Skip to main content

Locating Public Exploits

searchsploit​

Search the local Exploit-DB copy:

searchsploit <service> <version>

Useful flags:

searchsploit -x <edb-id>            # read/examine the exploit
searchsploit -m <edb-id>            # mirror (copy) the exploit into the current dir
searchsploit -p <edb-id>            # print the full path to the exploit file
searchsploit --nmap scan.xml        # auto-search from an nmap -oX export
searchsploit -w <service>           # include Exploit-DB URLs in results
searchsploit --update               # refresh the local database
tip

searchsploit -t <term> restricts matching to the exploit title only, cutting noise. Exclude irrelevant results with --exclude="dos | /webapps/".

Exploit-DB (Online)​

https://www.exploit-db.com/

Search parameters for privilege escalation:

  • Type: local
  • Platform: Windows or Linux
  • Search: priv esc

GitHub​

Search for CVE identifiers and PoC code.

Fixing Exploits​

Exploits may need modification before use:

  • Update hardcoded IPs and ports
  • Change payload/shellcode
  • Fix compatibility issues for the target architecture
  • Cross-compile for the target OS
tip

When copying exploit scripts between systems, you may need to remove Windows carriage return characters: sed -e "s/\r//" exploit.sh > clean.sh