Pentesting 2018

For the past few years, we have been using tools such as the Metasploit Framework, routersploit, LinuxEnum.sh, nmap, and so on for post-exploitation and scanning. With the growing popularity of new tools, it would be good to learn about some new tools that can be used for post-exploitation. Out of the many available tools, we will be looking at MSFvenom Payload Creator (MSFPC)—a simple MSF-based payload generator; and Koadic—a COM-based Command and Control (C3) server, which can be used in red-team operations or penetration testing for post-exploitation.

In this chapter, we will cover the following tools:

• MSFPC
• Kaodic

Technical requirements

• *nix-based system (Kali, Ubuntu, or macOS X)
• The Metasploit framework (needed for MSFPC)
• Python package version 2 or 3 (needed for Koadic)

MSFvenom Payload Creator

MSFvenom Payload Creator (MSFPC) is a user-friendly multiple payload generator that can be used to generate Metasploit payloads based on user-selected options. The user doesn't need to execute the long msfvenom commands to generate payloads anymore. With MSFPC, the user can generate the payloads with far fewer commands.

Before downloading the tool, Metasploit should be installed in the system. MSFPC is just a simple bash script, which means that it can be executed on *nix systems.

We can download the MSFPC package from https://github.com/g0tmi1k/mpc. We can either download the repository in a ZIP file or we can clone the repository on our local system by running the following command:

git clone https://github.com/g0tmi1k/mpc

After cloning the repo, let's issue an execute permission on msfpc.sh file.

cd mpc/
chmod +x msfpc.sh 
./msfpc.sh
./msfpc...

Koadic

Koadic is a Windows post-exploitation toolkit with a similar interface to the other famous tools used for penetration testing purposes, namely, Empire and Metasploit. It's called C3 for a reason and that is because it uses the Component Object Model (COM) in Windows and operates using the script host utility (also known as JScript/VBScript). COM objects were introduced by Microsoft in 1993, which also means that Koadic's payloads are compatible with the older versions of Windows (NT/95/2000) up until the latest version, Windows 10. Koadic is built on Python and it's compatible with Python 2 as well as Python 3. The payloads generated by Koadic can be executed completely in-memory (from the stage 0 to the second stage and beyond) and it also supports the stager communication over SSL/TLS, although it depends upon what setting is enabled on the victim OS.

...

Summary

Let's quickly summarize what we have worked on until now. At the beginning of this chapter, you were introduced to MSF Payload Creator (MSFPC) and the steps to install MSFPC on the system. We looked at the use of resource files (.rc), which were generated by MSFPC besides the payload file. Different types of payload generation were presented, according to the scenario; that is, the type of shell dropped by the payload (cmd or msf), the type of payload connection used (bind versus reverse), the type of payload (staged or stageless), the communication method (tcp/http/https/find_ports), and the modes used for mass payload generation (batch mode or loop mode).

In the latter part of this chapter, you were introduced to Koadic, a C3 server, its installation and usage, and the stages for performing a Koadic-style post-exploitation.

...

Questions

1. Why use MSFPC when you can use msfvenom?
2. Should we expect new features in MSFPC?
3. Where can we use the loop and batch modes in a real-world scenario?
4. Is MSFPC already installed in Kali Linux?
5. Why use Koadic when you can use Empire and Metasploit?
6. There's not many modules (implants) in Koadic as compared to metasploit or Empire. Why is that?
7. What else can we use instead of these boring command-line tools?

Further reading

For more information on the topics discussed in this chapter, please visit the following links:

• MSFvenom Payload Creator (MSFPC): https://github.com/g0tmi1k/mpc
• https://null-byte.wonderhowto.com/how-to/simplify-payload-creation-with-msfpc-msfvenom-payload-creator-0180240/
• MSFPC: https://tools.kali.org/exploitation-tools/msfpc
• MSFvenom Payload Creator (MSFPC): https://www.yeahhub.com/msfvenom-payload-creator-msfpc-installation-usage/
• Koadic: koadichttps://github.com/zerosum0x0/koadic
• https://null-byte.wonderhowto.com/how-to/use-koadic-command-control-remote-access-toolkit-for-windows-post-exploitation-0181742/
• Penetration Testing Lab: https://pentestlab.blog/tag/koadic/
• Hunting for Koadic – a COM-based rootkit: https://countercept.com/our-thinking/hunting-for-koadic-a-com-based-rootkit/
• Koadic: An Advanced Windows JScript/VBScript RAT!: http://pentestit...