Exploiting a public CVE: finding, reading and fixing exploits from searchsploit and GitHub
From a version number to a shell: identify the software, search searchsploit, GitHub and nuclei, read the exploit before running it and fix the broken ones.
It is the most tagged technique in the catalogue: more than 100 machines have a public CVE somewhere along the way. It is not about firing the first hit on Google but about a method: know exactly which version is running, find the right exploit, understand it and adapt it. In the OSCP exam it is half the job.
1. Identify the software and its version
No version, no CVE. Where to look:
- nmap banners:
nmap -sV -sC -p- target(the nmap cheat sheet has more options). - The website itself: the footer, the source code (
<meta name="generator">), static file paths (/wp-content/,/media/system/js/), the login or "About" page. - Well-known files for each product:
CHANGELOG.txt,README.md,/administrator/manifests/files/joomla.xml,/composer.json,/package.json. - Headers:
Server,X-Powered-By, cookies named after the product. - CMS-specific tools (CMS exploitation):
wpscan(WordPress),joomscanordroopescan(Joomla, Drupal),CMSeeK.
whatweb -a 3 http://target.htb
curl -s http://target.htb/CHANGELOG.txt | head
wpscan --url http://target.htb -e ap,at,u --api-token TOKEN
2. Find the exploit
searchsploit drupal 7
searchsploit -m 44449 # copy the exploit to the current folder
searchsploit -x 44449 # open it to read
And also:
- GitHub: search for
CVE-YYYY-NNNNN pocor<product> <version> exploit. There are often newer, better-written versions than the Exploit-DB one. - nuclei: checks thousands of CVEs automatically (
nuclei -u http://target.htb -tags cve). If it reports a hit, open the template: it shows you the exact request. - The vendor advisory and the patch diff: when there is no exploit, comparing the vulnerable and fixed versions tells you where the bug is.
Warning
Always read the code before running it. Exploits from unknown repositories sometimes come with surprises (they download something, delete files, or simply do not do what they claim). On a real engagement, an exploit that crashes a service is a serious problem too.
3. Understand the exploit
Before running it, answer these by reading the code:
- Does it need authentication? Many Exploit-DB exploits are "authenticated RCE": you need credentials (look for default credentials or reused ones).
- Which path and parameters does it use? On your target the application may live under
/app/rather than the root. - What exactly does it do? Run a command, upload a web shell, create a user...
- Which versions does it cover? One minor version apart can change everything.
4. Fixing the ones that do not work
The usual failures when running old exploits:
| Symptom | Likely cause | Fix |
|---|---|---|
SyntaxError on print "..." |
Written for Python 2 | Parentheses on print, bytes vs str, or run it with python2 |
SSL: CERTIFICATE_VERIFY_FAILED |
HTTPS with a self-signed certificate | verify=False in requests |
| Nothing happens and no error | Base path or payload does not fit | Route the traffic through Burp (proxies={'http':'http://127.0.0.1:8080'}) and compare with what you expect |
| The reverse shell never arrives | Wrong IP or port, or egress blocked | Test first with ping or curl to your box |
| The C exploit does not compile | Missing library or 32-bit code | gcc -m32, -static, or compile on a system similar to the target |
If the original exploit is too convoluted, it is sometimes faster to reproduce the request by hand in Burp: it is often a single HTTP request with a specific payload.
5. Windows and kernel exploits
To escalate on an unpatched Windows box (Windows exploits), pull the list of updates and compare:
systeminfo
wmic qfe get HotFixID,InstalledOn
# On your box
wes.py systeminfo.txt --impact "Elevation of Privilege" --exploits-only
Classics that still show up: MS17-010 (EternalBlue, on Blue), MS16-032, MS10-059 and Spooler bugs such as PrintNightmare. On Linux, the equivalent is comparing uname -a with linux-exploit-suggester (the kernel exploit technique); try them as a last resort, because they can hang the machine.
Examples from the catalogue
- Armageddon: Drupalgeddon2 on an unpatched Drupal 7.
- Devvortex: a Joomla API information leak that hands you credentials.
- Optimum: HttpFileServer 2.3 with RCE, then a Windows kernel exploit.
- Bizness, Broker and Boardlight: enterprise products (OFBiz, ActiveMQ, Dolibarr) with recent CVEs.
What next
A CVE gets you in; next comes the post-exploitation checklist. And if you are hunting vulnerable versions of something running inside the machine (a service on localhost), reach it first with port forwarding.