Combining the Pieces
Throughout this course, we introduced various concepts and attack vectors
and have used both existing and custom tools to exploit those vectors.
In most of these scenarios, the exercises we completed were isolated.
However, in a real-world penetration test we will often combine attacks
and techniques, chaining them together while evading and bypassing antivirus
and other protection mechanisms.
In this module, we will walk through an attack against a network of machines,
combining various attacks and techniques in a simulated penetration test.
Before we begin, let’s reiterate some concepts as they apply to this module.
We typically conduct a penetration test from either a completely external
position, or from an assumed-breach vantage point.
In the latter case, the penetration tester has been provided authenticated access to
at least one system on the network.
This is the primary approach we have adopted during this course.
In this module we will instead perform a simulated penetration test with
no initial foothold as a starting point.
Specifically, we will not have access to any details including authentication
information as we approach the test.
We will walk through a fairly simple case study containing three networked machines
but as we will discover, attack chaining is rarely simple.
We will also use a virtual development machine for information gathering,
testing, and code development, which is common during a penetration test.