What are the steps to use an exploit on an OS vulnerability?

I tried the popular ms08-067 on an XP machine, following a guide found on the internet, discovering Metasploit etc., but I can't figure out what to do with another OS in a different situation.

How does one find remote/local vulnerabilities, and how to know which have public exploits?


I'll give an example to be more specific. I'm on a network and scanning all the hosts with nmap. Now that I have the list of all the services/ports opened and running on each host, how can I look for exploits?

I think I have to take these steps:

  1. Which OS and version is it?
  2. Which programs/services are running/installed?
  3. Search for "$OS + $service/software_on_the_machine + exploit"
  • How to know which have a public exploit -> google / exploit-db – Xatenev Jun 19 '14 at 7:47
  • How to find remote/local vulns -> Be creative – Xatenev Jun 19 '14 at 7:50
  • This question is much too broad - the answer will depend on every vuln+exploit. Xatanev's guidance is correct, if a bit terse :-) – Rory Alsop Jun 19 '14 at 9:33

Finding and exploiting an OS vulnerability varies depending upon the kind of process/service you are targeting. For example the vulnerability Ms-08-067 exists in NetAPI32.dll where-in a malformed packet is not properly parsed by the Netapi thus leading to memory corruption. Hence, its a vulnerability in a service that is used by the OS.

The vulnerability can be either remote or local depending upon how it can be exploited. Obviously a remotely exploitable vulnerability is more dangerous as the attacker can exploit it just by knowing your IP. A client side vulnerability requires intervention of the target user in order to trigger the vulnerability for example, opening a PDF or doc etc.

In order to exploit any OS process/service it is important to understand certain factors:

How that process is handled inside the memory. What other services are dependent on that process. Remote or client side vulnerability. Vulnerabilities are triggered at abnormal conditions, so are we able to handle the abnormal condition properly so as to exploit it.

Above all it is important to understand assembly instructions to debug the memory and reverse the process and understand its flaws.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.