Gaining access phase. So here's the point 2
we're going to start gaining our 3
foothold into the system. So we've done 4
all of our research, we've done all of 5
our enumeration or scanning, and now is 6
the time to actually launch that attack, 7
we're going to gain our access. So at 8
this point in the attackers methodology, we are 9
going to exploit something in the 10
operating system to be able to get 11
ourselves into that. Whether that's going 12
to be a client-side, a remote side, or 13
other type of attack, this is where we're going 14
to do our exploitation. So step three is 15
gaining access, and this is where we're 16
going to perform our exploits for the 17
first time in order to gain our access 18
into the system. So we can do this 19
through a client-side, or remote 20
exploitation attack. That's things like 21
social engineering, open wireless 22
connections, software bugs, unpatched 23
systems, web application vulnerabilities, 24
backdoors, buffer overflows, Trojans, 25
there's numerous ways to gain access. And it 26
really doesn't matter which way we're 27
going to use to gain access, the point is 28
we're going to get our access into the 29
system. Now, as we start going through 30
this in our lab, what we're going to 31
use is a simple buffer overflow type 32
attack. We're also going to use in our 33
lab some other types of things, such as 34
the unpatched software. So, if there's a 35
system that hasn't been patched with the 36
latest update, we can take that, use that 37
to our advantage, and break into the 38
system that way. So gaining access, how do 39
we gain access? Well, it's really just a 40
three-step process. We're going to 41
identify the target with the 42
vulnerability, we're going to find a 43
matching exploit, and then we're going to 44
select a payload. Now what do those 45
three things really mean? Well, a 46
vulnerability is a software coding error, 47
so if usually a software bug. It could 48
also be a misconfiguration of the 49
software as well, that allows us to gain 50
access to the target operating system. So 51
for instance if you're running Microsoft 52
Windows, and you didn't apply the patch 53
that came out last Tuesday that is a 54
known vulnerability, that can be 55
something that I can attack. So that 56
vulnerability just means that there's a 57
hole that can be exploited, it doesn't 58
mean that it was exploited. Now if we 59
move on to an exploit, an exploit is 60
actually the method of delivery that the 61
payload uses to accomplish the goal that 62
it wants to do to get access. So to 63
exploit it is actually to take that 64
vulnerability, and find a way to break 65
into the system using that vulnerability. 66
So an exploit is a method of delivery of 67
a payload, and we're going talk about 68
payloads here in a second, but we want to 69
deliver that payload to accomplish 70
a specific goal. So when we have that 71
vulnerability, it just means there's a 72
hole there. But now how do we actually 73
break in to get through that hole is the 74
exploit itself. So if there was a 75
software bug or misconfiguration out 76
there that was identified, that's the 77
vulnerability. Now if we reverse-engineer 78
that, and find a way that we can exploit 79
that, that's where that exploit and that 80
exploitation can occur. Now when we get into 81
payloads, this is the effect. A payload of 82
the effect caused by a virus or other 83
malicious code that we want something to 84
happen. So when we have a vulnerability, 85
that's the hole, we have the exploit the 86
method, we then do the thing which is the 87
payload. So the payload is the actual 88
code that's going to be run once the 89
exploit occurs. So if we think about it 90
like a house for instance, just because 91
you left the front door open doesn't 92
mean the bad guys going to break in, but 93
if the bad guy finds that you left the 94
front door open and he turns the handle, 95
that's the exploit that allows him to 96
open the door. But he hasn't really done 97
anything yet. Now once he steps through 98
that door and grabs your TV, and walks 99
off, that was the payload, the theft of 100
the TV. So those are how we have that 101
vulnerability, that exploit, and that 102
payload and how they relate to each other. 103
Now, as we go into our next couple of 104
lectures, we're going to go into a deeper 105
dive here. We're going to go into the lab 106
environment, and we're going to walk 107
through how a buffer overflow occurs, 108
what a buffer overflow is, why it 109
occurred, and how we can use that to our 110
advantage. We're also going to talk about 111
different payloads. We're going to talk 112
about shellcode, we're gonna talk about 113
bind and reverse shell code, and we're 114
also going to talk about meterpreter, 115
which is a specific type of shell code 116
that we use inside the metasploit 117
environment, the metasploit framework 118
that we're using as our attack platform. 119
So as we keep going through this, we're 120
going to go through this gaining access 121
phase, we're going to dive in just a 122
little bit deeper into each of these 123
areas, but again the gaining access is 124
just a big concept of finding a 125
vulnerability, exploiting that 126
vulnerability, and delivering and 127
executing a payload.