It’s time to put all our skills to the test. In this guide we are going to scan a computer, find an exploit, and use it to gain access to the machine. The first step is to start a metasploitable VM, and get the IP address.

I can see that my target’s IP is 192.168.0.90, so now I’m going to run an nmap scan with the -sV flag to find out what software is running. This gives the following results:

I’ve used vsftpd as an example in my previous guides, and since it is first on the list I’m going to try hacking Metasploitable through this. The first step is to fire up metasploit and search for exploits.

There aren’t many exploits for it, but there is a backdoor which I can try to use. using the command ‘show options’ will show me what I need to set.

I now know I need to provide RHOSTS, which is defined by ‘The target host(s)’. I’m only attacking one target, so I set RHOSTS as the target IP.

Using the command ‘exploit’ should now give me access to the Metasploitable machine.

Success! This exploit doesn’t give us a shell, but we can type linux commands in.

It’s hard to see, but I have used the ‘ls’ and ‘pwd’ command to demonstrate that I have access. I have demonstrated this further by navigating to msfadmin’s home directory and viewing one of the files.

If you’ve followed this walkthrough you should also have gained access and hacked your first machine. If you haven’t you can send me a message or an ask and I can try to help you.