gwillcox-r7
commented
2 years ago We generally recommend running Metasploit on a VM rather than your primary machine for reasons such as this one. If possible I would try to use a VM, however if this is not possible then what I would recommend is to see if dynamic behavioral scanning is taking place. This sometimes happens with Windows Defender whereby a file could be labeled as fine on disk, but when its executed in memory the dynamic behavioral analysis engine catches the file again and prevents it from executing or quarantines it.
I'd also recommend perhaps installing it all into one directory and then adding an exception for that directory. You could do this by cloning the Git repo using the instructions at https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment whilst disabling your AV, set an exception on the directory you cloned the Git repo into, and then reenable the AV. This won't stop any behavioral analysis from blocking things, but should prevent disk scans from picking up and removing your files.
Hope that helps :)
MrUndead13
h00die
adfoster-r7
github-actions[bot]
Good evening, I just installed Kaspersky Internet Security on my MacBook Air M1 (Monterey 12.1) and after doing a scan it quarantined all Metasploit files. So I added /opt/metasploit-framework to exceptions and reinstalled Metasploit (after turning Kaspersky off and on after the installation). From now on, Metasploit works but every time I restart my MacBook, msfconsole is deleted from the path and when I run msfconsole from the /bin directory, it initialized it (database and data) just like if I was launching it for the first time.
Is there another folder to put into the exceptions to avoid that or another fix ?
Thanks in advance :)