Metasploit s a pretty cool little framework. I've messed with it quite a bit in vmware sessions.

Another one that I find seems to be updated more frequently is the security forest exploitation framework which is a similar concept to metasploit.

There is good fun to be had with both the frameworks... though, I recommend playing around in vmware or virtual pc sessions so your real boxes are not vulnerable to these "attacks".

http://www.securityforest.com/wiki/i...tion_Framework

Metasploit is a very cool package, and a great way to convince your boss that you may need a better patching policy.
You may want to get permission from you boss first. Before you find yourself in HR's office discussing violations of other policies which lead to your dismissal.