OSCP · Module 15
Metasploit Framework Essentials
Metasploit workflow, msfvenom payloads, Meterpreter post-exploitation, and pivoting. Exam limits MSF to one target.
~1.5 h 5 resources Last updated September 27, 2026
Metasploit is the most widely used exploitation framework in penetration testing. PEN-200 covers msfconsole workflow (search, use, set, exploit), msfvenom payload generation, Meterpreter post-exploitation (hashdump, getsystem, portfwd, autoroute), and pivoting through compromised hosts. The OSCP exam limits Metasploit use to one target, so understanding manual alternatives is equally important.
Known Service Exploits with Metasploit
Several classic vulnerabilities have ready-made Metasploit modules: vsftpd 2.3.4 backdoor, ProFTPd 1.3.3c, UnrealIRCd, BlueKeep, EternalBlue, and PrintNightmare. These modules demonstrate the Metasploit workflow: select the exploit, configure RHOSTS/LHOST/LPORT, choose a payload, and run. Each of these services also has a manual exploitation path documented on HackIndex.
Warning
HackIndex does not currently have dedicated pages for msfconsole usage, msfvenom payload generation, or Meterpreter post-exploitation commands. Refer to the PEN-200 course material for framework fundamentals, handler configuration, and Meterpreter scripting.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 2 min readvsftpd 2.3.4 Backdoor
-
Guide 2 min readProFTPD 1.3.3c Backdoor
-
Guide 2 min readUnrealIRCd 3.2.8.1 Backdoor Exploitation