Comptia pentest chapter 5: conducting pentest attacks

First step in pentesting is to always?

pentester needs to look at is to double check the scope of the pentest.

High value asset (AV) are

Some examples of high-value assets include:

Customer data - This can include Personal Identifiable Information (PII) such as names, addresses, phone numbers and email addresses.

Intellectual property - Company secrets, recipes, and other proprietary company information.

Authentication systems - Passwords, MFA systems, and biometrics are examples of authentication systems.

Financial systems - Anything to do with the financial aspects of the organization, such as what system is used to handle business transactions.

Critical infrastructure - Servers, network systems, and cloud services are all examples of critical infrastructure.

Regulatory compliance data - Many organizations must stay in compliance with regulatory agencies. For example, medical organizations need to remain in compliance with HIPAA.

Common Servces the pentester uses

Web servers such as Apache and IIS

Databases such as SQL

File servers such as FTP and SMB

Email servers

Remote access services

Vulnerable encryption methods

MD5, SHA1, DES, WEP, RC2, LM hash, CRC and blowfish

Load balancer

stabilize network traffic across two or more servers. As shown in the graphic, balancing the load prevents any one server from getting too many requests:

Firewalking

technique that uses a combination of traceroute and port scanning to discover the details of the internal network. Firewalking works by first determining the number of hops a packet takes to get to the firewall. Once this is known, the pentester will send packets that are set to target specific ports or protocols with the TTL set to one hop past the firewall.

If the firewall allows the packet through, the target responds, indicating that the port or protocol is permitted.

If the firewall blocks the packet, no response is received, or a message that the destination is unreachable is returned.

SOAR system

can take this a step further and can actively respond to potential security threats, compared to SIEM System

metaploit commands

RHOSTS - (remote) target names or addresses

LHOST - attacker ("listener") address

RPORT - target port

LPORT - attacker listener port

SMBUser - a username for SMB-based attacks

SMBPass - a password for SMB-based attacks

msfvenom

customize exploits is msfvenom which is included with the Metasploit Framework. Msfvenom can be used to generate payloads for multiple platforms and supports a variety of payload formats. One feature of msfvenom is the ability to easily customize payloads by specifying options such as payload type, target architecture, encoding, and output format.

Before an attack commences, proper documentation and planning should be done. These diagrams are essential in visualizing the attack; create low level diagram

The diagram should include all phases of the pentest, including:

Reconnaissance / Enumeration

Scanning / Vulnerability Assessment

Exploitation

Post-Exploitation

Reporting

During the reconnaissance, enumeration, and scanning phases of the pentest, many diagrams of the network systems and how they are all interconnected will have been generated. These maps should all be used to help fully see and understand how the network is organized.

An attack path map should contain the following components:

Nodes that represent all known network devices.

Connections and relationships between each nodes. This can include network links, communication channels, and trust relationships.

Attack paths that show the potential paths an attacker can take to move through the network to reach high-value targets.

Attack vectors showing the methods and techniques used to exploit vulnerabilities. This can include phishing attacks, malware, privilege escalation, and more.

PowerUpSQL

uses PowerShell modules to discover, enumerate, pull credentials, and exploit Microsoft SQL Servers.

bash commands

The following is an example of a simple Bash script named admin-hash-pull that outputs a Windows Administrator's LM/NTLM hash from a dump file:

#!/bin/bash

echo "Pulling Admin password hash from dump file..."

grep "Administrator" /root/dumps/winsrv_hash_dump.txt | cut -d ":" -f3-4 > admin-hash.txt

echo "Admin LM/NTLM hash extracted!"

The first line of the script indicates what type of interpreter the system should run, as there are several scripting languages beyond just Bash. The echo lines simply print messages to the console.

The grep command searches for any line in the hash dump text file that contains the text "Administrator." This command is then piped to the cut command which trims the output to only show the LM/NTLM hash values. These results are sent to a file called admin-hash.txt.

Impacket tool

how Python scripts can be used by the pentester. Impacket is a collection of Python scripts and libraries that can be used to perform a wide variety of tasks, such as:

Network enumeration

Credential dumping

Remote command execution

Exploitation

Scapy tool

another powerful Python based tool used in pentesting for network packet manipulation, crafting, and analysis. Some of the key features of Scapy include:

Crafting custom network packets from scratch, specifying every field in the packet headers. This is useful for testing network protocols and for creating custom traffic patterns.

Packet sniffing

Support of numerous protocols, including Ethernet, IP, TCP, UDP, ICMP, ARP, DNS, HTTP, and more.

Network discovery

As a Python library, Scapy can be integrated into Python scripts.

Breach and Attack Simulation (BAS)

allows organizations to simulate real-world attack scenarios in a controlled environment using specialized tools and software. The primary goal is to identify vulnerabilities and weaknesses in an organization's security before they can be exploited.

popular BAS platforms include:

Atomic Red Team is an open-source project that provides a library of simple, prescriptive, and flexible tests. Each "atomic test" is designed to be as simple as possible, allowing users to understand and execute them with minimal setup and are mapped to the MITRE ATT&CK framework.

Infection Monkey is an open-sourced BAS tool that mimics the behavior of a human attacker. It is designed to be both comprehensive and easy to use by automatically simulating a variety of attack techniques, including exploitation of vulnerabilities, lateral movement, and data exfiltration.

Caldera is an open-sourced tool developed by the MITRE corporation. It is designed to simulate sophisticated cyber attacks against enterprise networks by emulating the behaviors and techniques of real-world threat actors.