## https://sploitus.com/exploit?id=A02B53D4-9E5A-581E-B76F-C5FF27EEACBB
# n8n-nodes-metasploit
[](https://www.npmjs.com/package/n8n-nodes-metasploit)
[](./LICENSE)
Community node for n8n that drives the **Metasploit Framework** through its
MessagePack RPC API (`msfrpcd`). Search and run modules, generate payloads,
manage sessions and jobs, read/write the Metasploit database (hosts, services,
vulns, loot…) and trigger workflows automatically when a new session opens — all
from n8n.
> ⚠️ **Authorized testing only.** This node automates an offensive-security
> framework. Use it exclusively against systems you own or are explicitly
> authorized to test. You are responsible for complying with all applicable laws
> and rules of engagement.
## Installation
**Settings → Community Nodes → Install** → `n8n-nodes-metasploit`.
Then create a **Metasploit RPC API** credential (see [Credentials](#credentials))
and make sure `msfrpcd` is running and reachable from n8n.
## Requirements: start the RPC daemon
The node talks to `msfrpcd` (the Metasploit RPC daemon). It works the same whether
Metasploit is installed **natively on a host** or run in **Docker** — the node just
makes HTTP requests to whatever URL you configure. Start the daemon on a host n8n
can reach:
```bash
# -U user -P password -S = plain HTTP (no SSL) -a bind addr -p port -f foreground
msfrpcd -U msf -P 'change-me-strong-password' -S -a 0.0.0.0 -p 55553 -f
```
- **`-a 0.0.0.0`** binds all interfaces. If you omit it, msfrpcd listens only on
`127.0.0.1` and nothing outside that host (including an n8n container) can reach it.
- **`-S`** serves plain HTTP → use `http://…` in the Base URL. Only do this on a
**trusted / isolated network**. Drop `-S` to require TLS → use `https://…`
(the node already tolerates self-signed certs).
- The **Database** operations need `msfrpcd` connected to PostgreSQL (via
`msfdb init`, or a `database.yml` + `MSF_DATABASE_CONFIG`). Without a database
they return an ActiveRecord connection error; every other operation works
without one.
## Credentials (required)
The node **requires** a **Metasploit RPC API** credential — there is no anonymous
access. `auth.login` is called with your username/password on every run.
| Field | Required | Description |
|---|---|---|
| **Base URL** | ✅ | Where msfrpcd listens, no trailing slash (see scenarios below) |
| **Username** | ✅ | the `msfrpcd -U` user (e.g. `msf`) |
| **Password** | ✅ | the `msfrpcd -P` password — the field is empty by default, **you must fill it** |
| **msfvenom / Tools Wrapper URL** | ❌ optional | For `Payload → Generate File` and the `Tool` resource; leave empty otherwise |
The token from `auth.login` is sent in the MessagePack request body, so there is no
auth header to configure — just URL + username + password.
## Connection scenarios (Base URL)
Pick the row matching **where n8n runs relative to Metasploit**. The daemon command
is the same in all cases (`msfrpcd -U msf -P … -S -a 0.0.0.0 -p 55553 -f`); only the
**Base URL** you put in the credential changes.
| n8n runs… | Metasploit is… | Base URL to use |
|---|---|---|
| natively on a host | on the **same** host | `http://127.0.0.1:55553` |
| in Docker | on the **host** (native install) | `http://host.docker.internal:55553` — on Linux add `extra_hosts: ["host.docker.internal:host-gateway"]` to the n8n service, or use the bridge IP `http://172.17.0.1:55553` |
| in Docker | in **Docker on the same network** | `http://:55553` (e.g. `http://metasploit:55553`) |
| anywhere | on another machine / LAN | `http://:55553` |
> If msfrpcd runs **without `-S`** (TLS on), use `https://` instead of `http://` in
> any of the rows above.
## Example: full Docker stack
A ready-to-run stack (n8n + Metasploit RPC + PostgreSQL + optional msfvenom wrapper)
is in [`examples/docker-compose.yml`](./examples/docker-compose.yml), with
[`examples/database.yml`](./examples/database.yml) and
[`examples/msfvenom-wrapper.rb`](./examples/msfvenom-wrapper.rb). Copy the three
files into a folder and:
```bash
docker compose up -d
```
Then create the credential with:
| Field | Value |
|---|---|
| Base URL | `http://metasploit:55553` |
| Username | `msf` |
| Password | `change-me-strong-password` (must match `msfrpcd -P` in the compose file) |
| msfvenom / Tools Wrapper URL | `http://msfvenom:8095` (optional) |
Trim the stack to taste: drop the `msf-db` service (and the two `MSF_DATABASE_CONFIG`
/ `volumes` lines on `metasploit`) if you don't need the Database ops, and drop
`msfvenom` if you don't need `Generate File`.
## Resources & operations
| Resource | Operations |
|---|---|
| **Console** | Create · Get Many · Read · Write · **Run Command** · Destroy |
| **Core** | Get Version · Get/Set Global Option · Reload Modules · Get Module Stats · Get Thread List |
| **Database** | Get Hosts / Services / Vulns / Creds / Notes / Loots / Workspaces · **Import Data** (Nmap XML) · Report Host / Service / Vuln / Note |
| **Job** | Get Info · Get Many · Stop · Stop All |
| **Module** | Search · Get Info · Get Options · Get Compatible Payloads · Check · **Execute** · Get Many |
| **Payload** | Generate File (formatted payload via msfvenom) |
| **Plugin** | Get Many · Load · Unload |
| **Session** | Get Many · Run Shell Command · Run Meterpreter Command · Run Meterpreter Script · Get Compatible Modules · Upgrade Shell to Meterpreter · Stop · Stop All |
| **Tool** | Pattern Create · Pattern Offset · Assemble (NASM/Metasm) · Generate Egghunter · Find Bad Chars · EXE to VBA/VBS · PDF to XDP · Java Deserializer · VirusTotal · Run Tool |
| **Advanced** | **Call RPC Method** — raw passthrough to *any* RPC method |
Plus a **Metasploit Trigger** node that polls and starts a workflow on events:
new **session / host / service / vulnerability / credential / loot / note / job /
framework event**, plus disappearance events **Session Closed** and **Job
Finished**.
### Advanced → Call RPC Method (100% coverage)
The curated operations above cover everything you normally need. For the long tail
— any RPC method not surfaced as a dedicated operation, or a new one added by a
future Metasploit release — use **Advanced → Call RPC Method**:
- **Method** — the RPC method name, e.g. `session.ring_read`, `db.report_loot`,
`core.stop`, `module.encode`.
- **Prepend Auth Token** — on by default (the login token is sent as the first
argument). Turn off only for methods that take no token.
- **Arguments (JSON Array)** — the positional args *after* the token, e.g.
`["exploit", "windows/smb/ms17_010_eternalblue"]` or `[{ "host": "10.0.0.5" }]`.
This makes the node a complete client for the whole Metasploit RPC surface.
⚠️ It is a raw passthrough — some methods are destructive (e.g. `core.stop` shuts
the daemon down); you are responsible for what you call.
### Structured output vs the console
Prefer the structured operations (`Module → Search`, `Get Info`, `Get Compatible
Payloads`, `Session/Job → Get Many`, `Database → …`) for chaining: they return
clean JSON you can filter and map directly. `Console → Run Command` returns the
raw framework text plus a cleaned `lines[]` array and a `consoleId` you can reuse
(the console is stateful — `use` → `set` → `run` persist), useful for commands
with no structured RPC equivalent.
## Typical flow: search → inspect → payloads
```mermaid
flowchart LR
A["ModuleSearch 'eternalblue'"] -->|filter by rank| B["Pick exploit(Code)"]
B -->|moduleName| C["ModuleGet Info"]
B -->|moduleName| D["ModuleGet Compatible Payloads"]
```
`module.search` returns each module as `{ type, name, fullname, rank,
disclosuredate }`. `fullname` includes the type prefix (e.g.
`exploit/windows/smb/ms17_010_eternalblue`); strip it (`split('/')`) before
passing to `Get Info` (`moduleType` + `moduleName`) or `Get Compatible Payloads`.
## Recon → report (Database)
```mermaid
flowchart LR
A["Import Nmap XML"] --> B["Get Hosts"] --> C["Get Services"] --> D["Report Vuln"] --> E["Get Vulns"] --> F["Build report (Code)"]
```
`Import Data` accepts the scan output either as text or from a binary property, so
you can chain a "Read/Download File" node holding an Nmap XML straight into it.
## Auto-respond to a new session (Trigger)
```mermaid
flowchart LR
T["Metasploit TriggerOn New Session"] -->|session_id| A["SessionRun Meterpreter Command"] --> S["Summarize (Code)"]
```
In manual (test) mode the trigger returns all current sessions so you can build
the flow; when active it only emits sessions/hosts/loot it has not seen before.
## The helper wrapper (optional): msfvenom + Tools
Some capabilities live in Metasploit's **CLI tools**, not the RPC:
- **Formatted payloads** (`exe`, `elf`, `dll`, …) — the RPC only returns *raw*
bytes; formatting is a `msfvenom` capability (`Payload → Generate File`).
- **The `Tool` resource** — `pattern_create`, `pattern_offset`, `nasm_shell`,
`egghunter`, `exe2vba`/`exe2vbs`, `pdf2xdp`, `java_deserializer`, `virustotal`,
etc. are standalone scripts under `tools/`, not RPC methods.
Both are served by a single small HTTP wrapper you run alongside Metasploit (it
shells out to `msfvenom` and the `tools/` scripts). Point the credential's
**msfvenom / Tools Wrapper URL** at it. A ready-to-run wrapper is
[`examples/msfvenom-wrapper.rb`](./examples/msfvenom-wrapper.rb) (endpoints
`POST /generate` and `POST /tool`); it is already wired up in
[`examples/docker-compose.yml`](./examples/docker-compose.yml). Leave the field
empty if you use neither `Generate File` nor the `Tool` resource.
For file-based tools (EXE to VBA/VBS, PDF to XDP, Java Deserializer, VirusTotal)
the input is read from a **binary property** on the incoming item, and file-output
tools return their result as a binary property (`data`). `Run Tool` is a generic
escape hatch to invoke any `tools//` script with your own
arguments, stdin and optional input/output files.
## Build
```bash
npm install
npm run build # tsc + copy icons into dist/
```
## Deploy to a self-hosted (Docker) n8n
n8n auto-loads packages placed in `~/.n8n/custom/node_modules/`. If your n8n data
dir is bind-mounted from the host:
```bash
# after `npm run build`
mkdir -p /path/to/n8n-data/custom/node_modules
cp -r . /path/to/n8n-data/custom/node_modules/n8n-nodes-metasploit
docker restart n8n
```
Only `package.json` + `dist/` are needed at runtime (`n8n-workflow` is a peer
dependency provided by n8n itself).
## Notes
- The node ships **no runtime dependencies** — the MessagePack codec is bundled
inline so it can qualify as a verified community node.
- Long-running module executions return a `job_id`; poll `Job → Get Info` /
`Get Many` to follow them.
- `Session → Run Shell Command` works on **shell** sessions; use
`Run Meterpreter Command` for **meterpreter** sessions.
- **Session** and **Job** fields are pickers: choose a live session/job *From
List*, or switch to *By ID* to type one directly.
- `Module → Get Many` supports **Return All / Limit** (the exploit list is large).
- msfrpcd returns HTTP 200 even on failure; the node inspects the response and
raises a proper node error (message from `error_message`), so failures respect
**Continue On Fail** and the error output branch.
## Disclaimer
This project is not affiliated with or endorsed by Rapid7 or the Metasploit
project. "Metasploit" is a trademark of Rapid7. Use only for lawful, authorized
security testing.
## License
[MIT](./LICENSE)