EXPLOTAR BASE DE DATOS

 EXPLOITS

SearchSploit - El manual
 GHDB

Included in our Exploit Database repository on GitHub is searchsploit, a command line

search tool for Exploit-DB that also allows you to take a copy of Exploit Database with you,
 DOCUMENTOS everywhere you go. SearchSploit gives you the power to perform detailed off-line searches
through your locally checked-out copy of the repository. This capability is particularly useful
for security assessments on segregated or air-gapped networks without Internet access.
 SHELLCODES

Many exploits contain links to binary files that are not included in the standard repository
but can be found in our Exploit Database Binary Exploits repository instead. If you anticipate
you will be without Internet access on an assessment, ensure you check out both
repositories for the most complete set of data.
 BÚSQUEDA EDB

This guide is for version 4 of SearchSploit. Note, The name of this utility is SearchSploit and
as its name indicates, it will search for all exploits and shellcode. It will not include any
 MANUAL DE SEARCHSPLOIT
results for Google Hacking Database, but it can include Papers if configured (correctly!).

 ENVÍOS

 ENTRENAMIENTO EN LINEA

PRUEBA DE PENETRACIÓN

PWK CON KALI

AWAE ADVANCED WEB ATTACKS How to Install SearchSploit

ATAQUES INALÁMBRICOS
Linux macOS/OS X Windows Git
WIFU

 RECURSOS OFFSEC
Kali Linux
If you are using the standard GNOME build of Kali Linux, the exploitdb package is already
included by default! However, if you are using the Kali Light variant or your own custom-built
ISO, you can install the package manually as follows:

root@kali:~# apt update && apt -y install exploitdb

Es posible que desee instalar algunos otros paquetes relacionados: exploitdb-papers y

exploitdb-bin-sploits .

Linux
Si no está utilizando Kali Linux, el paquete exploitdb puede no estar disponible a través del
administrador de paquetes, en cuyo caso, puede continuar siguiendo las instrucciones en la
pestaña 'Git'.
  EXPLOTAR BASE DE DATOS
Actualización de SearchSploit
Si está utilizando Kali Linux, puede esperar que el paquete exploitdb se actualice
semanalmente . Si está utilizando Homebrew o Git, puede esperar actualizaciones diarias
 EXPLOITS
(a las 05:05 UTC).
Independientemente de cómo instaló SearchSploit, todo lo que necesita hacer para
actualizarlo es ejecutar lo siguiente:
 GHDB

$ searchsploit -u
 DOCUMENTOS
Si está utilizando el paquete Kali Linux y no ha actualizado desde antes del 20 de
septiembre de 2016 (es una pena), primero deberá actualizar el paquete de la manera
tradicional:
 SHELLCODES

root@kali:~# apt update && apt -y full-upgrade

Tenga en cuenta que no recomendamos que utilice los paquetes .zip de GitHub o los
 BÚSQUEDA EDB
paquetes archive.tar.bz2 heredados para actualizar.

 MANUAL DE SEARCHSPLOIT

Usando SearchSploit
 ENVÍOS

Pantalla de ayuda
 ENTRENAMIENTO EN LINEA
Al usar -h, puede ver todas las características y opciones disponibles:

root@kali:~# searchsploit -h
PRUEBA DE PENETRACIÓN
Usage: searchsploit [options] term1 [term2] ... [termN]
PWK CON KALI

==========
AWAE ADVANCED WEB ATTACKS
Examples
==========
ATAQUES INALÁMBRICOS
searchsploit afd windows local
WIFU searchsploit -t oracle windows
searchsploit -p 39446
 RECURSOS OFFSEC
searchsploit linux kernel 3.2 --exclude="(PoC)|/dos/"

For more examples, see the manual: https://www.exploit-

db.com/searchsploit/

=========
Options
=========
-c, --case [Term] Perform a case-sensitive search
(Default is inSEnsITiVe).
-e, --exact [Term] Perform an EXACT match on exploit
title (Default is AND) [Implies "-t"].
-h, --help Show this help screen.
-j, --json [Term] Show result in JSON format.
-m, --mirror [EDB-ID] Mirror (aka copies) an exploit to
the current working directory.
-o, --overflow [Term] Exploit titles are allowed to
overflow their columns.
-p, --path [EDB-ID] Show the full path to an exploit
(and also copies the path to the clipboard if possible).
-t, --title [Term] Search JUST the exploit title
(Default is title AND the file's path).
-u, --update Check for and install any
exploitdb package updates (deb or git).
-w, --www [Term] Show URLs to Exploit-DB.com rather
than the local path.
-x, --examine [EDB-ID] Examine (aka opens) the exploit
using $PAGER.
--colour Disable colour highlighting in
search results
 search results.
--id Display the EDB-ID value rather
  EXPLOTAR BASE DE DATOS
than local path.
--nmap [file.xml] Checks all results in Nmap's XML
output with service version (e.g.: nmap -sV -oX file.xml).
 EXPLOITS
Use "-v" (verbose) to try even
more combinations
--exclude="term" Remove values from results. By
 GHDB
using "|" to separated you can chain multiple values.
e.g. --
 DOCUMENTOS
exclude="term1|term2|term3".

=======
 SHELLCODES
Notes
=======
* You can use any number of search terms.
* Search terms are not case-sensitive (by default), and
 BÚSQUEDA EDB
ordering is irrelevant.
* Use '-c' if you wish to reduce results by case-sensitive
 MANUAL DE SEARCHSPLOIT
searching.
* And/Or '-e' if you wish to filter results by using an exact
match.
 ENVÍOS
* Use '-t' to exclude the file's path to filter the search
results.
* Remove false positives (especially when searching using
numbers - i.e. versions).
 ENTRENAMIENTO EN LINEA
* When updating or displaying help, search terms will be
ignored.
PRUEBA DE PENETRACIÓN

PWK CON KALI root@kali:~#

AWAE ADVANCED WEB ATTACKS

Búsqueda básica
ATAQUES INALÁMBRICOS Simplemente agregue cualquier número de términos de búsqueda que desee buscar:
WIFU
root@kali:~# searchsploit afd windows local
 RECURSOS OFFSEC
----------------------------------------------------------------
----------------------- ----------------------------------------
--
Exploit Title
| Path

| (/usr/share/exploitdb/)
----------------------------------------------------------------
----------------------- ----------------------------------------
--
Microsoft Windows (x86) - 'afd.sys' Local Privilege Escalation
(MS11-046) | exploits/windows_x86/local/40564.c
Microsoft Windows - 'AfdJoinLeaf' Local Privilege Escalation
(MS11-080) (Metasploit) | exploits/windows/local/21844.rb
Microsoft Windows - 'afd.sys' Local Kernel (PoC) (MS11-046)
| exploits/windows/dos/18755.c
Microsoft Windows 7 (x64) - 'afd.sys' Dangling Pointer Privilege
Escalation (MS14-040) | exploits/windows_x86-64/local/39525.py
Microsoft Windows 7 (x86) - 'afd.sys' Dangling Pointer Privilege
Escalation (MS14-040) | exploits/windows_x86/local/39446.py
Microsoft Windows XP - 'afd.sys' Local Kernel Denial of Service
| exploits/windows/dos/17133.c
Microsoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation
(K-plugin) (MS08-066) | exploits/windows/local/6757.txt
Microsoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation
(MS11-080) | exploits/windows/local/18176.py
----------------------------------------------------------------
----------------------- ----------------------------------------
--
Shellcodes: No Result
 root@kali:~#
  EXPLOTAR BASE DE DATOS
Tenga en cuenta que SearchSploit usa un operador AND , no un operador OR . Cuantos más
términos se utilicen, más resultados se filtrarán.
Consejo profesional: no use abreviaturas (use inyección de SQL, no SQLi).
 EXPLOITS
Consejo profesional: si no recibe los resultados esperados, intente buscar de manera más
amplia utilizando términos más generales (use Kernel 2.6 o Kernel 2.x, no Kernel 2.6.25).

 GHDB

Búsqueda de títulos
 DOCUMENTOS
Por defecto, searchsploit verificará TANTO el título del exploit como la ruta. Dependiendo de
los criterios de búsqueda, esto puede generar falsos positivos (especialmente cuando se
buscan términos que coincidan con plataformas y números de versión). Las búsquedas se
 SHELLCODES
pueden restringir a los títulos usando la -topción:

root@kali:~# searchsploit -t oracle windows

----------------------------------------------------------------
 BÚSQUEDA EDB
----------------------- ----------------------------------------
--
Exploit Title
 MANUAL DE SEARCHSPLOIT
| Path

 ENVÍOS | (/usr/share/exploitdb/)
----------------------------------------------------------------
----------------------- ----------------------------------------
--
 ENTRENAMIENTO EN LINEA
Oracle 10g (Windows x86) - 'PROCESS_DUP_HANDLE' Local Privilege
Escalation | exploits/windows_x86/local/3451.c
Oracle 9i XDB (Windows x86) - FTP PASS Overflow (Metasploit)
PRUEBA DE PENETRACIÓN
| exploits/windows_x86/remote/16731.rb
PWK CON KALI
Oracle 9i XDB (Windows x86) - FTP UNLOCK Overflow (Metasploit)
| exploits/windows_x86/remote/16714.rb
AWAE ADVANCED WEB ATTACKS Oracle 9i XDB (Windows x86) - HTTP PASS Overflow (Metasploit)
| exploits/windows_x86/remote/16809.rb
ATAQUES INALÁMBRICOS Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)
WIFU | exploits/windows/remote/35777.rb
Oracle MySQL (Windows) - MOF Execution (Metasploit)
 RECURSOS OFFSEC
| exploits/windows/remote/23179.rb
Oracle MySQL for Microsoft Windows - Payload Execution
(Metasploit) |
exploits/windows/remote/16957.rb
Oracle VM VirtualBox 5.0.32 r112930 (x64) - Windows Process COM
Injection Privilege Esc| exploits/windows_x86-64/local/41908.txt
Oracle VirtualBox Guest Additions 5.1.18 - Unprivileged Windows
User-Mode Guest Code Do| exploits/multiple/dos/41932.cpp
----------------------------------------------------------------
----------------------- ----------------------------------------
--
Shellcodes: No Result
root@kali:~#
root@kali:~# searchsploit oracle windows | wc -l
94
root@kali:~#

Si no lo usáramos -t, tendríamos 87 resultados (7 líneas en el encabezado / pie de página),

en lugar de 9.

Eliminar resultados no deseados

Podemos eliminar resultados no deseados mediante el uso de la --excludeopción.
También podemos eliminar varios términos separando el valor con un |(tubería). Esto se
puede demostrar por lo siguiente:

root@kali:~# searchsploit linux kernel 3.2 --exclude="

(PoC)|/dos/"
----------------------------------------------------------------
----------------------- ----------------------------------------
 --
  EXPLOTAR BASE DE DATOS Exploit Title
| Path

| (/usr/share/exploitdb/)
 EXPLOITS
----------------------------------------------------------------
----------------------- ----------------------------------------
 GHDB --
Linux Kernel 2.6.39 < 3.2.2 (Gentoo / Ubuntu x86/x64) -
'Mempodipper' Local Privilege E| exploits/linux/local/18411.c
 DOCUMENTOS
Linux Kernel 2.6.39 < 3.2.2 (x86/x64) - 'Mempodipper' Local
Privilege Escalation (2) | exploits/linux/local/35161.c
Linux Kernel 3.2.0-23/3.5.0-23 (Ubuntu 12.04/12.04.1/12.04.2
 SHELLCODES

x64) - 'perf_swevent_init'| exploits/linux_x86-64/local/33589.c

Linux Kernel 3.2.x - 'uname()' System Call Local Information
Disclosure | exploits/linux/local/37937.c
 BÚSQUEDA EDB Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.04/13.10 x64) -
'CONFIG_X86_X32=y' Local Privilege| exploits/linux_x86-
64/local/31347.c
 MANUAL DE SEARCHSPLOIT
Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.10) - 'CONFIG_X86_X32'
Arbitrary Write (2) | exploits/linux/local/31346.c
Linux Kernel < 3.2.0-23 (Ubuntu 12.04 x64) - 'ptrace/sysret'
 ENVÍOS

Local Privilege Escalation| exploits/linux_x86-64/local/34134.c

----------------------------------------------------------------
----------------------- ----------------------------------------
 ENTRENAMIENTO EN LINEA --
Shellcodes: No Result
root@kali:~#
PRUEBA DE PENETRACIÓN
root@kali:~# searchsploit linux kernel 3.2 | wc -l
PWK CON KALI
19
root@kali:~#
AWAE ADVANCED WEB ATTACKS
Al hacer esto, reducimos los resultados a 7 en lugar de 12 (¡7 líneas son para el encabezado
/ pie de página)!
ATAQUES INALÁMBRICOS
Consejo profesional: Al hacer esto searchsploit linux kernel --exclude="
WIFU (PoC)|/dos/" | grep ' 3.2', obtendrá una salida aún más "limpia" (ordenada según la
versión sin encabezado / pie de página).
 RECURSOS OFFSEC

Salida de tubería (método alternativo para eliminar

resultados no deseados)
The output from searchsploit can be piped into any other program, which is especially
useful when outputting the results in JSON format (using the -j option). With this, it is
possible to remove any unwanted exploits by using grep. In the following example, we use
grep to filter out any "Denial of Service (DoS)" results.

root@kali:~# searchsploit XnView | grep -v '/dos/'

----------------------------------------------------------------
----------------------- ----------------------------------------
--
Exploit Title
| Path

| (/usr/share/exploitdb/)
----------------------------------------------------------------
----------------------- ----------------------------------------
--
XnView 1.90.3 - '.xpm' Local Buffer Overflow
| exploits/windows/local/3777.c
XnView 1.92.1 - 'FontName' Slideshow Buffer Overflow
| exploits/windows/local/5346.pl
XnView 1.92.1 - Command-Line Arguments Buffer Overflow
| exploits/windows/remote/31405.c
XnView 1.93.6 - '.taac' Local Buffer Overflow
| exploits/windows/local/5951.c
XnView 1.97.4 - '.MBM' File Remote Heap Buffer Overflow
| exploits/windows/remote/34143.txt
 ----------------------------------------------------------------
  EXPLOTAR BASE DE DATOS ----------------------- ----------------------------------------
--
root@kali:~#
root@kali:~# searchsploit XnView | wc -l
 EXPLOITS
24
root@kali:~#
 GHDB
By piping the search results into grep, we managed to filter the results down to 5 rather than
17 (7 lines are in the heading/footer)!

 DOCUMENTOS Pro Tip: We recommend using "/dos/" with grep rather than "dos" so the filter is applied to
the path, rather than the title. Although denial of service entries may not include "dos" in
their title, they will nevertheless have "dos" in the path. Removing results based on the path
 SHELLCODES will also ensure you don't inadvertently filter out results that legitimately contain "dos" in
their title (i.e.: EDB-ID #24623).

 BÚSQUEDA EDB Colour Output

By default, searchsploit highlights the search terms in the results when they are displayed to
the user. This works by inserting invisible characters into the output before and after the
 MANUAL DE SEARCHSPLOIT
colour changes.
Now, if you were to pipe the output (for example, into grep) and try to match a phrase of
 ENVÍOS both highlighted and non-highlighted text in the output, it would not be successful. This can
be solved by using the --colour option (--color works as well).

 ENTRENAMIENTO EN LINEA

PRUEBA DE PENETRACIÓN

PWK CON KALI

AWAE ADVANCED WEB ATTACKS

ATAQUES INALÁMBRICOS
Copy To Clipboard
WIFU So now that we have found the exploit we are looking for, there are various ways to access
it quickly.
 RECURSOS OFFSEC
By using -p, we are able to get some more information about the exploit, as well as copy the
complete path to the exploit onto the clipboard:

root@kali:~# searchsploit 39446

----------------------------------------------------------------
----------------------- ----------------------------------------
--
Exploit Title
| Path

| (/usr/share/exploitdb/)
----------------------------------------------------------------
----------------------- ----------------------------------------
--
Microsoft Windows 7 (x86) - 'afd.sys' Dangling Pointer Privilege
Escalation (MS14-040) | exploits/windows_x86/local/39446.py
----------------------------------------------------------------
----------------------- ----------------------------------------
--
Shellcodes: No Result
root@kali:~#
root@kali:~# searchsploit -p 39446

Exploit: Microsoft Windows 7 (x86) - 'afd.sys' Dangling

Pointer Privilege Escalation (MS14-040)
URL: https://www.exploit-db.com/exploits/39446/
Path:
/usr/share/exploitdb/exploits/windows_x86/local/39446.py
File Type: Python script, ASCII text executable, with CRLF line
terminators
  EXPLOTAR BASE DE DATOS Copied EDB-ID #39446's path to the clipboard.
root@kali:~#
root@kali:~#
/usr/share/exploitdb/exploits/windows_x86/local/39446.py
 EXPLOITS

 GHDB Copy To Folder

We recommend that you do not alter the exploits in your local copy of the database.
 DOCUMENTOS Instead, make a copy of ones that are of interest and use them from a working directory. By
using the -m option, we are able to select as many exploits we like to be copied into the
same folder that we are currently in:
 SHELLCODES

root@kali:~# searchsploit MS14-040

----------------------------------------------------------------
----------------------- ----------------------------------------
 BÚSQUEDA EDB
--
Exploit Title
| Path
 MANUAL DE SEARCHSPLOIT

| (/usr/share/exploitdb/)

 ENVÍOS ----------------------------------------------------------------
----------------------- ----------------------------------------
--
Microsoft Windows 7 (x64) - 'afd.sys' Dangling Pointer Privilege
 ENTRENAMIENTO EN LINEA
Escalation (MS14-040) | exploits/windows_x86-64/local/39525.py
Microsoft Windows 7 (x86) - 'afd.sys' Dangling Pointer Privilege
Escalation (MS14-040) | exploits/windows_x86/local/39446.py
PRUEBA DE PENETRACIÓN
----------------------------------------------------------------
PWK CON KALI
----------------------- ----------------------------------------
--
AWAE ADVANCED WEB ATTACKS Shellcodes: No Result
root@kali:~#
ATAQUES INALÁMBRICOS root@kali:~# searchsploit -m 39446 win_x86-64/local/39525.py
WIFU
Exploit: Microsoft Windows 7 (x86) - 'afd.sys' Dangling
 RECURSOS OFFSEC
Pointer Privilege Escalation (MS14-040)
URL: https://www.exploit-db.com/exploits/39446/
Path:
/usr/share/exploitdb/exploits/windows_x86/local/39446.py
File Type: Python script, ASCII text executable, with CRLF line
terminators

Copied to: /root/39446.py

Exploit: Microsoft Windows 7 (x64) - 'afd.sys' Dangling

Pointer Privilege Escalation (MS14-040)
URL: https://www.exploit-db.com/exploits/39525/
Path: /usr/share/exploitdb/exploits/windows_x86-
64/local/39525.py
File Type: Python script, ASCII text executable, with CRLF line
terminators

Copied to: /root/39525.py

root@kali:~#

You do not have to give the exact EDB-ID value (such as "39446"); SearchSploit is able to
automatically extract it from a path given to it (such as "39525").

Exploit-DB Online
The Exploit Database repository is the main core of Exploit-DB, making SearchSploit
efficient and easy to use. However, some of the exploit metadata (such as screenshots,
 setup files, tags, and vulnerability mappings) are not included. To access them, you will
  EXPLOTAR BASE DE DATOS need to check the website.
You can quickly generate the links to exploits of interest by using the -w option:

root@kali:~# searchsploit WarFTP 1.65 -w

 EXPLOITS
----------------------------------------------------------------
----------------------- ----------------------------------------
--
 GHDB
Exploit Title
| URL
 DOCUMENTOS
----------------------------------------------------------------
----------------------- ----------------------------------------
--
 SHELLCODES
WarFTP 1.65 (Windows 2000 SP4) - 'USER' Remote Buffer Overflow
(Perl) | https://www.exploit-
db.com/exploits/3482/
WarFTP 1.65 (Windows 2000 SP4) - 'USER' Remote Buffer Overflow
 BÚSQUEDA EDB
(Python) | https://www.exploit-
db.com/exploits/3474/
 MANUAL DE SEARCHSPLOIT
WarFTP 1.65 - 'USER' Remote Buffer Overflow
| https://www.exploit-db.com/exploits/3570/
----------------------------------------------------------------
 ENVÍOS
----------------------- ----------------------------------------
--
Shellcodes: No Result
root@kali:~#
 ENTRENAMIENTO EN LINEA

PRUEBA DE PENETRACIÓN Downloads

PWK CON KALI

Certifications

AWAE ADVANCED WEB ATTACKS

Training

ATAQUES INALÁMBRICOS
Pro Services
WIFU

 RECURSOS OFFSEC

   EXPLOIT DATABASE BY OFFENSIVE SECURITY TERMS PRIVACY ABOUT US FAQ COOKIES

© OffSec Services Limited 2020. All rights reserved.