Metasploit

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

exploit the box somehow (ssh_login for instance)

a remote unauthenticated attacker can bypass authentication by connecting to the vSmart DTLS port with any self-signed client certificate and claiming to be a vHub (type 2) in the CHALLENGE_ACK message. No valid credentials, no CA-signed certificate, and no knowledge of the SD-WAN deployment are required.

Windows operating systems provide a utility (schtasks.exe) which enables system administrators to execute a program or a script at a specific given date and time. This kind of behavior has been heavily abused by threat actors and red teams as a persistence mechanism.

References https://attack.mitre.org/techniques/T1053/ ... The persistence technique of scheduled tasks can be implemented both manually and automatically.

For instance, a Metasploit module can force the device to run remote scripts.

From the command prompt the “ schtasks ” executable can be used to create a schedule task that will download and execute a PowerShell based payload in every Windows logon as a SYSTEM.

As we can see above, the attacker achieves unauthenticated RCE with root privileges on the device. This is demonstrated by the attacker executing a reverse shell payload and running several arbitrary OS shell commands.

According to the report, “This helper function ParseICECandidate contains a stack based buffer overflow.” ... an unauthenticated attacker can trigger a classic stack crash by sending an overly long request.

This malicious DLL needs to be dropped in one of the folders that windows are loading DLL files. As it can be see below when the service restarted a Meterpreter session opened with SYSTEM privileges through DLL hijacking.

If these DLL’s doesn’t exist or are implemented in an insecure way (DLL’s are called without using a fully qualified path) then it is possible to escalate privileges by forcing the application to load and execute a malicious DLL file.

Windows operating systems provide a utility (schtasks.exe) which enables system administrators to execute a program or a script at a specific given date and time. This kind of behavior has been heavily abused by threat actors and red teams as a persistence mechanism.

References https://attack.mitre.org/techniques/T1053/ ... The persistence technique of scheduled tasks can be implemented both manually and automatically.

exploit the box somehow (ssh_login for instance)

We identified a particularly impactful post-authentication primitive: persistent SSH key injection via MSG_VMANAGE_TO_PEER (Message type 14).

use exploit/multi/persistence/obsidian_plugin

Pulls out systemd from the init persistence module and adds new persistence mixin.

Windows operating systems provide a utility (schtasks.exe) which enables system administrators to execute a program or a script at a specific given date and time. This kind of behavior has been heavily abused by threat actors and red teams as a persistence mechanism.

References https://attack.mitre.org/techniques/T1053/ ... The persistence technique of scheduled tasks can be implemented both manually and automatically.

Conversation Add Windows Defender BlueHammer LPE exploit ( CVE-2026-33825 )

exploit the box somehow (ssh_login for instance)

We identified a particularly impactful post-authentication primitive: persistent SSH key injection via MSG_VMANAGE_TO_PEER (Message type 14).

Pulls out systemd from the init persistence module and adds new persistence mixin.

In Windows environments when an application or a service is starting it looks for a number of DLL’s in order to function properly... then it is possible to escalate privileges by forcing the application to load and execute a malicious DLL file.

Once you have the base address of kernel32.dll, you walk its export table and find WinExec using a ROR13 hash comparison | The challenge on Windows is that you can’t call WinExec directly in position-independent shellcode. You don't know where kernel32.dll is loaded at runtime (ASLR). Instead, you find it dynamically by walking the Process Environment Block | The Windows synthesiser uses a technique called PEB walking with ROR13 hashing — the same approach used by Metasploit’s Windows stagers.

exploit the box somehow (ssh_login for instance)

This malicious DLL needs to be dropped in one of the folders that windows are loading DLL files. As it can be see below when the service restarted a Meterpreter session opened with SYSTEM privileges through DLL hijacking.

If these DLL’s doesn’t exist or are implemented in an insecure way (DLL’s are called without using a fully qualified path) then it is possible to escalate privileges by forcing the application to load and execute a malicious DLL file.

ssh_login: Convert to run_scanner ... ssh_login: Use SSH mixin ... ssh_login: Add store_ssh_key_loot() ... ssh_login: Support BLANK_PASSWORDS, USER_AS_PASS & ANONYMOUS_LOGIN

ssh_login: Support BLANK_PASSWORDS, USER_AS_PASS & ANONYMOUS_LOGIN

ssh_creds: Add PARSE_KNOWN_HOSTS - report_host() ... ssh_creds: Add CRACK_KNOWN_HOSTS - report_host ... ssh_creds: Add report_note(ssh.privatekey)

The majority of the applications used Transport Layer Security (TLS). However, none of the apps verified the certificate used by the server, which meant that Man-in-the-Middle attacks were still possible using an intercepting proxy tool.

ssh_creds: Add ATT&CK ref

GOLD KINGSWOOD is a cybercriminal group that uses tactics more commonly associated with government-sponsored threat actors to infiltrate the internal networks of financial institutions around the globe.

For instance, a Metasploit module can force the device to run remote scripts. The attacker crafts a special SIP INVITE message stuffed with padding characters.

The majority of the applications used Transport Layer Security (TLS). However, none of the apps verified the certificate used by the server, which meant that Man-in-the-Middle attacks were still possible using an intercepting proxy tool.

At this point the attacker can begin to execute arbitrary NETCONF commands, for example the following “get-config” command can be run by the attacker in the NETCONF session.

Add support for HTTP/S PHP and TLV config | Add support for HTTP/S PHP and TLV config ... Fix custom_headers emission, add C2 UUID for placement ... Wire MC2 into PHP payloads ... Wire MC2 into mettle

This script then executes within the context of the Android application and can potentially instruct the device to download a malicious payload from the attacker’s server, providing access to the user’s phone with the privileges of the application.