Clone or download
System Administrator System Administrator
System Administrator and System Administrator accidentally changed wrong path
Latest commit 500aed2 Dec 8, 2018

metasploitHelper (msfHelper)

Slides for Black Hat Asia 2017 :


metasploitHelper is meant to assist penetration testers in network penetration tests.

metasploitHelper (msfHelper) communicates with Metasploit via msrpc. It uses both port and web related exploits from Metasploit.

You can point msfHelper at an IP address/Nmap XML file/File containing list of Ip addresses.

First, it performs a Nmap scan of the target host(s) and then attempt to find compatible and possible Metasploit modules based on 1) nmap service banner and 2) service name and run them against the targets.

Please see the slides above for more information regarding the tool as well as the video demo.

It is also possible to use the -m option in msfHelper along with msfconsole (load msgrpc Pass=xxx) if you would like to interact with the targets that msfHelper had compromised.

msfHelper by default only test ports which were found in metasploit modules. If you would like to scan all ports, please use the -a option.


  • The demo shows running msfHelper (exploit modules) against Metasploitable 2
sudo python -a -t exploit


  • Building from Dockerfile
docker build -t metasploithelper .
docker run --rm -it milo2012/metasploithelper
python -a
  • Pull latest Docker image
docker pull milo2012/metasploithelper
docker run --rm -it milo2012/metasploithelper
python -a
  • To see help menu
docker pull milo2012/metasploithelper
docker run --rm -it milo2012/metasploithelper
python -h


On Kali Linux 2016.2 VM

$ apt-get install git-core -y
$ git clone
$ cd msfrpc && cd python-msfrpc && python install
$ pip install tabulate termcolor python-libnmap msgpack-python beautifulsoup4 termcolor requests
$ git clone
$ python x.x.x.x -i


root@kali:/code# python -h
usage: PROG [-h] [-P MYPASSWORD] [-p PORTSINPUT] [-i] [-m] [-a] [-n THREADS]
            [-u] [-q] [-gt GREATERTHAN] [--info] [-v] [-s] [-t CATEGORY]
            [-e {services,web,exploitdb,ports,all}]
            [target [target ...]]

                __ _   _      _
 _ __ ___  ___ / _| | | | ___| |_ __   ___ _ __
| '_ ` _ \/ __| |_| |_| |/ _ \ | '_ \ / _ \ '__|
| | | | | \__ \  _|  _  |  __/ | |_) |  __/ |
|_| |_| |_|___/_| |_| |_|\___|_| .__/ \___|_|


positional arguments:
  target                The target IP(s), range(s), CIDR(s), hostname(s),
                        FQDN(s) or file(s) containg a list of targets

optional arguments:
  -h, --help            show this help message and exit
  -P MYPASSWORD         Password to connect to msfrpc
  -p PORTSINPUT         Only scan specific TCP ports
  -i                    Intelligent mode (Match the Nmap service banner with
                        the Metasploit modules
  -m, --manual          Manually start up Msfconsole and 'load msgrpc
  -a, --scanall         Scan all 65535 TCP ports
  -n THREADS            Set how many concurrent threads to use (default: 5)
  -u, --update          Update Metasploit and metasploitHelper DB
  -q, --quick           Performs a quick scan - Do not use modules where
                        TARGETURI is set to /
  -gt GREATERTHAN       Only scan TCP ports greater than x number
  --info                Lookup information about ports online
  -v, --verbose         Verbose mode
  -s, --showonly        Show matching Metasploit modules but don't run
  -t CATEGORY           Choose between 'exploit' or 'auxillary'

Whether to run Metasploit 'services', 'ports', 'web' modules or 'exploitdb':
  Options for executing commands

  -e {services,web,exploitdb,ports,all}, --exec-method {services,web,exploitdb,ports,all}

Sample Usage Examples

Use the intelligent mode and scan/test the target IP :

python -i

Specify the ports to be tested :

python -i -p 21,5432

Run metasploit modules that matches the port number :

python -i -e ports

Scan and test all ports on target host :

python -i -a

Enable verbose mode (see results from Metasploit modules :

python -i -v

Run msfHelper and interact with the shells :

#on the first terminal window
$ msfconsole
$ load msgrpc Pass=xxxxx

#on the second terminal window
python -i -m -P xxxxx

As Nmap sometimes is unable to fingerprint the target port accurately, you might want to use the --info option to retrieve information from speedguide (google cache) as to what applications typically use the port :

python -i --info

Do not run metasploit modules. Only run exploit-db detection :

python -e exploitdb

Run "port" based detection :

python -i -e ports

Run "services" based detection :

python -i -e services

Run "web" based detection :

python -i -e web