Exploitation Walkthrough: Metasploitable 2
About this lab
Metasploitable 2 is an intentionally vulnerable Linux virtual machine published by Rapid7 specifically for practicing exploitation techniques in an isolated, legal environment. It ships with deliberately outdated and misconfigured services so learners can safely practice the full assessment workflow without touching anything they don't own.
Run this only inside an isolated lab network (host-only or NAT'd VM networking), never on infrastructure you don't own or lack explicit permission to test.
Setting up the range
Import the Metasploitable 2 image into VirtualBox or VMware, set its network adapter to host-only or an isolated internal network so it can't reach or be reached from your real network, and boot it alongside a Kali Linux (or similar) attacker VM on the same isolated segment.
Reconnaissance and enumeration
Start with host discovery and a full port sweep to see what the box exposes:
nmap -sV -p- <target-ip>to identify open ports and service versions across the full range- Follow up on interesting ports with targeted scripts, e.g.
nmap --script vuln -p <port> <target-ip>
Metasploitable 2 typically surfaces a long list of outdated services — FTP, Samba, an old Apache Tomcat instance, an exposed database, and more. Each is a deliberate teaching example of a specific vulnerability class rather than a realistic modern config, which is exactly why it's useful for practice.
What to look for, service by service
vsftpd
An older vsftpd build on this image ships with a well-documented backdoor vulnerability from a compromised source release years ago. It's a canonical example of why verifying software integrity (checksums, signed releases) matters — the lesson is about supply chain trust, not the specific CVE.
Samba
The bundled Samba version has known remote code execution issues typical of that era's default configurations — a good exercise in why unauthenticated write access to file shares is a bigger risk than it looks.
Apache Tomcat
Default or weak manager credentials on the bundled Tomcat instance allow deploying a malicious web application archive to gain code execution — a pattern that still shows up in real assessments wherever default admin panels are left reachable.
Distributed file systems and legacy RPC services
Several other exposed services demonstrate why unauthenticated RPC and outdated remote service daemons are treated as high-priority findings in real engagements — they tend to offer a direct path to code execution with minimal effort.
Using Metasploit itself
The Metasploit Framework (msfconsole) ships with modules that map directly onto most of these services — searching the module database by service name and version (search vsftpd, search samba, etc.) is the standard workflow. The value of the lab isn't memorizing exact module names; it's building the habit of matching a discovered service and version to known weaknesses, understanding why the exploit works, and confirming access cleanly before moving on.
After the foothold
Once you have a shell, the exercise isn't over. Practice privilege escalation (checking for weak file permissions, misconfigured sudo rules, and outdated kernel versions), and get comfortable cleanly documenting exactly how you got there — that documentation habit is the actual skill that transfers to paid engagements.
The takeaway
Every one of these findings maps to a real-world root cause: outdated software, default credentials, unauthenticated services, and unpatched RPC daemons. Metasploitable exists so you build the instinct to spot those patterns quickly, safely, and legally, before you ever touch a system where the stakes are real.