Exploiting Operating System Vulnerabilities on Windows and Linux
Domain 6 tests exploitation of the host layer. Enumeration quality decides the outcome far more than exploit selection: you need the exact kernel build, patch level and configuration before a single payload is fired.
Linux enumeration and exploitation
Collect uname -a, cat /etc/os-release, kernel build date, installed packages and compiler availability. Then look at configuration: SUID and SGID binaries, writable cron jobs, sudo -l output, capabilities via getcap -r /, NFS exports with no_root_squash, and membership of privileged groups such as docker. High-impact kernel classes to recognise include PwnKit (CVE-2021-4034 in polkit's pkexec), Dirty Pipe (CVE-2022-0847), and Dirty COW (CVE-2016-5195). Match the exploit to kernel version and distribution, and compile for the correct architecture.
Windows enumeration and exploitation
Start with systeminfo, whoami /priv, whoami /groups, installed hotfixes, local administrators, and running services. Map missing patches with a local tool or manual comparison, and confirm the vulnerable service is actually exposed. Landmark vulnerabilities include MS17-010 (EternalBlue, SMBv1), PrintNightmare (CVE-2021-34527), and Zerologon (CVE-2020-1472). Protocol-level weaknesses matter as much: SMB signing disabled enables relay, LLMNR and NBT-NS poisoning harvest hashes, and WinRM plus reused local admin credentials give easy lateral movement. Metasploit is used as an execution engine - search, use, show options, check where the module supports it, then exploit.
Worked example
A host responds on 445 with SMBv1 enabled. The tester runs the MS17-010 auxiliary scanner, which reports the host as vulnerable. Because EternalBlue can blue-screen an unpatched target, the tester first confirms the client accepts the risk and that a snapshot exists, sets RHOSTS, LHOST and an x64 Meterpreter payload matching the confirmed architecture, then runs check before exploit. A session returning as NT AUTHORITY\SYSTEM is documented with the module name, timestamps and the patch that would have prevented it.
Traps that cost marks
- Running a kernel exploit on a production host with no snapshot or rollback agreement.
- Sending an x86 payload to an x64 target, or the reverse.
- Declaring a host patched because your exploit failed on a version mismatch.
- Equating a Meterpreter session with domain dominance; it is one host, one context.
- Ignoring EDR and antivirus telemetry, then being surprised when the payload is quarantined.