Exploitation and Password Attacks
What to know
Metasploit workflow: search, use, show options, set RHOSTS/LHOST/LPORT, check where supported, then exploit. Payload naming tells you the delivery style: staged payloads use a slash (windows/x64/meterpreter/reverse_tcp) and fetch the second stage, stageless payloads use an underscore (windows/x64/meterpreter_reverse_tcp) and are self-contained. Reverse payloads survive NAT; bind payloads only work when you can reach the target port.
msfvenom builds standalone payloads (-p, LHOST, LPORT, -f exe, optional encoder and iteration count). Raw shells should be upgraded: spawn a PTY with Python, or use script -qc /bin/bash /dev/null, then background, stty raw -echo, and foreground.
Password attacks split into online (spraying with netexec or hydra) and offline (hashcat, John). Know the common hashcat modes: NTLM 1000, NetNTLMv2 5600, Kerberoast 13100, AS-REP 18200, sha512crypt 1800, md5crypt 500, bcrypt 3200. Windows secret sources: SAM via secretsdump, LSASS via mimikatz sekurlsa::logonpasswords, DPAPI, unattended files. Linux sources: /etc/shadow, SSH private keys, shell history, application config files.
Traps
- Wrong hash mode, which wastes hours of cracking time.
- Spraying past the lockout threshold; always check policy first and use one password across many users.
- A bind payload fired through a pivot you cannot route back from.
- Confusing an NTLM hash with a NetNTLMv2 challenge/response.