I'm pretty new to pentesting and I just penetrated my first Win7 test-pc several days ago. Now I want to continue with my Windows 10 one.

Does anyone already know some Win10 remote exploits? I heard about eternalsynergy. Are there other ones? I also heard about eternalblue being ported to Win10, but I can't find it anywhere.

What else could I try to penetrate my Win10 PC without user interaction? What are the most common ways and what are more exotic ways?

  • 1
    Not sure if this question is not too broad. It certainly won't age well, as any list of exploits would have to be updated periodically. – Peter Harmann Apr 24 '18 at 19:14
  • What research have you done so far? – Tom K. Apr 24 '18 at 19:37
  • @PeterHarmann Well... thats kinda true... but otherwise i nearly dont find anything usefull at all. So maybe this question will help all those people who dont find anything too :) – genaray Apr 24 '18 at 19:37
  • @TomK. Exploit-DB for example and cvedetails. There are many vulnerabilities. But the problem is that are mostly no released exploits. The only one i found is "EternalSynergy" but this one requires a pipe and even user credentials to work. – genaray Apr 24 '18 at 19:39
  • 3
    This kind of question is almost like a software recommendation, in that it will get out-of-date really quickly. – nbering Apr 24 '18 at 19:48

This question could have been answered with a quick Google search. You can go to CVE Details and find out information about vendors, products, versions, and so on. Most CVEs will post information relevant to a vulnerability, e.g.: "Exploit available." As for "more exotic ways", I think you need to understand exploits, threats, and threat actors in general. Many organizations are compromised via phishing/social engineering primarily, then applications (Office, Excel, IE, etc) are "client side" attacked. (Browser based, file based, etc).

Exploits have been dwindling for some time now, so finding them is increasingly difficult, and threat actors aren't going to burn "0 day" exploits when they can continue using traditional methods that work time and time again. For what it is worth, metasploit's team does a decent job of adding exploits when there are proof of concepts in the wild/discussed. But you need to also understand that there is a huge market for exploits. What this means is that some researchers can hoard their exploits, sell them to heavy hitter buys (govs/mil), or sell them to some exploit clearinghouse. So if you think someone will be making it rain 0 days some time soon, I don't see it happening.


Not the answer you're looking for? Browse other questions tagged or ask your own question.