So before we wrap up this initial attack vectors section I want to talk about the attack strategies
that you might use when you're just starting out.
Now we know the attacks how do we piece it together and my thoughts are that we begin the day with man
the middle six or responder and we sit there and we've talked about this in the previous videos but
we want traffic to be generated right.
We need those users coming in.
So 8:00 a.m. is a good time when users are starting to come in or even after lunch when they're starting
to log back in.
You're going to have to read both of these on an assessment because you're going to have to assess for
Allah.
Men are in the network and you have to assess for ITV 6 in the network.
So either one is fine if you're looking for like a quick wind man the middle six is probably faster
nowadays but I still like to start out with the responder to see how well the network is responding
to us.
Right.
Are they giving us hashes are the hashes easy to crack.
If so that's going to tell me that we're probably in for an easy assessment if I'm not seeing Elohim
are enabled that I might be in trouble here they might have had a pen test before or they might you
know know some of the common attacks and our have already prevented against that.
So when you run those you're going to go ahead and run your scans to generate your traffic.
Now chances are that you're gonna be running a NSA scan to do this.
You might also be running an end map scan of some sort to get quick results as well.
But most places run nexus.
Now if your scans are taking too long if you have a big network which it can happen.
What I like to do is I like to just look for Web sites that are in scope.
And this is another thing that we can do.
We're trying to be quiet as opposed to just like running scans if your goal is to be quiet in the network
something that you can do is you can sweep the entire network for Web sites.
OK.
And I look with a tool called HP underscore version.
It's just a module that you can search in medicinally and you just say hey here's my range I want to
look and see if anything responds to HP version when I send out an HP request from my computer.
I want to see if anything else response to that and that's going to be less likely to get picked up
because you're making traffic on 80 and four for three which is very common.
Right as opposed to port scanning every single device and network which is going to get picked up pretty
easily by a good sin.
So from here what can we do.
Well we take those Web sites in scope and we can look at those log in and we can check those Loggins
for default credentials and some of the things that we're looking for are like printers.
I have gotten domain admin off of printer more than one time.
So if you think about a printer what does a printer have a feature of typically has a scan feature in
that scan feature is a scan to computer feature right.
Well a lot of times an admin will make that user.
That has to be able to scan from the printer to the computer via SMB.
They'll make that user domain admin and that's overly permissive.
And what we can do is we can go in and we can dump those credentials into clear text get with the passwords
are for the S&P user or they might even be using individual user accounts.
There's so many different things that they do.
And I've seen weird varieties but printers are a big one in a lot of people don't secure their printers
because they're just like it's just a printer Why do I need to change the password on it.
But it's a really big one to start thinking outside the box on a Jenkins instances.
If you have any developers Jenkins sometimes is wide open you can use that to get a shell in their machine
as well.
And there's just a lot of different things so you're going to look through the Web log ins you see if
you see some sort of log in go research that page look up what the default credentials are look up if
there's any known vulnerabilities for what's running.
And just enumerate that network.
OK.
So while we're looking for initial attack vectors we're looking for hashes with the responder.
We're looking to get that loot back from man in the middle six or maybe even strike gold and get an
account created on the domain controller right away.
And if that happens if you if you get domain admin in like two hours and you're sitting there for a
40 hour assessment guess what.
Chances are you're probably going to have to go back and try it a different way and find as many parts
as possible.
So just keep thinking about how you want to do that but look for a responder look from an 6 look around
the network and sweep around with your your end map and look for any SMB that's open with the S&P signing
disable and start picking out targets for your SMB really attacks as well.
So maybe that's something you might attempt in the afternoon you try to capture hashes in the morning
and then you start relaying hashes in the afternoon and you could spend just one day doing that and
then spend another day focusing a man on the middle six.
You want to give your client the best comprehensive coverage that you can and try to find all the low
hanging fruit if it's their first assessment or try to find those unique ways in if it's not their first
assessment.
So remember it's a timed assessment.
We only have so much time.
If it's a really really bad environment then we need to get all the critical findings out of the way.
If it's a tougher environment it's been pen tested before it might take us all 40 hours to find any
way in or we might not even find a way in at all and that's OK as well.
So the last thing I want to say is to start thinking outside the box.
So when you have an environment sometimes you're going to run into weird things I've run into environments
where there was no SMB.
I've run into environments where there was an element ah and you just have to start looking around at
what's available to you.
And one story that I can think about is that I was in this very small medical environment and there
was maybe 20 machines and there was no SMB in this network no Elam and ah I could not get leverage anywhere
and then I found by listening in the middle I found some clear texts coming through on a password.
OK.
The password was going for a map and the eye map was just running in clear text and I took that password
and I started passing that password around and I got into a phone system and in that phone system I
had the ability to change some stuff I could change you know where the phones were redirected and forwarded
and then I started thinking OK well what can I do with a phone system.
So I started looking at their Microsoft Outlook and their outlook had a password reset functionality
password reset functionality went to their office phones Guess who controlled the office phones I did.
So what if I said I want to reset the user somebody I know that's an admin I want to reset their password
and with that reset I want to forward that to my phone.
And so the office phone is going to.
So when it rings up I say Yeah I'm the user here's my here's my code code or token or whatever they
send you.
And go ahead and let's change that password and you bypass the multi factor authentication there.
So thinking outside the box is a big one.
You're going to run into situations where these initial attack vectors might not work for you.
And just enumerating and seeing what's out there is the most important you might not have a situation
and where responder works or a man in the middle six works or S&P relay works.
You might have to look at what ports are open on these machines.
You might have to look around and really focus the Web sites first.
That's my big one if you're struggling focused web sites and just see what's out there and try to get
your leverage and start thinking outside the box and just enumerate enumerate enumerate.
The more you enumerate.
I've been harping on this the entire course the more you enumerate the better attacker you're going
to be.
Don't just focus on the exploit.
Focus on as much information as you can gather and you're gonna be super successful.
So that's my spiel for this.
We're going to go ahead and move into post compromise enumeration.
We're going to talk about using power shall a tool called power of you and we're gonna talk about bloodhound
as well.
We'll do a little bit enumeration and then we'll get into some post compromise attacks and that's where
a lot of the real fun begins and we can start leveraging some of the stuff we've done in this section
and really utilizing that to move upwards so so far we've kind of just moved laterally.
We're going to start moving upward now and really take over that domain AB and learn some cool tools
and techniques and then we'll be well on our way in the course.
So I'll catch you over in the next section.