Hi!
So you can try the attack but it’s very probable that it won’t work as we need that the third machine has any open vulnerable service, that’s why we use metasploitable.

But try it anyway.

Let me know how it goes!
Diego