Metasploit.

Metasploit is a modular offensive-security framework originally created by H.D. Moore in 2003 and acquired by Rapid7 in 2009, which now maintains it as an open-source project and a commercial product (Metasploit Pro). It provides a database of public exploits, payloads (including the in-memory Meterpreter agent), encoders, and auxiliary modules that operators chain to validate vulnerabilities, develop proof-of-concept exploits, and conduct authorized penetration tests. The msfvenom utility generates standalone payloads, while msfconsole drives module selection, option setting, and session handling.

Its module library tracks impactful CVEs quickly: exploit/windows/smb/ms17_010_eternalblue is a port of the Equation Group's ETERNALBLUE (MS17-010, CVE-2017-0144) — the SMBv1 flaw leaked by the Shadow Brokers and later weaponized by WannaCry and NotPetya — and the framework added a working module for BlueKeep (CVE-2019-0708) as well. Because Metasploit lowers the bar for weaponizing known vulnerabilities, defenders rely on it for control validation, detection engineering, and purple-team exercises. Blue teams fingerprint its default Meterpreter staging, characteristic TLS certificates, and process-injection behavior. Use without explicit written authorization is illegal in most jurisdictions.

flowchart LR
  A[Recon / vuln scan] --> B[msfconsole: select exploit module]
  B --> C[Set RHOSTS / options]
  C --> D[Choose payload<br/>e.g. Meterpreter]
  D --> E[Run exploit]
  E -->|Success| F[Session / Meterpreter shell]
  F --> G[Post-exploitation modules<br/>privesc, pivot, loot]
  E -->|Fail| B