Manual kernel exploitation

In some cases, you will not have access to a target with a Meterpreter session or you may have exploited the target through a manual exploitation technique such as a web shell. In that event, you will have access through a standard reverse shell most likely facilitated through netcat. This poses a few issues; how can I scan the target for potential kernel exploits? And how can I transfer over the kernel exploit to the target?

These are the issues we will be addressing in this section; our target of choice will be the Windows 7 virtual machine.

Local enumeration

The first step is to scan and identify potential kernel vulnerabilities. This can be done through the use of the Windows-Exploit-Suggester tool or other enumeration scripts and tools. In this case, we will utilize the winPEAS binary to enumerate information from our target.

Note

winPEAS is a local Windows enumeration script that searches and scans for potential vulnerabilities and enumerates...