Searchsploit and public exploit workflow

Searchsploit and public exploit workflow

TL;DR: Given a service banner you can usually find a working exploit on exploit-db, GitHub, or packetstorm. The workflow is: fingerprint precisely → search broadly → triage candidates → read code → adapt → fire in a safe order. The fastest pentesters in the world do this loop in two minutes. This is the floor for oscp-roadmap and porting-public-exploits.

When this is the right move

  • You have a confident version banner (e.g. vsftpd 2.3.4, ProFTPD 1.3.5, Apache Tomcat/9.0.30).
  • The target software is old, unpatched, or has a known CVE.
  • You’ve already enumerated everything cheaper (default creds, weak config).

If the banner is nginx 1.24 from last month, public exploits won’t help — go back to web-layer testing.

Step 1 — fingerprint precisely

Don’t search “tomcat exploit”. Search for the exact version triple:

1
2
3
4
5
6
7
8

nmap -sV -sC -p 8080 10.10.10.5
# 8080/tcp open  http  Apache Tomcat 9.0.30

curl -sI http://10.10.10.5:8080/
# Server: Apache-Coyote/1.1

# Also try unusual paths to confirm app version
curl -s http://10.10.10.5:8080/manager/html

For web stacks, pull the version from <meta> tags, /changelog.txt, /readme.html, JS bundle hashes — banners lie or get stripped.

Step 2 — search

Local: searchsploit

1
2
3
4
5

searchsploit tomcat 9.0
searchsploit -t "vsftpd 2.3.4"      # title only
searchsploit -m 49757                # mirror to cwd (copy)
searchsploit -p 49757                # print path + try to open
searchsploit --update                 # before exam day

Online (in this order):

  1. exploit-db.com — most curated.
  2. github.com — search tomcat CVE-2020-1938 poc. Filter by stars.
  3. packetstormsecurity.com — sometimes has refined versions.
  4. nvd.nist.gov / cve.mitre.org — vendor links + advisories.
  5. Vendor advisory page — for the fix, which often reveals the bug.

Step 3 — triage candidates

Open the top 3-5. For each, in under 60 seconds, score:

Question Why
Does the version match exactly? Most PoCs are version-pinned
Is the language something you can run? (python2/3/ruby/perl/c) Avoid rabbit holes
Pre-auth or post-auth? Pre-auth wins on OSCP
What does it deliver — RCE, info-disc, DoS? DoS is exam-useless
Author notes any preconditions? “requires DefaultServlet enabled”
When was it last edited? Old PoCs may need porting

Eliminate fast. Pick the cleanest pre-auth RCE in a language you can debug.

Step 4 — read before you run

Never run a downloaded exploit blind. Three reasons:

  1. It might be malicious (curling evil.tld/shell.sh is in plenty of PoCs).
  2. It might brick the target (some PoCs leave services dead).
  3. You may need to edit a hard-coded IP, port, offset, or shellcode.

Open it and scan for:

1
2
3
4
5
6
7
8
9

# common edit points
LHOST   = "ATTACKER_IP"
LPORT   = 4444
target  = "TARGET_IP"
offset  = 2003          # likely needs recalculation
ret     = 0x625011AF    # likely needs new gadget on your binary
cmd     = "calc.exe"    # change to a reverse shell
url     = "http://evil/x.sh"   # WHO is evil — recheck
exec(...)               # any python2 print statements / urllib old API?

Also red-flag:

  • Base64 blobs you can’t decode.
  • Long padded strings (could be encoded malicious payload).
  • Anything that wgets from a random host.

If you don’t trust it, rewrite the harness in Python from the advisory.

Step 5 — fire safely

Pre-flight:

  1. Snapshot the target if it’s your own lab.
  2. Start your listener first (nc -lvnp 4444 or multi/handler).
  3. Run the exploit once with a benign payload (e.g. id, whoami) before delivering shellcode.
  4. If using shellcode, regenerate it with your LHOST/LPORT and the target’s bad-char set.
1
2

nc -lvnp 4444 &
python3 exploit.py 10.10.10.5

Step 6 — when the PoC doesn’t work

In order of likelihood:

  1. Wrong version — re-fingerprint, find a closer match.
  2. Wrong arch — x86 PoC against x64 target (or vice versa).
  3. Mitigation enabled — DEP/ASLR/canary the PoC didn’t account for.
  4. Patched — vendor backported the fix without bumping the version string.
  5. Network filter — your reverse shell can’t egress; try bind shell or DNS C2 (dns-c2-and-icmp-c2).
  6. Bad chars — your shellcode includes a byte the input handler munges.

Each of these has a fix; none of them justifies giving up. See porting-public-exploits for the surgery.

Workspace hygiene

1
2
3
4
5

mkdir -p ~/oscp/<target>/exploits
cd ~/oscp/<target>/exploits
searchsploit -m 49757            # local copy
cp 49757.py original.py          # keep the original
cp original.py edited.py         # edit this one

Notes file per target captures the version, the PoC URL, your edits, the date, and the outcome.

References