Software Exploits

#Overview

Software exploit development targets known vulnerabilities in specific applications, operating systems, or services. Unlike network service exploitation (which leverages misconfiguration), CVE-driven exploitation exploits code flaws that grant code execution, privilege escalation, or arbitrary file access. The methodology is consistent: identify software versions, search for known CVEs, locate or adapt proof-of-concept code, and execute against the target.

#CVE-Driven Exploitation Methodology

Software Version Discovery
  |
  ├─ Banner grabbing (nmap, nc, curl)
  ├─ File inspection (CHANGELOG, README, version.php, package.json)
  ├─ Web technology fingerprinting (Wappalyzer, whatweb)
  ├─ Service version detection (nmap -sV)
  v
Search for CVEs
  |
  ├─ searchsploit <software> <version>
  ├─ Google: "<software> <version> CVE exploit"
  ├─ GitHub: "CVE-XXXX-XXXXX poc"
  ├─ Packet Storm, Exploit-DB, NVD
  ├─ Metasploit: search <software>
  v
Adapt PoC
  |
  ├─ Modify LHOST/LPORT for reverse shells
  ├─ Adjust target paths (URL, file paths specific to environment)
  ├─ Fix compilation errors (gcc flags, static linking for older systems)
  ├─ Test against similar lab environment first
  v
Execute & Verify
  ├─ Run exploit and capture shell
  ├─ Document exact command and output
  └─ Clean up payloads after engagement

TEXT

#PoC Search Commands

searchsploit dolibarr                                   # Local search in Exploit-DB
searchsploit -m <EDB-ID>                                # Mirror (copy) exploit to current dir

# GitHub search - use via browser or gh CLI
gh search repos "CVE-2023-46604 poc" --limit 20

# Google dorks (run manually)
"CVE-XXXX-XXXXX" site:github.com
"CVE-XXXX-XXXXX" exploit
"<software> <version>" remote code execution

BASH

#Source Machines

Cerberus (Hard, Linux) - CVE-based exploitation chain
Editorial (Easy, Linux) - Git repository exposure and SSRF CVE exploitation

#Cross-References

#Tool References

Tool	Link
searchsploit	Built-in with Kali (exploitdb package)
Exploit-DB	https://www.exploit-db.com/
NVD (NIST)	https://nvd.nist.gov/
whatweb	https://github.com/urbanadventurer/WhatWeb