Lesson 6 of 12

Exploitation Basics

Exploitation is the phase where you prove a vulnerability is real by successfully leveraging it to gain access. You will use the Metasploit Framework — the most widely used exploitation platform — to launch your first real attacks against a vulnerable target. This lesson focuses on understanding what exploitation actually does at a technical level.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "the Metasploit Framework architecture" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

This objective builds a foundational skill that every security professional uses regularly. Mastering it gives you the vocabulary, mental models, and practical ability to tackle more advanced topics with confidence — and to communicate clearly with both technical and non-technical colleagues.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Exploitation Basics · Objective 1 of 4

VIDEO

Loading video…

Launch Metasploit and verify database connectivity

Open a terminal in Kali and type msfconsole to start Metasploit Framework — the first launch may take 30-60 seconds as it initializes the database. Once at the msf6 prompt, run db_status to confirm the PostgreSQL database is connected; you should see Connected to msf. Connection type: postgresql. If the database is not connected, run sudo service postgresql start and then msfdb init to initialize it. The database is important because it stores your scan results, hosts, services, and notes — without it, Metasploit still works but you lose the ability to organize and search your findings across sessions.

msfconsole

Import Nmap scan results and explore the database

First create a named workspace to keep this engagement separate from others by running workspace -a metasploitable-lab. Then import the XML scan results from your earlier Nmap scan using db_import. After importing, run hosts to see all discovered hosts and services to see all open ports and services organized in a searchable table. This database-driven approach is how professional penetration testers work — you build up a picture of the target environment over time rather than running everything from scratch each session. Run vulns to see any vulnerabilities that Nmap NSE scripts identified during scanning.

workspace -a metasploitable-lab
db_import /path/to/full-scan.xml
hosts
services

Search for and select an exploit module

Use the search command to find exploit modules matching a specific service or CVE — search for vsftpd to find the vsftpd 2.3.4 backdoor exploit. The search results show the module path, disclosure date, rank (Excellent/Great/Good/Normal/Average/Low), and a brief description. Always prefer modules with Excellent rank as these are reliable and well-tested. Type use exploit/unix/ftp/vsftpd_234_backdoor to select the module, then run info to read the full description including how the vulnerability works and what conditions are required for successful exploitation. Understanding the vulnerability, not just running the exploit, is what separates a skilled penetration tester from someone who just runs tools.

search vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
info

Configure all required exploit options

Run show options to see all configurable parameters for the selected exploit — required options are marked with yes in the Required column and the exploit will not run without them. Set RHOSTS to your Metasploitable IP address and verify RPORT is correct (21 for FTP). Run show payloads to see compatible payloads — for this exploit, cmd/unix/interact is the default and appropriate choice. A common mistake is forgetting to set LHOST when using reverse shell payloads — LHOST must be your Kali IP address (the IP the target will connect back to), not the target IP. Run show advanced to see additional options that can improve reliability.

show options
set RHOSTS 192.168.56.101
show payloads
set LHOST 192.168.56.102

Execute the exploit and interact with the session

Type run or exploit to execute the module and watch the output carefully. If successful, you will see a message like Command shell session 1 opened and be dropped into a shell on the target — run id immediately to confirm your access level, which should be root for this exploit. Type sessions to list all active sessions, and sessions -i 1 to interact with session 1 if you were dropped back to the msf6 prompt. If the exploit fails, check that the target is running vsftpd 2.3.4 (verify with nmap -sV -p 21 target), that the IP addresses are correct, and that no firewall is blocking the connection.

run
id
whoami
sessions

Document the complete exploitation chain

After confirming successful exploitation, type exit to close the session and return to the msf6 prompt. Use the notes command to add documentation directly to the Metasploit database: record the vulnerability exploited, the CVE number, the exact module and payload used, the access level obtained, and the timestamp. This documentation habit is critical for professional work — clients expect a detailed exploitation narrative in the final report, and trying to reconstruct what you did from memory hours or days later is unreliable and often inaccurate. Also run loot to see any credentials or sensitive data automatically captured during the session.

exit
notes -a -t exploitation -d "vsftpd 2.3.4 backdoor CVE-2011-2523 - root shell obtained"
loot

Previous: Vulnerability Assessment Next Lesson