Introduction
Welcome to the Understanding Exploit Modules lab!
In penetration testing, weaponizing a vulnerability means using an exploit module to deliver a payload to a target system. The Metasploit Framework is one of the most popular tools for this purpose, providing a massive, searchable database of exploit modules for various known vulnerabilities.
But mature exploitation work is not "search and fire." It is a methodical process of selecting the right module, understanding its assumptions, configuring it carefully, and checking the target before risking disruptive action.
In this lab, you will learn the standard methodology for using these modules. You will practice searching for a real-world exploit, analyzing the module's requirements, configuring the target options, and safely checking a live vulnerable service before launching an actual attack.
Search for Specific Exploits (CVE/Name)
In this step, you will learn how to launch the Metasploit Framework console and search for specific exploit modules.
Metasploit contains thousands of modules. To find the right one, you can use the search command. You can search by the name of the software, the type of vulnerability, or specific identifiers like a CVE number. For this lab, we will work with a real Shellshock target exposed on 127.0.0.1:8080.
First, start the Metasploit console. The -q flag is used to start it in "quiet" mode, which skips the startup banner.
msfconsole -q
Once the console loads, your prompt will change to msf6 >. Now, use the search command to find modules related to Shellshock.
Searching by vulnerability family or CVE is often the fastest bridge from reconnaissance to candidate exploit logic.
search shellshock
You will see an output table listing matching modules. Pay attention to the Name column, which shows the path of the module. For this lab, the exploit module we care about is exploit/multi/http/apache_mod_cgi_bash_env_exec. The Disclosure Date column indicates when the vulnerability was made public. The Rank column describes how reliable the exploit is (for example, Excellent, Good, or Normal). Finally, the Check column specifies whether the module supports a safer vulnerability check.
Analyze Module Information (info)
In this step, you will select the exploit module you found and analyze its details.
To tell Metasploit which module you want to work with, you use the use command followed by the module's name (the path shown in the search results).
Type the following command in your msf6 > prompt:
use exploit/multi/http/apache_mod_cgi_bash_env_exec
Notice that your prompt changes to include the module name, indicating that it is now active. Before configuring anything, it is a best practice to understand what the module does. You can do this using the info command.
info
The info command provides a wealth of information. This includes details about who provided the module, such as the authors and researchers who developed it. It also lists the basic options, which are the parameters you need to configure in the next step. Furthermore, it offers a detailed description of how the vulnerability works and how the exploit takes advantage of it. Finally, it provides references, which are links to external databases (like the National Vulnerability Database) for further reading.
Reading this information is part of operator discipline. A module may require a very specific path, protocol behavior, or environment. If you skip that context, you are effectively guessing.
Take a moment to read the description to understand the mechanics of the Shellshock vulnerability and how this module abuses CGI environment variables.
Configure Exploit Targets and Options
In this step, you will configure the necessary options to point the exploit module at your specific target.
Every module requires certain parameters to be set. To view the current configuration, use the show options command:
show options
Look at the Required column. If an option says yes, it must be configured before the module can run. The most common options you need to set are RHOSTS, which specifies the Remote Host (the IP address of your target), and RPORT, which specifies the Remote Port (the port the vulnerable service is running on). For web exploit modules, you also often need TARGETURI, which tells Metasploit which HTTP path should receive the malicious request.
Our vulnerable target is running locally on port 8080, and the vulnerable CGI path is /cgi-bin/vulnerable. Use the set command to configure these parameters:
set RHOSTS 127.0.0.1
set RPORT 8080
set TARGETURI /cgi-bin/vulnerable
After setting the values, it is always a good idea to verify that your changes were applied correctly. Run the options command again:
show options
You should now see 127.0.0.1 listed under the Current Setting for RHOSTS, 8080 for RPORT, and /cgi-bin/vulnerable for TARGETURI.
Check Vulnerability Status (check)
In this step, you will verify if the target is actually vulnerable before launching an attack.
The check workflow exists because safety and reliability matter. Confirming exposure first reduces unnecessary noise, failed attempts, and service instability.
In professional penetration testing, blindly firing exploits can crash services or trigger security alerts. Fortunately, many Metasploit modules (including the one we are using) support the check command.
The check command sends a probe to the target to determine if the vulnerability exists, without immediately launching a full exploit payload.
Run the following command in your Metasploit prompt:
check
In this lab, the Shellshock target is intentionally vulnerable, so you should see output similar to this:
[+] 127.0.0.1:8080 - The target is vulnerable.
This confirms that the target is susceptible to the module. You have now completed the core exploit-module workflow: searching for the right module, reading its documentation, configuring the required options, and validating the target before exploitation.
If you want an extra manual confirmation outside Metasploit, you can test the service from another terminal with curl http://127.0.0.1:8080 and verify that the CGI path exists at http://127.0.0.1:8080/cgi-bin/vulnerable.
Since we have completed our objective of understanding the module methodology, you can now exit the Metasploit console:
exit
Summary
Congratulations! You have successfully completed the Understanding Exploit Modules lab.
In this lab, you learned the fundamental methodology for weaponizing vulnerabilities using the Metasploit Framework. You practiced searching for a real Shellshock exploit, analyzing module descriptions and requirements, configuring remote target options such as RHOSTS, RPORT, and TARGETURI, and utilizing the built-in check functionality to safely verify a vulnerable target. These steps form the core workflow for any penetration tester working with exploit modules.
