EH-Net

spending a bit of time in my home lab today. Have a VM of BT5 R2 loaded up, target machine is XP Pro SP3, firewall disabled. Nothing else installed. Fully patched.

If there are no vulns to exploit, would the only way to get a shell be to go after the browser and get the user to click a link?

Working on learning the basic strategies and tools.

Well vulnerabilities may still exist, but they may not be with the OS.  There may be a 3rd party app running on the device that has vulns such as Adobe Reader or java.  you won't get that information from a frontal scan of the device.  These may be assumptions and yes your only way to tell is if you send them a crafted phishing email with an infected attachment or link.  Again you will still need to exploit something.  And even though your initial scan comes up empty, vulns still may exist but other controls are in place to prevent the information from being known.

Ways to get the information on what software they might be running could involve some social engineering attempts (unless that is listed as out-of-scope on the engagement docs).

So social engineering aside, the attack method for my test XP box is basically throw best guesses at it, like recent java /IE/adobe exploits at it and see what sticks? So for a better testing experience, I should load up old adobe and other apps and toss exploits at it.

On the target machine, I am browsing to the IP and port my BT5 box is serving malicious code on. Pretending to be a user who says OK to everything.