Metasploit

OG notes

• Source: https://github.com/rapid7/metasploit-framework
• Installers builder: https://github.com/rapid7/metasploit-omnibus

Kali

Tip

TL;DR: I would install metasploit-framework from Kali's repo, and not from the Nightly Installers from Rapid7, because Kali adds some patches that Rapid7 doesn't have.

Wow the -isms with Kali are just ...special.

Kali metasploit-framework apt package is behind the Nightly Installers / Tagged versions

Note

All of the "at time of writing" crap (8/7/2025) below was just to show timelines and versions and was me walking through this to see what the beans was going on

• Official tagged versions (at time of writing, 6.4.78 7/31/2025)
• Nightly Install method uses metasploit-omnibus, specifically msfupdate.erb (which gets put on the system as msfinstall) (at time of writing, installs 6.4.76-dev- 7/24/2025).
• Kali's repackaged version (at time of writing, 6.4.69-0kali1 6/12/2025)
  • Kali pipelines for pulling in upstream changes seem to be started manually after manual updates to debian/changelog. The debian directory contains patches and tests which are done specific to Kali and is not a directory on upstream.
  • For at least the last 2 years (I stopped scrolling back after that), Kali has updated their metasploit-framework package from upstream AT LEAST once a month. This seems so reasonable to me that, combined with the next section, I would just use this one.

Warning

Outstanding question: Why is Nightly Installer not match latest tags?

---

Installing Nightly Installers repo actually misses out on some things Kali has fixed (like msfdb)

While doing some testing on the differences between Kali's and Rapid7's Nightly Installer versions, after uninstalling the former, and installing the latter, I ran sudo msfdb status and was flabbergasted to see this:

$ sudo msfdb status
Metasploit running on Kali Linux as root, using system database
Error: unrecognized action 'status'

Manage a metasploit framework database

  msfdb-kali init    # initialize the database
  msfdb-kali reinit  # delete and reinitialize the database
  msfdb-kali delete  # delete database and stop using it
  msfdb-kali start   # start the database
  msfdb-kali stop    # stop the database

It turns out, back in 2017(!!), Brent took Kali's msfdb script and dropped it into metasploit-omnibus in PR#46. So while Kali has updated this script multiple times since that pluck, it has not been updated in metasploit-omnibus and therefore did not get the updates to support the status subcommand.