n8n-nodes-metasploit

Community node for n8n that drives the Metasploit Framework through its MessagePack RPC API (msfrpcd). Search and run modules, generate payloads, manage sessions and jobs, read/write the Metasploit database (hosts, services, vulns, loot…) and trigger workflows automatically when a new session opens — all from n8n.

⚠️ Authorized testing only. This node automates an offensive-security framework. Use it exclusively against systems you own or are explicitly authorized to test. You are responsible for complying with all applicable laws and rules of engagement.

Installation

Settings → Community Nodes → Install → n8n-nodes-metasploit.

Then create a Metasploit RPC API credential (see Credentials) and make sure msfrpcd is running and reachable from n8n.

Requirements: start the RPC daemon

The node talks to msfrpcd (the Metasploit RPC daemon). It works the same whether Metasploit is installed natively on a host or run in Docker — the node just makes HTTP requests to whatever URL you configure. Start the daemon on a host n8n can reach:

# -U user  -P password  -S = plain HTTP (no SSL)  -a bind addr  -p port  -f foreground
msfrpcd -U msf -P 'change-me-strong-password' -S -a 0.0.0.0 -p 55553 -f

• -a 0.0.0.0 binds all interfaces. If you omit it, msfrpcd listens only on 127.0.0.1 and nothing outside that host (including an n8n container) can reach it.
• -S serves plain HTTP → use http://… in the Base URL. Only do this on a trusted / isolated network. Drop -S to require TLS → use https://… (the node already tolerates self-signed certs).
• The Database operations need msfrpcd connected to PostgreSQL (via msfdb init, or a database.yml + MSF_DATABASE_CONFIG). Without a database they return an ActiveRecord connection error; every other operation works without one.

Credentials (required)

The node requires a Metasploit RPC API credential — there is no anonymous access. auth.login is called with your username/password on every run.

| Field | Required | Description | |---|---|---| | Base URL | ✅ | Where msfrpcd listens, no trailing slash (see scenarios below) | | Username | ✅ | the msfrpcd -U user (e.g. msf) | | Password | ✅ | the msfrpcd -P password — the field is empty by default, you must fill it | | msfvenom / Tools Wrapper URL | ❌ optional | For Payload → Generate File and the Tool resource; leave empty otherwise |

The token from auth.login is sent in the MessagePack request body, so there is no auth header to configure — just URL + username + password.

Connection scenarios (Base URL)

Pick the row matching where n8n runs relative to Metasploit. The daemon command is the same in all cases (msfrpcd -U msf -P … -S -a 0.0.0.0 -p 55553 -f); only the Base URL you put in the credential changes.

| n8n runs… | Metasploit is… | Base URL to use | |---|---|---| | natively on a host | on the same host | http://127.0.0.1:55553 | | in Docker | on the host (native install) | http://host.docker.internal:55553 — on Linux add extra_hosts: ["host.docker.internal:host-gateway"] to the n8n service, or use the bridge IP http://172.17.0.1:55553 | | in Docker | in Docker on the same network | http://<service-name>:55553 (e.g. http://metasploit:55553) | | anywhere | on another machine / LAN | http://<machine-ip>:55553 |

If msfrpcd runs without -S (TLS on), use https:// instead of http:// in any of the rows above.

Example: full Docker stack

A ready-to-run stack (n8n + Metasploit RPC + PostgreSQL + optional msfvenom wrapper) is in examples/docker-compose.yml, with examples/database.yml and examples/msfvenom-wrapper.rb. Copy the three files into a folder and:

docker compose up -d

Then create the credential with:

| Field | Value | |---|---| | Base URL | http://metasploit:55553 | | Username | msf | | Password | change-me-strong-password (must match msfrpcd -P in the compose file) | | msfvenom / Tools Wrapper URL | http://msfvenom:8095 (optional) |

Trim the stack to taste: drop the msf-db service (and the two MSF_DATABASE_CONFIG / volumes lines on metasploit) if you don't need the Database ops, and drop msfvenom if you don't need Generate File.

Resources & operations

| Resource | Operations | |---|---| | Console | Create · Get Many · Read · Write · Run Command · Destroy | | Core | Get Version · Get/Set Global Option · Reload Modules · Get Module Stats · Get Thread List | | Database | Get Hosts / Services / Vulns / Creds / Notes / Loots / Workspaces · Import Data (Nmap XML) · Report Host / Service / Vuln / Note | | Job | Get Info · Get Many · Stop · Stop All | | Module | Search · Get Info · Get Options · Get Compatible Payloads · Check · Execute · Get Many | | Payload | Generate File (formatted payload via msfvenom) | | Plugin | Get Many · Load · Unload | | Session | Get Many · Run Shell Command · Run Meterpreter Command · Run Meterpreter Script · Get Compatible Modules · Upgrade Shell to Meterpreter · Stop · Stop All | | Tool | Pattern Create · Pattern Offset · Assemble (NASM/Metasm) · Generate Egghunter · Find Bad Chars · EXE to VBA/VBS · PDF to XDP · Java Deserializer · VirusTotal · Run Tool | | Advanced | Call RPC Method — raw passthrough to any RPC method |

Plus a Metasploit Trigger node that polls and starts a workflow on events: new session / host / service / vulnerability / credential / loot / note / job / framework event, plus disappearance events Session Closed and Job Finished.

Advanced → Call RPC Method (100% coverage)

The curated operations above cover everything you normally need. For the long tail — any RPC method not surfaced as a dedicated operation, or a new one added by a future Metasploit release — use Advanced → Call RPC Method:

• Method — the RPC method name, e.g. session.ring_read, db.report_loot, core.stop, module.encode.
• Prepend Auth Token — on by default (the login token is sent as the first argument). Turn off only for methods that take no token.
• Arguments (JSON Array) — the positional args after the token, e.g. ["exploit", "windows/smb/ms17_010_eternalblue"] or [{ "host": "10.0.0.5" }].

This makes the node a complete client for the whole Metasploit RPC surface. ⚠️ It is a raw passthrough — some methods are destructive (e.g. core.stop shuts the daemon down); you are responsible for what you call.

Structured output vs the console

Prefer the structured operations (Module → Search, Get Info, Get Compatible Payloads, Session/Job → Get Many, Database → …) for chaining: they return clean JSON you can filter and map directly. Console → Run Command returns the raw framework text plus a cleaned lines[] array and a consoleId you can reuse (the console is stateful — use → set → run persist), useful for commands with no structured RPC equivalent.

Typical flow: search → inspect → payloads

flowchart LR
    A["Module<br/>Search 'eternalblue'"] -->|filter by rank| B["Pick exploit<br/>(Code)"]
    B -->|moduleName| C["Module<br/>Get Info"]
    B -->|moduleName| D["Module<br/>Get Compatible Payloads"]

module.search returns each module as { type, name, fullname, rank, disclosuredate }. fullname includes the type prefix (e.g. exploit/windows/smb/ms17_010_eternalblue); strip it (split('/')) before passing to Get Info (moduleType + moduleName) or Get Compatible Payloads.

Recon → report (Database)

flowchart LR
    A["Import Nmap XML"] --> B["Get Hosts"] --> C["Get Services"] --> D["Report Vuln"] --> E["Get Vulns"] --> F["Build report (Code)"]

Import Data accepts the scan output either as text or from a binary property, so you can chain a "Read/Download File" node holding an Nmap XML straight into it.

Auto-respond to a new session (Trigger)

flowchart LR
    T["Metasploit Trigger<br/>On New Session"] -->|session_id| A["Session<br/>Run Meterpreter Command"] --> S["Summarize (Code)"]

In manual (test) mode the trigger returns all current sessions so you can build the flow; when active it only emits sessions/hosts/loot it has not seen before.

The helper wrapper (optional): msfvenom + Tools

Some capabilities live in Metasploit's CLI tools, not the RPC:

• Formatted payloads (exe, elf, dll, …) — the RPC only returns raw bytes; formatting is a msfvenom capability (Payload → Generate File).
• The Tool resource — pattern_create, pattern_offset, nasm_shell, egghunter, exe2vba/exe2vbs, pdf2xdp, java_deserializer, virustotal, etc. are standalone scripts under tools/, not RPC methods.

Both are served by a single small HTTP wrapper you run alongside Metasploit (it shells out to msfvenom and the tools/ scripts). Point the credential's msfvenom / Tools Wrapper URL at it. A ready-to-run wrapper is examples/msfvenom-wrapper.rb (endpoints POST /generate and POST /tool); it is already wired up in examples/docker-compose.yml. Leave the field empty if you use neither Generate File nor the Tool resource.

For file-based tools (EXE to VBA/VBS, PDF to XDP, Java Deserializer, VirusTotal) the input is read from a binary property on the incoming item, and file-output tools return their result as a binary property (data). Run Tool is a generic escape hatch to invoke any tools/<category>/<name> script with your own arguments, stdin and optional input/output files.

Build

npm install
npm run build   # tsc + copy icons into dist/

Deploy to a self-hosted (Docker) n8n

n8n auto-loads packages placed in ~/.n8n/custom/node_modules/. If your n8n data dir is bind-mounted from the host:

# after `npm run build`
mkdir -p /path/to/n8n-data/custom/node_modules
cp -r . /path/to/n8n-data/custom/node_modules/n8n-nodes-metasploit
docker restart n8n

Only package.json + dist/ are needed at runtime (n8n-workflow is a peer dependency provided by n8n itself).

Notes

• The node ships no runtime dependencies — the MessagePack codec is bundled inline so it can qualify as a verified community node.
• Long-running module executions return a job_id; poll Job → Get Info / Get Many to follow them.
• Session → Run Shell Command works on shell sessions; use Run Meterpreter Command for meterpreter sessions.
• Session and Job fields are pickers: choose a live session/job From List, or switch to By ID to type one directly.
• Module → Get Many supports Return All / Limit (the exploit list is large).
• msfrpcd returns HTTP 200 even on failure; the node inspects the response and raises a proper node error (message from error_message), so failures respect Continue On Fail and the error output branch.

Disclaimer

This project is not affiliated with or endorsed by Rapid7 or the Metasploit project. "Metasploit" is a trademark of Rapid7. Use only for lawful, authorized security testing.

License

MIT