🏠 Home BlogGitHub📚 Buy Me a Book
Edit

Exploitation

⚡ Prerequisites

  • Basic familiarity with Linux & Windows

  • Basic understanding of TCP & UDP protocols

  • Basic familiarity with Metasploit

📕 Learning Objectives

  • Identify services vulnerabilities

  • Search for and manipulate public exploit code

  • Utilize exploitation frameworks, bind & reverse shells

  • Perform exploitation in a black box pentest

  • Evade signature-based antivirus solutions

🔬 Training list - PentesterAcademy/INE Labs

subscription required

🔬 Home Labs

Exploitation Introduction

🗒️ Exploitation is a phase of a penetration test that focuses on establishing access, initial foothold, to a system or resource by bypassing security restrictions.

With a proper vulnerability analysis, the exploitation attack vector should focus on the success probability and the high value target assets with the highest impact on the scanned organization.

  • The use of automated exploitation tools (Metasploit, Powershell Empire, etc) shouldn't be prevalent

  • Exploitation methodology:

    • Identify Vulnerable Services

    • Prepare Exploit Code

    • Gaining Remote access

    • Bypass AV detection

    • Pivoting

Vulnerability Scanning

  • Identify running and vulnerable services

🗒️ Banner grabbing is the info gathering manual or automatic process used to obtain software and services name and version. The host server displays a text with this information as a banner.

Tools and techniques:

  • nmap service version detection scan

  • Netcat connection

  • Authentication with a supported service

  • curl / wget to get headers details of an HTTP server

🔬 Check the SSH Enumeration Lab here

Some useful commands from the lab environment:

  • nmap

  • nc / netcat

  • SSH Authentication

Nmap Scripts

🗒️ Nmap Engine Scripting (NSE) - an nmap feature that allows to write simple scripts to automate a wide variety of tasks, like:

  • network discovery

  • sophisticated version detection

  • vulnerability detection and exploitation

  • backdoor detection

Scripts are written using the Lua programming language.

Nmap script default directory is:

  • /usr/share/nmap/scripts

🔬 Check the Bash - ShellShock Lab here

Some useful commands and nmap script scan from the lab environment:

Metasploit

Focus on the techniques and the flow to detect vulnerabilities.

🔬 Home Lab based on a Windows 7/2008 R2 target vulnerable to EternalBlue SMB RCE. Check the Lab 2 here

Searching for Exploits

Exploit code can be found online or inside locally-stored exploit database in pentest Linux distributions (searchsploit, MSF).

Verifiable online sources:

❗ Always pay attention at publicly available exploits. An exploit can be weaponized to attack the actual attacker system!

📌 Analyze the exploit code behavior to ensure that it works as intended.

Searchsploit

🗒️ searchsploit - command line search tool for Exploit-Db that allows to have an offline copy of the Exploit-Db.

  • Useful for security assessments on networks without Internet access

  • Pre-packed with Kali Linux

  • exploitdb local directory is:

    • /usr/share/exploitdb

Fixing Exploits

🔬 Check the Fixing Exploits Lab here

Cross-Compiling Exploits

Exploit code developed in C, C++, C# has to be compiled into a portable executable or binary.

🗒️ Cross-compilation is the process of building on one platform a binary that will run on another platform.

  • Compiling C code is a necessary skill

📌 ExploitDB bin-sploits - useful for pre-compiled binaries

e.g. of Windows and Linux exploit code compiling

Tools:

Windows

  • Download the VLC exploit or use searchsploit

  • Compile the C exploit

    • check for comments in the code regarding the compilation commands

gcc Cross Compilation

Linux

  • Download the DirtyCow exploit or use searchsploit

  • Compile the C exploit

    • check for comments in the code regarding the compilation commands to compile it successfully

gcc -pthread 40839.c -o dirty -lcrypt

Bind & Reverse Shells

Netcat

nc - a network utility used for a variety of tasks associated with TCP/UDP.

  • Client mode - used for connection to any TCP/UDP port or to a listener

  • Server Mode - used as a listener for connection from clients on a specific port

Functionalities:

  • open TCP connections, listen on TCP or UDP ports

  • Banner grabbing, Port scanning, Files transferring

  • Bind/Reverse shells

  • 📌 Hacking with Netcat

🔬 Some HFS Lab commands

Setup a listener:

  • Transfer nc.exe to the windows target

  • Setup a listener on the attacker machine

  • Transfer files with nc

Bind Shells

📌 Bind and Reverse shells

Bind Shell - geeksforgeeks.org

🗒️ Bind Shell - a remote shell where the attacker connects to the listener running on the target system and execute commands on the target system.

  • Bind shells issues:

    • Must have access to the target system

    • Inbound traffic can be blocked by a firewall, it is very suspect

  • A netcat listener must be configured on the target system to execute:

  • cmd.exe - Windows

  • /bin/bash - Linux

🔬 Same lab as above (IPs might change)

  • Once uploaded the nc.exe on the target system, proceed with the bind shell

Bind Shell - Windows
Bind Shell - Linux

Reverse Shells

Reverse Shell - geeksforgeeks.org

🗒️ Reverse Shell - a remote shell where the target connects to a listener running on the attacker's system (e.g. Metasploit Meterpreter).

  • Reverse shells advantages:

    • The connection can be initialized without netcat too

    • Outgoing traffic may not be blocked by firewalls

  • Reverse shells issues:

    • used exploit have to know the attacker's IP

    • the attacker's IP can be logged as malicious or present in the exploit file

Reverse Shell - Win
Reverse Shell - Linux

Reverse Shell without Netcat

📌 PayloadsAllTheThings - Reverse Shell Cheatsheet

  • Examples of Reverse Shell with different code (bash, Python, Powershell, PHP, etc)

📌 Reverse Shell Generator

e.g.

Exploitation Frameworks

The Metasploit Framework

  • Focus on the Exploitation phase

  • Modular

  • MSF turns the exploit code into a module, using the Ruby programming language

🔬 Check the Workflow Platform Lab here

PowerShell-Empire

Empire - PowerShell post-exploitation framework for Win, Linux and macOS

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server. There is also a GUI available for remotely accessing the Empire server, Starkiller.

  • PowerShell-Empire is primarily designed for Windows targets

  • Starkiller - GUI frontend for PowerShell-Empire

  • Kali Linux install

🔬 Home Lab based on a Kali Linux attacker VM and Win7 target VM with IP 192.168.31.131

powershell-empire server

  • In another terminal tab

powershell-empire client

  • Open Starkiller

    • http://localhost:1337/index.html#/

    • Credentials: empireadmin:password123

Starkiller
Plugins

  • Run the csharpserver

Modules

  • Create a http listener to receive the reverse connection from the target system

Listener

  • Generate a Stager with windows_csharp_exe type

Stager

  • Actions - Download the Sharpire.exe stager

  • Back on the Starkiller Agents page, check for the active agent

Agents
File Browser

  • Back in the Empire terminal session

Windows Black Box Exploitation

🗒️ Black Box penetration test - security assessment conducted without any internal system or network knowledge.

  • The pentester act like an external unprivileged hacker from outside the network

  • No information about the target system

Typical Black Box Methodology:

  • Host discovery ➡️ Port Scanning ➡️ Enumeration

  • Vulnerability detection

  • Exploitation ➡️ Manual/Automated

  • Post Exploitation - PrivEsc ➡️ Persistence ➡️ Dumping Hashes

e.g.

Scenario

  • Penetration Test to gain access and exploit a Win Server 2008 host.

Scope

  • Identify running and vulnerable services on the target

  • Exploit the vulnerabilities to obtain a foothold

🔬 The techniques will be covered in the dedicated Win Black Box Pentest Lab here. This is a lab containing a Metasploitable3 target.

  • Identify easily exploitable services

  • Pick the target as efficiently as possible

  • Time is a factor

Linux Black Box Exploitation

Scenario

  • Penetration Test to gain access and exploit a Linux server host.

Scope

  • Identify running and vulnerable services on the target

  • Exploit the vulnerabilities to obtain a foothold and gain access to the system

🔬 The techniques will be covered in the dedicated Linux Black Box Pentest Lab here. This is a lab containing a Metasploitable2 target.

AV Evasion & Obfuscation

🗒️ Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. (MITRE)

  • Antivirus detection methods can be classified as follows:

Method
Description

Signature based detection

A signature is a static unique sequence of bytes of known malware, created using essential elements of an analyzed file. The AV comes with a signature database

Heuristic base detection

Statically examine files for suspicious specific characteristics, relying on rules to determine a malicious binary

Behavior based detection

Monitor malware for suspicious behavior

  • On-disk Evasion techniques

    • Obfuscation - The act of hiding anything crucial, useful, or vital. Code is reorganized through obfuscation to make it more difficult to decipher or reverse engineer.

    • Encoding - The process of transforming data into a new format using an encoding strategy. Data can be encoded to a new format and then decoded back to its original format since encoding is a reversible operation.

    • Packing - Generate executables with updated binary structures, lower in size and a new payload's signature.

    • Crypters - Encrypts payloads, then the encrypted code is decrypted in memory. The decryption key is typically kept in a stub. (ransomware)

  • In-memory Evasion techniques

    • Memory manipulation rather than writing files to disk

    • Payload is injected into a process, then executed in memory in a separate thread

Shellter

Shellter - dynamic shellcode injection tool and dynamic PE (Portable Executable) infector ever created.

  • Uses a unique dynamic approach based on the execution flow of the target app

  • Takes advantage of the original structure of the PE file

  • Supports any 32-bit payload (generated either by metasploit or custom ones by the user)

  • Portable

  • Compatible with Windows x86/x64 (XP SP3 and above) & Wine/CrossOver for Linux/Mac

🔬 Home lab with Kali Linux and Win7 VMs

Shellter Kali Linux Installation:

  • Execute an exe file on Linux

Shellter

  • Inject the shellcode into/usr/share/windows-binaries/vncviewer.exe file after copying it to a folder

  • In the SHELLTER windows, choose A for automatic

  • PE Target: /home/kali/certs/ejpt/AVBypass/vncviewer.exe

  • Stealth Mode: Y = vncviewer will function as normal and the shellcode will be executed in the background

  • Payload: L - 1

  • LHOST: Attacker's IP - 192.168.31.128

  • LPORT: 1234

  • Now the /home/kali/certs/ejpt/AVBypass/vncviewer.exe file has been replaced by the Shellter generated malicious executable

  • Copy the vncviewer.exe file to the target machine

vncviewer.exe file copied

  • Run the vncviewer.exe file and chheck the msfconsole Meterpreter session

PowerShell Code Obfuscation

Invoke-Obfuscation - a PowerShell v2.0+ compatible PowerShell command and script obfuscator.

🔬 Home lab with Kali Linux and Win7 VMs

  • Kali Linux install PowerShell

  • Run pwsh

Invoke-Obfuscation

  • Create the reverse PowerShell script in a new file

    • PowerShell Reverse Shell code will be

  • Back in Invoke-Obfuscation

  • Obfuscated code is:

  • Run the obfuscated.ps1 file on the Win10 VM

  • Back on the Kali VM check the PowerShell reverse shell

PowerShell reverse shell
Previous🔬Linux Post Exploitation - MSFNext🔬Fixing Exploits - HFS

Last updated

Was this helpful?