Metasploit + Metasploitable First Module 2026 — vsftpd Backdoor to Root Shell | Hacking Lab 34

This article is a hands-on lab guide teaching penetration testers how to execute their first Metasploit exploit against an intentionally vulnerable Metasploitable target. It demonstrates the complete five-command Metasploit workflow using the vsftpd 2.3.4 backdoor vulnerability to achieve root shell access in under 60 seconds, then reinforces the workflow by running a second exploit (Samba usermap_script) to distinguish between bind and reverse shell mechanisms. The article matters because it establishes the foundational module execution pattern that transfers to all subsequent Metasploit exploitation, providing both theory and practical exercises with explicit command sequences.

• Five-Command Metasploit Workflow StructureEvery Metasploit exploit follows an identical five-step structure: launch msfconsole, use the module, set RHOSTS (target IP), show options to verify configuration, and run the exploit. This consistent pattern applies whether exploiting a trivial backdoor or complex vulnerability, making it the foundational skill for all subsequent modules in the series.
• vsftpd 2.3.4 Backdoor MechanismCVE-2011-2523 is a deliberate backdoor inserted into vsftpd 2.3.4 source code that triggers when a username containing ':)' (a smiley face) is sent during FTP login, causing the service to open a root command shell on port 6200. This extreme simplicity makes it the ideal first module because it teaches the workflow without exploit complexity obscuring the process.
• Bind Shell vs Reverse Shell DistinctionThe vsftpd module creates a bind shell where the target opens port 6200 and the attacker connects inward (LHOST not needed). The Samba usermap_script module requires setting LHOST because it creates a reverse shell where the target connects outbound to the attacker's listener on port 4444. In real engagements with firewalls, reverse shells are more likely to succeed because outbound target connections are typically allowed while inbound connections to arbitrary ports are blocked.
• Post-Exploitation Enumeration SequenceAfter obtaining root access, the article prescribes an immediate enumeration sequence: confirm identity with id/whoami/hostname/uname, enumerate network services with netstat to discover internal-only services (bound to 127.0.0.1) not visible in external scans, extract credentials from /etc/passwd and /etc/shadow, find application config files, and locate SSH keys. This sequence reveals infrastructure the target considered safe because it wasn't externally exposed.
• Session Types and Their CapabilitiesThe vsftpd and Samba exploits produce command shell sessions that provide basic shell access and full filesystem access from root without privilege escalation needed. The article contrasts this with Meterpreter sessions (introduced in later labs) which provide advanced post-exploitation capabilities like file upload/download, process migration, screenshot capture, and keylogging through an on-target agent.
• Samba CVE-2007-2447 Command InjectionThe Samba usermap_script vulnerability (CVE-2007-2447) exploits unsanitised shell command substitution in the username map script feature—injecting shell metacharacters (backticks or $()) in the username causes arbitrary commands to execute as root, demonstrating a different exploitation class than vsftpd's straightforward backdoor trigger.
• Lab Environment and Authorization RequirementsThe article emphasizes this lab runs only on an isolated Metasploitable VM on a host-only network and explicitly warns that running Metasploit modules against systems without written authorization is illegal under laws like the Computer Fraud and Abuse Act (US) and Computer Misuse Act (UK), with legitimate use restricted to owned systems, authorized targets, or sanctioned lab environments.
• Output Sequence InterpretationThe exploit output follows a predictable sequence: FTP banner confirmation identifying the vulnerable version, backdoor trigger confirmation, UID verification showing uid=0 (root access), and session opened message including the internal port (6200 for vsftpd). Understanding this output sequence allows practitioners to verify exploitation success and diagnose failures through expected signals.

Bottom line: The five-command Metasploit workflow (use → set RHOSTS → show options → run) is identical across all exploits regardless of complexity, making it the core skill to internalize through the simplest possible example (vsftpd backdoor) before tackling complex modules. Understanding bind shells versus reverse shells and performing systematic post-exploitation enumeration immediately after shell access are equally critical to successful penetration testing beyond the initial exploitation moment.