SearchSploit
The Exploit Database provides a downloadable archived copy
of all the hosted exploit code.
This archive is included by default in Kali in the exploitdb package.
We recommended updating the package
before any assessment to ensure the latest exploits are installed.
This command updates the local copy of the Exploit Database.
The exploitdb directory is split into two major sections,
exploits and shellcodes.
The exploitdb directory contains CSV files
for each of the exploits and shellcodes directories.
Each CSV file contains the file information of all files
within their respective subdirectories.
These CSV files contain similar information to the Exploit DB website,
such as the EDB-ID, title, author, platform, and other information.
When we redirect to the exploits directory,
we’ll find many sub-directories containing all of the exploits.
These sub-directories are separated based on operating system,
architecture, scripting language, etc.
For example, the linux subdirectory contains all Linux-related exploits.
Manually searching the Exploit Database is by no means ideal,
especially given the large quantity of exploits in the archive.
This is where the searchsploit utility comes in handy.
We can run searchsploit from the command line
without any parameters to display its usage.
As the built-in examples reveal,
searchsploit allows us to search through the entire archive and display results
based on various search options provided as arguments.
The options allow us to narrow our search, change the output format,
update the exploitdb package, and more.
Finally, the Notes section of the help menu reveals some useful search tips.
For example, with this syntax we can search for all available remote exploits,
that target the SMB service on the Windows operating system.
The exploits that contain the search parameters are listed in the output.
For demonstration, let’s imagine we enumerated two SMB servers
that are vulnerable to SMBGhost and EternalBlue.
We can copy an exploit into our current working directory using the -m option
if we need to modify it.
An advantage of copying the exploit into the current working directory
is that it will be easier to organize the exploits used in an engagement
and correlate them to systems being tested.
Let’s copy the two exploits with this option.
We can do this with either the path of the exploit
which can be found it its path name.
Or the EDB-ID of the exploit.
The exploits we wanted are now copied into our current working directory.