Hey everybody welcome to the next video.
So we talked about now how to get root access or admin access to the machine.
So what happens when your route or admin now.
So what's important here is that you shouldn't just brush off the box like it's done and go on to the
next one.
While in some cases that might be appropriate in most cases you're going to want to understand and truly
understand what that machine is doing on that network.
Is it a web service.
Is it a is it a bridged host to another network.
Is it a password storage server.
Are there SSA keys that are available that you might want to use the password hashes on the machine
might be reused elsewhere so you don't need to think of this as more than just you've attacked a machine
but you need to look at it from a lateral movement perspective.
You need to be able to take your machine and say OK.
This machine has this installed it has these at this access it's on this network what can I do with
this.
So for example if your machine that you just compromised was a puppet a puppet master.
You can modify Muppet puppet manifests to be able to execute code and spawn back shells as root on almost
every machine that's connected to it.
So just understanding that puppets on the machine and it's a puppet master can can let you do that.
If there is a password storage vault on to a machine.
Now what happens if you're able to grab the local files and reset the local admin password for the web
service and log in and start ripping plaintext passwords for systems on the network.
Now you've taken one compromise to compromise half the network or possibly the whole thing or at least
at a bare minimum help yourself get to another host such as maybe you have a Web site that's running
on the machine you check the network tracker to see if people are hitting it on the access log you see
it's been hitting getting hit frequently.
What happens if you add in a let's say a browser based exploit that auto attacks the machines as they
come in.
What happens with that.
There's a lot of option you can do when you start looking at this from a lateral movement perspective
instead of a pone I got you done.
So in some cases for depending on the engagement.
So for example if you're an external contractor hired by an organization to test something out you might
just be under the scope of attack machine you've got access you're good.
Sometimes the scope doesn't allow you to push it further.
But if you're internal most cases it does you're allowed to kind of push that extra a little bit to
kind of find out what you can actually do.
So always keep in mind that once your route you have more to do in some cases it's almost more than
actually attacking the machine itself and doing all the recon because now you're recon starts over again
but this time your recon is on the machine itself.