Chapter 5

Objective 5.1

  • Scheduled Tasks/Cron Jobs
    • Function: Automating tasks to run at specified times.
    • Use Case: Setting up periodic execution of malicious scripts or commands.
    • Example: Creating a cron job to regularly execute a script that maintains a backdoor connection.
  • Service Creation
    • Function: Creating system services that run with elevated privileges.
    • Use Case: Establishing persistence by installing malicious services.
    • Example: Creating a Windows service that launches a reverse shell upon system startup.
  • Reverse Shell
    • Function: Gaining remote access to a target system.
    • Use Case: Maintaining control over the target by initiating a connection from the target to the attacker.
    • Example: Using a reverse shell to connect back to the attacker’s machine and issue commands.
  • Bind Shell
    • Function: Opening a port on the target system for remote access.
    • Use Case: Allowing the attacker to connect to the target system at any time.
    • Example: Setting up a bind shell that listens for incoming connections on a specific port.
  • Add New Accounts
    • Function: Creating new user accounts with administrative privileges.
    • Use Case: Ensuring persistent access by adding new accounts to the system.
    • Example: Adding a new user with administrative rights to the local user database.
  • Obtain Valid Account Credentials
    • Function: Acquiring legitimate user credentials.
    • Use Case: Using valid credentials to maintain access without raising suspicion.
    • Example: Dumping password hashes and cracking them to gain valid login information.
  • Registry Keys
    • Function: Modifying system settings via the registry.
    • Use Case: Configuring persistence mechanisms that run at startup.
    • Example: Adding a registry key to execute a script upon user login.
  • Command and Control (C2) Frameworks
    • Function: Managing compromised systems from a central location.
    • Use Case: Coordinating attacks and maintaining persistence across multiple targets.
    • Example: Using C2 frameworks like Cobalt Strike or Metasploit to issue commands and gather information.
  • Backdoor
    • Web Shell
      • Function: Executing commands on a web server through a web interface.
      • Use Case: Maintaining access to a compromised web server.
      • Example: Uploading a PHP web shell to execute commands and navigate the file system.
    • Trojan
      • Function: Disguising malicious software as legitimate applications.
      • Use Case: Establishing persistence by running hidden malicious processes.
      • Example: Delivering a Trojan horse that provides remote access while appearing benign.
  • Rootkit
    • Function: Hiding the presence of malicious processes and files.
    • Use Case: Maintaining stealthy access to a compromised system.
    • Example: Installing a rootkit to intercept and alter system calls, hiding the attacker’s activities.
  • Browser Extensions
    • Function: Extending browser functionality with malicious intent.
    • Use Case: Maintaining persistence through a compromised browser.
    • Example: Installing a malicious browser extension that captures credentials and sends them to the attacker.
  • Tampering Security Controls
    • Function: Disabling or altering security mechanisms.
    • Use Case: Ensuring that persistence mechanisms remain undetected.
    • Example: Disabling antivirus programs or modifying firewall rules to avoid detection.

Objective 5.2

  • Pivoting
    • Function: Using a compromised system to access other systems in the network.
    • Use Case: Expanding the reach within the target environment.
    • Example: Compromising a workstation and using it to access a restricted server.
  • Relay Creation
    • Function: Setting up relays to route traffic through compromised hosts.
    • Use Case: Obfuscating the attacker’s true location and maintaining stealth.
    • Example: Using an SSH relay to tunnel traffic through a compromised machine.
  • Enumeration
    • Service Discovery
      • Function: Identifying services running on hosts.
      • Use Case: Finding targets and attack vectors.
      • Example: Using Nmap to list open ports and services.
    • Network Traffic Discovery
      • Function: Monitoring and analyzing network traffic.
      • Use Case: Identifying active hosts and services.
      • Example: Using Wireshark to capture and analyze network packets.
    • Additional Credential Capture
      • Function: Gathering more credentials from compromised systems.
      • Use Case: Escalating privileges and moving laterally.
      • Example: Using Mimikatz to extract passwords from memory.
    • Credential Dumping
      • Function: Extracting credentials from memory, files, or other locations.
      • Use Case: Using these credentials to access other systems.
      • Example: Dumping NTLM hashes from a Windows machine.
    • String Searches
      • Function: Searching for sensitive information in files.
      • Use Case: Finding passwords, keys, or other useful data.
      • Example: Using grep to search for “password” in configuration files.
  • Service Discovery
    • SMB/Fileshares
      • Function: Identifying and accessing shared files.
      • Use Case: Finding sensitive data or further access points.
      • Example: Enumerating SMB shares with smbclient.
    • RDP/VNC
      • Function: Identifying remote desktop services.
      • Use Case: Gaining graphical access to systems.
      • Example: Scanning for open RDP ports with Nmap.
    • SSH
      • Function: Identifying SSH services.
      • Use Case: Securely accessing remote systems.
      • Example: Scanning for SSH services and attempting login with credentials.
    • Cleartext Protocols
      • Function: Identifying protocols that transmit data in cleartext.
      • Use Case: Intercepting sensitive information.
      • Example: Capturing Telnet traffic with a packet sniffer.
    • LDAP
      • Function: Identifying directory services.
      • Use Case: Extracting user and network information.
      • Example: Using ldapsearch to query an LDAP directory.
    • RPC
      • Function: Identifying remote procedure call services.
      • Use Case: Executing commands on remote systems.
      • Example: Enumerating RPC services with rpcclient.
    • FTP
      • Function: Identifying file transfer protocol services.
      • Use Case: Transferring files to/from the target.
      • Example: Connecting to FTP servers with anonymous access.
    • Telnet
      • Function: Identifying Telnet services.
      • Use Case: Gaining remote command-line access.
      • Example: Logging into Telnet services with cleartext credentials.
    • HTTP/HTTPS
      • Function: Identifying web services.
      • Use Case: Exploiting web applications and interfaces.
      • Example: Enumerating web servers and discovering web interfaces with Burp Suite.
    • LPD
      • Function: Identifying line printer daemon services.
      • Use Case: Exploiting printer services.
      • Example: Scanning for LPD services with Nmap.
    • JetDirect
      • Function: Identifying printer services.
      • Use Case: Exploiting printer services.
      • Example: Enumerating JetDirect printers.
    • RPC/DCOM
      • Function: Identifying RPC and DCOM services.
      • Use Case: Executing commands on remote systems.
      • Example: Using rpcclient to enumerate RPC services.
    • Process IDs
      • Function: Identifying running processes.
      • Use Case: Finding processes to exploit or terminate.
      • Example: Using tasklist on Windows to list process IDs.
  • Window Management Instrumentation (WMI)
    • Function: Managing and querying system information on Windows.
    • Use Case: Executing commands and gathering information.
    • Example: Using WMI to run scripts and commands on remote systems.
  • Window Remote Management (WinRM)
    • Function: Remotely managing Windows systems.
    • Use Case: Executing commands and managing systems remotely.
    • Example: Using PowerShell Remoting to manage Windows systems.

Tools

  • Living Off the Land Binaries (LOLBins)
    • Netstat
      • Function: Displays network connections and listening ports.
      • Use Case: Identifying active connections on the system.
      • Example: netstat -an to list all active connections and listening ports.
    • Net Commands
      • Function: Manages network resources, users, and services.
      • Use Case: Administering network shares, user accounts, and services.
      • Example: net user to list user accounts.
    • cmd.exe
      • Function: Windows command prompt.
      • Use Case: Executing commands and scripts.
      • Example: Running batch files or individual commands.
    • explorer.exe
      • Function: Windows graphical user interface.
      • Use Case: Browsing files and directories.
      • Example: explorer.exe to open the file explorer.
    • ftp.exe
      • Function: File Transfer Protocol client.
      • Use Case: Transferring files to/from remote servers.
      • Example: ftp.exe <server> to connect to an FTP server.
    • mmc.exe
      • Function: Microsoft Management Console.
      • Use Case: Managing Windows administrative tools.
      • Example: mmc.exe to open the management console.
    • rundll
      • Function: Runs functions exported from DLLs.
      • Use Case: Executing DLL functions.
      • Example: rundll32.exe <dllname>,<entrypoint> to execute a function.
    • msbuild
      • Function: Builds .NET applications.
      • Use Case: Compiling and executing code.
      • Example: msbuild <project>.proj to build a .NET project.
    • route
      • Function: Displays and modifies the routing table.
      • Use Case: Managing network routes.
      • Example: route print to display the routing table.
    • strings/findstr.exe
      • Function: Searches for text strings in files.
      • Use Case: Finding specific text in files.
      • Example: findstr <text> <filename> to search for text within a file.
  • Covenant
    • Function: Command and control framework.
    • Covenant is an open-source, .NET-based Command and Control (C2) framework designed for red teaming and penetration testing.
    • It allows security professionals to simulate advanced attacks, manage compromised hosts, and conduct post-exploitation activities in a controlled manner.
    • Covenant supports a variety of attack techniques and provides an interactive web-based interface for managing and orchestrating operations.
    • Use Case: Managing compromised systems and executing commands remotely.
    • Example: Using Covenant to execute PowerShell scripts on compromised hosts.
  • CrackMapExec
    • Function: Post-exploitation tool for managing Windows networks.
    • Use Case: Automating various tasks such as credential validation and command execution.
    • Example: Using CrackMapExec to enumerate users and shares.
  • Impacket
    • Function: Collection of Python classes for working with network protocols.
    • Use Case: Scripting and automating network tasks.
    • Example: Using psexec.py from Impacket to execute commands on remote systems.
  • Netcat
    • Function: Network utility for reading and writing data across network connections.
    • Use Case: Creating reverse or bind shells.
    • Example: nc -lvp <port> to start a listener.
  • sshuttle
    • Function: Transparent proxy server that works as a poor man’s VPN.
    • sshuttle is an open-source tool that provides a simple way to create a VPN-like connection over SSH.
    • It allows users to forward all traffic from their local machine through an SSH tunnel to a remote server, effectively allowing access to remote networks as if they were directly connected to them.
    • It’s particularly useful for bypassing network restrictions and accessing internal resources securely.
    • Features:
      • Transparent Proxy: Routes traffic from your local machine through an SSH tunnel, making it appear as if you’re on the remote network.
      • No Root Required: Operates without needing root privileges on the local machine.
      • Supports IPv4 and IPv6: Handles both IPv4 and IPv6 traffic.
      • Simple Setup: Easy to configure and use with minimal setup required.
    • Use Case: Tunneling traffic through a compromised host.
    • Example: sshuttle -r user@host 0.0.0.0/0 to tunnel all traffic through an SSH connection.
    • Usage → sshuttle -r <user@remote_host> <network>
  • Proxychains
    • Function: Forces any TCP connection made by any application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy.
    • Proxychains is a Linux utility that allows you to force any TCP connection made by any given application to go through a proxy (such as SOCKS or HTTP proxies).
    • It is especially useful for network penetration testing, privacy, and anonymizing traffic.
    • Proxychains works by intercepting network calls and redirecting them through specified proxy servers.
    • Features:
      • Support for Multiple Proxy Types: Supports SOCKS5, SOCKS4, and HTTP proxies.
      • Flexible Proxy Chain: Allows chaining multiple proxies to enhance anonymity.
      • Application Transparency: Routes traffic for any application without requiring modifications to the application itself.
      • Configuration File: Provides a configuration file where proxies and options are defined.
    • Use Case: Obfuscating traffic through multiple proxies.
    • Example: proxychains nmap -sT <target> to run Nmap through proxies.
  • PowerShell Integrated Scripting Environment (ISE)
    • Function: Development environment for PowerShell scripts.
    • PowerShell Integrated Scripting Environment (ISE) is a Microsoft development tool that provides a rich graphical interface for creating, testing, and debugging PowerShell scripts.
    • It is an integrated environment that enhances the scripting and automation capabilities of PowerShell by offering features like syntax highlighting, IntelliSense, and debugging tools.
    • Although PowerShell ISE has been deprecated in favor of Visual Studio Code with the PowerShell extension, it is still used in various environments.
    • Features:
      • Script Editor: Provides a text editor for writing and editing PowerShell scripts with syntax highlighting.
      • IntelliSense: Offers auto-completion for commands, parameters, and variables, improving script accuracy and efficiency.
      • Script Debugger: Includes tools for debugging scripts, such as breakpoints, variable inspection, and step execution.
      • Integrated Console: Allows you to run and test PowerShell commands interactively within the ISE.
      • Command Add-ons: Supports custom add-ons and modules to extend functionality.
    • Use Case: Writing and debugging PowerShell scripts.
    • Example: Using PowerShell ISE to develop and test scripts for enumeration and exploitation.
    • Usage: Launch → powershell_ise
  • Batch Files
    • Function: Scripts that execute a series of commands in Windows.
    • Batch files are scripts containing a sequence of commands to be executed by the command-line interpreter (CMD.EXE) on Windows operating systems.
    • They automate repetitive tasks, manage system configurations, and execute commands in a batch process.
    • Batch files use a simple scripting language that includes basic programming constructs like loops, conditionals, and variables.
    • Features:
      • Command Automation: Automates sequences of command-line operations.
      • System Configuration: Used for setting environment variables, managing files, and configuring system settings.
      • Simple Scripting: Employs a straightforward scripting language with basic programming capabilities.
      • File Extension: Typically saved with the .bat or .cmd file extension.
    • Use Case: Automating tasks and command sequences.
    • Example: Creating a batch file to automate network scans.
  • Metasploit
    • Function: Penetration testing framework.
    • Use Case: Exploiting vulnerabilities and managing post-exploitation activities.
    • Example: Using Metasploit modules to exploit known vulnerabilities and establish sessions.
  • PsExec
    • Function: Executes processes on remote systems.
    • PsExec is a command-line tool from Microsoft’s Sysinternals suite that allows users to execute processes on remote systems and interact with them as if they were running locally.
    • It can be used for various administrative tasks such as running scripts, installing applications, and managing processes on remote machines.
    • PsExec is often employed in system administration, troubleshooting, and penetration testing.
    • Features:
      • Remote Execution: Run commands and processes on remote systems.
      • Interactive Session: Launch interactive sessions on remote machines.
      • Service Management: Start and stop services on remote systems.
      • File Execution: Execute applications and scripts remotely.
    • Use Case: Running commands and scripts remotely.
    • Example: psexec \\<remote_host> -u <user> -p <password> cmd to open a command prompt on a remote machine.
  • Mimikatz
    • Function: Post-exploitation tool for extracting plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory.
    • Mimikatz is an open-source tool developed by Benjamin Delpy that is used for extracting and manipulating authentication credentials from Windows systems.
    • It is widely used in penetration testing and security research to demonstrate and exploit vulnerabilities related to Windows authentication mechanisms.
    • Mimikatz can extract plaintext passwords, hash values, and Kerberos tickets, and perform various attacks on Windows authentication protocols.
    • Use Case: Credential dumping and privilege escalation.
    • Example: Using Mimikatz to dump Windows password hashes from memory.

Objective 5.3

  • File Encryption and Compression
    • Purpose: Protect and reduce the size of files for easier and more secure transfer.
    • Examples:
      • Encryption: Using tools like GPG to encrypt files before exfiltration.
      • Compression: Using ZIP or RAR to compress files, often with added password protection for security.
  • Covert Channels
    • Steganography: Hiding data within other non-suspicious data.
      • Example: Embedding sensitive data in image or audio files.
    • DNS: Using DNS queries and responses to exfiltrate data.
      • Example: Encoding data into DNS queries that get sent to an attacker-controlled DNS server.
    • Internet Control Message Protocol (ICMP): Using ICMP packets (commonly used for ping) to exfiltrate data.
      • Example: Sending data within ICMP Echo Request and Reply packets.
    • HTTPS: Encrypting data within HTTPS traffic to avoid detection.
      • Example: Sending encrypted data through HTTPS to a remote server controlled by the attacker.
  • Email
    • Purpose: Sending data as attachments or within the body of emails.
    • Example: Using a compromised email account to send sensitive files to an external email address.
  • Cross-Account Resources
    • Purpose: Using access to multiple accounts or systems to stage and move data.
    • Example: Moving data between different cloud accounts or using multiple compromised user accounts to exfiltrate data gradually.
  • Cloud Storage
    • Purpose: Uploading data to cloud storage services for later retrieval.
    • Examples:
      • Google Drive, Dropbox, AWS S3: Uploading sensitive files to these services using compromised credentials
  • Alternate Data Streams (ADS)
    • Purpose: Hiding data within NTFS file system streams.
    • Example: Storing data in an alternate data stream of a legitimate file to avoid detection.
  • Text Storage Sites
    • Purpose: Using public paste sites to exfiltrate data.
    • Examples:
      • Pastebin, Ghostbin: Posting data to these sites, often in a format that seems harmless or encoded.
  • Virtual Drive Mounting
    • Purpose: Mounting remote or virtual drives to store and access data.
    • Example: Using tools to mount a virtual drive on a compromised system and copying sensitive data to it for later access.

Objective 5.4

  • Remove Persistence Mechanisms
    • Objective: Ensure that no backdoors, rootkits, or other persistent threats remain on the system.
    • Examples:
      • Deleting scheduled tasks or cron jobs created by the penetration tester.
      • Removing malicious registry keys or startup entries.
  • Revert Configuration Changes
    • Objective: Restore the system to its pre-test state, reversing any changes made during the penetration test.
    • Examples:
      • Undoing modifications to system configurations or security settings.
      • Reverting altered firewall rules or access control lists (ACLs).
  • Remove Tester-Created Credentials
    • Objective: Eliminate any user accounts or credentials created during the penetration test.
    • Examples:
      • Deleting any test accounts or passwords added during the engagement.
      • Ensuring all test accounts are fully removed and cannot be used later.
  • Remove Tools
    • Objective: Clean up all tools and scripts used during the penetration test to leave no trace.
    • Examples:
      • Deleting all binaries, scripts, and files associated with penetration testing tools like Metasploit, Nmap, or custom scripts.
      • Ensuring no temporary files or logs related to the tools remain on the system.
  • Spin Down Infrastructure
    • Objective: Decommission any temporary infrastructure set up for the penetration test.
    • Examples:
      • Terminating cloud instances, virtual machines, or containers used during the test.
      • Ensuring all temporary network configurations are reverted.
  • Preserve Artifacts
    • Objective: Keep necessary logs, data, and evidence for reporting and auditing purposes while ensuring no sensitive data remains exposed.
    • Examples:
      • Archiving relevant logs, screenshots, and data used to document findings and support the final report.
      • Ensuring these artifacts are securely stored and only accessible to authorized personnel.
  • Secure Data Destruction
    • Objective: Ensure that any sensitive data collected during the penetration test is securely destroyed to prevent unauthorized access.
    • Examples:
      • Using secure deletion tools to wipe sensitive files or data.
      • Following best practices for data destruction, such as overwriting data multiple times or using encryption before deletion.

Tools

Reconnaissance

  • WHOIS → Tools to gather information from public records about domain ownership.
  • Nslookup → Tools to help identify the IP addresses associated with an organization.
  • theHarvester → scours search engines and other resources to find email addresses, employee names, and infrastructure details about an organization.
  • Recon-ng → A modular web reconnaissance framework that organizes and manages OSINT work.
  • Censys → A web-based tool that probes IP addresses across the Internet and then pro- vides penetration testers with access to that information through a search engine.
  • FOCA (Fingerprinting Organizations with Collected Archives) → an open source tool used to find metadata within Office documents, PDFs, and other common file formats.
  • Shodan → A specialized search engine to provide discovery of vulnerable Internet of Things (IoT) devices from public sources.
  • Maltego → A commercial product that assists with the visualization of data gathered from OSINT efforts.

Vulnerability Scanners

  • Nessus → A commercial vulnerability scanning tool used to scan a wide variety of devices.
  • OpenVAS → An open source alternative to commercial tools such as Nessus. OpenVAS also performs network vulnerability scans.
  • Sqlmap → An open source tool used to automate SQL injection attacks against web applications with database back ends.
  • Nikto, Wapiti, and W3AF → Open source web application vulnerability scanners. WPScan is a web application testing tool designed to work with websites running the WordPress content management system.
  • Security Content Automation Protocol (SCAP) → A set of tools designed to help organi- zations manage compliance with security standards.

Social Engineering

  • The Social Engineer Toolkit (SET) → Provides a framework for automating the social engi- neering process, including sending spear phishing messages, hosting fake websites, and collecting credentials.
  • Browser Exploitation Framework (BeEF) → Provides an automated toolkit for using social engineering to take over a victim’s web browser.

Credential Testing Tools

  • Hashcat, John the Ripper, Hydra, Medusa, Patator, and Cain → Password-cracking tools used to reverse-engineer hashed passwords stored in files.
  • CeWL → A custom wordlist generator that searches websites for keywords that may be used in password-guessing attacks.
  • Mimikatz → Retrieves sensitive credential information from memory on Windows systems.
  • DirBuster → A brute-forcing tool used to enumerate files and directories on a web server.

Debuggers and Software Testing Tools

  • Immunity Debugger → Designed specifically to support penetration testing and the reverse engineering of malware.
  • GDB → A widely used open source debugger for Linux that works with a variety of programming languages.
  • OllyDbg → A Windows debugger that works on binary code at the assembly language level.
  • WinDbg → Another Windows-specific debugging tool that was created by Microsoft. IDA is a commercial debugging tool that works on Windows, Mac, and Linuxplatforms.
  • Brakeman → A static software analysis tool used for scanning Ruby on Rails applications.
  • Covenant → A software security testing tool used for testing .NET applications.
  • TruffleHog → A tool that scans through code repositories for accidentally published secrets.

Network Testing

  • Wireshark → A protocol analyzer that allows penetration testers to eavesdrop on and dissect network traffic.
  • Hping → A command-line tool that allows testers to artificially generate network traffic.
  • Aircrack-ng, WiFite, mdk4, Fern, and Kismet → Wireless network security testing tools.
  • Rogue wireless access points → Used to attract connections from unsuspecting users. - EAPHammer → Used to conduct evil twin attacks against WPA2-Enterprise wireless networks.
  • Reaver → Used to conduct attacks against networks that support Wi-Fi Protected Setup (WPS).
  • Spooftooph → Used to perform attacks against Bluetooth-enabled devices.
  • The Wireless Geographic Logging Engine (WiGLE) → An open database of wireless network information collected by the community and published for open access.
  • Online SSL checkers → Used to determine whether websites are susceptible to SSL and/ or TLS vulnerabilities.

Remote Access

  • Secure Shell (SSH) → Provides secure encrypted connections between systems.
  • Ncat and Netcat → Provide an easy way to read and write data over network connections.
  • Proxychains → Allows testers to force connections through a proxy server where they may be inspected and altered before being passed on to their final destination.

Exploitation

  • Metasploit → The most popular exploitation framework and supports thousands of plugins covering different exploits.
  • SearchSploit → A command-line tool that allows you to search through a database of known exploits.
  • PowerSploit and Empire → Windows-centric sets of PowerShell scripts that may be used to automate penetration testing tasks.
  • Responder → A toolkit used to answer NetBIOS queries from Windows systems on a network.
  • Impacket → A set of network tools that provide low-level access to network protocols.
  • Mitm6 → A tool used to conduct attacks against IPv6 networks.
  • CrackMapExec → A set of tools used after gaining access to a network to assess the secu- rity of an Active Directory environment.

Steganography

  • Open Steg and Steghide → A general-purpose steganography tools used to hide text within images and other binary files.
  • Coagula → Used to embed text within audio files.
  • Sonic Visualiser → An audio analysis tool that may be used to detect alterations made by steganography tools.
  • Snow → Uses whitespace and tabs within a document to hide information.
  • TinEye → A reverse image search tool that allows security researchers to identify the original image when they suspect steganography is being used.
  • Metagoofil → Used to extract metadata from a large variety of file types.

Cloud Tools

  • ScoutSuite → A cloud security auditing tool that can work across commonly used cloud environments.
  • CloudBrute → A scanner used to identify the cloud components used by an organization. Pacu is a cloud exploitation framework focused on Amazon Web Services (AWS)-hosted environments.
  • Cloud Custodian → A rule enforcement engine that allows the consistent application of security policies across cloud environments.