-: Maintaining access, hold on tight. 2 2
So, at this point we've gained our access, 3 3
we've escalated our privileges and now we want 4 4
to maintain access. 5 5
How are we going to do that? 6 6
Well, as an attacker, 7 7
we're gonna use a couple different techniques. 8 8
One is we're gonna have networks sniffers, 9 9
we're gonna steal additional passwords, 10 10
we're gonna do lateral movement to other targets, 11 11
and we're gonna open ports to start services. 12 12
So, one of the first things we want to do 13 13
is we wanna survey the host and understand it's posture. 14 14
We want to look for others on the system. 15 15
Am I really alone here? 16 16
What if I broke into a system, 17 17
and that target had already had some other attacker 18 18
on there. 19 19
Well, I don't want to be fighting with another attacker, 20 20
so I either want to kick them off, and secure the system 21 21
for myself, or I might want 22 22
to go look for a different target. 23 23
Our goal here is we want to keep persistent access. 24 24
If there's two of us on the system, 25 25
we can actually start tripping each other up. 26 26
And the system admins can find us quicker. 27 27
That's not going to be good for us, 28 28
that's not going to be good for our persistent access. 29 29
So, once we've done this, we maintain our access 30 30
we're going to be ready for our data exfil, 31 31
we're going to be able to do our data compromise, 32 32
we'll be able to take over the system, 33 33
and do whatever it is for our long term benefit. 34 34
But in the mean time we want to make sure we 35 35
maintain access. 36 36
So that target is there when I want it, anytime I want it. 37 37
So one of the first things we can do is we can use 38 38
network sniffers. 39 39
Now, if you're on the same network as the target, 40 40
you can use Wireshark, and Wireshark is great for this. 41 41
You turn on Wireshark, you can capture all of the 42 42
data into a pcat file, which is network data. 43 43
And then you can go through it at your leisure 44 44
and take what you want. 45 45
Now, if you're not on there and you're doing this 46 46
remote access, you can use Meterpreter, 47 47
because Meterpreter has a built in sniffer as well. 48 48
And so if I attack from my Meterpreter 49 49
coli-box, into a Windows environment or a Linux 50 50
environment, I can actually use Meterpreter's built-in 51 51
sniffer to start capturing traffic and download those 52 52
PCAT files back to myself. 53 53
So, in Meterpreter how do we do that? 54 54
Well if you R from the meterpreter prompt, 55 55
you just type in "load sniffer", and it loads in 56 56
the sniffer module. 57 57
And at that point type in "help", and you'll get 58 58
the information about how to use this system. 59 59
So when we type in "help", you'll see something like this. 60 60
So if you do "sniffer_start", you'll actually be able to 61 61
start capturing the network data on the network. 62 62
If you do "sniffer_stats", it'll tell you how much 63 63
has been captured and the statistics currently there. 64 64
If you do stop, and dump, you'll be able to get that data 65 65
back to yourself. 66 66
One of the things we do during this phase, 67 67
is we also want to move laterally. 68 68
And by moving laterally, 69 69
we have gotten into a certain target. 70 70
For instance we may have attacked a vulnerable web server, 71 71
as in this picture here. 72 72
Now I might want to move from there onto a client that's 73 73
not checked as often, so that I can have that 74 74
persistent access. 75 75
And so from one system, I can jump from one, to another, 76 76
to another, to another, and work my way around the network. 77 77
Everywhere I go, I can drop and keep myself persistent 78 78
access so that I have additional points of presence. 79 79
The other thing we talked about was getting more passwords. 80 80
How do we do that? 81 81
Well, if we're doing network sniffing, we're going to be 82 82
able to capture more usernames and passwords that way. 83 83
If we do keystroke logging, we can get more 84 84
usernames and passwords that way. 85 85
We can also go, and if we've gotten system or domain 86 86
level admin, we can start creating additional 87 87
user accounts for ourselves, 88 88
so we have them in the future as well. 89 89
So as we do this lateral movement, we're going to jump 90 90
from place to place. 91 91
How do we find places to go? 92 92
Well one of the great ways is ARP. 93 93
And ARP is a way to find potential Ips to go after. 94 94
One of the things that's provided for us inside 95 95
Metasploit is an ARP scanner. 96 96
Again if we are using the PCAP, in PCAP we're 97 97
going to be able to find ARP callouts from 98 98
machine to machine, because machines do this 99 99
all the time. 100 100
As I generate this list of IPs, I can use 101 101
more different techniques going back again to 102 102
that enumeration phase, and restarting that part 103 103
as an internal look, and see what's going on. 104 104
There's also scanners like port scanners and TCP scanners 105 105
built into Meterpreter that you can use, such as 106 106
the auxiliary/scanner/portscan/tcp. 107 107
But again as you're getting this network data and you start 108 108
looking around, you're going to start going through 109 109
and doing more of that reconnaissance and enumeration again, 110 110
and we start figuring out where else we can go inside 111 111
the network. 112 112
These are the keys to maintaining your access. 113 113
It's all about more usernames, more passwords, 114 114
more targets, and moving laterally. 115 115
If you can do this, you can start spreading yourself out 116 116
and putting hooks in everywhere, makes it very 117 117
difficult for the defenders to start clearing you out 118 118
when they find you.