Public Exploits
Once we identify the services running on ports identified from our Nmap scan, the first step is to look if any of the applications/services have any public exploits. Public exploits can be found for web applications and other applications running on open ports, like SSH or ftp.
Finding Public Exploits
Many tools can help us search for public exploits for the various applications and services we may encounter during the enumeration phase. One way is to Google for the application name with exploit to see if we get any results:
A well-known tool for this purpose is searchsploit, which we can use to search for public vulnerabilities/exploits for any application. We can install it with the following command:
Then, we can use searchsploit to search for a specific application by its name, as follows:
We can also utilize online exploit databases to search for vulnerabilities, like Exploit DB, Rapid7 DB, or Vulnerability Lab. The Intro to Web Applications module discusses public vulnerabilities for web applications.
Metasploit Primer
The Metasploit Framework (MSF) is an excellent tool for pentesters. It contains many built-in exploits for many public vulnerabilities and provides an easy way to use these exploits against vulnerable targets. MSF has many other features, like:
Running reconnaissance scripts to enumerate remote hosts and compromised targets
Verification scripts to test the existence of a vulnerability without actually compromising the target
Meterpreter, which is a great tool to connect to shells and run commands on the compromised targets
Many post-exploitation and pivoting tools
Let us take a basic example of searching for an exploit for an application we are attacking and how to exploit it. To run Metasploit, we can use the msfconsole command:
Once we have Metasploit running, we can search for our target application with the search exploit command. For example, we can search for the SMB vulnerability we identified previously:
Tip: Search can apply complex filters such as search cve:2009 type:exploit. See all the filters with help search
We found one exploit for this service. We can use it by copying the full name of it and using USE to use it:
Before we can run the exploit, we need to configure its options. To view the options available to configure, we can use the show options command:
Any option with Required set to yes needs to be set for the exploit to work. In this case, we only have two options to set: RHOSTS, which means the IP of our target (this can be one IP, multiple IPs, or a file containing a list of IPs). The second option, LHOST, represents the IP of our attack host (this can be a single IP, or the name of a network interface. In the example below, LHOST is being set to the IP associated with our tun0 interface.) We can set them with the set command:
Once we have both options set, we can start the exploitation. However, before we run the script, we can run a check to ensure the server is vulnerable:
As we can see, the server is indeed vulnerable. Note that not every exploit in the Metasploit Framework supports the check function. Finally, we can use the run or exploit command to run the exploit:
As we can see, we have been able to gain admin access to the box and used the shell command to drop us into an interactive shell. These are basic examples of using Metasploit to exploit a vulnerability on a remote server. There are many retired boxes on the Hack The Box platform that are great for practicing Metasploit. Some of these include, but not limited to:
Granny/Grandpa
Jerry
Blue
Lame
Optimum
Legacy
Devel
Later on, in this module, we will walk through the Nibbles box step-by-step and then show exploitation using Metasploit. Metasploit is another essential tool to add to our toolkit, but it is crucial not solely to rely on it. To be well-rounded testers, we must know how to best leverage all of the tools available to us, understand why they sometimes fail, and know when to pivot to manual techniques or other tools.
Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)
Scan the target :
Access to the target's web site :
After accessing our target's website, we can see that it mentions a backup system with version 2.7.10 for WordPress. We are therefore conducting some research to obtain more information about the version of this backup plugin.
Result obtained following an Internet search (Backup Plugin 2.7.10 for WordPress exploit) :
https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_simple_backup_file_read/
The website mentions the possibility of retrieving information about our target host usingwp_simple_backup_file_read .
Using Metasploit with wp_simple_backup_file_read :
Custom options :
Run the exploit :
When executing the exploit, we observe that a file has been saved at the location /root/.msf4/loot/20250615004857_default_94.237.55.43_simplebackup.tra_491598.txt. We then read the contents of this file to obtain the flag:
Last updated