“The creds table will hold the data enumerated by the user… The origin will store the location where we were able to grab the creds from, the service will feature the particular service running, and public/private are just holders for the username and password.”
Day four of a flat-network engagement, three hundred hosts touched, and the operator is grepping a file called creds_FINAL_v2.txt trying to remember which of the four svc_backup passwords worked on which subnet. Everyone has been that person. Metasploit Framework Credentials is about the part of Metasploit that exists specifically to stop it happening: the PostgreSQL backend, which almost nobody switches on and which quietly records everything the framework touches.
Activating the Hive Mind
The guide assumes you can already fire an exploit and spends its pages on what happens to the output. Run msfdb init, confirm with db_status inside the console, and the creds subsystem starts collecting on its own.
The point it makes well is that this requires no discipline from the operator. Modules write to the database as a side effect of running:
- Network brute-forcing:
ftp_loginand its siblings do not just report a valid pair — they record the host, port, service and credential as a structured row while you are reading the console output. - Memory extraction (kiwi): Meterpreter’s
kiwimodule, Metasploit’s in-process Mimikatz implementation, pulls NTLM hashes and any cached cleartext from LSASS and files them the same way. Worth knowing it is loud: loading kiwi touches LSASS in a manner that any competent EDR flags immediately, so on a mature estate this is a decision, not a default. - Network capture:
capture/smbandcapture/telnetstand up rogue services that harvest authentication attempts, logging NetNTLM hashes as they arrive.
Parsing the Stolen Data
Collection is the easy half. The manual’s more useful section is the query syntax — filtering thousands of rows by host, by service (creds -s ssh), by port — because the operational question during an engagement is never “what have I got” but “do I already have something that works on this box”, and answering it in three seconds rather than three minutes changes how you move.
It closes with export: pulling hashes out in a format John the Ripper or Hashcat will take for offline cracking.
Two things worth stating that the guide leaves implicit. The database is a plaintext-and-hashes archive of the client’s credentials sitting on your testing machine, so it belongs on an encrypted volume and it belongs in your engagement’s data destruction plan alongside the report. And its quiet advantage is evidentiary: every credential row carries where it came from, which is the difference between a finding you can defend in a debrief and one that is your word against the client’s memory.
Who Is This Book REALLY For?
- Professional penetration testers: Multi-subnet work is bounded by how fast you can answer questions about your own loot. Text files stop scaling somewhere around the second
/24. - Red team tooling engineers: Knowing the internal schema is what lets a custom module plug into the existing store instead of inventing a parallel one.
- OSCP candidates: Modest benefit here, and worth naming honestly — the exam is a handful of hosts, so the database is overkill for passing it and the habit is worth building anyway for the work that comes after.
The Bottom Line
Metasploit Framework Credentials reframes the tool. Metasploit is not primarily an exploit collection — those age out and get replaced. It is an intelligence store with an exploit collection attached, and the store is the part that still matters on day four.
