14.1 Test review Flashcards
Cover topics from the first 6 days of Mod 14
Anatomy of an Exploit
3 parts
Delivery
Execution
Connection
Anatomy of a Masquerade
3 parts
Delivery
Execution
Connection
(Same as Anatomy of an Exploit)
Common Exploit techniques
2 Parts
Code-Based Exploit
Masquerade
Masquerade
use of credentials (usually stolen of “forged”), to geain access to a service ie SSH, Telnet, RDP
Code Based Exploit
Targets a specific vulnerability in an application. Usually ran from an exploit framework (Meteasploit), most common vulnerability is a buffer overflow
Buffer Overflow
Overwrites program data in the stack or heap memory to exploit code that allows an exploit of the machine or program
No Operation (NOP) Sled
assembly opcode x90 that tells the processor to execute nothing and to just move the instruction pointer forward one. Can be manipulated to create a buffer overflow
Types of Shell Code Payloads
2 types
SIngle payload
Staged Payload
Are code-based exploits big or small?
Small, the amount of memory a code based exploit can pass is only a few hundred bytes. This means that a small shell can be passed such as in a SINGLE payload, or instructions to set up a STAGED payload in increments to pass larger amounts of data
How does Meterpreter avoid forensic detection
By using in-memory DLL injection, which writes nothing to the disk, and using encryption for its network connection
What are the 2 stages of a Staged Payload?
Stager (s0); sets up tcp connection back to the attackers host and reads the much larger Stage payload into memory on the targets machine
Stage (s1); Fully functional remote shell loaded by the Stager
What are the 2 payload types that create a connection between target and attacker?
(ones –> and ones
Bind TCP; opens a port on the taget machine to listen for incoming connections, often blocked by firewalls
Reverse TCP: Creates a connection (callback) to the attacker, firewalls often allow this as they are more lenient on traffic that is outbound of the network
What are the 2 Metasploit interfaces?
2 commands
msfconsole; command line access to all metasploit options
msfpayload; generates shellcode payloads
Metasploit Commands
6 of them
search info use show options show payloads set
mspayload syntax
command part1 part2 part3
msfpayload
2 options for output_types in msfpayload
hugs and kisses
x; Creates an executable payload
o; Lists payload with configurable parameters
what is the Handler?
The handler is how metasploit connects to remote payloads and is the command line interface used to access the remote computer
what are the 2 ways to use the Handler?
Automatic; used in code-based exploits, connects to the shellcode payload the exploit started on the remote machine Manual; During masquerades, or when connected to a backdoor, a handler can be started by itself to connect to the target. This is often referred to as the multi/handler because the module is using the command use multi/handler
what command would allow you to manually connect to a Meterpreter payload?
use multi/handler
what are the 5 options that can be changed with most exploits?
RHOST RPORT Payload LHOST LPORT
Meterpreter Commands:
File system commands
(3 of them)
ls
pwd
cd
Meterpreter Commands:
Logged on Users and Accounts
(3 of them)
getuid: displays user Meterpreter is running as
getpid: Displays pid for running Meterpreter payload
pwd: displays working directory
Meterpreter Commands:
Running Processes
(1 command)
ps: lists running processes
Meterpreter Commands:
System and Hardware info:
(1 command)
sysinfo: displays target system info
Meterpreter Commands:
Network Information
(2 commands)
route; display/modify routing table info
arp: displays system arp cahce
Meterpreter Commands:
File Placement:
(1 command)
upload: uploads files onto target.
syntax: upload
