PenTest+ Module 24 - Automated Attacks

Automated Attacks

Involve the use of scripts and automated tools to systematically exploit vulnerabilities in systems and networks

Empire

Post-exploitation framework that allows to run PowerShell agents without needing PowerShell.exe which helps evade detection

PowerSploit

Collection of PowerShell scripts that can be used for post-exploitation, reconnaissance, and exploitation

Invoke-AllChecks - PowerSploit

Used to check for potential privilege escalation opportunities on a Windows machine

Invoke-Shellcode - PowerSploit

Allows to inject shellcode directly into the memory of a running process

PowerView

Collection of PowerShell scripts that helps map out an Active Directory environment. Includes identifying users, groups, computers, and the relationships between them

Primary use is to map out users, groups, and computers in an Active Directory domain

PowerUpSQL

Collection of PowerShell functions that make it easier to find, access, and exploit SQL Server installations, which are often critical assets in an organization

Get-SQLServerInfo - PowerUpSQL

PowerUpSQL command that can help gather detailed information about a specific SQL Server instance, including the version, users, and roles

Invoke-SQLEscalatePriv - PowerUpSQL

PowerUpSQL function, which can automate attempts to escalate privileges on the SQL Server

Get-SQLServerLoginDefaultPw - PowerUpSQL

PowerUpSQL command, which allows to find SQL Server instances in the domain and determine if they are configured with default passwords commonly used by applications

Get-SQLServerLink - PowerUpSQL

PowerUpSQL command, which identifies linked servers that might allow to move from one server to another

PowerShell

Powerful tool for automating tasks in Windows environments

Cmdlets - PowerShell

Allow to query and manipulate AD objects such as users, groups, and computers

Get-ADUser - PowerShell

Most basic cmdlet used for AD searches

Retrieve information about user accounts in AD

Scapy

A Python-based packet manipulation tool and library that captures, forges, decodes, and analyzes network packets

Mainly used to craft and manipulate network packets

Caldera

Open-source platform developed by MITRE that focuses on automating adversary emulation

Automates breach and attack simulations (BAS) based on the MITRE ATT&CK framework

Breach and Attack Simulation (BAS) Tools

Designed to mimic the actions of attackers as they attempt to breach a network and move laterally within it

Infection Monkey

An open-source tool that acts like a kind of “malware vaccine” for the network

Is essentially an adversary emulation tool

Helps simulate malware-like attacks to improve network security

Agent - Infection Monkey

Like a network worm that user can configure to spread through the network, steal data, and deliver payloads

Monkey Island - Infection Monkey

Command and control server

Atomic Red Team

An open-source tool that makes it easier to see how a network would hold up against specific techniques used by attackers

Tool based on the MITRE ATT&CK framework, which is a comprehensive list of the tactics and techniques that attackers use

Simplifies the simulation of individual attack techniques from the MITRE ATT&CK Framework

Atomic Tests - Atomic Red Team

Mimic real attacks without needing a lot of setup or specialized knowledge