2

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly available exploits that target the default Windows 7 operating system (or default services) that will work "straight out of the box"? Thanks in advance for any info; much appreciated.

MyWin7UltimateDVDRoseFilter

1
  • 10
    exploit-db.com is your friend
    – schroeder
    Nov 10 '15 at 6:51
4

I personally like cvedetails.com:
https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-17153/hasexp-1/Microsoft-Windows-7.html

exploit-db.com, that schroeder mentioned is great:
https://www.exploit-db.com/platform/?p=windows

1
  • Thank you for your contribution. I am aware of exploit-db.com. I am not entirely inexperienced when it comes to information security, just not quite so much when it comes to this particular style or method of directly executing written exploits. (ie. via Metasploit etc.). Your first recommendation, cvedetails.com is quite nice and provides a good amount of information, although it seem like the majority of their listed vulnerabilities aren't accompanied by the relevant, published exploit source-code.
    – voices
    Nov 13 '15 at 7:58
2

There are several exploits such as SMB attacks (require known credentials, like passing the hash) that will make an easy attack on a fresh system and thus helping you to find your way around the inside of the OS. If you use metasploit to do so the meterpreter shell will greatly help you find vulnerabilities through additional scanning etc. Here is a link to the website.

If you are starting with kali linux you will be provided with a plethora of attack vectors such as social engineering(Eg. SEToolkit), password cracking (Eg. JohnTheRipper), port analysis (Eg. nmap), exploit modules (Metasploit), wifi scanning etc.

One realistic setup would be to disable https and setup wireshark against a local router. In doing so any credentials logged in from the lab-pc will be sniffed and saved by wireshark. If you make a good assumption that the username and password are a lot similar to that of the pc, you could attempt many different credential based attacks towards the system. One of the most excelling tools in relation to vuln. analysis is Armitage which is available on Kali Linux as an extra to Metasploit.

Give them a go and see where you can get and what sort of escalation or attacks work best for you. Don't forget to always familiarize yourself with new environments also.

5
  • Can you provide an example of any particular SMB attacks? I have noticed that most Windows boxes typically reveal that such services are running, when queried by nmap etc.
    – voices
    Nov 13 '15 at 8:06
  • Generally you only use an SMB exploit if you know the credentials or have a cred list in a metasploit database. If you do, and you find that the windows box has SMB enabled you can use the "exploit/windows/smb/psexec" metasploit module (psexec stands for process execution. Essentially it uploads a payload to the selected windows share that you can authenticate to and the psexec will execute it with the same creds). If there is a reasonable AV on the target then chances are psexec won't work.
    – Brayden
    Nov 13 '15 at 13:15
  • If the windows box has powershell however, you can append a "_psh" to the psexec module (psexec_psh) and this is practically undetectable.
    – Brayden
    Nov 13 '15 at 13:16
  • How is it a vulnerability or an exploit if you already have the credentials?
    – voices
    Nov 13 '15 at 23:13
  • Because not all windows boxes are vulnerable to SMB attacks. Windows 8 for example by default has SMB disabled because it's generally an enterprise sort of feature, where it is only needed in controlled situations such as a business etc. Windows 7 however is enable by default so if you do have credentials it is still considered a vulnerability because you can get access and all 'holes' that you can access are vulnerabilities.
    – Brayden
    Nov 14 '15 at 0:19
0

Authenticated scan using Nessus home edition can make things more easier for you as it will also provide the CVE ID which you can later search on msfconsole (Metasploit). After getting the CVE IDs you can search for the script to exploit as mentioned by @yaloner in the above comment. This will rule out most of the exploits which won't work for your system and save you the time trying out those. Refer to @Brayden on how to use Metasploit in this case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.