How metasploit-framework is put together
Metasploit Framework is a Ruby-based penetration testing platform whose core is an exploit/payload module engine driven primarily through the msfconsole interactive CLI, with additional front-ends for RPC (msfrpcd, msf-json-rpc.ru, msf-ws.ru), a socket daemon (msfd), database management (msfdb), payload generation (msfvenom), and an MCP server (msfmcpd). It is structured as a Rails application shell (config/application.rb initializes Metasploit::Framework::Application with Zeitwerk autoloading) wrapping the MSF library under lib/, a large plugin subsystem under plugins/ that hooks framework events such as session creation, and a vast data/ tree of exploit payloads, templates, and auxiliary artifacts. Runtime state flows through sessions/events into plugins, and persistent settings are stored in an INI-style config file managed by Msf::Config.
Languages
Frameworks
Datastores
Infrastructure
Major components
Module engine (lib/msf, modules/)
Core exploit, payload, auxiliary, evasion, and post module runtime that msfconsole and all other front-ends drive.
Plugin subsystem (plugins/)
~35 loadable plugins (e.g., auto_add_route, session_tagger, wmap, nessus, mcp) that subscribe to framework events like session open/close to extend behavior.
Console UI (msfconsole, lib/msf/ui/console)
Primary interactive command-line interface with pluggable CommandDispatchers.
RPC/Web services (msfrpcd, msf-json-rpc.ru, msf-ws.ru, plugins/msgrpc.rb)
Expose framework functionality over MessagePack RPC and JSON-RPC/HTTP endpoints.
Database integration (msfdb, db/schema.rb, app/models)
Rails-side ActiveRecord models and schema backing workspace/host/vuln/credential persistence.
Payload generation (msfvenom, data/exploits)
Standalone encoder/payload generator plus a large corpus of prebuilt exploit binaries, documents, and templates.
Session notification & tagging plugins
On new sessions, notify operators via SMTP/SMS, DingTalk, Gotify, or ServerJiang webhooks, or auto-tag targets on disk.
Dev/test tooling (tools/, spec/, Rakefile)
Rake-driven RSpec suites including module validation and Zeitwerk compliance checks, plus developer utility scripts.
A quieter week focused on polishing the Rails Active Storage exploit and housekeeping like Ruby version requirements and documentation updates.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week focused on polishing the Rails Active Storage exploit and housekeeping like Ruby version requirements and documentation updates.
Week of 2026-08-17
A busy week adding new attack modules for SPIP and Forgejo plus MIPS payload improvements and a batch of bug fixes.
Week of 2026-08-10
Framework hit version 6.5.3 while gaining new Forgejo and Langflow exploits, AArch64 Windows stagers, and stronger automated code-quality rules.
Week of 2026-08-03
GhostCMS and WordPress exploits arrived while the team overhauled reflective payload loading and shipped framework release 6.5.2.
Week of 2026-07-27
The biggest week of the month: the Rails Active Storage exploit began landing, AArch64 Windows payload work kicked off, and Metasploit released version 6.5.0.
Over the past month, Metasploit Framework shipped a steady stream of new attack modules — including exploits for Rails Active Storage, SPIP, Forgejo, Langflow, GhostCMS, and WordPress — alongside a major push to support AArch64 (modern ARM) Windows payloads and psexec targets. Under the hood, the team modernized developer tooling (raising minimum Ruby to 3.2, expanding RuboCop lint rules, improving agent documentation) and fixed reliability issues in payload delivery, DNS forwarding, and reflective loaders. The framework also progressed through several point releases (6.5.0 through 6.5.3) with Kerberos token handling and JSON-RPC authentication improvements.
Week by week
2026-08-24A quieter week focused on polishing the Rails Active Storage exploit and housekeeping like Ruby version requirements and documentation updates.latest6 changes
Feature
Rails Active Storage Vips RCE merged
The exploit for remote code execution in Rails Active Storage's image processing was finalized, including fixes to target selection so Unix and Linux systems are handled correctly.
Chore
Minimum Ruby version raised to 3.2
The project now requires Ruby 3.2 as its baseline, keeping dependencies current.
Fix
Windows Meterpreter tests repaired
Automated tests for Windows Meterpreter functionality were corrected after they had broken.
Feature
WinRM login session type option added
Users can now specify the session type when authenticating to Windows machines via WinRM.
Fix
Fetch payload prepends corrected
Fixes were applied so that code prepended to fetch-based payloads is inserted properly.
Docs
Installer download links updated
Documentation now lists new installer versions for Metasploit 5.1.0 and 5.0.0.
2026-08-17A busy week adding new attack modules for SPIP and Forgejo plus MIPS payload improvements and a batch of bug fixes.6 changes
Feature
SPIP unauthenticated RCE module added
A new exploit lets attackers run commands on unpatched SPIP websites without logging in, via a filter parameter flaw.
Feature
New CVE-2026-9198 module landed
An exploit for this newly tracked vulnerability was contributed and refined based on reviewer feedback.
Feature
MIPS payload prepend options expanded
Payloads targeting MIPS processors gained configurable prepend options across mipsbe, mipsle, and mips64 variants, with regression tests.
Feature
AArch64 psexec support added
The psexec module can now compromise Windows machines running on modern 64-bit ARM hardware.
Fix
DNS server default request dispatch fixed
A community contributor corrected how the default DNS server handles dispatched requests.
Docs
Security disclosure page refreshed
SECURITY.md was updated with the correct reporting URL, replacing Zendesk references with FreshDesk.
2026-08-10Framework hit version 6.5.3 while gaining new Forgejo and Langflow exploits, AArch64 Windows stagers, and stronger automated code-quality rules.6 changes
Feature
Forgejo arbitrary file read module added
A new module can read sensitive files from vulnerable Forgejo servers (CVE-2026-59774).
Feature
Langflow unauthenticated RCE exploit added
Attackers can now run code on exposed Langflow AI-workflow instances without credentials (CVE-2026-33017).
Feature
AArch64 Windows reverse TCP shell stager
Metasploit gained a staged reverse TCP shell payload for Windows running on ARM64 chips, including shared low-level helper code.
Fix
DNS forward/cache crashes fixed
Two crash bugs in Metasploit's built-in DNS forwarding and caching path were resolved.
Chore
New lint rules enforce module best practices
Automated checks now require modules to declare their vulnerability-check ability, block hardcoded payloads, and flag outdated fingerprinting techniques.
Chore
Framework bumped to 6.5.3
A point release was cut bundling the week's fixes and additions.
2026-08-03GhostCMS and WordPress exploits arrived while the team overhauled reflective payload loading and shipped framework release 6.5.2.6 changes
Feature
GhostCMS authenticated RCE module added
A new exploit runs code on GhostCMS sites using stolen admin credentials (CVE-2026-29053).
Feature
WordPress batch desync RCE module added
A community-contributed module exploits request smuggling-style flaws in WordPress plugin batching.
Fix
Reflective loader reliability overhaul
Multiple fixes made the reflective DLL loader work correctly on unaligned memory maps, sped up Meterpreter startup when no extensions are needed, and restored legacy loader defaults.
Refactor
Native JWT generation migrated
Token creation moved to native JWT generation with support for custom header fields, reducing external dependencies.
Fix
Kerberos forged ticket handling improved
Forged ticket storage responses are preserved and credentials linked properly, making ticket-forging workflows more reliable.
Chore
Agent documentation expanded
Contributing guides for AI coding agents gained templates, error-handling guidance, and notes on metadata sources and stability ratings.
2026-07-27The biggest week of the month: the Rails Active Storage exploit began landing, AArch64 Windows payload work kicked off, and Metasploit released version 6.5.0.6 changes
Feature
Rails Active Storage Vips RCE exploit created
Work started on an exploit for remote code execution in Rails' image processing component (CVE-2026-66066), which would be polished the following weeks.
Feature
AArch64 Windows staged shell payload added
A staged reverse_tcp shell payload for Windows on ARM64 was introduced, with window hiding and SEH exit-function support following shortly after.
Chore
Metasploit 6.5.0 released
A major version bump shipped, followed by quick follow-up releases 6.5.1 and payload library updates.
Feature
Shared Kerberos GSS/SPNEGO token handling
Kerberos authentication token construction was centralized into reusable libraries used by multiple modules.
Feature
Ray local file inclusion module added
A new module reads local files from vulnerable Ray servers, with optional node ID configuration refined during review.
Fix
Meterpreter response timeout leak fixed
A resource leak where Meterpreter timeouts weren't cleaned up was patched, along with JSON-RPC payload test fixes.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required