comptia pentest chapter 7: enterprise attack

Common targets of using default credentials include:

Network devices (routers, switches, firewalls, etc.)

Web applications

Databases

IoT devices

Administrator logins for software

On-Path Attack with Netcat

used to open up a TCP or UDP connection between two computers on the network using any specified port. To carry out an attack, netcat must first be installed on the remote system. This can be done through a variety of methods.

Once netcat is on the remote system, the attacker can use the following command to intercept traffic from the target system:

nc -l -p <port>

While tools like netcat can be used for an on-path attack, in most cases, carrying out the on-path attack requires some type of spoofing.

spoofing

With an on-path attack, a malicious actor is in the middle of a communication channel and is able to intercept all traffic. This is generally done by using either a spoofing or cache poisoning strategy, such as one of the following:

Domain Name System (DNS) cache poisoning sends bogus records to a DNS resolver. When the victim requests an IP address, the DNS server will send the wrong IP address. That will redirect traffic to the malicious actor's IP address instead of the web server's IP address.

Address Resolution Protocol (ARP) spoofing transmits spoofed ARP messages out on the LAN. The spoofed messages falsely report a malicious actor's MAC address as being the victim's address. Similar to a DNS cache poisoning attack, this will redirect traffic to the malicious actor instead of the victim's MAC address.

MAC address spoofing will modify the MAC address on the malicious actor's NIC card so that it matches the MAC address on the victim's machine. Once done, the traffic will be directed to both the victim and the malicious actor.

Poisoning LLMNR and NBT-NS

are two name resolution services used in a Windows environment to resolve network addresses. During name resolution, if a Windows host cannot resolve a domain or host name via a DNS server, it will query other hosts on the local segment. By default, the process will first use LLMNR, and if that fails, it will try the NetBIOS Name Service (NBT-NS).

The main components of digital certificates include:

Public Key Infrastructure (PKI)- Guidelines that govern the issuance and management of digital certificates. PKI certificates verify the owners of private keys used to create digital certificates.

Certificates- The certificate itself is a digital document that uses cryptographic keys to verify users, devices, and services.

Certificate Authority (CA)- The CA is the trusted entity that issues and manages certificates within a PKI. This can be an external CA or internal to the organization.

Certificate Templates- The network administrator can streamline the process of requesting, issuing, and managing certificates by creating templates. These are predefined certificates that ensure consistent settings across the organization's PKI.

Certificate Services Attack Tools

a collection of Python tools that are designed to work with different network protocols. These Python tools can also be used to enumerate the domain environment to carry out attacks.

Another great tool is CrackMapExec. This tool can also be used to perform enumeration on a Windows domain and can also carry out certificate services attacks.

DLL Hijacking

Many Windows applications and services load DLL files when started. The pentester may be able to replace a DLL file with one they have created that will run malicious code with the same access level as the service itself.

VLAN Hopping

the act of illegally moving from one VLAN to another. To launch this attack, a malicious actor can do one of the following:

Launch a Mac Flooding attack, which overflows the MAC table on a vulnerable switch so that it behaves like a hub, repeating frames out all ports.

Some other packet crafting techniques that can be used to bypass the IDS include:

Fragmentation- Splitting the packets into small chunks so the IDS does not detect them.

TTL Evasion- Packets are crafted with a TTL value so they will expire before reaching the IDS, but not the target system.

Alternate Encoding - The packets are encoded in a way so the IDS will not decode them, but the target system will (ie. base64).

Source Routing - Customizing the route the packet takes to reach the destination so that it avoids any security systems.

Manipulating Source Port- If the IDS is configured to trust or block traffic based on ports, the packet can be crafted to use an allowed port instead so it will bypass the IDS.

multifactor authentication fatigue attack

occurs when an attacker has gained access to one authentication method and then attempts to overload the user with requests for a second authentication approval.

pass the hash attack

occurs when the pentester logs on to the target operating system or application providing the username and the hash of the password, rather than the password itself. The hash is obtained by inducing the operating system or application to dump them from RAM, the Windows Registry, or a credentials file.

If the pentester wants to pass the hash of another local admin

they could disable the restriction by navigating to the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Sys and then creating a DWORD entry of LocalAccountTokenFilterPolicy with a value of 1.

pass-the-token attack, also known as a pass-the-PRT attack

allows the pentester to laterally move through the organization's cloud infrastructure while bypassing authentication measures such as MFA. This attack targets the primary refresh token (PRT) which is like a TGT used in an Active Directory environment, except the PRT is used to keep the user authenticated in the cloud environment, such as Azure.

pass the token attack process

The user logs in to their Windows machine which communicates with the cloud authentication provider.

The Azure Active Directory validates the user's credentials and sends back the PRT and a session key.

The session key is encrypted using the device's TPM and then stored along with the PRT in the Local Security Authority Subsystem Service (LSASS).

Now when the user logs in to a cloud resource using the web browser, the cloud authentication provider creates a PRT cookie for the browser which is used to get tokens from Azure AD.

Azure AD validates the PRT cookie and grants the user access.

Kerberoasting

When carrying out a kerberoasting attack, the pentester will do the following:

Get user Service Principal Names (SPN), which will identify all accounts that are candidates for Kerberoasting.

From the list of SPNs, get the service tickets of an interesting target, such as a server.

Dump out the service ticket, which is encrypted with the NTLM hash of the requested service account.

Crack the account's plaintext password offline.

Delegation Attacks

There are three types of delegation in Kerberos:

Unconstrained Delegation - This allows a user or service to delegate authentication with no limitation on the scope of access granted. This is the least secure option and should not be used.

Constrained Delegation - This option restricts the delegation to specific services that can be accessed on behalf of the user.

Resource-Based Constrained Delegation - This option essentially reverses constrained delegation. The resource being accessed specifies which objects can delegate to it. This is the most secure delegation option.

Golden Ticket Attack

The ultimate goal when pentesting a Kerberos network is to gain access to the Kerberos Distribution Center. If the pentester can steal the hash of the Active Directory Key Distribution Service Account (KRBTGT), they will essentially be able to grant themselves valid tickets whenever they want. This is known as the golden ticket.

LDAP injection attack is very similar to a SQL injection attack

LDAP injection can be used to:

Bypass Authentication- The pentester can use LDAP injection to attempt to bypass user authentication. For example:

Typing *)uid=* in the username field and * in the password field will send the query (&(uid=*)(password=*)) to the LDAP server. This command will essentially tell the server to login using any account that is not empty (basically every account). This would bypass authentication and grant the pentester access.

Stealing Information- A malicious LDAP command can be sent to the server with the hopes of retrieving sensitive information such as user logins.

Denial-of-Service Attack- LDAP injection can also be used to carry out a DoS attack against the server.

mask attack

password cracking technique that is similar to a brute-force attack, but is more systematic and typically quicker. In a mask attack, the password cracker can try specific combinations of characters and password lengths.

When creating a mask in Hashcat, it will use the following to symbolize the different character sets:

?u = upper case

?l = lower case

?d = number

?s = special character

Password spraying

type of brute-force attack, but instead of trying to crack the password, the pentester attempts to crack the username.

Credential stuffing

type of brute force attack where an attacker obtains a user's login credentials from one organization and uses those login credentials on another site or app. The hope with this attack is that the user has an account with the second site and is reusing the same credentials.

OpenID Connect (OIDC) Attacks

authentication protocol that is based on the OAuth 2.0 authorization framework. OAuth allows a user to give a web app limited access to their account on another web app or site. For example, an application on a users phone may request access to their email contacts so it can recommend other users to connect with. The user can grant that access without providing their email login credentials to the requesting app.

OpenID consists of three main components:

Relaying Party - this is the site or app requesting authentication (in the above example, this would be CompTIA).

End User - This is the person being authenticated.

OpenID Provider - Account that is authenticating the user (Google, Facebook, LinkedIn, Apple, etc.).

Security Assertion Markup Language (SAML)

is an open standard that allows two parties to exchange authorization and authentication information using XML. SAML allows users to access multiple systems with a single sign-on. The following are the core components of SAML:

Identity Provider (IdP) - This is the entity responsible for verifying the user's identity.

Service Provider (SP) - The service the user needs to access.

Security Assertion Markup Language (SAML) Attacks types

XML Signature Wrapping - The contents of the XML file are edited to include malicious data while maintaining the original valid signature.

Assertion Tampering - The assertion statements are intercepted and altered changing the attributes or authorization data.

On-Path and Replay attacks - If the attacker can intercept a legitimate SAML assertion, they can use a replay attack to gain unauthorized access.

Some common types of host-based attacks that can be performed include:

Privilege-escalation attacks- These attacks are designed to grant the pentester privileges with higher access than what they currently have. To perform these attacks, the pentester will need to bypass UAC controls, disable security tools, dump credentials, and obfuscate payloads.

Misconfigured endpoints- Taking advantage of misconfigured network devices will allow the pentester to gain unauthorized access to these devices.

Injection attacks - Injecting malicious code into hollowed processes can give the pentester access to resources on the host machine. The pentester can also take advantage of unquoted service paths to gain access.

Escape attacks- Escaping from a shell or kiosk allows the pentester to access additional resources on the machine.

Log tampering- The pentester will need to perform log tampering to hide their tracks.

the following are common locations where credentials may be stored:

Databases- Websites will typically store user accounts in a database.

Security Accounts Manager (SAM)- This is a database in Windows that is used to authenticate system users.

Local Security Authorization (LSA)- The LSA is the service that handles authentication and security policies in Windows. Credentials for users that are interactively logged in are stored in the LSASS.

Active Directory- Authentication credentials are stored in an Active Directory database.

The most common tool used to dump credentials is Mimikatz.

This command-line tool can be used to pull credentials from the SAM database, LSASS, and more. It also has functions to help with performing Kerberoasting and also manipulating Active Directory to gather credentials.

For example, using the lsadump::lsa /patch module in Mimikatz will simply dump all hashes that are in the LSASS.

Living-off-the-land

Once the pentester has access to a host machine, they can use built-in system tools (such as PowerShell) to disable local security tools

Seatbelt will need to be run on the endpoint the pentester wants to scan. Seatbelt can scan for specific items or a full scan can be run using the command Seatbelt.exe -group=all.

Some of the areas that Seatbelt can scan for include:

Credentials- Seatbelt can look for stored passwords including passwords stored in the web browsers.

Processes and Services- Seatbelt can identify processes and services that are running with elevated privileges.

Network information- This includes network shares that might be accessible.

User Information- Information on local user accounts including privileges, credentials, and more.

polymorphism

payload's code is changed every time it's generated without changing the functionality.

User-Access Control Bypass

is a security feature in Windows that is designed to help prevent unauthorized changes. This feature works by prompting users for confirmation before allowing changes to be made. This is to help prevent malicious apps from making changes to the system.

Shell Enumeration

Before the pentester can escape the restricted shell, they need to first understand what type of shell environment they are in. There are many different types of shell environments including PowerShell for Windows and different shells for Linux including Bash, rbash, lshell, rssh, zsh, and others. The first step is to figure out what type of shell environment is being used and what type of access the pentester has. This can be done in few ways:

Type env and look for the SHELL variable. This should list the type of shell environment.

If env cannot be run, type echo $PATH or echo $0 to see if the shell environment can be returned.

Try typing in a fake command (ie. notacommand). Sometimes the error message will list the shell environment.

Kiosk Escape

Once the pentester has access to a File Explorer window, they can navigate through the system and access applications, open a command shell, and perform a variety of tasks. For example:

The pentester uses the CTRL + O shortcut to access the Open File function.

In the address bar, the pentester types shell:System.

The File Explorer will now move to the Windows\System32 folder.

process hollowing attack

stealthy attack in which the pentester injects malicious code into a legitimate process that is already running on the computer. In this attack, the memory space of the process is hollowed out and replaced with malicious code. Because the malicious code is running inside of a legitimate process, this attack can be extremely difficult to detect.

The steps to carry out this attack are: Process Hollowing and Injection

Identify a process that can be exploited. The process will be started, but immediately paused. This can be accomplished using the Windows API function 'CreateProcess' with the 'CREATE_SUSPENDED' flag.

Using a function like 'ZwUnmapViewofSection' or another similar function, the legitimate code will be removed from the process.

The 'VirtualAllocEx' function can then be used to allocate memory in the suspended process.

The malicious code is injected into the allocated memory using the 'WriteProcessMemory' function.

The now malicious process is then restarted and the malicious code will be executed.

Audit logs

which are created by the Operating System. These logs keep track of file access, changes made to the system, and other records about events that occur on such systems.

Application logs

are created by programs or applications in order to keep track of what occurs within their memory space.