ICMP Exfil Shell - Minion [HackTheBox]
In Minion from HackTheBox, I've got blind command execution and can only get ICMP back to my host. I'll generate a shell using the python-cmd module and scapy. This shell will take commands, generate PowerShell that will be run over the webshell. That PowerShell will run my command, and generate the ping packets necessary to send the full result back to me, where my Python script will see them and print the results.
Full blog post: https://0xdf.gitlab.io/2022/04/07/htb...
[00:00] Introduction
[01:44] Demo of webshell
[03:12] Python terminal showing Scapy to sniff ICMP packets
[05:30] Start of Python script, setting up simple cmd shell
[08:00] Setting up thread to capture ICMP packets and print contents
[12:55] Having user input trigger ping
[14:23] Generating PowerShell to run command and insert into ICMP packet from Windows VM
[24:09] Intergrating PowerShell into Python script
[26:36] Begin troubleshooting first of many failures
[28:35] Adding base64 and URL encoding to command
[34:15] Flushing output
[35:17] Flailing about not seeing what's wrong
[36:52] Found issue, adding missing code to the PowerShell
[37:53] Working Shell!
[39:30] Summary