Build a Cybersecurity Homelab

Introduction

30 Second Summary

Every company you trust with your data relies on security teams who practice breaking into systems before real attackers can. These professionals build private labs where they can safely test attacks without risking anything.

In this project, you will build your own cybersecurity lab on your Windows PC. You will set up an attacker machine and a deliberately vulnerable target on an isolated network, then perform a real penetration test to exploit a known vulnerability and gain remote access.

What You'll Build

A fully isolated hacking lab with Kali Linux as your attacker and Metasploitable 2 as your target, connected on a sealed-off network where you can safely practice real exploits.

By the end of this project, you'll have:

• An isolated Host-Only network in VirtualBox that prevents all lab traffic from reaching your real network.
• A completed Nmap scan revealing dozens of open ports and vulnerable services on your target machine.
• A successful exploit using Metasploit Framework that gains root shell access on the target.
• Secret Mission: Exploit a second vulnerability using a reverse shell technique.

Are there any prerequisites?

This project requires a Windows PC with at least 8 GB RAM (16 GB recommended), a 64-bit CPU with virtualization support (Intel VT-x or AMD-V), and approximately 50 GB of free disk space. No prior cybersecurity experience is needed.

Install VirtualBox and Enable Virtualization

Virtual machines need your CPU to support a feature called hardware virtualization. Without it, VirtualBox cannot run guest operating systems at near-native speed.

In this step, you will confirm that virtualization is turned on, install VirtualBox (the software that creates and runs virtual machines), and install 7-Zip (a tool for extracting the compressed VM files you will download later).

In this step, get ready to:

• Verify hardware virtualization is enabled on your CPU.
• Install VirtualBox 7.2.8 with the Extension Pack.
• Install 7-Zip for extracting VM image archives.

Verify virtualization is enabled

Hardware virtualization (Intel VT-x or AMD-V) is a CPU feature that lets VirtualBox create isolated virtual machines efficiently. You need to confirm it is turned on before installing anything.

• Open Task Manager by pressing Ctrl+Shift+Esc.
• Click the Performance tab at the top.
• Click CPU in the left panel.
• Look for the line that says Virtualization: Enabled in the information area below the graph.

✔️ I see Virtualization: Enabled

Your CPU is ready to run virtual machines. Close Task Manager and continue to the next substep.

ⓧ I see Virtualization: Disabled

Virtualization is supported but turned off. You need to enable it in your computer's BIOS or UEFI firmware settings.

• Restart your PC.
• During startup, press the key to enter BIOS/UEFI settings. This is usually F2, F10, Del, or Esc depending on your motherboard manufacturer.
• Find the virtualization setting (labeled Intel VT-x, Intel Virtualization Technology, or AMD-V) and set it to Enabled.
• Save and exit BIOS (usually F10).
• After Windows restarts, open Task Manager again and confirm Virtualization: Enabled now appears.

Why does the exact menu location vary?

Every motherboard manufacturer (ASUS, MSI, Gigabyte, Dell, HP, Lenovo) places the virtualization toggle in a different menu. Check your laptop or motherboard manual if you cannot find it.

Seeing a VT-x or AMD-V error later?

If you have Hyper-V enabled on Windows 11 Pro, it can conflict with VirtualBox. Open an Administrator Command Prompt and run:

bcdedit /set hypervisorlaunchtype off

Restart your PC after running this command. Note that disabling Hyper-V also disables WSL2 and Windows Sandbox.

Help me fix this VT-x or AMD-V error in VirtualBox on Windows.

Download and install VirtualBox

VirtualBox is the hypervisor that creates and manages your virtual machines. You need version 7.2.8 for this project.

• Press the Windows key and type VirtualBox to search for it.

✔️ I see version 7.2.8 or higher

VirtualBox is already installed at the correct version. Open it and skip ahead to the Extension Pack check below.

ⓧ I see an older version of VirtualBox

You need to upgrade to version 7.2.8. The VirtualBox installer handles upgrades in place.

• Open your browser and go to https://www.virtualbox.org/wiki/Downloads.
• Click the Windows hosts link to download VirtualBox-7.2.8-173730-Win.exe (approximately 170 MB).
• Run the downloaded installer.
• Accept all defaults and click Next through the wizard.
• Click Install when prompted. The installer will upgrade your existing installation.
• Click Finish when the installation completes.

ⓧ VirtualBox doesn't appear

VirtualBox is not installed yet. You will download and install it now.

• Open your browser and go to https://www.virtualbox.org/wiki/Downloads.
• Click the Windows hosts link to download VirtualBox-7.2.8-173730-Win.exe (approximately 170 MB).
• Run the downloaded installer.
• Accept all defaults and click Next through the wizard.
• The installer may warn that it will temporarily disconnect your network. Click Yes to proceed.
• Click Install when prompted.
• Click Finish when the installation completes. VirtualBox Manager will open automatically.

Now install the Extension Pack, which adds USB device support and other features needed for your lab.

• Go back to https://www.virtualbox.org/wiki/Downloads in your browser.
• Under VirtualBox Extension Pack, click the download link for Oracle_VirtualBox_Extension_Pack-7.2.8.vbox-extpack.
• Double-click the downloaded .vbox-extpack file. VirtualBox will open and ask you to confirm the installation.
• Scroll to the bottom of the license agreement and click I Agree.
• The Extension Pack installs in a few seconds. You will see it listed when installation completes.

What does the Extension Pack add?

The Extension Pack provides USB 2.0/3.0 passthrough, disk encryption, and PXE boot ROM support. These features are not included in the base VirtualBox package because they are under a different license.

• Confirm VirtualBox Manager is open. You should see the main window with a sidebar on the left and an empty VM list.

VirtualBox won't install?

Make sure you are running the installer as an Administrator. Right-click the .exe file and select Run as administrator.

If you see a Windows SmartScreen warning, click More info and then Run anyway.

Help me troubleshoot my VirtualBox installation.

Install 7-Zip

The Kali Linux VM image comes as a compressed .7z archive. You need 7-Zip to extract it.

• Press the Windows key and type 7-Zip to search for it.

✔️ I see 7-Zip File Manager

7-Zip is already installed. You are all set for extracting VM archives.

ⓧ 7-Zip doesn't appear

7-Zip is not installed yet. Download and install it now.

• Open your browser and go to https://www.7-zip.org/.
• Click the Download link for the 64-bit Windows x64 version.
• Run the downloaded installer.
• Click Install to accept the default location.
• Click Close when the installation finishes.

Not sure which 7-Zip version to pick?

Choose the 64-bit x64 version. Since your PC has a 64-bit CPU (required for this project), this is the correct choice.

Help me figure out which 7-Zip version to download.

Your tools are ready. Next up, you will download and import Kali Linux as your attacker virtual machine.

Download and Import Kali Linux

With VirtualBox installed, you need an attacker machine loaded with security tools. Kali Linux is a Linux distribution built specifically for penetration testing, and it comes with hundreds of pre-installed tools like Nmap, Metasploit, and Burp Suite.

Instead of installing Kali from scratch (which takes 20-30 minutes), you will download a pre-built VirtualBox image that is ready to boot immediately.

In this step, get ready to:

• Download and extract the Kali Linux 2026.1 VirtualBox image.
• Import the VM into VirtualBox and allocate resources.
• Boot Kali, verify internet connectivity, and take a baseline snapshot.

Download the pre-built Kali Linux VirtualBox image

The Kali team provides ready-to-use VirtualBox images so you can skip the OS installation process entirely.

• Open your web browser and navigate to the Kali Linux Virtual Machines download page:
• https://www.kali.org/get-kali/#kali-virtual-machines
• Scroll down to the Pre-built Virtual Machines section.
• Find the VirtualBox row and click the download button for the 64-bit image. The file is named kali-linux-2026.1-virtualbox-amd64.7z and is approximately 3.6 GB.
• Wait for the download to complete. This may take 10-30 minutes depending on your internet speed.

Why is the file a .7z archive?

The .7z format compresses the VM image to roughly half its uncompressed size, making the download faster. This is why you installed 7-Zip in the previous step.

• Once the download finishes, locate the kali-linux-2026.1-virtualbox-amd64.7z file in your Downloads folder.
• Right-click the file.
• Select 7-Zip from the context menu, then click Extract Here.
• Wait for the extraction to finish. You should see a new folder containing a .vbox file and a virtual disk file.

Extraction taking a long time?

Extracting 3.6 GB of compressed data can take several minutes, especially on a hard drive (HDD) rather than an SSD. Let it run to completion without interrupting.

If you see an error about insufficient disk space, free up at least 15 GB on your drive before trying again.

Help me troubleshoot my 7-Zip extraction

Import Kali Linux into VirtualBox

Now that you have the extracted VM files, you need to register them with VirtualBox so it knows about the new machine.

• Switch back to VirtualBox Manager.
• Click Machine in the top menu bar.
• Click Add.
• In the file browser that opens, navigate to the folder where you extracted the Kali download.
• Select the .vbox file and click Open.

The Kali Linux VM now appears in your VirtualBox Manager sidebar. Next, you need to give it enough resources to run smoothly.

• Select the Kali VM in the left panel.
• Click Settings (the gear icon at the top).
• Click System in the left sidebar.
• Under the Motherboard tab, set Base Memory to 4096 MB.
• Click the Processor tab.
• Set Processor(s) to 2 CPUs.
• Click OK to save your settings.

Why allocate 4 GB of RAM?

Kali Linux tools like Metasploit and Nmap can be memory-hungry. The default 2 GB works, but 4 GB (4096 MB) gives you a much smoother experience when running multiple tools at once.

If your PC only has 8 GB total, you can leave it at 2048 MB. You will notice slower performance but everything will still function.

Don't see the Kali VM in VirtualBox?

Make sure you selected the .vbox file (not the .vdi or .vmdk disk file) when using Machine > Add.

If the file browser does not show the .vbox file, check that you extracted the .7z archive fully. The extraction creates a folder containing the VM files.

Help me add Kali Linux to VirtualBox

Boot and verify Kali Linux

Time to fire up your attacker machine for the first time and confirm everything works.

• Select the Kali VM in VirtualBox Manager.
• Click the green Start arrow at the top.
• Wait for Kali to boot to the login screen. This takes 30-60 seconds on first boot.
• Enter the username kali and password kali.
• Click Log In.

You should see the Kali Linux desktop with a dark theme and a dragon logo. Now confirm that the VM has internet access.

• Right-click anywhere on the Kali desktop.
• Click Open Terminal Here.
• Confirm internet connectivity by running this command:

sudo apt update

What does this command do?

The sudo apt update command refreshes the list of available software packages from the internet. If it succeeds (you see lines downloading package lists), it proves your VM has working network connectivity through the default NAT adapter.

You should see output showing package lists being downloaded from http.kali.org. This confirms internet access is working.

Seeing 'connection timed out' errors?

Check that your host PC has a working internet connection first.

In VirtualBox Manager, select the Kali VM, open Settings > Network, and confirm Adapter 1 is set to NAT. NAT shares your host's internet connection with the VM automatically.

Help me fix Kali Linux network connectivity

Finally, take a snapshot so you can always revert to this clean state if anything goes wrong later.

• In the VirtualBox menu bar at the top of the VM window, click Machine.
• Click Take Snapshot.
• In the Snapshot Name field, type Baseline.
• Click OK.

What is a snapshot?

A snapshot saves the exact state of your VM at a point in time. If you break something later (which is the whole point of a hacking lab), you can restore this snapshot and get back to a known-good state in seconds.

Your attacker machine is ready. Next, you will download and set up Metasploitable 2, the deliberately vulnerable target that Kali will attack.

Download and Import Metasploitable 2

Your attacker machine is ready. Now you need something to attack.

In this step, you will download and set up Metasploitable 2, a deliberately vulnerable virtual machine created by Rapid7 for penetration testing practice. It has over 30 intentionally weak services running on it, making it the perfect target for your lab.

In this step, get ready to:

• Download and extract Metasploitable 2 from SourceForge.
• Create a new virtual machine in VirtualBox using the extracted disk file.
• Boot the VM and verify it works.

Download Metasploitable 2

Metasploitable 2 is distributed as a ZIP file containing a pre-built virtual hard disk. You do not install an operating system from scratch. Instead, you download the complete disk image and attach it to a new VM.

• Open your web browser and go to https://sourceforge.net/projects/metasploitable/files/Metasploitable2/.
• Download metasploitable-linux-2.0.0.zip (865.1 MB).
• Once the download completes, right-click the ZIP file in File Explorer.
• Select 7-Zip, then Extract Here.
• Wait for extraction to finish. You will see a folder containing a .vmdk file. This is the virtual hard disk for Metasploitable 2.

What is a .vmdk file?

A .vmdk file is a Virtual Machine Disk. It contains the entire operating system and all its files, pre-installed and ready to run. Think of it as a complete hard drive stored inside a single file.

Download taking too long?

The file is 865 MB, so it may take a while on slower connections. Make sure your browser did not pause or cancel the download.

If 7-Zip is not showing in your right-click menu, you may need to restart your PC after installing 7-Zip for it to register.

Help me troubleshoot my Metasploitable 2 download or extraction.

Create a new VM for Metasploitable 2

Unlike Kali Linux (which came as a pre-configured VM), Metasploitable 2 is just a raw disk file. You need to manually create a new virtual machine in VirtualBox and point it at the extracted .vmdk.

• Switch back to the VirtualBox Manager window.
• Click New in the toolbar at the top.
• In the Name field, type Metasploitable2.
• Set Type to Linux.
• Set Version to Ubuntu (64-bit).
• Click Next.
• Set the memory to 1024 MB.
• Click Next.
• On the Hard Disk screen, select Use an Existing Virtual Hard Disk File.
• Click the folder icon, then click Add.
• Browse to the folder where you extracted the Metasploitable 2 ZIP and select the .vmdk file.
• Click Choose, then click Create (or Finish, depending on your VirtualBox version).

You should now see Metasploitable2 listed alongside your Kali Linux VM in the VirtualBox Manager.

Why only 1024 MB of RAM?

Metasploitable 2 is a lightweight server with no graphical interface. It only needs 1 GB of RAM to run all its vulnerable services. This keeps your host machine responsive while both VMs are running.

Don't see the .vmdk file when browsing?

Make sure you extracted the ZIP file first. The .vmdk is inside the extracted folder, not inside the ZIP itself.

If the file browser is filtering by file type, look for a dropdown at the bottom and change it to show all files or Virtual Disk files.

Help me find the Metasploitable 2 .vmdk file in VirtualBox.

Verify Metasploitable 2 boots

• Select the Metasploitable2 VM in the VirtualBox Manager.
• Click Start in the toolbar.
• Wait for the VM to boot. You will see text scrolling and eventually a login prompt that says metasploitable login:.
• Type msfadmin and press Enter.
• When prompted for the password, type msfadmin and press Enter. The password will not appear on screen as you type. This is normal.

You should now be logged in and see a command prompt.

• Note the current IP address by running this command:

ifconfig

What should I see?

You will see network interface information. Look for inet addr: followed by an IP address (something like 10.0.2.15). Write this down. You will change the network in the next step, so this IP will change later.

• Shut down the VM cleanly by running:

sudo poweroff

The VM window will close once it finishes shutting down.

Never expose Metasploitable 2 to the internet

This VM is intentionally full of security holes. If it were connected to a real network, anyone could break into it within minutes. You will configure a safe, isolated network in the next step to prevent this.

VM won't boot or drops to (initramfs)?

This usually means the .vmdk file was not properly attached. Power off the VM, open Settings, go to Storage, and confirm the VMDK disk appears under a SATA controller.

If you see a boot error, try enabling PAE/NX. Go to Settings, then System, then the Processor tab, and check Enable PAE/NX.

Help me fix my Metasploitable 2 VM boot issue.

Both your attacker and target machines are now ready. Next up, you will connect them on an isolated network so they can communicate with each other without touching your real network or the internet.

Create an Isolated Host-Only Network

You now have both machines ready to go. Kali Linux is your attacker and Metasploitable 2 is your target. But right now they are on separate default networks with no way to talk to each other.

In a real penetration test, the attacker and target must be on the same network. You also need to guarantee that the vulnerable target machine can never reach the internet or your home network. A Host-Only network in VirtualBox solves both problems. It creates a sealed virtual network where your two VMs can communicate, but nothing else can get in or out.

In this step, get ready to:

• Create a Host-Only network in VirtualBox's Network Manager.
• Assign both VMs to the isolated network (with a NAT adapter on Kali for tool updates).
• Verify that the two VMs can reach each other but the target cannot reach the internet.

Create a Host-Only network in VirtualBox

A Host-Only network creates a virtual switch that only your VMs and your Windows host can see. No traffic leaves your machine.

• In the VirtualBox Manager window, click File in the top menu bar.
• Hover over Tools, then click Network Manager.
• In the Network Manager window, click the Host-only Networks tab.
• Click Create to add a new Host-Only network.
• A new network appears in the list, named something like VirtualBox Host-Only Ethernet Adapter.
• Click Properties to expand the network details.
• Confirm the DHCP Server tab shows Enable Server checked, and the subnet is in the 192.168.56.0/24 range.
• Close the Network Manager window.

What is a Host-Only network?

Think of it as a private Ethernet cable running between your VMs and your Windows host. The VMs can ping each other, but they have zero access to the outside world.

The built-in DHCP server automatically hands out IP addresses in the 192.168.56.x range, so you do not need to configure static IPs.

Why Host-Only instead of Bridged?

A Bridged adapter puts the VM on your real home network. That means Metasploitable's 30+ vulnerable services would be reachable from every device in your house. Host-Only keeps the entire lab sealed inside your PC.

Assign both VMs to the Host-Only network

Both VMs need to sit on the same Host-Only network so they can communicate. Kali gets a second adapter set to NAT so you can still download tool updates when needed.

• In the VirtualBox Manager, select the Kali Linux VM (make sure it is powered off).
• Click Settings in the toolbar.
• Click Network in the left sidebar.
• On the Adapter 1 tab, change the Attached to dropdown from NAT to Host-Only Adapter.
• In the Name dropdown below it, select the network you just created (VirtualBox Host-Only Ethernet Adapter).
• Click the Adapter 2 tab.
• Check Enable Network Adapter.
• Set Attached to to NAT.
• Click OK to save the Kali settings.

Why does Kali get two adapters?

Adapter 1 (Host-Only) lets Kali reach the target. Adapter 2 (NAT) lets Kali reach the internet for downloading tools and updates. The target only gets a Host-Only adapter, so it stays completely isolated.

• Now select the Metasploitable2 VM in the VirtualBox Manager.
• Click Settings, then Network.
• On the Adapter 1 tab, set Attached to to Host-Only Adapter.
• In the Name dropdown, select VirtualBox Host-Only Ethernet Adapter.
• Click OK to save.

Metasploitable must never have internet access

Do NOT enable a second adapter or set any adapter to NAT or Bridged on the Metasploitable VM. This machine has 30+ exploitable services. If it touches the internet, anyone could compromise it.

Verify network isolation

Time to boot both VMs and confirm they can reach each other, while Metasploitable stays sealed off from the internet.

• Start the Kali Linux VM by selecting it and clicking Start.
• Start the Metasploitable2 VM the same way.
• In the Kali VM, log in with username kali and password kali.
• Open a terminal in Kali (right-click the desktop and select Open Terminal Here).
• Find your Kali IP address by running this command:

ip addr show

• Look for the interface with an IP address in the 192.168.56.x range (this is your Host-Only adapter).

What am I looking for?

In the output, look for a section labeled eth0 or similar. You should see a line containing inet 192.168.56. followed by a number. That is Kali's IP on the Host-Only network.

• In the Metasploitable2 VM, log in with username msfadmin and password msfadmin.
• Find the Metasploitable IP by running:

ifconfig

• Note the inet addr value in the 192.168.56.x range. Write this IP down. You will use it throughout the rest of this project.

Now confirm that Kali can reach the target.

• Back in your Kali terminal, ping the Metasploitable IP by running:

ping -c 4 [[METASPLOITABLE_IP="Metasploitable IP address e.g. 192.168.56.101"]]

• You should see four successful replies, confirming the VMs can communicate over the Host-Only network.

Finally, confirm that Metasploitable cannot reach the internet.

• In the Metasploitable terminal, try to ping a public address by running:

ping -c 4 8.8.8.8

• This should fail with no responses. That confirms Metasploitable is completely isolated from the internet.

What do successful vs failed pings look like?

A successful ping shows lines like 64 bytes from 192.168.56.101: icmp_seq=1 with round-trip times.

A failed ping shows Network is unreachable or simply hangs with no output. Both mean the target has no route to the internet. That is exactly what you want.

Ping between VMs failing?

Make sure both VMs have their Adapter 1 set to Host-Only Adapter with the same network name selected. If you changed settings while a VM was running, shut it down fully and start it again for the changes to take effect.

If you see an IP outside the 192.168.56.x range, the VM is still on its old NAT adapter. Double-check the Network settings and restart the VM.

Help me troubleshoot why my VMs can't ping each other on the Host-Only network in VirtualBox.

Your lab network is locked and loaded. Both VMs can see each other on a sealed-off network, and the vulnerable target has zero internet access. Next up, you will use this network to scan the target and discover what services are exposed.

Scan the Target with Nmap

Your isolated lab network is up and running. Both VMs can talk to each other, and Metasploitable is safely sealed off from the internet.

Now it is time to think like an attacker. The first phase of any penetration test is reconnaissance. You need to discover what services are running on the target before you can find a way in. In this step, you will scan Metasploitable with a professional network scanning tool to reveal its attack surface.

In this step, get ready to:

• Run a service version scan against the target machine.
• Identify vulnerable services from the scan results.
• Take snapshots of both VMs as a clean restore point before exploitation.

Run a basic port scan

A port scan probes a target machine to discover which network services are listening and accepting connections. Each open port is a potential entry point for an attacker.

• In your Kali Linux terminal, run this Nmap scan against the Metasploitable IP address you noted earlier:

nmap -sV [[METASPLOITABLE_IP="your Metasploitable IP address e.g. 192.168.56.101"]]

What does this command do?

The -sV flag tells Nmap to probe each open port and attempt to determine the exact service name and version running on it. Without this flag, Nmap only reports whether a port is open or closed.

This version detection is critical for penetration testing. Knowing that port 21 runs vsftpd 2.3.4 (instead of just "FTP") lets you search for known vulnerabilities in that specific version.

The scan takes 1-2 minutes to complete. You should see a table of results with columns for PORT, STATE, SERVICE, and VERSION.

Scan not returning results?

Confirm the Metasploitable VM is still running by checking the VirtualBox Manager. If it shows as powered off, start it again.

Double-check the IP address you entered. Switch to the Metasploitable VM, log in with msfadmin / msfadmin, and run ifconfig to verify its current IP.

If you see "Host seems down", try adding -Pn to the command to skip the initial ping check.

Help me troubleshoot my Nmap scan against Metasploitable on a Host-Only network.

Identify vulnerable services

Your scan results reveal the full attack surface of Metasploitable 2. This machine has over 20 open ports with outdated, vulnerable services running on them.

• Review the Nmap output and look for these key services:

• Port 21: vsftpd 2.3.4 (this version has a known backdoor).
• Port 22: OpenSSH 4.7p1 (severely outdated SSH server).
• Port 80: HTTP with multiple vulnerable web applications.
• Ports 139/445: Samba file sharing (vulnerable to remote command execution).
• Port 3306: MySQL with an empty root password.
• Port 5432: PostgreSQL with default credentials postgres / postgres.

Why so many open ports?

Metasploitable 2 is an intentionally vulnerable machine designed for testing common vulnerabilities. Every one of these services represents a real-world misconfiguration or outdated software version that attackers look for in the wild.

In a production environment, a scan revealing this many open services would be a critical finding. Each open port increases the attack surface and gives an attacker more options to gain access.

Take a snapshot of both VMs

Before attempting any exploits, you want a clean restore point. Snapshots let you roll back to this exact state if anything goes wrong during exploitation.

• In the VirtualBox Manager, right-click your Kali Linux VM in the sidebar.
• Select Take Snapshot (or go to Machine > Take Snapshot).
• Name the snapshot Pre-Exploit and click OK.
• Repeat the same process for the Metasploitable2 VM. Name this snapshot Pre-Exploit as well.

Why take snapshots before exploiting?

Exploitation can change the state of a target machine. Files may be modified, services may crash, or new processes may be created. With a snapshot, you can restore both VMs to their current clean state in seconds.

This is also how professional pentesters work. They document a clean baseline, run their tests, then restore and re-test to confirm findings are reproducible.

• Confirm both snapshots appear in the VirtualBox Manager by clicking the Snapshots tab (the camera icon) next to each VM name.
• You should see both Baseline (from earlier) and Pre-Exploit listed for Kali, and Pre-Exploit for Metasploitable2.

Can't find the Snapshots tab?

In newer versions of VirtualBox, the snapshot view is accessed by clicking the small list icon next to the VM name in the left panel, then selecting Snapshots. If you only see "Details", look for a dropdown or hamburger menu next to the VM name.

Help me find and manage VM snapshots in VirtualBox.

Your lab is now fully prepped and documented. You have a complete map of the target's vulnerable services, and a safety net to roll back to. Next up, you will use one of these vulnerabilities to gain remote access to the target machine.

Exploit a Vulnerability and Gain Access

Your Nmap scan revealed dozens of open services on the target, including one with a well-documented backdoor.

Now it is time to move from reconnaissance to exploitation. You will use the Metasploit Framework to load a specific exploit module, point it at your Metasploitable target, and fire it to gain a root shell on the remote machine.

In this step, get ready to:

• Launch Metasploit Framework in your Kali terminal.
• Configure and run the vsftpd 2.3.4 backdoor exploit.
• Gain root-level access on the Metasploitable target.

Launch Metasploit Framework

Metasploit is the industry-standard penetration testing framework used by security professionals worldwide. It bundles hundreds of exploit modules that automate the process of attacking known vulnerabilities.

• In your Kali terminal, launch Metasploit by running this command:

msfconsole

Metasploit takes 30-60 seconds to load on first run. You will see an ASCII art banner and then the msf6 > prompt.

What is Metasploit Framework?

Metasploit is an open-source framework maintained by Rapid7 that organizes exploits, payloads, and auxiliary tools into modules. Instead of writing custom attack code, you select a module, configure the target, and run it.

Professional penetration testers use Metasploit to verify that vulnerabilities are actually exploitable, not just theoretically present. This is what separates a vulnerability scan from a penetration test.

Metasploit not loading?

If Metasploit hangs or shows database errors, it may need its database initialized first. Close the current attempt with Ctrl+C, then run sudo msfdb init followed by msfconsole again.

help me troubleshoot Metasploit not loading in Kali Linux

Search for and configure the exploit

Your Nmap scan identified vsftpd 2.3.4 running on port 21 of the target. This version had a malicious backdoor slipped into its source code in 2011 that opens a shell on port 6200 when triggered.

• At the msf6 > prompt, search for the vsftpd exploit module by running:

search vsftpd

You should see a result listing exploit/unix/ftp/vsftpd_234_backdoor in the output.

• Select the exploit module by running:

use exploit/unix/ftp/vsftpd_234_backdoor

• Set the target IP address (replace with your Metasploitable VM's actual IP from the previous step) by running:

set RHOSTS [[METASPLOITABLE_IP="your Metasploitable IP e.g. 192.168.56.101"]]

• Confirm your settings look correct by running:

show options

You should see RHOSTS populated with your Metasploitable IP address and RPORT set to 21 (the FTP port).

What do these commands do?

The search command queries Metasploit's database of exploit modules by keyword. The use command loads a specific module into memory so you can configure it.

The RHOSTS option tells the module which remote host to attack. The show options command displays all configurable settings and confirms everything is set before you fire.

Module not found?

If search vsftpd returns no results, your Metasploit database may not be fully initialized. Exit with exit, run sudo msfdb reinit, then relaunch msfconsole.

help me find the vsftpd exploit module in Metasploit

Execute the exploit and confirm access

Everything is configured. This is the moment you fire the exploit and see if you can gain a shell on the target machine.

• Launch the exploit by running:

exploit

If successful, you will see "Command shell session 1 opened" in the output. Your prompt will change, indicating you now have a live shell on the Metasploitable machine.

• Confirm you have root access by running:

whoami

This should return root. You have full administrative control over the target.

• Confirm which machine you are on by running:

hostname

This should return metasploitable. You are inside the target VM, not your Kali machine.

What just happened?

The vsftpd 2.3.4 backdoor works by triggering a hidden listener on port 6200 whenever a specially crafted username (one ending with :)) is sent to the FTP service. Metasploit automated this entire process for you.

The result is a command shell running as root on the target. In a real penetration test, this would be classified as a critical finding because an attacker gains full system control without needing any valid credentials.

• Exit the shell session on Metasploitable by running:

exit

• Exit Metasploit Framework back to your normal Kali terminal by running:

exit

You are now back at your regular Kali terminal prompt.

Exploit did not open a session?

If you see "Exploit completed, but no session was created," the most common cause is an incorrect IP in RHOSTS. Run show options to double-check the IP matches your Metasploitable VM.

Also confirm Metasploitable is still running and reachable. Open a new terminal tab and run ping followed by the IP. If the ping fails, check VirtualBox to confirm both VMs are on the same Host-Only network.

help me troubleshoot why the vsftpd exploit is not opening a session

Secret mission

Exploit a Second Vulnerability: Samba usermap_script

The vsftpd backdoor was just one of over 30 vulnerabilities on Metasploitable 2. Can you exploit the Samba file-sharing service on port 139/445 using a completely different attack technique? This time you will use a reverse shell, which is the more realistic attack pattern used in professional penetration testing.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally on your PC, so there are no ongoing cloud costs.

Resources you used:

• Oracle VirtualBox 7.2.8 (installed application).
• Kali Linux VM (with Baseline and Pre-Exploit snapshots).
• Metasploitable2 VM (with Pre-Exploit snapshot).
• VirtualBox Host-Only Network (VirtualBox Host-Only Ethernet Adapter).
• 7-Zip (installed application).

Keep everything running

No action needed. Choose this if you are still actively practicing or want to explore more vulnerabilities on Metasploitable 2.

• Your VMs stay in VirtualBox, ready to boot at any time.
• Your snapshots (Baseline, Pre-Exploit) remain available to restore from.
• The Host-Only Network stays configured for future sessions.
• VirtualBox and 7-Zip remain installed on your PC.

Pause - I'll come back to this later

Shut down the VMs to free up RAM and CPU. Your files and snapshots stay on disk so you can resume later.

• In the Metasploitable2 VM, log in and run:

sudo poweroff

• In the Kali Linux VM, open a terminal and run:

sudo poweroff

• Close VirtualBox. Your VMs, snapshots, and network configuration remain on disk and will be available next time you open VirtualBox.

Delete - I don't want to use this again

Remove all project resources and reclaim your disk space. This removes both VMs, the Host-Only network, and the installed applications.

• Shut down both VMs if they are still running.
• In VirtualBox Manager, right-click the Kali Linux VM and select Remove. Choose Delete all files to remove the VM and its virtual disk.
• Right-click the Metasploitable2 VM and select Remove. Choose Delete all files to remove the VM and its virtual disk.
• Go to File > Tools > Network Manager. Select the Host-Only Network you created and click the remove button to delete it.
• Delete the downloaded archive files and extracted folders from your Downloads folder. These include the Kali Linux .7z archive and the metasploitable-linux-2.0.0.zip file plus their extracted contents.
• Uninstall VirtualBox: open Windows Settings, select Apps, then Apps & features. Find Oracle VirtualBox, click it, and select Uninstall.
• Uninstall 7-Zip: in the same Apps & features list, find 7-Zip, click it, and select Uninstall.

Nice Work!

Nice Work!

You just built a professional-grade cybersecurity homelab and performed real penetration testing. You went from zero to gaining root access on a target machine using the same tools and methodology that professional security analysts use every day.

You've learned how to:

• Build an isolated cybersecurity lab using VirtualBox Host-Only networking, keeping all attack traffic safely sealed off from your real network and the internet.
• Set up a Kali Linux attacker machine and a Metasploitable 2 vulnerable target, with baseline snapshots for easy reset and ongoing practice.
• Execute a full penetration test chain: scanning the target with Nmap to discover open services, then exploiting the vsftpd 2.3.4 backdoor with Metasploit Framework to gain root access.
• Secret Mission: Exploited a second vulnerability (Samba usermap_script) using a reverse shell technique, demonstrating a more realistic attack pattern used in professional engagements.

Ready to quiz yourself?