[MUSIC PLAYING]
Introduction to post-exploitation.
So welcome to the first section and the first video
within this course.
In this video, I'm going to be introducing you
to post-exploitation.
So we're going to take a look at what post-exploitation is
and the various tasks and techniques that
fall under post-exploitation.
We'll also be exploring a few important things
that you need to keep in mind when
performing post-exploitation, so some very
important considerations.
All right.
So let's get started.
First and foremost, what is post-exploitation, right?
Because if this is your first foray into penetration testing,
you might be a little bit confused
because you have exploitation and then post-exploitation.
So post-exploitation is the final phase of the penetration
testing process or life cycle and consists
of the tactics, techniques, and procedures
that attackers or penetration testers undertake
after obtaining initial access on a target system.
To put it simply, post-exploitation
involves what you do or have to do after or once
you gain access or an initial foothold on the target system.
To make that even simpler, once you gain access to a target
system or once you have exploited the target
system, what do you do, that's where post exploitation
comes into play.
And this ties into the first question
that I essentially posed to you is if you're just
getting into penetration testing,
once you exploit the system, what do you do?
Does the penetration test end there?
Well, it doesn't.
We have a final stage, which is post-exploitation
and then of course, reporting.
But post-exploitation is the final phase
that essentially involves interacting with the target
system or the target network.
So again, this phase of the penetration test
essentially deals with what you should
do after you've gained access to a target system.
And the various tasks or phases that
fall under post-exploitation will essentially
involve gathering information about the target system
that you've just exploited, elevating your privileges,
dumping hashes for the purpose of password cracking
or authentication, identifying other target
systems on the company's internal network
that you can pivot to.
So really, from a very high or advanced level,
after you've gained access to one target system on a target
network, that really is the beginning of a penetration test
because, remember, once you've gained
an initial foothold on a target's network,
you then need to find other systems that you can exploit
on that network because, remember, as a penetration
tester, you have been hired to target the entire network.
And in some cases, you may be limited to specific systems,
but you need to proceed on in terms of your penetration test
with gathering information about these other target systems,
exploiting them, et cetera, and the cycle essentially
repeats itself.
Now one important thing that you need to take into consideration
is that post-exploitation will differ
based on the target operating system as well as the target
infrastructure.
What do I mean by this?
Well, we can sort of solidify or have a basic idea
of what we're going to do after we gain access
to a target system.
However, what we can do and the techniques and tools
that we can utilize will depend on the target operating system.
So if we're performing post-exploitation on Windows,
the process is going to be a little bit different.
If we're performing it on Linux, the same thing, right?
So we need to take the differences between these two
operating systems in--
we need to actually keep that, and we need
to take it into consideration.
Another thing that I mentioned here
is the target infrastructure.
So, as I said, post-exploitation is a really extensive section
or phase of the penetration test primarily
because it is also the phase or section that
involves targeting or exploiting other systems on the target
network.
So you also need to be aware of the target network
infrastructure and what other systems are on that network.
So, again, you really need to take that into consideration.
A few other considerations are the following.
So the post-exploitation techniques and tools
that you can use will depend on what kind of access
you have on the system that you've just compromised,
as well as how stealthy you have to be in order
to avoid detection.
So what does this mean?
Let me break it down.
The techniques and tools that you can use
or that you will eventually end up using
will depend on, number one, what kind of access
you have on the system.
So what does this mean?
Let's use a simple example.
Let's say you're a junior penetration tester,
and you've just exploited a Windows system.
And the default privileges that you've
obtained through this exploitation
are not privileged, or you've obtained access
to the target system via an unprivileged user.
So from that starting point, the phases
or the techniques and tools that you can use
or that you will follow will be different than if you would
have gained access to the target system
and obtained an elevated access.
So for example, if you exploit a Windows system,
and you gain access to the target
system via an unprivileged user account,
that means that before you can start
dumping hashes and credentials, you actually
need to elevate your privileges.
So you can see how the different phases that
fall under post exploitation will actually shift.
And in some cases, they might be eliminated altogether.
What do I mean by that?
Well, again, let's go to the example.
If I exploit a Windows system through the EternalBlue
exploit, for example, that will provide me
with an elevated session on the target, which
means I don't need to elevate my privileges as the EternalBlue
exploit will provide me with the highest privileges
available on that Windows system.
So that means that I don't have to go through the privilege
escalation phase because I've already elevated my privileges.
So you can see how these phases will essentially shift,
or in certain cases, will not need
to be performed given the type of access
you have on the system.
Another consideration is how stealthy you have to be.
And this will really tie down or fall under the various security
protocols and mechanisms that the company has in place
to detect an intrusion by an attacker.
So we're talking about EDRs, antivirus solutions.
So again, the tools and techniques
that you can use, again, will depend
on how stealthy you want to be in order to avoid detection.
And this ultimately means that you
will need to utilize different techniques and tools based
on the target operating system and its configuration,
as well as the other considerations that I just
mentioned.
What type of access you have on the system
and how stealthy you have to be.
The post-exploitation techniques that you
can run against the target will also
need to abide by the rules of engagement that
were agreed upon with the client that you are performing
the penetration test for.
So before you actually begin a penetration test,
one of the most important steps again, that really comes down
into the first phase before you actually begin the penetration
test involves setting up rules of engagement with the client.
So what you're trying to do here with the client
is you're trying to set up rules that
can be agreed upon by both parties that essentially lay
out what systems can be exploited,
what techniques can be run.
And another additional clause that can be added in there
is what I can do once I've gained access
to a target system.
Can I delete Windows event logs?
Can I interact with customer data?
All of these things need to be laid out
before the penetration test.
Now, as a junior penetration tester,
you will be made aware of the rules of engagement.
And again, post-exploitation is a very important phase
of the penetration testing lifecycle because as I said,
you actually have access to the target system.
And some of the techniques that you will be running
could negatively impact the company's infrastructure
or that system that you've just exploited.
So you need to take the rules of engagement into consideration.
So for example, if the rules of engagement that you've agreed
on with the client state that you cannot touch any customer
data, then you need to take that into consideration as you
perform post exploitation.
If they say that you cannot elevate your privileges,
then again, that's something that you should also eliminate.
So again, just keep that in mind.
One final consideration that I want
you to take into stride or I want
you to run along with and keep at the back of your mind
as you progress with your career as a penetration tester is
that when you're running post-exploitation techniques
and tools, you need to be sure that you have
the necessary rights, permissions, whatever you want
to call it, to modify services, system configurations,
perform privilege escalation, delete logs, et cetera.
And this ties into the rules of engagement.
So again, I want to just reiterate it
because it's very important.
The last thing you want is to delete
Windows event logs on a Windows system
that you've just exploited.
And that will essentially breach the rules of engagement
that you agreed upon with the client system.
Because all of that data that you
may be interacting with or deleting
could be vital to the company itself.
So again, just take that into consideration
as you move along.
With that being said, let's just end this video by getting
or by taking a look at the post-exploitation or rather
the privilege escalation lifecycle
and where post-exploitation fits into all of this.
As we've started off with the information gathering
enumeration section of the open testing lifecycle,
we were able to learn how to perform information gathering,
both active and passive.
We learned how to perform enumeration.
And of course, we explored exploitation.
And now, we are at post-exploitation.
So this gives you an idea of the steps or phases that
fall under post-exploitation.
So you'll typically start off with privilege escalation.
You'll then maintain persistent access.
And finally, you'll clear your tracks.
Now this is by no means an extensive or comprehensive view
of the post-exploitation methodology.
That is what we're going to be exploring in the next video.
So again, I just wanted to go back to this diagram
to show you where we are.
And indeed, this is the final stage of a penetration test
before you actually move on to reporting.
With that being said, we can actually
move on to the next video, where we'll
be exploring the post-exploitation methodology
and taking a look at where everything fits in terms
of techniques and tools.
So I'll be seeing you in the next video.