Command line reference

The program runs from a command line:

exploitmatic <solution.txt> <target> [flags]

The two required arguments are the solution file and the target. Flags are optional and can appear before or after the arguments.

The arguments

argument	what it is
solution.txt	the path to a solution file, the attack to replay
target	the target address, shaped by the solution’s protocols

The target shape depends on the protocol in the solution. A tcp or tls solution takes a host:port. An http or websocket solution takes a base URL. Host-scope solutions (process, file) ignore the target.

The flags

flag	default	what it does
-flag-path	flag.txt	where {flag_path} points
-param	empty	override the input parameter name
-oob-host	empty	override the out-of-band listener host; use a routable address when the target is in a container
-oob-port	0	override the out-of-band listener port (0 picks a free one)
-timeout	10s	per-request timeout

The result

The runtime prints one line per step and a result:

probe  PASS  contains "49"
rce    PASS  contains "REPL_RCE_MARKER"
read   PASS  flag
3/3 verified

Then it exits with one of three codes:

exit code	what it means
0	verified: every step’s test passed
1	error: bad arguments, invalid solution, or replay failure
2	not verified: at least one step failed its test

The result comes from the step tests. It is never stored anywhere, so it always comes from the run itself.

Examples

Heartbleed against a target:

exploitmatic solutions/openssl-heartbleed-mem-leak.txt example.com:8443

An HTTP solution against a target:

exploitmatic solutions/tpl-jinja2-ssti-rce.txt http://example.com/render \
    --param template --flag-path flag.txt

Host-scope steps:

exploitmatic examples/host-exec.txt example.com

Override the input parameter without editing the solution:

exploitmatic solutions/tpl-jinja2-ssti-rce.txt http://example.com/render \
    --param payload