Step 116. Getting Started with Metasploit — The Standard Assembly Plant of Attacks
Level 2 — Introduction to Security and the Basics of Attack Skills | Difficulty ★★★☆☆ | Estimated time: 3 hours
Prerequisites: you’ve read CVE-2011-2523 (the vsftpd 2.3.4 backdoor) in Step 115. You know that "attack code is published on Exploit-DB and in Metasploit."
- What you need: the lab’s Kali Linux (Metasploit is built in by default). Today we go only as far as "configuring" a module — running it (
exploit) happens in Step 117. - Caution: ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. This environment has no Kali or Metasploit, so every screen in this chapter is a Screen example. Follow along on your own Kali and compare.
In Step 115 we confirmed as fact that "the vsftpd 2.3.4 backdoor attack code exists as a Metasploit module (EDB-ID 17491)." Today we open the door of that tool warehouse. Metasploit is an exploit framework — the de facto standard penetration testing tool that assembles thousands of attack modules and payloads like Lego bricks and runs them. Fortunately, the operating flow is always the same: search (find) → use (select) → set (configure) → exploit (run). Today we get this four-word flow into our hands.
1. Learning Objectives
By the end of this chapter, you will be able to:
- Launch
msfconsoleand recognize the change in the prompt (ordinary shell → msf shell) - Find modules with
searchand read the results table (number, name, rank, description) - Select a module with
useand inspect its settings withshow options - Set options with
set RHOSTSand the like, distinguishing RHOSTS (target) from LHOST (my address) - View the list of compatible payloads with
show payloadsand explain what a payload means
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/environment | Kali Linux, Metasploit Framework (msfconsole) |
| Today’s commands | msfconsole, search, use, show options, set/unset, show payloads, info, back |
| Concepts needed | Module structure (exploit/auxiliary/payload), RHOSTS and LHOST, Step 115’s CVE reading card |
| Today’s artifact | The vsftpd backdoor module in a "fully configured" state (a capture of show options) |
2-1. Frameworks — An Assembly Plant for Attack Code
On Step 115’s Exploit-DB, attack code sits in raw form — you read it, modify it, compile it, and run it yourself. Metasploit standardizes this work. Every attack is wrapped in the same interface, so you can run any of them through the same procedure without knowing the details of each piece of code.
By analogy: if Exploit-DB is a parts warehouse, Metasploit is a factory equipped with assembly instructions and workbenches. Today we learn only how to use the workbench; firing the assembled product is postponed to the next chapter.
2-2. The Three Kinds of Modules — exploit, payload, auxiliary
Metasploit’s parts (modules) come in three broad kinds.
- Exploit: the code body that breaks through a vulnerability. It’s in charge of "how to open the door." Today’s protagonist,
exploit/unix/ftp/vsftpd_234_backdoor, is of this kind. - Payload: the code that runs on the other computer after you’ve broken through. "What to do after the door is open" — open a shell, add a user, and so on. Combining exploits and payloads like Lego bricks is Metasploit’s core design.
- Auxiliary: modules that don’t break in — scanning, information gathering, login attempts, and so on. Some of the reconnaissance we did with nmap can be done here too.
A module name’s path is its classification. exploit/unix/ftp/vsftpd_234_backdoor reads in order: "exploit / target OS (unix) / service (ftp) / name."
2-3. The Four-Word Flow — search → use → set → exploit
Whatever the module, the operating procedure is the same.
- search: find modules by keyword
- use: select a module — its name gets stamped into the prompt
- set: look at the required items with
show optionsand fill in the values - exploit: run it (today we only get this far; running happens in Step 117)
And from now on, distinguish these two direction variables clearly. RHOSTS is "Remote HOSTS — the address of the target (the machine playing the victim)"; LHOST is "Local HOST — my (Kali) address." Swapping these two is the number-one most frequent beginner mistake, and it’s the first Wall in section 6 today.
3. Follow Along
3-1. Launching msfconsole — The First Launch Is Slow
Run it from a Kali terminal.
Input (Kali terminal)
msfconsole
Screen example:
=[ metasploit v6.3.x ]
+ -- --=[ 2376 exploits - 1220 auxiliary - 413 post ]
+ -- --=[ 1382 payloads - 46 encoders - 11 nops ]
msf6 >
How to read it: the first launch can take 10–30 seconds due to database initialization. The numbers under the banner are today’s warehouse inventory — over two thousand exploits, over a thousand payloads. And the prompt has changed to msf6 >. From now on, the commands you type are received not by Linux but by Metasploit. To get out, exit; to stop something that’s running, Ctrl+C.
Why: the change in the prompt tells you "who you’re talking to right now." Shell commands like ls not working at msf6 > isn’t a malfunction — your conversation partner has changed.
3-2. search — Finding a Module in the Warehouse
Step 115’s reading card shines here. What we’re looking for is vsftpd.
Input
search vsftpd
Screen example:
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/unix/ftp/vsftpd_234_backdoor 2011-07-03 excellent No VSFTPD v2.3.4 Backdoor Command Execution
How to read it: read the table’s columns — number (#), module path (Name), disclosure date (Disclosure Date), reliability grade (Rank), description. excellent is a stability grade meaning "almost no risk of damaging the target even if it fails." The module we were looking for is there at number 0.
Why: the search results table is the framework’s answer to "is there a tool for this vulnerability?" You can confirm it’s the same module as the reading card’s EDB-ID 17491 (Metasploit) from the description’s "Backdoor Command Execution."
3-3. use and show options — Selecting a Module and Checking Its Settings
Input
use exploit/unix/ftp/vsftpd_234_backdoor
show options
Screen example:
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
[*] No payload configured, defaulting to cmd/unix/interact
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show options
Module options (exploit/unix/ftp/vsftpd_234_backdoor):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s) ...
RPORT 21 yes The target port (TCP)
How to read it: watch for three changes. ① The prompt changed to msf6 exploit(unix/ftp/vsftpd_234_backdoor) >, always showing "which module you’re currently holding." ② A notice that since you didn’t pick a payload separately, a default (cmd/unix/interact — an interactive command shell) was automatically assigned. ③ In the show options table, the item whose Required is yes but whose Current Setting is empty — RHOSTS is the only blank we must fill today. RPORT 21 is already filled because it’s the standard FTP port.
Why: the flow of select module → check blanks is the same for every module. "Fill what’s Required yes but empty" — this one sentence is the reason set exists.
3-4. set — Filling in the Target Address
Input
set RHOSTS 192.168.56.101
show options
Screen example:
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.56.101
RHOSTS => 192.168.56.101
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show options
Module options (exploit/unix/ftp/vsftpd_234_backdoor):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 192.168.56.101 yes The target host(s) ...
RPORT 21 yes The target port (TCP)
How to read it: set‘s confirmation response takes the form RHOSTS => value. Running show options again shows the blank filled. Here, 192.168.56.101 is only the lab’s MS2 address — you must substitute your own lab address. If you filled it wrong, empty it with unset RHOSTS or just set again.
Why: this is the habit of configure → re-verify. The last thing you do before firing in real work is re-check show options. A typo in the target address means "nothing happens at all" or, in the worst case, "firing at the wrong target."
3-5. show payloads — Browsing the Assemblable Parts
Let’s browse which payloads are compatible with this exploit.
Input
show payloads
Screen example (excerpt):
Compatible Payloads
===================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 cmd/unix/interact normal No Unix Command, Interact with Established Connection
1 cmd/unix/bind_perl normal No Unix Command Shell, Bind TCP (via Perl)
2 cmd/unix/bind_perl_ipv6 normal No Unix Command Shell, Bind TCP IPv6 (via Perl)
3 cmd/unix/bind_ruby normal No Unix Command Shell, Bind TCP (via Ruby)
4 cmd/unix/reverse_perl normal No Unix Command Shell, Reverse TCP (via Perl)
5 cmd/unix/reverse_bash normal No Unix Command Shell, Reverse TCP (/dev/tcp)
...
How to read it: even from the names alone, two families are visible — bind_* (the target opens a door and waits) and reverse_* (the target connects back to me). The default-assigned cmd/unix/interact is the minimal payload matching this backdoor’s nature (conversing with the already-open shell on port 6200). The difference between bind and reverse is something we build by hand and learn in Step 118, so for now just remember that "the connection direction is written in the payload’s name."
Why: this step confirms Metasploit’s core design — that the exploit (how to open the door) and the payload (what to do after it’s open) are separated. Even with the same exploit, changing the payload changes the outcome (the kind of shell).
3-6. info — Reading the Module’s Manual
The habit of reading the manual before firing.
Input
info
Screen example (excerpt):
Name: VSFTPD v2.3.4 Backdoor Command Execution
Module: exploit/unix/ftp/vsftpd_234_backdoor
Platform: Unix
Arch: cmd
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2011-07-03
Description:
This module exploits a malicious backdoor that was added to the
VSFTPD download archive. This backdoor was present in the
vsftpd-2.3.4.tar.gz archive sometime before 2011-07-03.
References:
https://nvd.nist.gov/vuln/detail/CVE-2011-2523
How to read it: the same information as Step 115’s reading card is inside the module too — disclosure date, description, and the CVE link. You can see scanner (Step 114) → NVD/Exploit-DB (Step 115) → Metasploit module (today) connecting in a single line.
Why: this is the wrap-up confirming that what we’ve learned so far is not separate tools but one flow. Today we do not press the run button exploit — firing is for after the configuration is fully verified.
4. Missions & Exercises
Mission — Reproducing the Module Configuration Flow Without a Manual
- Launch
msfconsole. - Find the vsftpd module with
search, and write the value of the results table’s Rank column in your notes. - Select the module with
use, then confirm the change in the prompt. - Find the blanks with
show options, and fill them in withset RHOSTS <your lab's MS2 address>. - From
show payloads, pick onebind_family entry and onereverse_family entry, and write down their names. - Exit the module with
back, then reproduce steps 2–4 from scratch without the manual.
Exercises
Exercise 1. State the difference in roles among Metasploit’s three module kinds (exploit, payload, auxiliary), one sentence each.
Exercise 2. Name two pieces of information the prompt msf6 exploit(unix/ftp/vsftpd_234_backdoor) > tells you.
Exercise 3. Explain the difference between RHOSTS and LHOST in terms of "whose address is it?", and state what happens if you set them swapped.
Exercise 4. In show options, what does an item whose Required is yes but whose Current Setting is empty mean, and how do you handle it?
5. Model Answers & Completion Criteria
Mission Model Answer
The whole flow (Screen example):
msf6 > search vsftpd
# Name Rank Description
0 exploit/unix/ftp/vsftpd_234_backdoor excellent VSFTPD v2.3.4 Backdoor Command Execution
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.56.101
RHOSTS => 192.168.56.101
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show options
... RHOSTS 192.168.56.101 yes ...
What should be written in your notes: Rank is excellent. A bind-family example is cmd/unix/bind_perl; a reverse-family example is cmd/unix/reverse_bash. back is the command that exits the selected module and returns to msf6 >.
How to verify: ① Can you do search → use → set → re-verify with show options in one go, without the manual? ② Did you confirm yourself, with show options after configuring, that the blank disappeared? ③ Have you still not pressed exploit — firing belongs to Step 117.
Exercise Answers
Answer 1. An exploit is code that breaks through a vulnerability and opens the door; a payload is code that runs on the other computer after the door is open (a shell, and so on); auxiliary is a module that helps without breaking in (scanning, information gathering). That exploits and payloads are separated and freely combined is the framework’s core.
Answer 2. First, that the party now receiving commands is Metasploit (msf6). Second, that the currently selected module is exploit/unix/ftp/vsftpd_234_backdoor. The prompt is a position sign saying "where you are right now."
Answer 3. RHOSTS is the target’s (attack destination, Remote) address; LHOST is my machine’s (Kali, Local) address. Swap them and the attack points at yourself, or in the case of a reverse payload, the victim learns the wrong address as "the place to connect to" — firing either makes no connection at all or, at worst, heads toward a third-party target. Re-verifying with show options after configuring is the safety net for this mistake.
Answer 4. It means "this module cannot run without this value." In today’s module, RHOSTS was that. Fill it with set name value, and only after confirming with show options again that it’s filled do you move to the next step.
Completion Criteria Checklist
- [ ] I can explain the change in
msfconsole‘s prompt - [ ] I can read the columns of the
searchresults table (number, path, rank, description) - [ ] I selected a module with
useand read its manual withinfo - [ ] I did the
show options→set→ re-verify flow without a manual - [ ] I can distinguish and explain RHOSTS and LHOST
- [ ] I distinguished the bind family from the reverse family in
show payloads - [ ] Mission: I reproduced the entire flow and reached the fully configured state
6. Common Pitfalls & Fixes
Wall 1. I swap RHOSTS and LHOST
Symptom (Screen example): only after setting set RHOSTS <my Kali address> do you realize something is off.
Cause: the two variable names are similar. R is Remote (target); L is Local (me).
Fix: remember "RHOSTS = the receiving side (target), LHOST = the lodging side (me)." And always re-verify with show options right after set — this one habit prevents the number-one beginner mistake.
Wall 2. msfconsole won’t launch, or the first launch is endlessly slow
Symptom (Screen example): you typed the command and the banner doesn’t appear for a long while.
Cause: the first launch spends tens of seconds initializing the module database. From the second time on, it’s fast.
Fix: just wait. If it truly never appears, don’t close the terminal — read the log. If the DB initialization got tangled on Kali, re-initialize with msfdb init.
Wall 3. Linux commands don’t work at the msf prompt
Symptom (Screen example): you typed ifconfig at msf6 > and it behaves oddly or errors.
Cause: your current conversation partner is not the Linux shell but Metasploit. (For reference, msfconsole passes through some system commands, but it varies by version.)
Fix: if you need a Linux command, open a new terminal tab. The Metasploit window belongs to the framework until exit.
Wall 4. search returns nothing at all
Symptom (Screen example): search vstfpd → Matching Modules is empty.
Cause: either a typo (vstfpd) or too long a keyword. search looks through names, descriptions, and even CVE numbers.
Fix: trim it down to a short core word (vsftpd). You can also find modules by CVE number (search CVE-2011-2523). When the module path is long, Tab autocompletion works during use input.
Wall 5. I did set but it doesn’t seem applied
Symptom (Screen example): set RHOST 192.168.56.101 (missing the S) — it passed without an error, but it’s not in options.
Cause: a typo in the option name. Depending on the version, setting a nonexistent name is silently ignored or stored as a separate variable. The exact name is RHOSTS (plural S).
Fix: type exactly the spelling shown in the show options table. And again — re-verifying after set catches everything.
7. Summary
Today’s Concepts
| Concept | One-line explanation |
|---|---|
| Exploit framework | A tool that assembles and runs attack modules and payloads through a standard interface |
| Module | A Metasploit part — exploit / payload / auxiliary, and so on |
| exploit | The code body that breaks through a vulnerability and opens the door |
| payload | Code that runs on the target after the door is open — bind/reverse direction noted in its name |
| RHOSTS / LHOST | The target’s (Remote) address / my machine’s (Local) address — the most frequent mix-up |
| Rank | A module’s stability grade — excellent means low risk of damaging the target |
Today’s Commands
| Command | What it does |
|---|---|
msfconsole |
Launch Metasploit’s interactive shell (first launch is slow) |
search keyword |
Search modules by name, description, or CVE |
use modulepath |
Select a module — the path gets stamped into the prompt (Tab autocompletion) |
show options |
Check settings and blanks (Required yes) |
set name value / unset name |
Fill an option / empty it |
show payloads |
List of payloads compatible with this exploit |
info / back / exit |
Module manual / deselect / quit |
An Instinct More Important Than Commands
Metasploit is not omnipotent — it’s "an organized warehouse." Once the four-word flow of search → use → set → exploit sticks to your body, you can handle any new module you meet through the same procedure. Today we took a part out of the warehouse, placed it on the assembly bench, and even tightened the screws (the options). The screen where show options shows no blanks is today’s artifact.
And remember — assembling and firing are different jobs. Today we deliberately did not fire. This state, with configuration complete, is the moment right before your life’s first shell opens, and that final one command belongs to Step 117.
Once every box is checked, Step 116 is complete. Click the checkbox in the sidebar to save your progress.