[MUSIC PLAYING]
Searching for exploits with SearchSploit.
In certain cases, you may not have access to online exploits
or online exploit resources like ExploitDB or Rapid7.
And as a result, you must be able to utilize
the exploit sources or resources available locally or offline.
Now, you might be asking yourself, well,
how can we actually have exploits offline
on our Kali Linux system?
Well, here's the great thing.
The entire ExploitDB database of exploits
comes pre-packaged with Kali Linux,
consequently providing you with all the exploits
available on ExploitDB locally.
So whenever you set up Kali Linux
or you install the default version of Kali Linux,
that version comes pre-packaged with the entire database,
or rather the entire ExploitDB database of exploits.
So all of those exploits that we are searching
for in the previous video are available offline
on your Kali Linux system.
So as I said, in certain scenarios
you may not be in a position where you can, essentially,
access online resources to, essentially, download exploits.
And you must have the ability to, essentially, search for
and identify the exploit code that you are looking for
or that is relevant to the vulnerability
that you're trying to exploit.
And you must be able to do this locally.
Now, given the fact that the entire ExploitDB
database of exploits is available offline on your Kali
Linux system, you need a way of actually
searching for the exploits that you're looking for.
And this is where the SearchSploit utility
comes into play, all right?
So the ExploitDB offline database of exploits
can be accessed and queried with a tool called SearchSploit,
all right?
So SearchSploit is part of the ExploitDB package.
And we'll actually take a look at that
during the practical demonstration, which is what
we're going to be doing now.
So this video doesn't have a lab environment attached to it.
All I'm really showcasing is the actual technique
or the various techniques involved in relation
to utilizing SearchSploit to find or to search
for the exploits stored locally or to search
for exploits that you're interested
in from the local ExploitDB database of exploits,
all right?
So I'll switch over to my Kali Linux VM,
and we can get started.
All right, so I'm back on my Kali Linux VM.
And the first step will essentially
involve updating or installing the ExploitDB package
if you don't have it installed already.
As I said, if you're using the latest version of Kali Linux--
the default version--
that could either be the ISO image or the VM file
or the VM image for both VirtualBox and VMware,
the ExploitDB package should come
prepackaged or pre-installed.
However, it is always recommended to keep it updated.
So in order to update it or install it,
we can update our repository.
So I'm going to say sudo apt get update.
And I can then say sudo apt get install ExploitDB.
That's the package.
And I'll hit Enter.
There we are.
So it's going to update my repositories.
And I'll give this a couple of seconds.
And it should tell me that I have
the latest version installed as it says right over here.
So ExploitDB is already the newest version.
Fantastic.
In your case, you may need to update yours.
So now that we have the ExploitDB package
updated, let's get an understanding
of where this local database of exploits is stored.
So the ExploitDB database or collection of exploits
is stored under user, share, exploitdb.
So if I Enter, you can see that this folder contains
two folders.
It contains exploits and shell code, all right?
Now, as I said, this directory is essentially
where everything is stored.
So all the exploits available on ExploitDB
are available within the exploits directory.
And then the shellcode directory contains all the shellcode
available on ExploitDB.
All right, so the exploit directory
is further sorted and categorized
based on the target operating system, architecture,
and the actual development language that was
used to develop that exploit.
You can, again, manually check or search
for exploits within this directory if you want to.
But this is really not efficient,
and that's why these search exploit utility was developed.
So if we just take a peek around the exploits directory--
let's see, that is under user, share ExploitDB.
And under the exploits you should
be able to see that we'll be able to sort
through the actual operating system.
So if we're looking for Windows exploits,
we can click on Windows.
And we can then specify what type of exploit.
So again, all of these filters or forms of categorization
are what we saw online when we accessed the ExploitDB website.
If you take a look at the filters,
this is what it is referring to.
So this is the type of exploit.
So if we're looking for a remote exploit,
we can head over into the remote directory.
So I can say remote, and then within this, you
can see all the exploits are listed not by their name
or by their title--
although that information is also available--
they are sorted by the ExploitDB ID.
And you can also query this directory
if you've identified an exploit and you know the exploit ID.
As I said, that information was important
in the previous video.
And this is why it's important.
So that is where the actual exploits are stored.
And of course, as I said, the tool
we are going to be utilizing to search for specific exploits
as we would if we were utilizing the ExploitDB website
is SearchSploit.
Now, SearchSploit-- again, I'll just
type it in right over here.
So SearchSploit, hit Enter.
It'll provide you with very useful documentation regarding
the actual syntax.
So you can see right over here-- usage.
You specify the SearchSploit operator.
You then specify options, then your term, the actual title,
or it could just be the banner of the service you're
trying to exploit.
And we'll take a look at all of this.
And it then provides you with examples here.
So you can see, if you're looking for exploits related
to Apache Struts 2.0.0, that is the actual search
query you would run.
And then, you have various options right over here.
Now, before we actually get started
with searching for exploits, this right over here
under the nonsearching, this option U for update,
this is very important because this option will essentially
check for and install any ExploitDB package updates.
So as I said, ExploitDB is updated every day.
So you can see that the latest exploit
added was on the 19th of January, 2022.
This is when I'm recording this video.
And in order to obtain the latest exploits,
you actually need to update the ExploitDB package.
And again, this is not the ExploitDB package
that we updated previously.
You actually need to manually do this
using the SearchSploit utility and the U option
right over here.
Now, it's important to note that if you have not
updated your ExploitDB database repository if you
will in a while, then the actual download
size will be quite large.
So I'll give you an example.
I haven't updated mine probably for I think a few months.
So if I type in SearchSploit U for update,
it's going to, again, update the repository.
So that we are.
Give that a couple of seconds.
And in my case, I have a couple of additional repositories
that's why it's taking a while.
So there we are.
You can see apt update is finished.
It's then going to update via the apt or the aptitude package
manager.
And we'll give this a couple of seconds.
And you'll actually see the entire size.
So you can see that it requires me
to download about three gigabytes,
which, again, in my case, I'm not really going to do now.
But that's something that is always recommended.
Ensure that you keep your ExploitDB archive of exploits
or the ExploitDB package updated to the latest version
so that you have the latest vulnerabilities that
were added, all right?
So that's one thing that I wanted to highlight.
Now, in the previous videos, we went
through how to utilize SearchSploit
at a very basic level.
We essentially typed in SearchSploit,
and then you can essentially type in or specify the banner--
the service banner in terms of the service
that you're trying to identify exploits for.
And if we used the previous examples like vsf tpd,
we can hit Enter, and you can see
that this is very vague because we're specifying the service
name but not the version.
And the version information is very important.
So if we narrow down our search to version 2.3.4,
you can see that it limits the results
to only two exploits-- one of which is a Metasploit module.
The other one is a Python script or a Python file.
And the important thing to note here
is once you've performed a search,
the results will be sorted into a table that
contains two columns.
You have your exploit title and the path.
Now, you can see that it's not referring
to an online link that would essentially allow
you to download the exploit.
This exploit is actually stored locally.
So again, if I head over into the user share ExploitDB
directory under exploits Unix remote,
I should be able to find this Python exploit.
Now, if you ever want to copy an exploit that you've identified
into your current working directory-- so, for example,
you can see that I'm on my desktop under exploits,
and that, of course, can be verified by typing
in print working directory.
If I wanted to copy this particular exploit
into my current working directory,
I can do that really simply by saying SearchSploit M,
and I can then specify the actual exploit ID.
And that is the exploit database ID.
So I can just say 49757.
And I don't need to specify the extension
because each exploit has a unique Exploit Database
ID or EDID.
So if I type in SearchSploit M and the actual ID
and hit Enter, you can see that it's
going to give you information regarding
that exploit, the path.
So as I said, it's going to be under use share ExploitDB
exploits Unix remote and then the ID there.
And it's going to copy it over to
your current working directory.
So if I list out the contents of this directory,
you can see I have the Pythons exploit here.
Fantastic.
So I can actually then move into modifying it.
So I can say--
I can utilize vim and open this up and hit Enter.
And you can see I have the entire exploit available.
So this is really, really awesome
because if I'm in an environment that
doesn't have a very good online connection or a stable internet
connection, then this is a lifesaver
because I can essentially access the entire database of exploits
locally on my Kali Linux system.
So I'll just quit and exit.
Now, let's talk a little bit about the SearchSploit search
terms that allow you to narrow down or essentially narrow down
your searches based on what you're looking for.
One of the great features is the fact
that SearchSploit allows you to perform
case-sensitive searches.
So for example, if I wanted to perform a case-sensitive search
for the banner or for the service openSSH,
I can utilize the hyphen C option.
And I'll just zoom in a little bit
here so you can see what's going on.
There we are.
And I can say C for case sensitive,
and then I can say openSSH.
I hit Enter, and that'll bring up
all the exploits pertinent to the actual keyword
or the string that I just specified.
And you can see that I've not specified the service version,
but it provides me--
and it actually color codes the actual string
or query that I provided to SearchSploit right over here
and shows all the matches.
And you can see that this is quite important or quite
accurate.
Now, if I launched a case-sensitive search
for openSSH and typed it in in lowercase,
you can see that I've not obtained the same results
that I would have had I used the actual case-sensitive option
and specified the service banner correctly.
So the reason why I'm using the openSSH example
is because openSSH is typically referred to as "as is."
So this is the case that is typically utilized for openSSH,
and it's very rarely referred to in lowercase.
So again, if I got rid of the case-sensitive search,
then I would essentially obtain the results I obtained earlier.
So you can see that right over there.
So the case-sensitive search is not really useful
if you don't want to ensure that the actual exploits
of the title of the exploit are case sensitive.
So be very careful with that.
As I said, only use that if you actually need to.
The other option or the other search term
that you can use to filter your searches at a very basic level,
is the title search, right?
Now, the title search essentially
searches for the keyword that you
specify within the title of the exploit.
So for example, if I wanted to search
for the keyword within the title of all the exploits,
I can say SearchSploit hyphen T. And then
I can say vsf tpd and hit Enter.
And that is going to bring up all exploits that
contain vsf tpd within the title as you can see right over here.
And this will essentially ensure that the information
that you're trying to query is only
stored within the title as opposed
to any other parameter associated
with a particular exploit or exploit code.
So again, this can be very helpful
if you are trying to identify a specific keyword
within the exploit title.
And this is not just limited to the service
banner or the service version.
I can also identify or find exploits
pertinent to a type of vulnerability.
So for example, if I'm looking for buffer overflow
vulnerabilities, I can type in buffer overflow,
and I can essentially bring up all buffer overflow exploits.
And these are not pertinent or relative
to a particular service.
But again, you can see how robust this is.
So it'll essentially search or find
all exploits that contain the keyword "buffer
overflow" in the title.
All right, so that is how to utilize the T option
or the title search option.
You can then perform--
and this is one of the most important.
This is the exact search option.
So if I open up the search exploit help menu,
you can see that we have the exact search term
right over here.
So this will perform an exact and order
match on the exploit title.
So an example of this would be if I wanted to search exactly
for a specific service banner that I obtained
during the banner grabbing phase of a penetration test--
so again, just to use a simple example here,
I can say SearchSploit.
And if I want exact matches, I can put it in quotation marks
and say Windows XP, for example.
So I can say, Windows XP, hit Enter.
And this is going to bring all--
this is going to display a list of all exploits that
contain Windows XP within the title right over here.
So you can see it's not just relative to Windows XP exploits
but also services that run on top of Windows XP.
So this is very, very helpful.
And of course, you can also limit this or essentially
filter through this by using the grep option.
So I can say grep.
And I want to match a pattern, and the pattern in this case,
I can probably limit it to Microsoft Windows XP.
So I can say Microsoft Windows XP and hit Enter.
And in this case, it looks like it is not
giving me what I'm looking for.
So what I can do is probably limit the results to Microsoft.
Let's see if that works.
There we are.
And you can now see that it will only display exploits
pertinent to Windows XP.
Fantastic.
So that is how to use the exact search option.
And of course, you can also do this
for other banners or other services
if you're looking for an exact match.
So I can say openSSH 7.2 P2 and close quotation marks.
Give that a couple of seconds.
Once complete, you can see that the actual exploits
pertinent to the version that we specified
will be highlighted in red.
And that's something that really is great when it comes down
to SearchSploit, and it's essentially
makes things easier to spot.
So that is the exact search.
So I'm just going to clear out the terminal.
And let's take a look at the final piece of functionality
that I wanted to highlight.
And that is the ability to utilize filters
that you typically use on the ExploitDB website.
So filters can be used to fine tune
your results similar to the ExploitDB website.
And they allow you to essentially filter through
based on the following categories-- so type, platform,
and/or port or service filters, right?
And all of this is going to be used to search for--
or all of the information you provide in terms of the search
filters will all be used to search
for relative or exploits that have that information
within the title.
So let me show you what this looks like.
So if I just open up the SearchSploit documentation
page, you can see that we should have the ability
to essentially specify from the example right over here.
You can see that this one may be a bit confusing because it's
not really searching for a specific service
version or a piece of software that
could be vulnerable like this one right over here.
Instead it's specifying AFD Windows Local.
So let me show you how that works.
So if I wanted to search for all exploits that
meet a certain parameter-- so for example,
if I wanted to search for remote exploits for Windows
operating systems that target the SMB port or the SMB
service, I could do that by saying SearchSploit,
and then I can say remote Windows SMB.
So I hope that makes sense.
We're looking for remote exploits and these, of course,
have to be Windows exploits.
And they are targeting the SMB service or the SMB port
if you will--
but really the SMB service because SMB
will be included within the exploit titles.
So I'll hit Enter.
And you can see that this will bring up a list of all Windows
exploits pertinent to the parameters or the options
we specified here.
So these are all remote exploits,
which means they will allow us to exploit a Windows system
remotely.
And they all target the SMB service.
So again, now, at this point, you'll
pretty much need to sort through the exploit that you will be--
that actually meets the requirements
in terms of the version of Windows
that is running on a target.
So this has narrowed down our search.
So for example, if I was looking for remote Windows SMB exploits
for Windows XP, I could utilize the search filters
that I've just typed in.
And I can head over, and you can see
we have one right over here for XP--
that is SMB authentication remote overflow.
And that really isn't an exploit code or exploit
file that can be run.
That is a text file that probably
contains information regarding how
the exploit can be performed.
We then have a few others here.
So again, just using the example of Windows XP,
let's see if we can identify any XP exploits here.
No, we cannot.
So we weren't able to obtain any XP exploits there.
And, yeah, that's perfectly fine.
But what we could do is, if we say--
we can get rid of the SMB option.
And we can then say, for example, buffer and hit Enter.
And this is going to display all buffer overflows for Windows.
But again, that is really expanding our searches.
So what we could do, for example--
let's try and utilize another example in the case of Linux.
So let's say I'm looking for remote Linux exploits that
target the SSH service.
And I'm not specifying the actual service itself or this
the service name, which I could do by saying openSSH here
for example, and that'll bring it up.
But if I get rid of openSSH, I can hit Enter,
and you can see this is going to bring up all SSH exploits
for Linux that are remote.
So again, they're not just limited to openSSH.
There's libSSH.
We have DropBearSSH.
We have Debian openSSH as well as a few others.
So you can see how useful this is.
And of course, this is not just limited
to Windows and Linux platforms.
You can also do this for web applications.
So let's say we have identified a web server that's
running WordPress and I'm looking for remote WordPress
exploits.
I can say SearchSploit, and then specify remote web apps,
and I can specify WordPress.
And this will bring us all remote exploits.
However, because this is a web application,
remote file inclusion exploits will actually
be brought up here.
So we could additionally or also utilize other keywords
to essentially limit our results to what we're looking for.
So we could also be--
we could be only looking for remote code execution exploits,
and we would then essentially provide or specify
the code execution or remote code
execution keyword if that's what we were looking for.
So again, this is not just limited to WordPress.
We can try and look for exploits that affect Drupal.
There we are.
You can see that this will bring up all Drupal exploits--
remote exploits.
That's something that needs to be taken into consideration.
Again, this is not just limited to remote.
We can also specify local.
For example, if we were looking for privilege escalation
exploits for Windows--
so if I was looking for local exploits for Windows,
I can hit Enter.
And in this case, you can see that it's only
the information--
all the exploits being displayed here
have Windows specified right over here, so Windows Local.
And they really aren't pertinent to Windows
because they are essentially showing--
these are all privilege escalation exploits
for various services or programs.
So we can utilize grep to fine tune this by saying grep.
And we can then search for Microsoft
to only show Microsoft products or services.
So Microsoft, hit Enter.
And this will now show us all local privilege escalation
exploits for Windows.
And of course, you can then fine tune
based on the version of Windows that you're looking for.
So again, SearchSploit is quite robust in regards
to looking for what you are--
essentially, finding what you're looking for specifically.
So that is what you can do there in terms of utilizing
the various search filters.
As I've already covered, you can utilize grep
to fine tune your results.
Now, one thing that I wanted to highlight here
is the ability to list the online links
for the exploit code.
So let's say you wanted to learn more about the exploit
itself and access it through ExploitDB online.
How would you how would you actually
get the URL pertinent to that particular exploit?
Well, let's say I'm looking for the EternalBlue exploit.
So I can say SearchSploit remote and Windows SMB.
I can then grep and say I want to limit
the results to only display those that contain
the keyword EternalBlue.
And in addition to this-- or let's
actually hit Enter, and let me show you
what I'm talking about.
So when I hit Enter, you can see that this will bring up
all the exploits that contain the keywords that we
specified-- so EternalBlue, EternalBlue, EternalBlue.
But by default, it'll display the local path
to that exploit stored locally.
If we want to get the links to these exploits online,
we can use the W option right over there.
And you can see that instead of the local paths being
displayed, we get the ExploitDB links.
And we can access all of these exploits online.
So you can open it up to learn more about it for example--
to learn more about that specific exploit.
So there we are.
You Can see this will give you information regarding
the author that you typically would not be able to access
via SearchSploit.
And you can see it's edb verified.
So this is a great way of actually checking and seeing
whether a particular exploit has been verified.
And then, of course, you can either
download it from here, from the website itself,
or copy it with SearchSploit to your current working directory,
which I've already covered.
Now, you also have the ability of copying it manually.
So again, if we wanted to copy--
I'll just get rid of the W option.
If we wanted to copy this exploit here,
instead of using the SearchSploit M option
and then specifying the exploit ID
as we did previously, what we could do
is we could copy it manually.
So I'll say sudo copy user share ExploitDB exploits.
And then, I would go to the path that
is under Windows and remote and the name or the exploit ID is--
and in this case, we need to copy
the entire file-- so 42031.py.
And then I can copy it into my current working directory.
There we are.
I'm just going to provide my password there.
And you can see that I have that exploit copied successfully.
So there's multiple ways you can do this.
All right, so that is going to conclude
the practical demonstration side of this video.
This information might not seem pertinent or important right
now, but it certainly will be in the upcoming sections,
especially when we'll be going through the Windows and Linux
black box penetration test.
So that's going to be it for the practical demonstration.
All right, so that concludes the searching for exploit section
of this course.
In the next section, we'll move on to the fixing or modifying
exploit section where we'll be covering the process of copying
over exploits that we've identified
or that are pertinent to the service that we're exploiting.
We'll then take a look at how to modify them because in most
cases, what you'll find is that exploits cannot be run
immediately after been copied and require some or quite a lot
of modification in order to work correctly.
So we'll get started with that.
And we'll also take a look at how to compile exploits--
both Windows and Linux exploits.
So I'll see you in the next section.