pocsuite3

Overview

pocsuite3 is a Python-based framework for writing, running, and managing proof-of-concept (PoC) and exploit scripts against remote vulnerabilities, in the spirit of Metasploit modules but lighter-weight and Python-native. It’s built by Knownsec 404 Team and integrates directly with their Seebug vulnerability database and ZoomEye search engine, making it convenient for both writing a quick PoC for a specific CVE and mass-verifying it across internet-wide targets.

Common Usage

Run a specific PoC script against a single target

pocsuite -u http://<target> -r pocs/cve_2021_xxxxx.py --verify

Attempt exploitation (not just verification) against a target

pocsuite -u http://<target> -r pocs/cve_2021_xxxxx.py --attack

Run against a list of targets from a file

pocsuite -f targets.txt -r pocs/cve_2021_xxxxx.py --verify

Pull targets directly from ZoomEye search results

pocsuite --zoomeye-search "app:nginx" -r pocs/cve_2021_xxxxx.py --verify

Interactive shell mode (Metasploit-like console)

pocsuite

Writing a Minimal PoC

from pocsuite3.api import Output, POCBase, register_poc, requests

class DemoPOC(POCBase):
    vulID = 'CVE-2021-XXXXX'
    version = '1.0'
    author = ['researcher']
    vulDate = '2021-01-01'
    createDate = '2021-01-01'
    updateDate = '2021-01-01'
    references = ['https://example.com/advisory']
    name = 'Example vulnerable endpoint RCE'
    appPowerLink = 'https://example.com'
    appName = 'ExampleApp'
    appVersion = '< 2.0'
    vulType = 'RCE'
    desc = 'Unauthenticated RCE via /debug endpoint'

    def _verify(self):
        result = {}
        resp = requests.get(f'{self.url}/debug?cmd=id')
        if 'uid=' in resp.text:
            result['VerifyInfo'] = {'URL': self.url}
        return self.parse_output(result)

    def _attack(self):
        return self._verify()

    def parse_output(self, result):
        output = Output(self)
        output.success(result) if result else output.fail('target not vulnerable')
        return output

register_poc(DemoPOC)

Options

-u URL              single target URL
-f FILE               file of target URLs, one per line
-r PATH               PoC script (or directory of PoCs) to run
--verify              only verify vulnerability, no exploitation
--attack              attempt full exploitation
--zoomeye-search Q    pull targets from a ZoomEye search query
--threads N            concurrency for mass scanning

Tips

• --verify should be preferred by default on client engagements — --attack actively exploits and may cause impact.
• pocsuite3’s PoC format is compatible with many public Seebug PoCs — check their PoC repo before writing one from scratch for a known CVE.

usage: pocsuite [options]

Target:
  -u URL                target URL
  -f FILE                file with target URLs
  --zoomeye-search QUERY  search ZoomEye and use results as targets

PoC:
  -r POC                  poc script or directory to load

Mode:
  --verify                verify mode only
  --attack                 attack (exploit) mode
  --shell                  return an interactive shell on success

Misc:
  --threads N              number of concurrent threads
  -v, --verbose            verbose output
  --debug                   debug mode

Vue d’ensemble

pocsuite3 est un framework Python permettant d’écrire, d’exécuter et de gérer des scripts de preuve de concept (PoC) et d’exploitation contre des vulnérabilités distantes, dans l’esprit des modules Metasploit mais en plus léger et nativement Python. Il est développé par la Knownsec 404 Team et s’intègre directement à leur base de données de vulnérabilités Seebug ainsi qu’au moteur de recherche ZoomEye, ce qui le rend pratique aussi bien pour écrire rapidement un PoC pour une CVE spécifique que pour le vérifier massivement sur des cibles à l’échelle d’Internet.

Utilisation courante

# Lancer un script PoC spécifique contre une seule cible
pocsuite -u http://<target> -r pocs/cve_2021_xxxxx.py --verify

# Tenter l'exploitation (pas seulement la vérification) contre une cible
pocsuite -u http://<target> -r pocs/cve_2021_xxxxx.py --attack

# Lancer contre une liste de cibles depuis un fichier
pocsuite -f targets.txt -r pocs/cve_2021_xxxxx.py --verify

# Récupérer directement les cibles depuis les résultats de recherche ZoomEye
pocsuite --zoomeye-search "app:nginx" -r pocs/cve_2021_xxxxx.py --verify

# Mode shell interactif (console façon Metasploit)
pocsuite

Écrire un PoC minimal

from pocsuite3.api import Output, POCBase, register_poc, requests

class DemoPOC(POCBase):
    vulID = 'CVE-2021-XXXXX'
    version = '1.0'
    author = ['researcher']
    vulDate = '2021-01-01'
    createDate = '2021-01-01'
    updateDate = '2021-01-01'
    references = ['https://example.com/advisory']
    name = 'Example vulnerable endpoint RCE'
    appPowerLink = 'https://example.com'
    appName = 'ExampleApp'
    appVersion = '< 2.0'
    vulType = 'RCE'
    desc = 'Unauthenticated RCE via /debug endpoint'

    def _verify(self):
        result = {}
        resp = requests.get(f'{self.url}/debug?cmd=id')
        if 'uid=' in resp.text:
            result['VerifyInfo'] = {'URL': self.url}
        return self.parse_output(result)

    def _attack(self):
        return self._verify()

    def parse_output(self, result):
        output = Output(self)
        output.success(result) if result else output.fail('target not vulnerable')
        return output

register_poc(DemoPOC)

Options

-u URL              single target URL
-f FILE               file of target URLs, one per line
-r PATH               PoC script (or directory of PoCs) to run
--verify              only verify vulnerability, no exploitation
--attack              attempt full exploitation
--zoomeye-search Q    pull targets from a ZoomEye search query
--threads N            concurrency for mass scanning

Conseils

• --verify doit être privilégié par défaut lors des missions clients : --attack exploite activement et peut avoir un impact.
• Le format de PoC de pocsuite3 est compatible avec de nombreux PoC publics de Seebug : consultez leur dépôt de PoC avant d’en écrire un de zéro pour une CVE connue.

usage: pocsuite [options]

Target:
  -u URL                target URL
  -f FILE                file with target URLs
  --zoomeye-search QUERY  search ZoomEye and use results as targets

PoC:
  -r POC                  poc script or directory to load

Mode:
  --verify                verify mode only
  --attack                 attack (exploit) mode
  --shell                  return an interactive shell on success

Misc:
  --threads N              number of concurrent threads
  -v, --verbose            verbose output
  --debug                   debug mode