Kali Linux Day 10 : Metasploit Tutorial Kali Linux 2026 — msfconsole, Modules & First Exploit Complete Guide

This article is a comprehensive tutorial on Metasploit Framework as part of a 180-day Kali Linux training course, specifically Day 10. It covers the core components of Metasploit—msfconsole navigation, module architecture, exploit execution, and post-exploitation—with hands-on exercises against Metasploitable 2, an intentionally vulnerable VM. The article demonstrates how Metasploit bridges the gap between identifying vulnerabilities and actually exploiting them, positioning it as the standard tool used by professional penetration testers to translate reconnaissance intelligence into authenticated system access.

• Metasploit's role in the attack chainMetasploit Framework sits at Step 3 (exploitation) in the penetration testing attack chain, following reconnaissance tools like Nmap and theHarvester. It is described as an end-to-end platform containing over 2,200 exploit modules covering Windows, Linux, macOS, network devices, and web applications, with dedicated modules for post-exploitation, pivoting, and persistence—not simply an exploit launcher.
• Six distinct module types architectureMetasploit organizes functionality into six module types: exploit/ (leverages vulnerabilities with payloads), auxiliary/ (scanners and brute forcers without payloads), payload/ (code executed after exploit success), post/ (runs after shell establishment for privilege escalation and credential harvesting), encoder/ (transforms payloads to avoid detection), and evasion/ (bypasses AV/EDR products). Understanding which type to use in any scenario is foundational to the platform.
• vsftpd 2.3.4 backdoor exploitation walkthroughThe article provides a step-by-step exploit sequence against Metasploitable 2: ping the target, launch msfconsole, search and load the exploit/unix/ftp/vsftpd_234_backdoor module, set RHOSTS to the target IP, and run the exploit. This delivers root access (uid=0) in under 30 seconds by exploiting CVE-2011-2523, a real backdoor inserted into vsftpd source code in 2011 that existed in production deployments.
• Meterpreter session capabilities and advantagesMeterpreter is presented as the advanced payload of choice for professional penetration testing because it runs entirely in memory (never writes to disk), encrypts communications, and provides a rich built-in command set for post-exploitation without requiring additional tools. Core commands include sysinfo (OS details), getuid (current privileges), hashdump (password hashes), download/upload (file transfer), and ps (process listing).
• msfconsole navigation and command syntaxThe article documents essential msfconsole commands including search (by keyword, CVE, platform, type), use (load module), show options (display settings), set (configure parameters), info (module details), run/exploit (launch), sessions management, and background. Tab completion is emphasized as essential for efficiency—typing a partial module path and pressing Tab twice auto-completes and lists options.
• Auxiliary modules for reconnaissance without exploitationAuxiliary modules enable port scanning, service enumeration, brute forcing, and vulnerability verification without payloads or creating sessions. The article demonstrates three examples: auxiliary/scanner/portscan/tcp (enumerate open ports), auxiliary/scanner/ssh/ssh_version (identify SSH versions), and auxiliary/scanner/smb/smb_version (enumerate SMB details), establishing these as the standard approach for the enumeration phase of professional assessments.
• Professional use cases versus script kiddie approachThe article argues that understanding Metasploit's architecture deeply—knowing when to use exploits versus manual PoCs versus encoders—separates professionals from script kiddies. Metasploit is the right choice when speed, documentation, and reliability matter (covering 90% of authorized penetration tests), but manual exploitation becomes important for EDR evasion, deep vulnerability understanding, or when no module exists.
• Legal authorization and lab isolation requirementsThe article emphasizes that Metasploit use is legal only with explicit written authorization on owned or authorized systems, violating the Computer Misuse Act and CFAA otherwise. Metasploitable 2 must always run on a host-only or isolated network—never internet-connected—because its vulnerabilities are real and exploitable. All exercises target this isolated lab environment, never production systems.

Bottom line: Metasploit Framework is the industry-standard penetration testing platform that transforms reconnaissance intelligence into authenticated access through a consistent module architecture (exploits, payloads, post-exploitation modules); mastering msfconsole navigation and module selection allows penetration testers to exploit identified vulnerabilities and establish Meterpreter sessions in minutes. Understanding when to use Metasploit's built-in modules versus manual exploitation, combined with st