It's a network security tool used for exploiting security holes in Windows systems in order to inject a remote control payload. It does have white-hat utility, but my sense is that it's mostly used for grey and black-hat activities.

Unlike the usual "script kiddie" Linux rootkits, it is largely focused in exploration and control of a single machine, but the building blocks Metasploit provides could easily be used to construct botnets, especially in dense networks like college campuses or medium-sized businesses without a strong IT security focus.