Windows Black Box Penetration Test.
Welcome to the Windows exploitation
section of this course.
In this section, we are going to be
covering Windows exploitation.
And the way we're going to do this or the way
we're going to orchestrate this is through a simulated Windows
Black box penetration test.
So in this video, I'm just going to be giving you
an introduction as to what a Black box penetration
test is as well as providing you with your scope and assignment.
In the next set of videos, I'll be taking you
through various services that you'll
be able to exploit on the target system.
And again, the objective here is to actually show you
the actual variability of services you'll typically
find running on a Windows system and the various ways you
can gain access to a Windows system.
So firstly, what is a Black box penetration test?
A Black box penetration test is a security assessment,
whereby the penetration tester is not
provided with any information regarding
the target system or network.
So the penetration test is not provided with any IPS or IP
ranges, any system information like the operating
system that's running on the target
or the information pertinent to the services that
are running on that target.
And they're not provided any default
credentials or the credentials that
are used by those applications, or services, or consequently,
the operating system.
So the primary objective of a Black box penetration test
is to accurately test the security of a system
or networks as an external unprivileged adversary.
This approach is very useful as it demonstrates
how an external attacker with no inside knowledge of a company
and its digital infrastructure would compromise the company's
systems or networks.
So again, the main difference between a white box pen
test and a Black box pen test is that you are not
provided with any information regarding
the target system or the network that you are trying to test.
All right, so that's what a Black box pen test is,
and this is what we're going to be doing.
We're not going to be provided with any information regarding
the target, apart from the target operating system.
And the reason why I'm doing that
is primarily because as you're just beginning,
that information is a very, very useful
until you actually have an idea of how to perform that.
But again, detecting the target operating
system is fairly simple as we have been able to demonstrate.
All right, so this is--
again, I'm just revisiting this slide
to show you what we're going to be doing.
So again, this course is focused on exploitation.
However, we're going to be covering
other aspects of the penetration testing methodology.
For example, information gathering,
enumeration to the point of exploitation, right?
So in terms of the Black box methodology,
this is really what the methodology
that you should be following, especially when it
comes down to targeting the system
that we will be targeting.
So firstly, you need to know how to perform host discovery.
So that essentially involves identifying
the target IP address or the domain, et cetera, et cetera.
You then move on to port scanning and enumeration.
This will involve identifying the open ports on a target
system as well as the services that are
running on those open ports.
We'll then move on to vulnerability detection, where
you will actually need to identify vulnerabilities
within the services that are running on the target system.
And then, of course, exploitation, which you
have covered quite a bit here.
And of course, this can either be
manual through publicly available exploit code.
And we've covered the process of finding exploit code,
modifying it, compiling it, et cetera.
And then, of course, you have automated exploitation
with an exploitation framework like Metasploit.
So again, you really are not required
to use any other exploitation framework
like PowerShell Empire.
You can pretty much just use manual exploitation techniques
or the Metasploit Framework for automated exploitation.
As part of the Black box methodology,
you also have post-exploitation, which we will not
be covering as that is something that we will
be exploring in its own course.
So you know, whatever falls on the post-exploitation,
we really are--
we are not going to be exploring that because what
comes under post-exploitation is, typically,
privilege escalation, persistence,
dumping hashes, data exfiltration, et cetera, right?
So in terms of what you are supposed to do,
let's take a look at the scenario and the scope.
So I want you to play along with this scenario, right?
So given the fact that this is part of eJPT
or the pen testing student course or certification,
if you will, the scenario is the following.
So you've just begun your first job
as a junior penetration tester.
And I've been assigned to assist in performing a penetration
test on a client's network.
Now, the pentest lead, that, of course-- a pen test lead
is essentially the leader, if you will,
of a group of individuals or pentesters
that are essentially working on a particular pentest, right?
So the pentest lead has assigned you to gain access or exploit
a host that is running Windows Server 2008
on the target's-- or on the client's network, right?
So he's told you that as your first assignment,
he wants you to try and find a way to gain access
to the system.
So your primary objectives are-- and this
falls into your scope-- is to identify the services that
are running on the target, identify vulnerabilities
within these services, and then exploit
these vulnerabilities to obtain an initial foothold
on the target system.
The pentest lead has informed you
that you are not going to be responsible for performing
the post-exploitation phase of the pentest.
So once you have gained access to the target system,
your job is done.
Now, one note, and I mentioned that in the previous slide,
is that you are permitted to use the Metasploit
Framework for exploitation.
So the pentest lead has been very gracious
and is testing you out to see what you're capable of doing.
Now, that is pretty much all that I
wanted to get started with.
In the next video, we'll actually
get started with the Black box pen test on the target.
And we'll be starting off by performing port scanning
and enumeration, and then we'll move on
to exploit various services on the target system.
Now, I just want to make something as clear as possible.
The target system or the system that has been actually
been configured within the lab environment
for this entire section, again, will
be used for each of the videos.
And again, as I said, your primary objective
is to find a way to gain access to the target system.
And the actual target system has been configured
to host multiple services, some of which are vulnerable,
some of which are not.
So again, this is why it's really going
to be quite fun and exciting.
I am not going to be covering all the exploitation vectors
you can utilize to gain access.
But I'll be showing you the different ways
or the different services that you can target
and how they can be targeted.
So again, this is going to encapsulate
everything that we've learned so far within this course,
as well as the other courses that
are part of the pen testing student or eJPT certification.
So I'll see you in the next video.