Lab 15 of 17 · By Michael Stout
In this lab
Use Copy beside a command to copy it exactly.
Validate the OpenVAS finding with Metasploit
Lab 14 flagged the vsftpd 2.3.4 backdoor as critical, based on a version match. This lab confirms it's actually exploitable, using Metasploit's own module against the same target — the true/false-positive triage step Chapter 7 treats as a real analyst skill, not an offensive add-on.
“Vulnerable” is a hypothesis, not a fact
A scanner flags vsftpd 2.3.4 because it recognizes the version banner — it doesn't actually try the backdoor. That's usually right, but not always: a backported patch or a scanner misread can turn a real finding into a false positive, or a real weakness into a missed one. Confirming exploitability before it goes in a report is exactly this triage. Metasploit packages known exploits as configurable modules rather than hand-written exploit code — the same shape as the validation work an analyst actually does in the field.
This lab reuses Lab 14's finding as its reason, but the backdoor itself doesn't care whether you scanned for it first. If you skipped Lab 14, this still works against Lab 12's range on its own.
What you'll need
Lab 12's range, with the metasploitable container up.
Roughly 600 MB inside the Kali container for the Metasploit package and PostgreSQL, its dependency.
None beyond Lab 12's Docker Desktop setup — everything here runs inside the existing scanner container.
15–20 minutes, most of it the one-time package install.
Into the same Kali container as Lab 12
- Get a shell in the Kali container:Same command Lab 12 used to install Nmap — run it from
docker compose exec scanner bash
C:\labs\nmap-range. - Install the framework:This pulls in PostgreSQL as a dependency — roughly 600 MB, and the slow step in this lab.
apt update && apt install -y metasploit-framework
- Initialize its database and start it:First run creates the database; wait for the
msfdb init msfconsole -q
msf6 >prompt before continuing.
Same target, a different kind of proof
- Find and select the module:
search vsftpd_234 use exploit/unix/ftp/vsftpd_234_backdoor
- Point it at the target:Compose's built-in DNS resolves the name the same way it has for every Nmap scan in this series.
set RHOSTS metasploitable
- Run it:A line reporting a command shell means the framework agrees the backdoor is real, not just theoretically present.
run
- Prove it:
id whoami
root, from a bug in a fifteen-year-old package — typeexitwhen you're done to leave the shell.
Metasploitable has more than one backdoor
| Try | What it shows you |
|---|---|
search unreal_ircd | Metasploitable's bundled IRC daemon carries a separate, well-documented backdoor (exploit/unix/irc/unreal_ircd_3281_backdoor) — same workflow, different service. |
sessions -l / sessions -i 1 | List and switch between shells if you run more than one exploit in the same console, instead of losing track of which is which. |
set VERBOSE true before run | The module logs the exact bytes it sends — a useful cross-reference if you go on to Lab 16 and watch the same exchange in Wireshark. |
Metasploit doesn't need Lab 12's NET_ADMIN / NET_RAW capabilities for this particular exploit — it's an ordinary TCP connection, not a raw-socket scan. That doesn't make it lighter-weight tooling. Keep it inside this isolated range, the same as Nmap in Lab 11.
Validating that a finding is real is a legitimate analyst task inside an authorized, isolated lab. It is not a license to run the same module against anything outside it — the authorization rule from Lab 11 applies here at least as strictly.
Sources. Kali Linux Documentation, starting Metasploit Framework, kali.org/docs/tools/starting-metasploit-framework-in-kali. Kali Linux Tools, metasploit-framework package page, kali.org/tools/metasploit-framework. Rapid7, module reference for exploit/unix/ftp/vsftpd_234_backdoor and exploit/unix/irc/unreal_ircd_3281_backdoor, rapid7.com/db/modules. Module names and the package's PostgreSQL dependency are current as of September 2026.