Labs / ethical hacking

Exploitation Framework Basics on a Purpose-Built Vulnerable VM

intermediate EVE-NG/VM lab with a purpose-built vulnerable practice VM (e.g. Metasploitable) — never a real production system exploitationmetasploitnetwork-security

Scenario

Authorization note: this lab must only be run against a purpose-built vulnerable practice VM (such as Metasploitable, which ships with intentionally vulnerable services specifically for this kind of training) inside your own isolated lab — never against a real system. Your goal is to understand the exploitation framework’s workflow: search, select, configure, and confirm — not to memorise a specific exploit.

What you need

  • An attacker VM with Metasploit Framework installed.
  • A purpose-built vulnerable practice VM on the same isolated lab network, with its known intentionally-vulnerable services enabled (this is exactly what such VMs are published for).

Step 1 — Confirm the target service first

Earlier phases matter here too — don’t skip straight to exploitation.

attacker$ nmap -sV 192.168.100.30

Confirm the exact service and version you intend to target is actually running, matching what your vulnerability assessment expects.

Step 2 — Search for a matching module

msf6 > search <service-name>

Review the results and note that a module’s description tells you what specific weakness it targets — always confirm this matches your enumerated service and version before proceeding.

Step 3 — Select and configure the module

msf6 > use <module-path>
msf6 > show options
msf6 > set RHOSTS 192.168.100.30

show options is the habit to build here — always review exactly what a module needs before running it, rather than guessing.

Step 4 — Run it and confirm the result

msf6 > exploit

On success, you should get an interactive session on the target. Confirm this by running a basic command (like listing the current user) inside that session — this is your evidence, not just “the framework said success.”

Step 5 — Document it as a finding

Using the structure from Penetration Test Reporting, write up: which specific version was vulnerable, what access was gained, and what the remediation is (patch/upgrade the affected service to a supported, current version).

Break it

Try the same module against a patched or different service version and observe it fail — this reinforces that exploitation only works because vulnerability assessment correctly matched a specific version, not a whole product family.

Reference

  • AddySec original content — written for the Ethical Hacking track, building on Exploitation Framework Fundamentals and Vulnerability Assessment Basics.