Metasploitable 2 and 3: Install Them Safely and Run Your First Exploits

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely
5. Ubuntu in your lab: desktop, server, SSH and Docker
6. Active Directory lab with Windows Server
7. Attack-and-defend network: firewall and vulnerable targets
8. Metasploitable 2 and 3: install and first exploits (you are here)
9. Blue-team lab: Wazuh, Sysmon and Security Onion
10. Android app testing lab: emulator, MobSF, Frida and Burp
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark

What they are

Metasploitable is Rapid7's family of intentionally vulnerable machines, built to be attacked with Metasploit and other tools.

These machines are deliberately insecure. They must only ever sit on an isolated network - never bridged, never NAT with port forwards, never reachable from your home LAN.

Metasploitable 2

1. Download the Metasploitable 2 archive from its SourceForge page and extract it.
2. In VirtualBox: Machine > New, type Linux, version Ubuntu (64-bit) or Other Linux, 512 MB-1 GB RAM. Choose Use an existing virtual hard disk file and select the extracted .vmdk. (VMware users can open the .vmx directly.)
3. Set the network adapter to your isolated / ATTACK network from part 7.
4. Boot and log in with the default credentials shown on the login banner (msfadmin / msfadmin). Run ip a to find its IP.

Metasploitable 3

Metasploitable 3 is built from source with Vagrant, which downloads a base box and configures the vulnerable services automatically. It needs more resources: plan for 4 GB RAM or more for the Windows build.

1. Install VirtualBox (part 2) and Vagrant from HashiCorp's site.
2. Clone the repository and follow its README, which is the authoritative, current set of instructions:

git clone https://github.com/rapid7/metasploitable3.git
cd metasploitable3
vagrant up

3. By default this brings up both the Windows and the Linux machines using pre-built boxes. To build only one, pass its name, for example vagrant up ub1404 or vagrant up win2k8 (check the Vagrantfile for the current names).
4. The default credentials are vagrant / vagrant.
5. Vagrant attaches a host-only/private network. Before attacking, check each VM's adapters in VirtualBox and remove or disable any NAT adapter you do not need, then put Kali on the same private network.

If the build fails, the README's troubleshooting section and issue tracker cover the common causes (usually plugin or box versions).

Your first full cycle

1. Recon

nmap -sV -p- <target-ip> -oN ms2-full.txt

On Metasploitable 2 you will see dozens of open services. Note each service and version - that list is your attack surface.

2. Research

Look up each version: searchsploit vsftpd 2.3.4, or search inside Metasploit with search. Ask *why* each is vulnerable - a backdoored package, default credentials, or an unauthenticated service.

3. Exploit with Metasploit

msfconsole
search vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS <target-ip>
run

The famous vsftpd 2.3.4 backdoor gives a root shell. Then try the same target without Metasploit (connect manually, or use a public proof of concept) so you understand what the module actually does.

4. Escalate and loot

On Metasploitable 3, practise Windows privilege escalation and credential harvesting - the skills used against real domains in part 6.

5. Detect it

Re-run the exploit while your SIEM (part 9) and firewall logs (part 7) are watching. Write down which log source caught it and which missed it.

6. Fix it

Patch or disable the vulnerable service, rescan, and confirm the exploit now fails. Then roll back to your snapshot for the next exercise.

Good habits

• Snapshot each target before you start and revert after every exercise.
• Keep notes like a real pentest report: finding, evidence, impact, fix.
• Never copy techniques from here onto systems you do not own.

Our pentest path lab and cyber range let you practise the same recon-to-exploit workflow in the browser.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

Next step

Part 9 adds the blue-team side: a SIEM, endpoint telemetry with Sysmon and network monitoring.