wufufu770 TL;DR
- 目的：CVE PoC 生成与验证：从公开情报构建最小可复现验证器，输出标准化 PoC 文件。
- 适用：已知 CVE 的复现（用于报告）
- 输入：CVE 编号 + 目标组件版本
- 输出：可复现 PoC + 利用步骤 + 风险评估
- 红线：仅用于授权测试；不传播 0-day
- 关联：上游：component-nday → 下游：fp-check, reporting
When to Use
- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology
When NOT to Use
- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
Workflow
- Identify CVE — From component fingerprint
- Search sources — ExploitDB, GitHub, Packet Storm, Metasploit
- Select PoC — Read-only preferred, full-RCE only with approval
- Adapt — Match target version, environment
- Test in isolation — Never on production
- Verify — Cross-validate with fp-check
- Document — Screenshot, request/response, time
Advanced Techniques
ExploitDB Search Strategy
Search ExploitDB by EDB-ID, CVE, or keywords. Verify PoC is for exact component version (not just family).
PoC Adaptation
When no direct PoC exists, use Metasploit module (search type:exploit name:cve) + manual crafting based on CVE description.
Safe Exploitation
Always run PoC in isolated VM first. Use strace/ltrace to understand what PoC does before running on production target.
Multi-Stage Exploits
Some CVEs require chain: e.g., SSRF → IMDSv1 → IAM creds. Use one skill's output as another's input.