Client-Side Attacks
What to know
Client-side attacks aim at code execution on a workstation (through user action) or at capturing credentials on the wire. Delivery routes include phishing attachments or links, watering-hole pages, and removable media. Common payload formats are Office macro documents (.docm, .xlsm), HTA, LNK files, VBS/JS scripts, MSI packages, ISO/IMG containers, and DLL or library side-loading. Tooling: msfvenom, Metasploit file-format modules, Responder, and ntlmrelayx.
Network-side client attacks are at least as important. LLMNR, NBT-NS and mDNS fallback lets a poisoned response capture NetNTLMv2 hashes when a user mistypes a share name; those hashes can be cracked offline or relayed to a host that does not require SMB signing. Forced-authentication tricks, malicious .scf or .url files dropped into writable shares, and spoofed WPAD also belong here.
Traps
- Forgetting the Mark-of-the-Web: files downloaded from the internet prompt or block macros; container formats such as ISO often dodge this.
- Ignoring endpoint protection; macros and common encoders are heavily signatured, so obfuscation or an alternate loader is often needed.
- Attempting to relay a hash back to the host that produced it.
- Forgetting that the exploit needs a callback reachable from the victim, not just from your attack host.
Worked example
You control a share the victim browses. You cannot run code there. Instead you drop a file that causes the workstation to authenticate to you, capture the NetNTLMv2 response, and crack it offline. The lesson: match the payload to the delivery mechanism and to the victim's egress path before anything else.