Skip to content

exploit.md

Latest commit

 

History

History
227 lines (169 loc) · 6.43 KB

exploit.md

File metadata and controls

227 lines (169 loc) · 6.43 KB
Raw

CVE-to-Exploit Pipeline

ShakkaShell v2 features an automated CVE-to-exploit pipeline with real API integrations that queries live vulnerability databases and synthesizes exploits using LLMs.

Overview

The pipeline queries live APIs from these sources:

Source API Description
NVD services.nvd.nist.gov/rest/json/cves/2.0 Real-time CVE details, CVSS 3.1 scores
Exploit-DB searchsploit CLI + web fallback Verified exploits with code download
GitHub api.github.com/search/repositories PoC repositories ranked by stars
LLM Synthesis Configured provider AI-generated exploit code

Verified Integration (Log4Shell Example)

CVE-2021-44228 (Log4Shell):
├── NVD: CVSS 10.0 (critical), 103 references
├── GitHub: 10+ PoC repos (fullhunt/log4j-scan: 3438★)
└── Exploit-DB: EDB-50592 (verified, Python PoC)

CLI Usage

# Basic CVE lookup
shakka exploit CVE-2024-1234

# Filter by source
shakka exploit CVE-2021-44228 --source exploit_db
shakka exploit CVE-2023-44487 --source github
shakka exploit CVE-2020-1472 --source nvd

# Show exploit code with syntax highlighting
shakka exploit CVE-2024-1234 --code

# Limit results
shakka exploit CVE-2024-1234 --limit 3

# Disable LLM synthesis (only search existing exploits)
shakka exploit CVE-2024-1234 --no-llm

Example Output

╔══════════════════════════════════════════════════╗
║  CVE-2021-44228 - Apache Log4j RCE               ║
╠══════════════════════════════════════════════════╣
║  CVSS: 10.0 (Critical)                           ║
║  Affected: Apache Log4j 2.0-beta9 to 2.14.1      ║
║  Type: Remote Code Execution                     ║
╠══════════════════════════════════════════════════╣
║  Exploits Found: 5                               ║
║  [1] exploit-db/50592 (verified) ✓               ║
║  [2] github/kozmer/log4j-shell-poc               ║
║  [3] github/tangxiaofeng7/CVE-2021-44228        ║
║  [4] nuclei/cves/2021/CVE-2021-44228.yaml       ║
║  [5] LLM synthesis (confidence: 0.85)            ║
╠══════════════════════════════════════════════════╣
║  [D]ownload  [T]est  [G]enerate custom  [S]can   ║
╚══════════════════════════════════════════════════╝

Python API

from shakka.exploit import ExploitPipeline, ExploitSource

# Create pipeline (uses real APIs by default)
pipeline = ExploitPipeline()

# Search for exploits - queries NVD, Exploit-DB, GitHub in parallel
results = await pipeline.search("CVE-2024-1234")

for result in results:
    print(f"Source: {result.source}")
    print(f"URL: {result.url}")
    print(f"Confidence: {result.confidence}")
    print(f"Verified: {result.verified}")
    if result.code:
        print(f"Code:\n{result.code}")

NVD API (CVE Details)

Real-time queries to NVD API 2.0:

from shakka.exploit import CVELookup

# Query live NVD API
lookup = CVELookup()
cve = await lookup.get("CVE-2021-44228")

print(f"{cve.cve_id}: {cve.description}")
print(f"CVSS: {cve.cvss.score} ({cve.cvss.severity.value})")
print(f"References: {len(cve.references)}")
# Output: CVE-2021-44228: CVSS 10.0 (critical), 103 references

GitHub PoC Search

GitHub API search with star-based ranking:

from shakka.exploit import GitHubSearch

search = GitHubSearch()

# Search by CVE
repos = await search.search_by_cve("CVE-2021-44228", min_stars=100)
for repo in repos:
    print(f"{repo.full_name}: {repo.stars}★")
# Output: fullhunt/log4j-scan: 3438★, kozmer/log4j-shell-poc: 1849★

# Download file content
code = await search.get_file_content(repos[0], "exploit.py")

Exploit-DB Search

Dual approach: searchsploit CLI (if installed) + web API fallback:

from shakka.exploit import ExploitDBSearch

search = ExploitDBSearch()

# Search by keyword (uses searchsploit if available)
exploits = await search.search_by_keyword("log4j")

# Search by CVE
results = await search.search_by_cve("CVE-2021-44228")

# Download exploit code
code = await search.get_exploit_code("50592")

LLM Synthesis

When no existing exploit is found, the pipeline can synthesize one:

from shakka.exploit import ExploitPipeline

pipeline = ExploitPipeline(enable_llm_synthesis=True)

# This will use LLM if no existing exploit found
results = await pipeline.search("CVE-2024-9999", synthesize=True)

for result in results:
    if result.source == ExploitSource.LLM:
        print("LLM-generated exploit:")
        print(result.code)
        print(f"Confidence: {result.confidence}")

Safety Checks

The pipeline includes safety checks for dangerous patterns:

from shakka.exploit import ExploitPipeline

pipeline = ExploitPipeline(safety_checks=True)

# Exploit code is scanned for dangerous patterns
results = await pipeline.search("CVE-2024-1234")

for result in results:
    if result.safety_warnings:
        print("⚠️ Safety warnings:")
        for warning in result.safety_warnings:
            print(f"  - {warning}")

Data Models

from shakka.exploit import ExploitResult, ExploitSource, CVSSScore

# ExploitResult
result = ExploitResult(
    cve_id="CVE-2024-1234",
    source=ExploitSource.EXPLOIT_DB,
    url="https://exploit-db.com/exploits/50383",
    title="Apache Path Traversal RCE",
    description="Remote code execution via path traversal",
    code="#!/usr/bin/python3\n...",
    confidence=0.95,
    verified=True,
    cvss=CVSSScore(
        score=9.8,
        vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    )
)

Configuration

# config.yaml
exploit:
  sources:
    - nvd
    - exploit_db
    - github
    - llm
  enable_llm_synthesis: true
  safety_checks: true
  max_results: 10
  
  # NVD API (rate limited without key)
  nvd_api_key: ${NVD_API_KEY}
  
  # GitHub token for higher rate limits
  github_token: ${GITHUB_TOKEN}

See Also