From service version to working exploit
The workflow connecting enumeration results to an actual exploit: MSF search, searchsploit, Nessus, WMAP, db_autopwn.
msfconsole·1 min read··INE Certification
Once enumeration hands you a service name and exact version, the next step is verifying whether it’s actually exploitable.
1. Get the exact service and version
nmap -sS -sV -O <target_ip>2. Search for a matching exploit
search type:exploit name:Microsoft IIS # inside msfconsole
search cve:2017 platform:windows # cve: field also filters by yearsearchsploit "Microsoft Windows SMB" # exploit-db, offline
searchsploit "Microsoft Windows SMB" | grep -e "Metasploit" # narrow to ones with a ready MSF module3. Check before exploiting
Most exploit modules have a companion auxiliary/checker module.
auxiliary/scanner/smb/smb_ms17_010 # checks if vulnerable
exploit/windows/smb/ms17_010_eternalblue # the actual exploitAutomation
load db_autopwn
db_autopwn -p -t
analyze
vulnsBroader scanning
When you want a full report rather than a targeted check:
| Tool | Scope | Notes |
|---|---|---|
| Nessus | CVE-tagged vulnerabilities across the whole host | db_import <nessus_output_file> pulls results into MSF once scanned |
| WMAP | Web applications, fully inside msfconsole | load wmap, then wmap_sites / wmap_targets / wmap_run |
Related
- searchsploit: offline exploit-db search
- db_autopwn: automatic exploit matching in Metasploit
- Metasploit Framework: console and database basics
- EternalBlue: the checker/exploit pair used above
- Nmap: version and OS detection