Exploitation
Last updated
Was this helpful?
Last updated
Was this helpful?
⚡ Prerequisites
Basic familiarity with Linux & Windows
Basic understanding of TCP & UDP protocols
Basic familiarity with Metasploit
📕 Learning Objectives
Identify services vulnerabilities
Search for and manipulate public exploit code
Utilize exploitation frameworks, bind & reverse shells
Perform exploitation in a black box pentest
Evade signature-based antivirus solutions
🔬 Training list - PentesterAcademy/INE Labs
subscription required
🔬 Home Labs
🗒️ Exploitation is a phase of a penetration test that focuses on establishing access, initial foothold, to a system or resource by bypassing security restrictions.
With a proper vulnerability analysis, the exploitation attack vector should focus on the success probability and the high value target assets with the highest impact on the scanned organization.
The use of automated exploitation tools (Metasploit, Powershell Empire, etc) shouldn't be prevalent
Exploitation methodology:
Identify Vulnerable Services
Prepare Exploit Code
Gaining Remote access
Bypass AV detection
Pivoting
Identify running and vulnerable services
🗒️ Banner grabbing is the info gathering manual or automatic process used to obtain software and services name and version. The host server displays a text with this information as a banner.
Tools and techniques:
nmap service version detection scan
Netcat connection
Authentication with a supported service
curl / wget to get headers details of an HTTP server
Some useful commands from the lab environment:
nmap
nc / netcat
SSH Authentication
🗒️ Nmap Engine Scripting (NSE) - an nmap feature that allows to write simple scripts to automate a wide variety of tasks, like:
network discovery
sophisticated version detection
vulnerability detection and exploitation
backdoor detection
Scripts are written using the Lua programming language.
Nmap script default directory is:
/usr/share/nmap/scripts
Some useful commands and nmap script scan from the lab environment:
Focus on the techniques and the flow to detect vulnerabilities.
Exploit code can be found online or inside locally-stored exploit database in pentest Linux distributions (searchsploit, MSF).
Verifiable online sources:
always check for the Verified column
use search filters
❗ Always pay attention at publicly available exploits. An exploit can be weaponized to attack the actual attacker system!
📌 Analyze the exploit code behavior to ensure that it works as intended.
🗒️ searchsploit - command line search tool for Exploit-Db that allows to have an offline copy of the Exploit-Db.
Useful for security assessments on networks without Internet access
Pre-packed with Kali Linux
exploitdb local directory is:
/usr/share/exploitdb
Exploit code developed in C, C++, C# has to be compiled into a portable executable or binary.
🗒️ Cross-compilation is the process of building on one platform a binary that will run on another platform.
Compiling C code is a necessary skill
e.g. of Windows and Linux exploit code compiling
Tools:
Download the VLC exploit or use searchsploit
Compile the C exploit
check for comments in the code regarding the compilation commands
Download the DirtyCow exploit or use searchsploit
Compile the C exploit
check for comments in the code regarding the compilation commands to compile it successfully
nc - a network utility used for a variety of tasks associated with TCP/UDP.
Client mode - used for connection to any TCP/UDP port or to a listener
Server Mode - used as a listener for connection from clients on a specific port
Functionalities:
open TCP connections, listen on TCP or UDP ports
Banner grabbing, Port scanning, Files transferring
Bind/Reverse shells
🔬 Some HFS Lab commands
Setup a listener:
Transfer nc.exe to the windows target
Setup a listener on the attacker machine
Transfer files with nc
🗒️ Bind Shell - a remote shell where the attacker connects to the listener running on the target system and execute commands on the target system.
Bind shells issues:
Must have access to the target system
Inbound traffic can be blocked by a firewall, it is very suspect
A netcat listener must be configured on the target system to execute:
cmd.exe - Windows
/bin/bash - Linux
🔬 Same lab as above (IPs might change)
Once uploaded the nc.exe on the target system, proceed with the bind shell
🗒️ Reverse Shell - a remote shell where the target connects to a listener running on the attacker's system (e.g. Metasploit Meterpreter).
Reverse shells advantages:
The connection can be initialized without netcat too
Outgoing traffic may not be blocked by firewalls
Reverse shells issues:
used exploit have to know the attacker's IP
the attacker's IP can be logged as malicious or present in the exploit file
Examples of Reverse Shell with different code (bash, Python, Powershell, PHP, etc)
e.g.
Focus on the Exploitation phase
Modular
MSF turns the exploit code into a module, using the Ruby programming language
Empire - PowerShell post-exploitation framework for Win, Linux and macOS
PowerShell-Empire is primarily designed for Windows targets
Starkiller - GUI frontend for PowerShell-Empire
🔬 Home Lab based on a Kali Linux attacker VM and Win7 target VM with IP
192.168.31.131
In another terminal tab
Open Starkiller
http://localhost:1337/index.html#/
Credentials: empireadmin:password123
Run the csharpserver
Create a http listener to receive the reverse connection from the target system
Generate a Stager with windows_csharp_exe type
Actions - Download the Sharpire.exe stager
Back on the Starkiller Agents page, check for the active agent
Back in the Empire terminal session
🗒️ Black Box penetration test - security assessment conducted without any internal system or network knowledge.
The pentester act like an external unprivileged hacker from outside the network
No information about the target system
Typical Black Box Methodology:
Host discovery ➡️ Port Scanning ➡️ Enumeration
Vulnerability detection
Exploitation ➡️ Manual/Automated
Post Exploitation - PrivEsc ➡️ Persistence ➡️ Dumping Hashes
e.g.
Scenario
Penetration Test to gain access and exploit a Win Server 2008 host.
Scope
Identify running and vulnerable services on the target
Exploit the vulnerabilities to obtain a foothold
Identify easily exploitable services
Pick the target as efficiently as possible
Time is a factor
Scenario
Penetration Test to gain access and exploit a Linux server host.
Scope
Identify running and vulnerable services on the target
Exploit the vulnerabilities to obtain a foothold and gain access to the system
Antivirus detection methods can be classified as follows:
Signature based detection
A signature is a static unique sequence of bytes of known malware, created using essential elements of an analyzed file. The AV comes with a signature database
Heuristic base detection
Statically examine files for suspicious specific characteristics, relying on rules to determine a malicious binary
Behavior based detection
Monitor malware for suspicious behavior
On-disk Evasion techniques
Obfuscation - The act of hiding anything crucial, useful, or vital. Code is reorganized through obfuscation to make it more difficult to decipher or reverse engineer.
Encoding - The process of transforming data into a new format using an encoding strategy. Data can be encoded to a new format and then decoded back to its original format since encoding is a reversible operation.
Packing - Generate executables with updated binary structures, lower in size and a new payload's signature.
Crypters - Encrypts payloads, then the encrypted code is decrypted in memory. The decryption key is typically kept in a stub. (ransomware)
In-memory Evasion techniques
Memory manipulation rather than writing files to disk
Payload is injected into a process, then executed in memory in a separate thread
Shellter - dynamic shellcode injection tool and dynamic PE (Portable Executable) infector ever created.
Uses a unique dynamic approach based on the execution flow of the target app
Takes advantage of the original structure of the PE file
Supports any 32-bit payload (generated either by metasploit or custom ones by the user)
Portable
Compatible with Windows x86/x64 (XP SP3 and above) & Wine/CrossOver for Linux/Mac
🔬 Home lab with Kali Linux and Win7 VMs
Execute an exe file on Linux
Inject the shellcode into/usr/share/windows-binaries/vncviewer.exe file after copying it to a folder
In the SHELLTER windows, choose A for automatic
PE Target: /home/kali/certs/ejpt/AVBypass/vncviewer.exe
Stealth Mode: Y = vncviewer will function as normal and the shellcode will be executed in the background
Payload: L - 1
LHOST: Attacker's IP - 192.168.31.128
LPORT: 1234
Now the /home/kali/certs/ejpt/AVBypass/vncviewer.exe file has been replaced by the Shellter generated malicious executable
Copy the vncviewer.exe file to the target machine
Run the vncviewer.exe file and chheck the msfconsole Meterpreter session
🔬 Home lab with Kali Linux and Win7 VMs
Kali Linux install PowerShell
Run pwsh
Create the reverse PowerShell script in a new file
PowerShell Reverse Shell code will be
Back in Invoke-Obfuscation
Obfuscated code is:
Run the obfuscated.ps1 file on the Win10 VM
Back on the Kali VM check the PowerShell reverse shell
🔬 Check the
🔬 Check the
🔬 Home Lab based on a Windows 7/2008 R2 target vulnerable to EternalBlue SMB RCE. Check the
🔬 Check the
📌 - useful for pre-compiled binaries
📌
📌
📌
📌
🔬 Check the
Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server. There is also a GUI available for remotely accessing the Empire server, .
🔬 The techniques will be covered in the dedicated . This is a lab containing a target.
🔬 The techniques will be covered in the dedicated . This is a lab containing a target.
🗒️ consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. (MITRE)
:
- a PowerShell v2.0+ compatible PowerShell command and script obfuscator.
