Introduction to exploitation.
Before we can get started with taking a look at what
exploitation entails and exploring the various sub
techniques that fall under exploitation,
let's get an understanding of what exploitation is
and what we will be taking a look at in regards
to exploitation within a penetration test
because that's really what we're exploring within this course
and within this certification.
All right?
So fundamentally speaking, exploitation
consists of techniques and tools used
by adversaries or penetration testers
to gain an initial foothold on a target system or network.
So that's really what it is.
It's essentially the process of saying
I've identified a vulnerability, and I'm
going to exploit it in order to gain access
to a target system or network.
Now, it's very important to note that successful exploitation
will heavily depend on the nature and the quality
of information gathering and service enumeration performed
on a target.
And this can best be analogized by an unknown quote
by an unknown person, and the quote is the following.
"We can only exploit a target if we know what is vulnerable."
And that is extremely true of exploitation,
especially within a penetration test, right?
So you really will not know what to exploit
and how to exploit a particular service unless you
know if it's vulnerable, right?
So if you're given the opportunity
to perform a penetration test on a network of computers,
you need to be able to identify the services that
are running on the target system, first and foremost.
After which, you also need to be able to identify
the vulnerabilities that affect those services.
And furthermore, you also need to be able to identify or find
exploit code that you can use to exploit the vulnerabilities
within those services.
Now, we have already covered exploitation
of Windows and Linux systems both manually and automatically
quite comprehensively within the system and host-based attacks
course as well as the Metasploit framework course.
However, we still need to get a clearer
picture of the exploitation methodology
and the tools and techniques involved in the process.
Now, what am I talking about specifically here?
Well, we've taken a look at how to exploit
Windows Services and misconfigurations as well
as Linux services and misconfigurations
within the system and host-based attacks course.
And we also explored privilege escalation,
the process of dumping hashes as well as clear text passwords.
And we also took a look at how this can be performed
with the Metasploit framework.
However, as a penetration tester there really
shouldn't be a reliance on automated exploitation
frameworks like Metasploit or PowerShell empire.
And really, this is where this course comes into play.
This course is going to give you all the knowledge and skills
required for you to essentially perform exploitation
on a target or to exploit a target successfully
without reliance on a particular exploitation framework
or without reliance on a particular set of services
that you're familiar with in terms of exploitation.
So really, this course will essentially set up the stage
and will take you through the exploitation process,
as I said, within a simulated pen test environment.
And of course, that will be covered
during the Windows exploitation section and the Linux
exploitation section.
Now, there are a few areas or aspects
that weren't covered during the system and host-based attacks
course as well as the Metasploit framework
course that were done for this exact purpose.
And that, of course, entails or revolves
around the various tools and techniques
that essentially involve or that are involved
in the exploitation process.
An example of that would be the process of setting up
a reverse shell or a bind shell, the various tools or utilities
and cheat sheets that can help you
in obtaining a reverse shell, understanding
how reverse shells work, how to set up one yourself,
et cetera, et cetera.
Furthermore, you also need to have the ability
to find exploit code.
Compile it or modify it.
Launch it.
And again, build up your expertise
in terms of not relying on an exploitation
framework like Metasploit.
All right?
Now, in the Metasploit framework course,
I briefly touched upon the penetration testing execution
standard.
The penetration testing execution standard, also known
as ptes, is a penetration testing methodology
that was developed by a team of information security
practitioners with the aim of addressing
the need for a comprehensive and up-to-date standard
for penetration testing.
It's a fantastic standard that will essentially
outline the various phases involved in a penetration test.
And you can then learn more about what each phase entails.
And in this particular case, we are focused on exploitation.
So if we take a look at the various penetration
testing phases, so you start off with information gathering,
right?
And that involves performing both passive and active
information gathering.
So in the context of a penetration test,
you typically perform active information gathering.
So you'll perform a port scan and identify open ports as well
as the services.
You'll then move on to enumeration, right?
Enumeration involves really identifying
what is running on those particular ports
and getting the service versions.
And you might also be able to identify vulnerabilities
within those services.
But that's something that really will come or fall
into the exploitation phase because exploitation not only
involves the identification of vulnerabilities,
but also the testing of exploit code
to verify that indeed that particular service is
vulnerable because that's what you're paid
to do as a penetration tester.
You're not just paid to identify vulnerabilities.
You're also paid to test them and test
the efficacy of exploits against those vulnerabilities.
All right?
So we are currently within the exploitation phase.
All right?
And of course, we will be covering
the post-exploitation phase in another course, which
is quite comprehensive.
But for now, we're focused on exploitation.
So the exploitation methodology in my experience
and in the experience of many other penetration
testers and red teamers will typically
follow the following flow.
Number 1, we will need to identify vulnerable services
running on a target.
You then need to identify and prepare exploit code, right?
And that, of course, will mean that you can either
use an exploitation framework like Metasploit
or PowerShell empire.
Alternatively-- and this is something that you will be
running across quite a bit-- you need to have a good
understanding of how to search for exploit code available
online through verifiable sources--
how to modify the exploit code and how
to compile it in the event that you need to do so.
These are very, very important skills, right?
And then in terms of gaining access,
that will essentially involve executing or using
the exploit code that you've just downloaded and modified.
And this can be automated through the use of a Metasploit
framework module, or it can be done manually with exploit code
that you downloaded from the internet.
Once you've been able to execute the exploit,
you then need to obtain remote access on the target system,
right?
So it doesn't really end at just exploiting a service
because exploit code out there-- and you'll actually see this--
might not necessarily provide you with remote access.
It may only execute a command on the target,
but not do much more.
And this is where the whole ideas of reverse shells
and payloads come into play.
So once you have exploited the service,
you actually need your reverse shell,
or you need to obtain access to a target system,
typically through a reverse shell.
And that is very, very important phase of exploitation as well.
Another important phase of exploitation, and this
can fall either before the actual gaining access phase
or after, and that is bypassing antivirus detection, right?
And of course, this will involve obfuscation and coding
of payloads, so on and so forth.
And it's, again, something that's
also very, very important.
And finally, you need to have the ability
to pivot onto other systems.
So once you've gained access to a target system,
this system might not be a privileged system
or might not have the data that you're looking
for as a penetration tester.
And as part of your penetration test,
you need to compromise as many systems
as you can on a target network.
And so you also need the ability to identify information
pertinent to the other systems that
are running on that network.
And setting up port forwarding or tunneling in order for you
to successfully pivot from one system on a network to another.
All right?
So I want you to really take in the exploitation methodology
and understand the various phases.
And you'll start to see why this particular course is
very important in the context of a penetration test.
By this point, you should have enough experience
to exploit a Windows system or exploit a Linux system.
But this will really give you all
of the other important knowledge that
really falls all that is pertinent to exploitation,
right?
So now that we have an idea of what the exploitation
phase of the penetration test essentially entails,
we can get started with the first section
of this course, which is vulnerability scanning
or really just identifying services on a target system
and identifying vulnerabilities within those services that
can be exploited.
So I'll see you in the next video.