scan requires.
Key takeaway
Metasploit's modules sit in labelled drawers, and this unit opens only the ones that gather information without taking control: auxiliary and scanner. The same use-set-execute pattern that ran smb_version works for any other module in those two drawers.