Your First Penetration Test with Kali

Set up a pen testing lab and exploit a real vulnerability using Metasploit.

Introduction

30 Second Summary

Every company with a website or app has someone trying to break in. Penetration testers are the professionals hired to find the weaknesses before the real attackers do.

In this project, you will build an isolated hacking lab on your MacBook and perform your first real penetration test. You will discover a target, scan it for vulnerabilities, exploit a real backdoor, and gain root access on the target machine.

What You'll Build

By the time you finish, you will type a single command in Kali Linux and watch a root shell appear on a target system you just hacked, following the same methodology that professional certifications like OSCP and eJPT test.

By the end of this project, you'll have:

  • A working pen testing lab where you can scan a target network and instantly see every open port and running service.
  • The ability to perform service enumeration to identify a specific vulnerable software version and know exactly which exploit to use against it.
  • A completed exploitation using the Metasploit Framework where you launch an exploit and gain root access on the target.
  • Proof of impact through post-exploitation where you extract password hashes and read protected system files.
  • Secret Mission: Find and exploit a second vulnerability on the same target using a completely different attack vector.

Are there any prerequisites?

None. This guide walks you through installing every tool from scratch. You just need a MacBook with at least 16 GB of RAM and around 30 GB of free disk space for the virtual machines.

Before We Start

Before you touch any tools, let's lock in what you're about to build and why it matters.

Set Up Your Pen Testing Lab

To hack into a target system, you first need a safe place to do it. Running attacks on real networks without permission is illegal.

In this step, you will build an isolated lab on your MacBook using two virtual machines: Kali Linux as your attacker and Metasploitable 2 as your target. They will sit on a private network that cannot touch the internet or any other device.

In this step, get ready to:
  • Install VirtualBox on your MacBook.
  • Import Kali Linux and Metasploitable 2 virtual machines.
  • Configure an isolated network and verify connectivity between the two VMs.
Install VirtualBox

VirtualBox is a free tool that lets you run entire operating systems inside windows on your Mac. You will use it to run both your attacker and target machines.

  • Check whether VirtualBox is already installed by opening Terminal and running this command:
VBoxManage --version

✔️ I see version 7.2.14 or higher

VirtualBox is ready to go. Skip ahead to the next substep where you import the virtual machines.

ⓧ I see an older version

You need version 7.2.14 or higher for this project. Download the latest version and install it over your existing copy.

  • Open your browser and go to the VirtualBox downloads page:
  • https://www.virtualbox.org/wiki/Downloads
  • Under "VirtualBox 7.2.14 platform packages", click the link for macOS / Intel hosts.
  • Open the downloaded VirtualBox-7.2.14-174565-OSX.dmg file.
  • Double-click VirtualBox.pkg inside the mounted disk image.
  • Follow the installer prompts to completion.
  • If macOS shows a notification that a system extension was blocked, open System Settings, go to Privacy & Security, scroll down, and click Allow next to the Oracle message. Reboot if prompted.
  • After rebooting, run VBoxManage --version again to confirm you see 7.2.14 or higher.

ⓧ Command not found

VirtualBox is not installed yet. Follow these steps to install it fresh.

  • Open your browser and go to the VirtualBox downloads page:
  • https://www.virtualbox.org/wiki/Downloads
  • Under "VirtualBox 7.2.14 platform packages", click the link for macOS / Intel hosts.
  • Open the downloaded VirtualBox-7.2.14-174565-OSX.dmg file.
  • Double-click VirtualBox.pkg inside the mounted disk image.
  • Follow the installer prompts to completion.

What about the kernel extension?

VirtualBox installs a kernel driver called vboxdrv so it can run virtual machines. macOS blocks third-party kernel extensions by default and requires you to approve them manually.

After the installer finishes, macOS will show a notification that a system extension was blocked. Open System Settings, go to Privacy & Security, scroll down, and click Allow next to the Oracle message. Reboot your MacBook when prompted.

  • After rebooting, open a new Terminal window and verify the install by running:
VBoxManage --version

You should see a version number starting with 7.2.14.

Still seeing command not found?

The VirtualBox installer adds VBoxManage to your PATH automatically. If the command is still not found after a reboot, try opening a brand new Terminal window. If that still does not work, launch VirtualBox from your Applications folder directly to confirm the install succeeded.

Help me troubleshoot VirtualBox not being recognized in Terminal after install.

Import Kali Linux and Metasploitable 2

You need two virtual machines: Kali Linux (your attacker, loaded with hacking tools) and Metasploitable 2 (a deliberately vulnerable target built by Rapid7 for practice).

Download and import Kali Linux
  • Download the pre-built Kali Linux VirtualBox image from the official Kali downloads page:
  • https://www.kali.org/get-kali/
  • Look for the Virtual Machines section and download the VirtualBox 64-bit image.
  • The file is named kali-linux-2026.2-virtualbox-amd64.7z and is approximately 3.7 GB.
  • Extract the .7z archive. You will get a .ova file inside.

Need a 7z extractor?

If your Mac cannot open .7z files, download a free tool like The Unarchiver from the Mac App Store.

  • Open VirtualBox from your Applications folder.
  • Click File in the menu bar, then click Import Appliance.
  • Click the folder icon, navigate to the extracted .ova file, select it, and click Open.
  • Click Next, then click Import. Wait for the import to finish.

You should now see a Kali Linux VM listed in VirtualBox Manager.

Download and create the Metasploitable 2 VM
  • Download metasploitable-linux-2.0.0.zip (approximately 865 MB) from SourceForge:
  • https://sourceforge.net/projects/metasploitable/files/Metasploitable2/
  • Extract the ZIP file. Inside you will find a .vmdk virtual hard disk file.
  • In VirtualBox Manager, click New to create a new virtual machine.
  • Set Name to Metasploitable2.
  • Set Type to Linux.
  • Set Version to Ubuntu (64-bit).
  • Set Memory size to 512 MB.
  • Under Hard disk, select Use an existing virtual hard disk file.
  • Click the folder icon, then click Add. Navigate to the extracted .vmdk file, select it, and click Open.
  • Click Create.

You should now see both Kali Linux and Metasploitable2 listed in VirtualBox Manager.

Why Metasploitable 2?

Metasploitable 2 is a deliberately vulnerable Linux machine built by Rapid7 (the company behind Metasploit). It has over 20 exploitable services running out of the box, making it the perfect punching bag for learning penetration testing without risking real systems.

Configure the isolated network

Right now, both VMs exist but cannot talk to each other. You need to put them on a private network that is completely isolated from the internet.

  • In VirtualBox, click File in the menu bar, then click Host Network Manager.
  • Click Create to add a new Host-only network.
  • Confirm a network named vboxnet0 appears with the IPv4 address 192.168.56.1/24 and DHCP enabled.
  • Close the Host Network Manager.

What is a Host-only network?

A Host-only network creates a private virtual network that only your Mac and the VMs can see. Unlike NAT or Bridged mode, traffic on this network never leaves your machine. This means Metasploitable 2 and all its vulnerable services are completely invisible to anything outside your laptop.

Now configure each VM's network adapters.

  • Select the Kali Linux VM in VirtualBox Manager and click Settings.
  • Go to the Network tab.
  • Under Adapter 1, confirm Attached to is set to NAT. This gives Kali internet access for updates.
  • Click the Adapter 2 tab.
  • Check Enable Network Adapter.
  • Set Attached to to Host-only Adapter.
  • Confirm Name shows vboxnet0.
  • Click OK.
  • Now select the Metasploitable2 VM and click Settings.
  • Go to the Network tab.
  • Under Adapter 1, set Attached to to Host-only Adapter.
  • Confirm Name shows vboxnet0.
  • Click OK.

Metasploitable 2 must never have NAT

Metasploitable 2 has dozens of wide-open vulnerable services. If you give it internet access (NAT or Bridged), those services become reachable from your real network. Keep it on Host-only Adapter only.

Boot both VMs and verify connectivity
  • Select the Kali Linux VM and click Start.
  • Wait for it to reach the login screen. Log in with username kali and password kali.
  • Select the Metasploitable2 VM and click Start.
  • Wait for it to reach the login prompt. Log in with username msfadmin and password msfadmin.

Both VMs are now running. You need to find Metasploitable 2's IP address so Kali knows where to aim.

  • In the Metasploitable 2 terminal, find its IP address by running:
ifconfig

Look for the inet addr value on the eth0 interface. It will be in the 192.168.56.x range. Write this IP down.

Before you run the ping, think about what you expect to happen. Both machines are on the same Host-only network. Do you think the ping will succeed?

  • Switch to your Kali Linux VM. Open a terminal and test connectivity by running:
ping -c 3 [[METASPLOITABLE_IP="Metasploitable 2 IP from ifconfig (e.g. 192.168.56.101)"]]

You should see three replies with response times, confirming Kali can reach Metasploitable 2 over the isolated network.

Not getting ping replies?

  • Confirm both VMs show Running in VirtualBox Manager (green arrow icon).
  • Double-check that Kali's Adapter 2 and Metasploitable 2's Adapter 1 both say Host-only Adapter and reference vboxnet0.
  • If you changed adapter settings while the VMs were running, shut them down and restart them for the changes to take effect.
  • Make sure the IP you are pinging matches what ifconfig showed on Metasploitable 2.

Help me troubleshoot my Kali VM not being able to ping Metasploitable 2 on the Host-only network.

Your pen testing lab is ready. You have an attacker machine and a target machine on a private network, completely isolated from the outside world. Next up, you will use Kali's scanning tools to discover what is running on that target.

Reconnaissance - Discover Your Target

Your lab is ready. Both VMs are running on the isolated network, and you confirmed connectivity in the last step.

Now the real work begins. In a real penetration test, you start by discovering what is actually on the network. You can ping the target, but you know nothing about what services it is running or how to get in. Nmap is the tool that changes that.

In this step, get ready to:
  • Discover live hosts on your isolated network using a ping sweep.
  • Run a port scan against the target to reveal its full attack surface.
  • Interpret the scan results and understand what each open port represents.
Perform host discovery

Before scanning ports, you need to find which hosts are alive on the network. A ping sweep sends probes across the entire subnet and reports back which IP addresses responded.

Before you run this, what do you expect to see? How many hosts do you think are alive on the 192.168.56.0/24 network?

  • Run a ping sweep across the Host-only network by running this command in the Kali terminal:
nmap -sn 192.168.56.0/24

What does this command do?

  • nmap is the network scanning tool pre-installed on Kali.
  • -sn tells Nmap to perform host discovery only. It sends ICMP and ARP probes but does not scan any ports.
  • 192.168.56.0/24 targets the entire subnet of 256 addresses on your Host-only network.

You should see at least two hosts reported as up: the VirtualBox gateway (192.168.56.1) and your Metasploitable 2 target. Each host appears as a "Nmap scan report for" line with "Host is up" beneath it.

Not seeing your Metasploitable 2 host?

  • Make sure the Metasploitable 2 VM is still running in VirtualBox. Check the VirtualBox Manager window for a green arrow next to it.
  • Verify that Metasploitable 2 is connected to the Host-only adapter (vboxnet0). Right-click the VM, select Settings, then Network, and confirm Adapter 1 is set to Host-only Adapter.
  • Try running ping -c 3 followed by the IP you noted earlier. If the ping fails, the network adapter is misconfigured.

Help me troubleshoot why my nmap ping sweep is not finding the Metasploitable 2 VM on 192.168.56.0/24.

Run a basic port scan

Now you know where the target is. The next question is: what services is it running? A port scan probes each port on the target and reports which ones are listening for connections.

Before you run this scan, how many open ports do you think a typical server has? Take a guess.

  • Scan the target for open ports by running this command:
nmap [[METASPLOITABLE_IP="your Metasploitable 2 IP address (e.g. 192.168.56.101)"]]

What does this command do?

Running nmap with just an IP address performs a default TCP scan of the top 1000 most common ports. For each port, Nmap reports whether it is open (listening), closed, or filtered.

This takes a few seconds. When it finishes, Nmap prints a table with three columns: PORT, STATE, and SERVICE.

You should see a long list of open ports. The output shows over 20 open ports including 21 (ftp), 22 (ssh), 23 (telnet), 25 (smtp), 80 (http), 139 (netbios-ssn), 445 (microsoft-ds), and many more.

Seeing "Host seems down" or 0 open ports?

  • Double-check the IP address you entered. It should match the IP from your ping sweep results.
  • If you see "Host seems down", try adding -Pn to skip host discovery and scan directly. This bypasses cases where ICMP is blocked.

Help me figure out why nmap says my Metasploitable 2 target is down or shows no open ports.

Understand your attack surface

Look at that list. Each open port is a service accepting connections from anyone on the network. Each one is a potential way in.

  • Port 21 (FTP) allows file transfers.
  • Port 22 (SSH) provides remote shell access.
  • Port 23 (Telnet) provides unencrypted remote access.
  • Port 80 (HTTP) serves web pages.
  • Port 445 (SMB) handles Windows-style file sharing.

What do you know so far?

You know which ports are open and the general service type (ftp, ssh, http). What you do NOT know yet is the exact software version running on each port.

Version information is critical. A service with a known vulnerability in a specific version is exploitable. The same service at a patched version is not. The next step adds that missing piece.

You now have a map of your target's attack surface. Over 20 services are exposed, each one a potential entry point. Next, you will probe these ports for exact version numbers and find the one that has a known vulnerability you can exploit.

Service Enumeration - Find the Weakness

In the last step, you discovered 20+ open ports on your target. That is a lot of potential entry points.

Knowing a port is open is not enough to exploit it. You need the exact software version running on each port to find a matching vulnerability. In this step, you will turn a list of open ports into actionable intelligence.

In this step, get ready to:
  • Run a version detection scan to identify the exact software behind each open port.
  • Attempt manual FTP access and discover why it is not enough.
  • Research the vulnerability you will exploit in the next step.
Run a version detection scan

Your basic port scan from the previous step told you which ports are open. Now you need to know what software is listening on each one and which version is running.

  • In your Kali terminal, run a version detection scan against your target by running this command:
nmap -sV [[METASPLOITABLE_IP="your Metasploitable 2 IP"]]

What does this command do?

The -sV flag tells Nmap to probe each open port and identify the exact service name and version number. Without it, you only see port numbers and generic service names.

This scan takes longer than the basic scan because Nmap sends specialised probes to each port and analyses the responses.

The output will look similar to your basic scan, but now each line includes the software version. Look at port 21 specifically.

You should see the line: 21/tcp open ftp vsftpd 2.3.4.

Why does the version matter?

A port labelled "ftp" just tells you it runs an FTP server. Knowing the exact version (vsftpd 2.3.4) lets you search for known vulnerabilities specific to that release. One version might be perfectly safe while another has a critical backdoor.

Not seeing version info?

Make sure you typed -sV (capital V). A lowercase -sv is not valid and will produce an error.

If the scan hangs, confirm your Metasploitable 2 VM is still running and that the IP address is correct from your earlier ping sweep.

Still stuck? Help me troubleshoot my nmap version scan

Try connecting manually and hit the wall

You know port 21 is running vsftpd 2.3.4. Before looking for exploits, try connecting to the service directly to see what access you get with default credentials.

  • Connect to the FTP service on the target by running this command:
ftp [[METASPLOITABLE_IP="your Metasploitable 2 IP"]]

What will this prompt you for?

The ftp command opens an interactive session. It will prompt you for a username and then a password.

  • When prompted for Name, type anonymous and press Enter.
  • When prompted for Password, type anonymous and press Enter.

You are now logged in. Before you run the next command, what do you think you will find inside this FTP directory?

  • List the directory contents by typing:
ls

Nothing. The directory is completely empty. You have confirmed the service is reachable, but anonymous access gives you nothing useful.

  • Exit the FTP session by typing:
bye

Why does this matter?

This is a common experience in penetration testing. You can reach the service, but basic access does not give you anything meaningful. You need an actual exploit to get deeper access.

The fact that anonymous login is allowed does confirm the service is running and accepting connections. That is still useful intelligence for the next phase.

Research the vulnerability

You know the target runs vsftpd 2.3.4 and that anonymous access is a dead end. Time to search for known vulnerabilities in this specific version.

  • Search the Exploit Database offline archive by running this command:
searchsploit vsftpd 2.3.4

What does searchsploit do?

The searchsploit tool searches a local copy of the Exploit Database that comes pre-installed on Kali Linux. It works offline, so you can find exploits even without internet access.

It matches your search terms against exploit titles and file paths in the database.

You will see results referencing a backdoor command execution vulnerability. This is CVE-2011-2523.

What is the vsftpd 2.3.4 backdoor?

In July 2011, someone slipped a malicious backdoor into the vsftpd 2.3.4 source code that was available for download. When a user logs in with a username containing :) (a smiley face), the backdoor opens a root shell listening on port 6200.

This is a real-world example of a supply chain attack. The software itself was compromised at the source, meaning anyone who downloaded and installed that version was immediately vulnerable.

You now have everything you need: a target (Metasploitable 2), a vulnerable service version (vsftpd 2.3.4), and a known exploit (CVE-2011-2523 backdoor on port 6200).

To confirm your version detection one more time, run a targeted scan against port 21 only:

nmap -sV -p 21 [[METASPLOITABLE_IP="your Metasploitable 2 IP"]]

You should see the output line 21/tcp open ftp vsftpd 2.3.4. That confirms your target is exploitable.

Searchsploit not returning results?

Make sure you typed vsftpd 2.3.4 with a space between the name and version number. Running searchsploit vsftpd2.3.4 without the space will not match any entries.

If you see zero results, try updating the database with searchsploit -u (this requires the Kali VM to have internet access via its NAT adapter).

Need more help? Help me troubleshoot searchsploit

You have identified the exact weakness. You know the software, the version, and the exploit that targets it. Next up, you will use the Metasploit Framework to fire that exploit and gain root access to the target.

Exploitation - Gain Root Access

You have a target, a vulnerable service version, and a matching exploit. All the reconnaissance and enumeration work has led to this moment.

Now you will use the Metasploit Framework to weaponize the vsftpd 2.3.4 backdoor and gain root access on the target machine. This is the exploitation phase of the PTES methodology.

In this step, get ready to:
  • Launch the Metasploit Framework console.
  • Load and configure the vsftpd backdoor exploit module.
  • Execute the exploit and confirm root-level access on the target.
Launch Metasploit and load the exploit

The Metasploit Framework is the industry-standard tool for delivering exploits against remote targets. Its interactive console, msfconsole, gives you access to thousands of exploit modules.

  • In your Kali terminal, launch the Metasploit console by running this command:
msfconsole

What does this command do?

This starts the Metasploit Framework interactive console. It loads the framework's database of exploits, payloads, and auxiliary modules. You will see a startup banner and then an msf6 > prompt when it is ready for commands.

The console may take 15-30 seconds to load. Wait until you see the msf6 > prompt before typing anything.

Console not loading?

If msfconsole hangs for more than 60 seconds, press Ctrl+C to cancel and try again. On the Kali VirtualBox image, Metasploit is pre-installed and should start without issues.

help me troubleshoot why msfconsole is not starting on my Kali Linux VM

  • Once you see the msf6 > prompt, load the vsftpd backdoor exploit module by running:
use exploit/unix/ftp/vsftpd_234_backdoor

What does this command do?

The use command selects a specific exploit module from Metasploit's library. The module exploit/unix/ftp/vsftpd_234_backdoor automates the entire attack against the vsftpd 2.3.4 backdoor (CVE-2011-2523).

It sends a specially crafted username containing :) to the FTP server, which triggers the backdoor to open a root shell on port 6200.

Your prompt should now change to show the loaded module. It will look similar to msf6 exploit(unix/ftp/vsftpd_234_backdoor) > confirming the module is active.

Configure and fire the exploit

The module needs one piece of information: the IP address of your target. This is the Metasploitable 2 IP you discovered during reconnaissance.

  • Set the target IP by running this command (replace the IP with your Metasploitable 2 address):
set RHOSTS [[METASPLOITABLE_IP="your Metasploitable 2 IP (e.g. 192.168.56.101)"]]
  • Verify your settings are correct by running:
show options

You should see a table showing RHOSTS set to your Metasploitable 2 IP address. Confirm the IP is correct before continuing.

What is RHOSTS?

In Metasploit, RHOSTS stands for "remote hosts." It tells the exploit module which target machine to attack. Every exploit module requires at least this one option to know where to send its payload.

Before you run the exploit, think for a moment. What do you expect to happen when you fire this? Will it succeed or fail? What will success look like?

  • Fire the exploit by running:
exploit

Metasploit connects to port 21 on the target, triggers the backdoor, and then connects to the shell that opens on port 6200.

Exploit did not open a session?

If you see "Exploit completed, but no session was created," check the following:

  • Confirm your Metasploitable 2 VM is still running and reachable. Switch to the Metasploitable 2 VM window and verify it is at the login prompt.
  • Verify the RHOSTS IP is correct. Run show options again and compare the IP to what you saw in your earlier nmap scan.
  • Try running exploit again. Occasionally the first attempt times out if the network handshake is slow.

help me troubleshoot why the vsftpd 2.3.4 backdoor exploit is not opening a session on my Metasploitable 2 target

Confirm root access

If the exploit succeeded, you should see a message indicating a command shell session was opened. You are now connected to a root shell on the target machine.

  • Confirm your access level by running:
id

You should see uid=0(root) gid=0(root) in the output. This means you have full root-level access on the target system.

  • Double-check by running:
whoami

The output should simply say root.

What just happened?

You went from knowing nothing about this machine to having complete administrative control over it. The entire attack followed a methodical process: discover the host, scan its ports, identify a vulnerable service version, research the exploit, and execute it.

The vsftpd 2.3.4 backdoor was a real supply chain attack from 2011. Someone injected malicious code into the official vsftpd source distribution. Any server running this version was silently backdoored, giving attackers root access with a single connection.

You have just performed your first successful exploitation. Getting root is not the end though. Next up, you will prove the severity of this compromise by extracting sensitive data that demonstrates what an attacker could do with this level of access.

Post-Exploitation - Prove the Impact

You just gained root access on the target machine. That is a massive milestone.

Getting root is not the end of a penetration test. A professional pen tester must prove what an attacker could do with this access. In this step, you will extract sensitive data that demonstrates the full severity of the compromise.

In this step, get ready to:
  • Extract password hashes from the target system to demonstrate credential exposure.
  • Read sensitive system data to prove the depth of the compromise.
  • Document your full kill chain following the PTES methodology.
Extract password hashes

The /etc/shadow file contains the hashed passwords for every user on a Linux system. On a properly secured system, only root can read this file. Since you have root access, you can read it all.

Before you run this command, what do you expect to see? Think about what password storage looks like on a Linux system.

  • In your active root shell, extract the password hashes by running:
cat /etc/shadow

You should see a list of usernames followed by their password hashes. Look for entries like msfadmin, user, and postgres with long hash strings next to them.

What are password hashes?

A hash is a one-way transformation of a password. The system stores hashes instead of plain-text passwords so that even administrators cannot read them directly.

In a real engagement, you would take these hashes offline and crack them using tools like John the Ripper or Hashcat to demonstrate password weakness.

Not seeing any output?

If you see "No such file or directory" or a permission denied error, your shell session may have closed. Return to msfconsole and re-run exploit to open a new root shell. Confirm you have root by running id first.

Help me reconnect to my root shell on Metasploitable 2

Read sensitive system data

Password hashes are just the start. Each piece of data you access is evidence of how deep this compromise goes. A real pen test report would include all of this as proof of impact.

  • View all user accounts on the system by running:
cat /etc/passwd

You should see a full list of every user account on the system, including service accounts and human users.

  • View user home directories by running:
ls /home/

You should see directories for each user with a home folder. In a real engagement, you would search these for SSH keys, config files, and stored credentials.

  • Check what commands the root user has previously run by running:
cat /root/.bash_history

This reveals the command history for root. In a production environment, this could expose database passwords, API keys, or other sensitive operations that were run from the command line.

Why does post-exploitation matter?

A pen test finding of "I got root" is significant, but showing what an attacker can DO with root is what convinces decision-makers to fix the vulnerability. Password hashes, sensitive files, and command history make the risk tangible.

Document the kill chain and exit

You have completed a full penetration test following the industry-standard PTES methodology. This is exactly the methodology tested on OSCP and eJPT certifications.

Your kill chain was:

  • Host discovery (nmap -sn) to find live targets on the network.
  • Port scan (nmap) to discover open services.
  • Version detection (nmap -sV) to identify exact software versions.
  • Vulnerability research (searchsploit) to find a matching exploit.
  • Exploitation (Metasploit vsftpd_234_backdoor) to gain root access.
  • Post-exploitation (shadow file extraction) to prove impact.
  • Close your root shell on the target by running:
exit

This drops you back into the msfconsole prompt.

  • Before you run this next command, what do you think it will show about your session?
  • View your completed session record by running:
sessions -l

You should see your completed session listed. This is your record of the successful exploitation.

What does sessions -l show?

The sessions -l command lists all sessions that Metasploit has opened during your current run. Your session 1 appears as a completed command shell, confirming that the exploit worked and you had root access on the target.

Seeing "No active sessions"?

If you closed msfconsole and reopened it, the session history resets. That is fine. The important thing is that you successfully ran the exploit and confirmed root access earlier with id and extracted /etc/shadow.

Help me understand my Metasploit session history

Secret mission

Exploit a Second Vulnerability

A real penetration tester does not stop at one finding. Your target has 20+ vulnerable services waiting to be exploited. Can you find and exploit a different vulnerability using the same PTES methodology you just mastered?

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally on your MacBook, so there are no ongoing costs.

Resources you used:

  • Kali Linux VM (~20 GB disk space).
  • Metasploitable 2 VM (~4 GB disk space).
  • VirtualBox Host-only network (vboxnet0).
  • VirtualBox 7.2.14 application.

Keep everything running

No action needed. Choose this if you plan to keep practising exploits on Metasploitable 2 or preparing for certifications like OSCP or eJPT.

  • Leave both VMs and VirtualBox installed. Metasploitable 2 has 20+ exploitable services you have not touched yet.
  • The Host-only network keeps Metasploitable 2 completely isolated from the internet, so there is no security risk in leaving it on your machine.
  • You can boot both VMs anytime and resume where you left off.

Pause - I'll come back to this later

Shut down both VMs to free up memory and CPU. Your VMs stay on disk and boot right back up when you return.

  • In VirtualBox Manager, right-click the Kali Linux VM and select Close, then Power Off.
  • Right-click the Metasploitable2 VM and select Close, then Power Off.
  • Both VMs consume zero CPU and memory when powered off. The ~24 GB of disk space remains in use until you delete them.

Delete - I don't want to use this again

Remove all project resources and reclaim your disk space. Follow each step below.

  • In VirtualBox Manager, right-click the Kali Linux VM and select Remove. When prompted, click Delete all files. This removes the VM and its ~20 GB virtual disk.
  • Right-click the Metasploitable2 VM and select Remove. Click Delete all files. This removes the VM and its ~4 GB virtual disk.
  • Go to File > Host Network Manager. Select vboxnet0 and click Remove to delete the Host-only network.
  • Delete the downloaded archive files by running this in Terminal:
rm -f ~/Downloads/kali-linux-2026.2-virtualbox-amd64.7z
rm -f ~/Downloads/metasploitable-linux-2.0.0.zip
  • To uninstall VirtualBox, open Finder > Applications. Drag VirtualBox.app to the Trash, then empty the Trash.

Nice Work!

Nice Work!

You just performed your first real penetration test. You went from a blank MacBook to full root access on a target system, following the same methodology that professional pen testers use every day.

You've learned how to:

  • Build a professional penetration testing lab with Kali Linux and Metasploitable 2 running on an isolated VirtualBox network where you can legally practice attacks.
  • Execute a full attack chain using the PTES methodology. You performed reconnaissance with Nmap, enumerated service versions, and exploited the vsftpd 2.3.4 backdoor with the Metasploit Framework to gain root access.
  • Prove the severity of a compromise through post-exploitation. You extracted password hashes from /etc/shadow and documented a complete kill chain from host discovery through root shell.
  • Secret Mission: You independently found and exploited a second vulnerability on the same target using a completely different attack vector.

Ready to quiz yourself?