Field Notes: From Service Version to a Working Exploit
CWE, CVE, NVD, Exploit-DB — four acronyms that sound interchangeable and aren't. Here's how I actually move through them.
Once you've enumerated a target and know what OS and service versions are running, the next step is vulnerability research: finding out whether what's installed is actually exploitable.
Say a scan turns up a host running SMB version 3.1.1. A quick check shows that's not the latest release — worth digging into.
A quick aside on the Common Weakness Enumeration (CWE) database first: I don't think it carries much weight for a straightforward penetration test. CWE categorizes types of vulnerabilities — it's a taxonomy, not a lookup tool for "is this specific version exploitable." Where it does matter is for deeper work: secure software design, bug bounty hunting, or zero-day research, where understanding a vulnerability class actually helps.
For a practical pen-test lookup, I go to two places:
- NIST's National Vulnerability Database (NVD) — searching for "SMB" returns a list of CVEs with affected version numbers laid out clearly.
- Exploit-DB — my preferred stop, because it pairs a CVE with an actual proof-of-concept or working exploit, not just a description.
Searching Exploit-DB for SMB turns up CVE-2020-0796, nicknamed "SMBGhost" — a remote code execution flaw in the SMBv3.1.1 compression feature, affecting Windows 10 and Windows Server versions 1903 and 1909. There's also a Metasploit module for it.
This is a contrived example — in a real engagement the next step would be running the module against the target — but it shows the actual path: enumerate, identify the exact version, cross-reference NVD for the CVE, then check Exploit-DB for something runnable against it.
I prefer Exploit-DB in practice because it's tied to searchsploit, the CLI tool bundled with Kali and Parrot, so the same database is queryable straight from a terminal without opening a browser. Metasploit's own module search covers most common services and versions too, and between the two, most well-known vulnerabilities in common services are a search away.
The bigger point here isn't the specific CVE. It's that this entire chain — version detection to working exploit — can take minutes once you know where to look. That's exactly why patch cadence matters: going a few weeks or months without updates is enough time for a new CVE and a public exploit to both land.
The Takeaway
Vulnerability research isn't really research, most of the time. It's a lookup. The hard part was the enumeration that told you exactly what version you're dealing with — once you have that, the exploit is usually one search away.
Sources
- SentinelOne. CVE-2020-0796: Windows SMBv3 RCE Vulnerability.
- Microsoft Security Response Center. CVE-2020-0796 - Windows SMBv3 Client/Server Remote Code Execution Vulnerability.