exploitation-phase

Files (1)

• SKILL.md

SKILL.md (first lines)

# Exploitation — Prove Impact, Don't Break Things

Golden rule: the goal is a DEMONSTRATED impact for the report, not maximum damage. Prefer the least destructive proof (file read > RCE > data exfil).

## Web → load the matching `web-*` skill
SQLi (`web-sqli`), SSTI (`web-ssti`), SSRF (`web-ssrf`), LFI (`web-lfi-traversal`), upload RCE (`web-upload-rce`), XXE (`web-xxe`), auth bypass/IDOR (`web-auth-bypass-idor`), deserialization (`web-deserialization`). Router + payload index: `playbook-webapp`.
- `sqlmap --batch --level 3 --risk 2` only after a manual injection point is confirmed.
- Public PoC for a known CVE: fetch, READ IT, adapt to the exact version — never blind-run exploit binaries.

## Network
- **Capture**: `tcpdump -i eth0 -w cap.pcap 'host X'` / Wireshark — creds in cleartext protocols (FTP, HTTP basic, SNMP) are findings on their own.
- **MITM/relay**: ARP spoofing only on flat L2 segments with authorization; NTLM relay requires SMB signing disabled (checked in enumeration).
- Responder + ntlmrelayx are the standard authorized chain: LLMNR/NBT-NS poison → relay to SMB/ADCS/LDAP.
- Impacket suite covers the rest: `GetNPUsers.py` (AS-REP), `GetUserSPNs.py` (kerberoast), `secretsdump.py`, `psexec.py`/`wmiexec.py` (lateral).

## Credential attacks — lockout-aware ALWAYS
```
# Spray: ONE password across MANY users, never the reverse
nxc smb DC -u users.txt -p 'Summer2024!' --continue-on-success
hydra -L users.txt -p 'CommonPass1!' target https-post-form '/login:user=^PASS^:F=invalid'
```
- Respect lockout policy (enumerate it via `netexec ... --pass-pol` first). A locked-out user base = failed test.
- Cracking offline: `hashcat -m 1000` (NTLM), `-m 18200` (AS-REP), `-m 13100` (TGS), `-m 22000` (WPA). John as fallback. Rockyou + rules; custom wordlist from client context (org name, products, local slang).

## Wireless
- Monitor-mode capture → `aircrack-ng -w rockyou cap.cap` (WPA2 handshake) or PMKID (`hcxdumptool`).
- Evil twin / deauth = disruptive; ONLY with written authorization, never on client production SSIDs during business hours.

## Exploitation hygiene
- Verify scope (`scope_check`) before launching any exploit — payload callbacks to out-of-scope infra are a RoE breach.
- One shell per host is enough; unstable public PoCs → prefer manual exploitation for reliability.
- Log the exact command + timestamp as evidence at success time.
- If a chain caused unexpected impact (crash, data corruption): STOP, note it, disclose in report. Never hide it.

From s0ld13rr/pentestcode, MIT.

More from s0ld13rr/pentestcode