Before we dive into the demos on msfvenom's capabilities,
I want to take a moment to talk about where it fits in the MITRE
ATT&CK framework. The ATT&CK knowledge base developed by MITRE
categorizes adversary tactics and techniques into multiple categories
to describe the adversary's behavior.
The tactics are categories that cover different phases of an
attack and allow defensive teams to model an adversary's actions
and improve the defense of their networks.
We'll cover two tactics that venom is used for, exploitation for
privilege escalation and exploitation for client execution.
Venom can accomplish this by enabling adversaries to generate
payloads to use in a variety of different exploits.
In this course, we'll look at two different scenarios that
could occur in a real world environment.
If an attacker wanted to take control of devices on
Globomantics' network, depicted here,
one option they have is to use venom to generate a payload and then place
it on a website they host from their attacking machine.
The attacker then sends a malicious link to their victim which when
accessed directs the target back to the attacker's page.
The shellcode is executed which allows the hacker to obtain
a Command shell on the victim's machine.
In this case,
the attacker has taken control of HR's machine and can
potentially access employees' personal information.
Another scenario involves an attacker discovering vulnerable software running
on Globomantics' servers and creating a script to exploit that vulnerability.
The attacker generates a payload to create a bind shell and codes the payload
to tailor it to the specific exploit and then run their script against the
vulnerable application.
The application executes the malicious shellcode,
allowing the attacker to connect directly to a port the shellcode
opens and escalate their privileges to the equivalent of the
account running the vulnerable application.
Depending on how the victim configures service accounts and the
required privileges of the exploited software, this could give
the attacker administrative privileges over the server and
possibly the entire domain.