Lion Cipher Lab
Your first exploit with Metasploit (in your own lab)
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Metasploit is the single most widely used exploitation framework in the world, and 'can you drive Metasploit' is a baseline expectation for anyone stepping toward penetration testing or red teaming. But most beginners meet it as a magic incantation they copy off a blog: paste four lines, get a shell, understand nothing. That is worse than useless, because the moment the target is even slightly different the incantation fails and they are stranded. This lab teaches the FRAMEWORK instead of a trick. You will see that Metasploit is really a giant, organised library of ready-made attack pieces —…
What you'll learn
- understanding what the Metasploit Framework is and why it is the standard tool for exploitation
- knowing, in plain words, what a module, an exploit, a payload, and a session actually are — and how they differ
- launching msfconsole and finding your way around Metasploit's own command line
- using `search` to find the right exploit module for a service you have identified
- loading a module with `use` and reading `show options` to see what a module needs before it will run
- setting RHOSTS (the target you attack) and understanding it is the remote host
- choosing a payload and setting LHOST (your own machine) so a reverse shell can connect back to you
- firing an exploit with `exploit`/`run` and landing a real command shell session on a target you own
- listing and interacting with sessions (`sessions`, `sessions -i`) and proving you are root on the target
- understanding what Meterpreter is and when you would reach for it instead of a plain command shell
Steps in this lab
- The one rule that makes this legal: your VMs, your isolated network, nobody else
- The words you need first: framework, module, exploit, payload, session, RHOSTS, LHOST, Meterpreter
- Make sure your lab is up: attacker, target, and the isolated network
- Open Metasploit for the first time: launch msfconsole
- Find the right attack: search for a module
- Load the module with `use`, then read `show options`
- The heart of it: set the target, choose a payload, set LHOST
- Fire it: run the exploit and land a session
- Work with your session: background it, list it, come back to it
- What you just did — clean up, and where it takes you