n8n-nodes-metasploit

Community node for n8n that drives the Metasploit Framework through its
MessagePack RPC API (msfrpcd). Search and run modules, generate payloads,
manage sessions and jobs, read/write the Metasploit database (hosts, services,
vulns, loot…) and trigger workflows automatically when a new session opens — all
from n8n.

⚠️ Authorized testing only. This node automates an offensive-security
framework. Use it exclusively against systems you own or are explicitly
authorized to test. You are responsible for complying with all applicable laws
and rules of engagement.

Installation

Settings → Community Nodes → Install → n8n-nodes-metasploit.

Then create a Metasploit RPC API credential (see Credentials)
and make sure msfrpcd is running and reachable from n8n.

Requirements: start the RPC daemon

The node talks to msfrpcd (the Metasploit RPC daemon). It works the same whether
Metasploit is installed natively on a host or run in Docker — the node just
makes HTTP requests to whatever URL you configure. Start the daemon on a host n8n
can reach:

# -U user  -P password  -S = plain HTTP (no SSL)  -a bind addr  -p port  -f foreground
msfrpcd -U msf -P 'change-me-strong-password' -S -a 0.0.0.0 -p 55553 -f

• -a 0.0.0.0 binds all interfaces. If you omit it, msfrpcd listens only on
  127.0.0.1 and nothing outside that host (including an n8n container) can reach it.
• -S serves plain HTTP → use http://… in the Base URL. Only do this on a
  trusted / isolated network. Drop -S to require TLS → use https://…
  (the node already tolerates self-signed certs).
• The Database operations need msfrpcd connected to PostgreSQL (via
  msfdb init, or a database.yml + MSF_DATABASE_CONFIG). Without a database
  they return an ActiveRecord connection error; every other operation works
  without one.

Credentials (required)

The node requires a Metasploit RPC API credential — there is no anonymous
access. auth.login is called with your username/password on every run.

The token from auth.login is sent in the MessagePack request body, so there is no
auth header to configure — just URL + username + password.

Connection scenarios (Base URL)

Pick the row matching where n8n runs relative to Metasploit. The daemon command
is the same in all cases (msfrpcd -U msf -P … -S -a 0.0.0.0 -p 55553 -f); only the
Base URL you put in the credential changes.

If msfrpcd runs without -S (TLS on), use https:// instead of http:// in
any of the rows above.

Example: full Docker stack

A ready-to-run stack (n8n + Metasploit RPC + PostgreSQL + optional msfvenom wrapper)
is in examples/docker-compose.yml, with
examples/database.yml and
examples/msfvenom-wrapper.rb. Copy the three
files into a folder and:

docker compose up -d

Then create the credential with:

Trim the stack to taste: drop the msf-db service (and the two MSF_DATABASE_CONFIG
/ volumes lines on metasploit) if you don't need the Database ops, and drop
msfvenom if you don't need Generate File.

Resources & operations

Plus a Metasploit Trigger node that polls and starts a workflow on events:
new session / host / service / vulnerability / credential / loot / note / job /
framework event, plus disappearance events Session Closed and Job
Finished.

Advanced → Call RPC Method (100% coverage)

The curated operations above cover everything you normally need. For the long tail
— any RPC method not surfaced as a dedicated operation, or a new one added by a
future Metasploit release — use Advanced → Call RPC Method:

• Method — the RPC method name, e.g. session.ring_read, db.report_loot,
  core.stop, module.encode.
• Prepend Auth Token — on by default (the login token is sent as the first
  argument). Turn off only for methods that take no token.
• Arguments (JSON Array) — the positional args after the token, e.g.
  ["exploit", "windows/smb/ms17_010_eternalblue"] or [{ "host": "10.0.0.5" }].

This makes the node a complete client for the whole Metasploit RPC surface.
⚠️ It is a raw passthrough — some methods are destructive (e.g. core.stop shuts
the daemon down); you are responsible for what you call.

Structured output vs the console

Prefer the structured operations (Module → Search, Get Info, Get Compatible Payloads, Session/Job → Get Many, Database → …) for chaining: they return
clean JSON you can filter and map directly. Console → Run Command returns the
raw framework text plus a cleaned lines[] array and a consoleId you can reuse
(the console is stateful — use → set → run persist), useful for commands
with no structured RPC equivalent.

Typical flow: search → inspect → payloads

flowchart LR
    A["Module<br/>Search 'eternalblue'"] -->|filter by rank| B["Pick exploit<br/>(Code)"]
    B -->|moduleName| C["Module<br/>Get Info"]
    B -->|moduleName| D["Module<br/>Get Compatible Payloads"]

module.search returns each module as { type, name, fullname, rank, disclosuredate }. fullname includes the type prefix (e.g.
exploit/windows/smb/ms17_010_eternalblue); strip it (split('/')) before
passing to Get Info (moduleType + moduleName) or Get Compatible Payloads.

Recon → report (Database)

flowchart LR
    A["Import Nmap XML"] --> B["Get Hosts"] --> C["Get Services"] --> D["Report Vuln"] --> E["Get Vulns"] --> F["Build report (Code)"]

Import Data accepts the scan output either as text or from a binary property, so
you can chain a "Read/Download File" node holding an Nmap XML straight into it.

Auto-respond to a new session (Trigger)

flowchart LR
    T["Metasploit Trigger<br/>On New Session"] -->|session_id| A["Session<br/>Run Meterpreter Command"] --> S["Summarize (Code)"]

In manual (test) mode the trigger returns all current sessions so you can build
the flow; when active it only emits sessions/hosts/loot it has not seen before.

The helper wrapper (optional): msfvenom + Tools

Some capabilities live in Metasploit's CLI tools, not the RPC:

• Formatted payloads (exe, elf, dll, …) — the RPC only returns raw
  bytes; formatting is a msfvenom capability (Payload → Generate File).
• The Tool resource — pattern_create, pattern_offset, nasm_shell,
  egghunter, exe2vba/exe2vbs, pdf2xdp, java_deserializer, virustotal,
  etc. are standalone scripts under tools/, not RPC methods.

Both are served by a single small HTTP wrapper you run alongside Metasploit (it
shells out to msfvenom and the tools/ scripts). Point the credential's
msfvenom / Tools Wrapper URL at it. A ready-to-run wrapper is
examples/msfvenom-wrapper.rb (endpoints
POST /generate and POST /tool); it is already wired up in
examples/docker-compose.yml. Leave the field
empty if you use neither Generate File nor the Tool resource.

For file-based tools (EXE to VBA/VBS, PDF to XDP, Java Deserializer, VirusTotal)
the input is read from a binary property on the incoming item, and file-output
tools return their result as a binary property (data). Run Tool is a generic
escape hatch to invoke any tools/<category>/<name> script with your own
arguments, stdin and optional input/output files.

Build

npm install
npm run build   # tsc + copy icons into dist/

Deploy to a self-hosted (Docker) n8n

n8n auto-loads packages placed in ~/.n8n/custom/node_modules/. If your n8n data
dir is bind-mounted from the host:

# after `npm run build`
mkdir -p /path/to/n8n-data/custom/node_modules
cp -r . /path/to/n8n-data/custom/node_modules/n8n-nodes-metasploit
docker restart n8n

Only package.json + dist/ are needed at runtime (n8n-workflow is a peer
dependency provided by n8n itself).

Notes

• The node ships no runtime dependencies — the MessagePack codec is bundled
  inline so it can qualify as a verified community node.
• Long-running module executions return a job_id; poll Job → Get Info /
  Get Many to follow them.
• Session → Run Shell Command works on shell sessions; use
  Run Meterpreter Command for meterpreter sessions.
• Session and Job fields are pickers: choose a live session/job From
  List, or switch to By ID to type one directly.
• Module → Get Many supports Return All / Limit (the exploit list is large).
• msfrpcd returns HTTP 200 even on failure; the node inspects the response and
  raises a proper node error (message from error_message), so failures respect
  Continue On Fail and the error output branch.

Disclaimer

This project is not affiliated with or endorsed by Rapid7 or the Metasploit
project. "Metasploit" is a trademark of Rapid7. Use only for lawful, authorized
security testing.

License

MIT