WEBVTT 00:00:01.440 --> 00:00:05.320 Are you looking for a proxy‑aware command and control framework to 00:00:05.320 --> 00:00:08.390 leverage against remote hosts during an attack engagement? 00:00:08.840 --> 00:00:12.560 Hello, and welcome to Command and Control with PoshC2. 00:00:13.140 --> 00:00:15.330 I'm Jeff Stein, and in this course, 00:00:15.340 --> 00:00:19.050 I will take you through how you can use PoshC2 to engage in 00:00:19.050 --> 00:00:22.430 a number of post‑exploitation activities in a red team 00:00:22.430 --> 00:00:24.060 environment against your target. 00:00:24.640 --> 00:00:28.390 We will walk through system enumeration techniques to help plan our 00:00:28.390 --> 00:00:31.800 attack and apply our findings towards data exfiltration, 00:00:31.810 --> 00:00:34.660 harvesting credentials for privilege escalation, 00:00:35.040 --> 00:00:37.470 and moving laterally through our victim network. 00:00:38.440 --> 00:00:42.870 Before we get started, let's jump into a quick overview of what PoshC2 is. 00:00:44.240 --> 00:00:48.880 PoshC2 is a command and control framework used to assist with red teaming, 00:00:49.010 --> 00:00:51.560 post exploitation, and lateral movement. 00:00:52.240 --> 00:00:54.250 It was created by the team at Nettitude, 00:00:54.640 --> 00:00:57.890 and I want to thank them for their efforts in developing and maintaining 00:00:57.890 --> 00:01:01.840 the framework. PoshC2 has many different features, 00:01:02.100 --> 00:01:05.950 but overall was designed for penetration testers to leverage during post 00:01:05.950 --> 00:01:10.570 exploitation while offering them the ability to customize or extend the C2 00:01:10.570 --> 00:01:13.190 framework to suit their needs and environment. 00:01:13.940 --> 00:01:18.320 PoshC2 is an open source tool available on GitHub and can be either 00:01:18.320 --> 00:01:22.910 cloned or installed via an install script. In addition to the core 00:01:22.910 --> 00:01:26.430 functionality of the tool, one of the great aspects of the project 00:01:26.430 --> 00:01:30.350 is the modular approach that extends the PoshC2 command and control 00:01:30.350 --> 00:01:31.260 capabilities. 00:01:32.100 --> 00:01:36.180 Scripts can be written or customized and then loaded into the PoshC2 00:01:36.180 --> 00:01:39.750 framework as modules to run during your attack engagement. 00:01:40.240 --> 00:01:44.200 Also, the framework leverages a configurable implant beacon feature, 00:01:44.620 --> 00:01:48.300 which allows you to effectively evade defensive measures while working 00:01:48.300 --> 00:01:50.710 with the implants running on a compromised host. 00:01:51.140 --> 00:01:55.190 Now that we have a good idea of how we will utilize PoshC2, let's 00:01:55.190 --> 00:01:58.620 take a look at where the tool falls on the kill chain. If you're 00:01:58.620 --> 00:02:00.200 familiar with the Cyber Kill Chain, 00:02:00.200 --> 00:02:05.280 you will see that the features of PoshC2 can be used post exploitation and 00:02:05.280 --> 00:02:08.370 continue on through the remaining phases of the kill chain. 00:02:09.139 --> 00:02:11.440 If we map the techniques we will learn during this 00:02:11.440 --> 00:02:13.430 course to the MITRE ATT&CK framework, 00:02:13.440 --> 00:02:17.500 we will be covering two of the attack framework categories, in Discovery, 00:02:17.840 --> 00:02:22.240 including Account Discovery with coverage of the Local Account sub‑technique, 00:02:22.640 --> 00:02:27.700 as well as Command & Control, with Application Layer Protocols using the Web 00:02:27.700 --> 00:02:31.350 Protocols sub‑technique and Remote Access Software. 00:02:32.940 --> 00:02:37.750 Now let's quickly review how our attack scenario will look with PoshC2. We 00:02:37.750 --> 00:02:40.810 will start by targeting the email system of Globomantics, 00:02:41.010 --> 00:02:45.010 an evil corporation to gain initial access leveraging a spear‑phishing 00:02:45.010 --> 00:02:48.660 attack to carry our PoshC2 payload to our target. 00:02:49.440 --> 00:02:51.680 Once we have an implant loaded on our victim, 00:02:51.690 --> 00:02:54.250 we will begin our command and control communication 00:02:54.250 --> 00:02:56.670 channel to leverage in exfiltrating data, 00:02:57.240 --> 00:03:00.670 gaining privileged access, and finally, moving laterally through the 00:03:00.670 --> 00:03:03.750 Globomantics network as we continue our attack.