Introduction to system or host-based attacks.
Before we get started with any of the exploitation techniques
that we can perform on both Windows and Linux,
let's get an understanding of what
system or host-based attacks are,
and why they're so important.
So what is or what our system or host-based attacks?
Well, a system or host-based attack
is essentially an attack that is targeted
towards a specific system or host running
a specific operating system.
For example, Windows or Linux.
And of course, we actually need to contextualize this
in the case of network-based penetration
testing or network-based attacks, right?
So network services really are not
the only attack vector that can be targeted
during a penetration test.
System or host-based attacks usually come into play
after you've gained access to a target network,
where you'll be required to exploit servers, workstations,
or laptops on the internal network.
So in the context of the penetration test,
why is this so important?
Why do you need to get an understanding of system
or host-based attacks and the various vulnerabilities that
affect both Windows and Linux?
Well, let's take a simple scenario here.
Let's say you are contracted to perform a penetration test.
And you are provided with an IP address
to a public-facing server.
And the public-facing server is running various services
that can be exploited remotely.
For example, SSH, FTP, a web server, as well as
a MySQL Database.
And through exploiting one of these services,
you gain access to that public-facing server.
And you realize that that public facing server
is also part of an internal network.
And that internal network has various systems or hosts on it.
And these systems or hosts will typically
be servers, workstations or laptops, employee laptops,
right?
And of course these are internal hosts, right?
They're not part of an external network,
or they can't be accessed remotely through the internet.
And the only way you can access them
is through your compromised host.
So this is where host-based attacks come into play.
And they essentially revolve around identifying
and exploiting vulnerabilities within that specific operating
system that they're running.
And what two operating systems are
the most popular in terms of internal networks
or in terms of just, generally speaking, computing?
They are Windows and Linux.
And for that reason, you need to have a good understanding
of the vulnerabilities that affect both of these operating
systems.
So system or host-based attacks are primarily
focused on exploiting inherent vulnerabilities
or misconfigurations on the target operating system,
wherever it may be or whatever it may be,
whether it may be Windows or Linux.
And unlike network-based attacks,
host-based attacks are much more specialized
and require an understanding of the target operating system
and the vulnerabilities that affect said operating system.
So again, just continuing on with our scenario.
So once we've gained access to the public-facing server,
we perform a little bit of network scanning or port
scanning.
And we identify that we have various hosts running
on the internal network.
And they are a mix of Linux servers and workstations
and employee laptops that are running Windows.
So what do we do next?
Well, they are not running any services
that you'd typically find, like FTP, MySQL, or a web server
because they are essentially standard hosts that have
been configured for employees.
And the only thing you know about them
is that they're running Windows or Linux, right?
And you can start to understand at this point
why host-based attacks is so important
because host-based attacks essentially gives you
an understanding of the vulnerabilities that affect
either Windows or Linux and the multiple versions
and distributions for both Windows and Linux,
and how they can be exploited.
So I'll give you, again, just continuing on
with the scenario.
After performing internal reconnaissance or network
scanning on the internal network,
we identify that we can pretty much target the employee
laptops as they're running Windows 10.
And apart from SMB, they really aren't
running any of the services.
And the only reason why they're running SMB
is because they're part of an internal network that
has file sharing.
And they also sharing a few printers.
So SMB is enabled by default.
Well, if you were an attacker, and you
didn't have an understanding of Windows vulnerabilities
or inherent Windows vulnerabilities,
then you really would be lost because you've only
learned about network-based attacks
and how to exploit remote services or services that
can be accessed remotely.
So again, if you were to get an understanding of the Windows
operating system and the inherent vulnerabilities
or misconfigurations that affected,
you then be able to stage your attack.
And you'd be able to find an exploit or a vulnerability
within SMB that you could then exploit to gain access
to that employee laptop.
And of course, this works the same for the Linux server
that might be running on the internal network.
And it could be used for plethora of functionality,
from LDAP.
Or it could be used just to store data
or an internal application.
And the only service it may be running is SSH.
And so again, having an understanding
of these operating systems and the vulnerabilities that affect
them is very, very important.
So in essence, host-based attacks essentially
involve exploiting misconfigurations and inherent
vulnerabilities within the target operating system,
irregardless of whether it's Windows or Linux.
And in this course, we will be primarily focusing
on exploiting Windows and Linux vulnerabilities.
And we'll be taking a look at how
they can be exploited, irregardless
of the versions of Windows, whether it's running Windows
server, Windows 10, Windows 7.
Or all the Linux server or the Linux systems
are running Ubuntu, CentOS, Debian, so on, and so forth,
right?
And of course, this is not just limited
to exploitation or gaining an initial foothold
on the host of the systems that are running
on the internal network.
This also goes down to privilege escalation, right?
Because once you've gained access to a Windows system,
for example, you also need to be able to elevate
your privileges locally.
And having an understanding of the various techniques
that can be performed locally are very, very important.
So you need to be able to understand
how to perform, how to exploit the kernel,
how to perform impersonation attacks, so on, and so forth.
So this is a very, very important course
as it will give you specialized knowledge
in regards to inherent vulnerabilities
and misconfigurations within Windows and Linux hosts.
And as I said, it's not just limited
to exploitation or privilege escalation.
We'll also be taking a look at dumping credentials,
both clear text and hashes.
And taking a look at how these credentials can be set up
for password cracking.
Or how we can utilize, in the case of Windows,
the NTM hashes for lateral movement
or pass the hash attacks that will allow us to laterally move
through the target network.
So this is a very, very important course.
And it will give you specialized knowledge in regards
to both Windows and Linux and how
they can be exploited without having services running
on them, the typical services that you'd
find on a public-facing server.
So now that you have an understanding of system
or host-based attacks.
We can now begin or move on to the next section, which will
focus on Windows vulnerability.
So we'll get started by taking a look at an overview of Windows
vulnerabilities and misconfigurations,
as well as the protocols and services that are natively
built into Windows.
And how to exploit them as we move on.
And then of course, once we complete the Windows section,
we'll then move into the Linux section
and how Linux systems can be exploited ad
so on and so forth.
So I hope you're excited.
You should have a good understanding
of what we'll be doing now.
And I'll be seeing you in the next section.