CMU6XX

Ethical Hacking

Session 5: System Hacking & Exploitation

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Master the architecture of the Metasploit Framework.
  • Differentiate between Staged and Non-Staged payloads.
  • Compare Bind Shells vs Reverse Shells in heavily firewalled environments.
  • Execute Linux Privilege Escalation using SUID binaries and capabilities.
  • Analyze post-exploitation techniques, including hash dumping (Mimikatz) and lateral movement.

Seminar Structure (3 Hours)

Part 1: The Metasploit Framework (1.5 hrs)
  • Exploits vs Payloads
  • Reverse vs Bind Shells
  • Task 1: MSF Payload Delivery
Part 2: Privilege Escalation & Post-Exploitation (1.5 hrs)
  • Linux SUIDs & Windows Token Impersonation
  • Dumping Hashes (Mimikatz)
  • Task 2: Linux Privilege Escalation (GTFOBins)

Part 1: The Metasploit Framework

Duration: 1.5 Hours

Exploits vs Payloads

Metasploit decouples the vulnerability from the action you want to take.

  • Exploit: The code that takes advantage of the vulnerability to gain execution on the target (the "delivery mechanism").
  • Payload: The code that actually runs on the target after the exploit succeeds (the "warhead").
You can pair an EternalBlue exploit with a Reverse Shell payload, or a Bind Shell payload, or a payload that simply adds a new user.
Practical Resource: Metasploit Unleashed Course

Bind vs Reverse Shells

Bind Shell

The payload opens a port on the target machine (e.g., Port 4444) and listens. The attacker connects to the target.

Problem: Almost always blocked by the target's inbound firewall.

Reverse Shell

The payload connects back to the attacker's machine (which is listening).

Advantage: Bypasses inbound firewalls because the connection originates from inside the target network (outbound traffic is often unrestricted).

Staged vs Non-Staged Payloads

Memory corruption exploits (like buffer overflows) often have very limited space for shellcode (e.g., 200 bytes).

  • Non-Staged (Inline): The entire payload (e.g., windows/shell_reverse_tcp) is sent at once. Highly reliable, but often too large to fit in memory.
  • Staged: The exploit sends a tiny piece of code (the "Stager"). The Stager connects back to the attacker, allocates more memory, and downloads the rest of the payload (the "Stage", e.g., Meterpreter). Syntax: windows/meterpreter/reverse_tcp.

Introduction to Task 1

Catching a reverse shell requires careful coordination of LHOST (Local Host) and LPORT (Local Port) settings.

We will configure a Metasploit multi-handler to catch a staged callback from a compromised Windows machine.

Task 1: MSF Payload Delivery

Timing: 45 minutes

You have used msfvenom to generate a malicious executable (windows/meterpreter/reverse_tcp) pointing back to your Kali IP (10.0.0.10) on Port 4444.

  1. Write the exact msfconsole commands to start a listener (exploit/multi/handler) to catch this specific payload.
  2. The target clicks the executable, and you receive a Meterpreter session. Write the Meterpreter commands to:
    • Check what user you are running as.
    • Dump the system password hashes.

15 Minute Break

Please return promptly for Part 2.

Part 2: Privilege Escalation & Post-Exploitation

Duration: 1.5 Hours

Privilege Escalation

Initial exploitation usually grants access as a low-privileged user (e.g., www-data). The next goal is becoming root or SYSTEM.

  • Kernel Exploits: Exploiting a flaw in the OS kernel directly (e.g., Dirty COW). High risk of crashing the server.
  • Misconfigurations: The preferred method.
    • Windows: Unquoted Service Paths, Token Impersonation (PrintSpoofer).
    • Linux: SUID Binaries, excessive sudo permissions, Cron jobs running as root.

Post-Exploitation: Credential Harvesting

Once you have SYSTEM, you want to move laterally across the network.

  • SAM Database: Extracting NTLM password hashes from the Windows registry. Requires offline cracking (Hashcat/John).
  • Mimikatz: A legendary post-exploitation tool that interacts with the Windows LSASS process to extract passwords in cleartext directly from memory.
  • Pass-the-Hash (PtH): Using the dumped NTLM hash to authenticate to other Windows machines without ever cracking the password.

Linux SUID Binaries

SUID (Set Owner User ID up on execution) is a special file permission in Linux.

  • When a file with SUID is executed, it runs with the privileges of the file owner (usually root), regardless of who executes it.
  • Required for commands like passwd (so normal users can change their password).
  • The Vulnerability: If an admin accidentally sets the SUID bit on a binary that can execute system commands (like vim, find, or python), any user can use it to spawn a root shell.

Introduction to Task 2

GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.

We will exploit a misconfigured SUID binary to escalate from a low-privileged user to root.

Task 2: Linux Privilege Escalation

Timing: 50 minutes

You have a reverse shell as user www-data. You run find / -perm -u=s -type f 2>/dev/null and discover that /usr/bin/find has the SUID bit set.

  1. Access the GTFOBins website and search for the find binary.
  2. Identify the exact command syntax required to abuse the SUID permission on find to spawn an interactive root shell.
  3. Explain why this works (referencing the -exec flag).
Practical Resource: GTFOBins (Unix Privilege Escalation)

Summary & Next Steps

  • Gaining initial access is only step one. Privilege escalation and lateral movement are where the real damage is done.
  • Misconfigurations (SUID, bad GPOs) are far more common and reliable vectors for escalation than zero-day kernel exploits.
Next Week: Sniffing & MITM Attacks (Intercepting Data)