Post-exploitation methodology.
In this video, we're going to be taking a closer
look at post-exploitation.
And we're going to get an understanding
of the various phases or sections that
make up post exploitation.
And we're going to be exploring a very commonly
used methodology for post-exploitation.
The objective here is to essentially lay out or give you
an understanding of what we will be
performing under post-exploitation
in a structured format, right?
So why are we doing this?
Well, in order to perform a thorough and complete
post-exploitation phase, we need to utilize
a structured methodology that encompasses
the most important stages of post-exploitation that can
be applied during engagements.
This structured methodological approach
ensures that we do not skip or overlook
important phases of the post-exploitation phase
in order to essentially provide us
with the ability to track objectives based on each stage.
So as I mentioned in the previous video,
and you probably have been able to deduce it already,
post-exploitation involves a lot of stages or phases, right?
And if you are just getting into penetration testing,
this can be quite confusing and overwhelming.
As a result-- and this is a good practice that is implemented
by penetration testers--
is to utilize a methodology that will provide you
with a structured approach in regards
to what you need to do whenever you're
performing post-exploitation.
Now, as I mentioned in the previous video,
the stages that you will go through
or that you will essentially follow through
will depend on the target operating system as well as
the type of access you have, in addition to how stealthy
you want to be.
However, this is the typical post-exploitation methodology.
So this diagram outlines each stage.
And of course, they are numbered based on how
you should go through them.
Now, one thing I would like to point out
is that for these two stages or phases--
transferring files and upgrading shells--
these are really optional.
In most or in some cases, you may not
need to go through these stages, right?
So for example, if you gain access to a target system,
and you have obtained elevated privileges,
then you may not need to transfer any additional files,
and you may not need to upgrade your shells
if you have obtained a Meterpreter
session for that matter.
So again, the reason I'm laying this out
is because this is very, very, very important, right?
So let's go through this step by step.
Number 1, when you gain access to a target system,
what's the first thing you do?
You start off with local enumeration.
The objective here being to enumerate
as much information as possible from the target system
that you've just compromised.
So what are you looking for?
We'll actually get to that in a couple of seconds.
We then move on to transferring files.
Do you need to transfer any files to the target system
after you've gained access?
That's what that phase deals with.
If you've obtained a non-interactive shell
or a standard command shell, do you
need to upgrade to a Meterpreter session
in order to perform additional tasks that you'd
like to perform?
That's what that phase covers.
If you've obtained access to a target system
without elevated privileges, then you
need to elevate your privileges.
And that's what the privilege escalation phase is for.
You then need to set up a persistent access
to your target systems so that in the event
the system is shut down or restarted,
you can gain access to the target system
without exploiting the vulnerability that provided you
with initial access to the target
system in the first place.
So you set up a system.
So you can essentially maintain access to the target system
through system reboots, shutdowns.
And even in the case, you'll actually see this quite a lot.
In some cases, the vulnerability might be patched.
So that's a very, very important phase
of the post-exploitation methodology.
You can then move on to dumping and cracking password hashes.
The objective here is to, again, dump password hashes
on both Windows and Linux.
And you can then utilize these hashes
for legitimate authentication through SMB, for example,
in the case of Windows.
You can also crack these hashes to obtain their clear text
password equivalence and utilize that
for authentication via SSH, RDP, so on and so forth.
We'll then move on to pivoting, right?
So pivoting essentially involves identifying target systems
on the target network that you can compromise, and of course,
exploiting them and moving onto the next system
within that network.
And then once you're done with the system
that you have compromised, you can then clear your tracks
to avoid detection.
And the beautiful thing about post-exploitation
is that the process repeats itself.
So once you have exploited another system
from the pivoting stage, you then
go ahead and start performing local enumeration,
transfer your files, upgrade your shows if you want to,
elevate your privileges.
And the cycle repeats on every new system
that you're able to compromise.
So this, again, gives you a good idea
of what we'll be covering through this course.
And of course, this, again, provides you with something
that you can incorporate into your pen tests,
especially when you approach or when
you arrive at the post-exploitation phase
of a penetration test.
So I've laid out all of these stages of post-exploitation
and laid out what we will be performing within each
of these stages because again, as I said,
this will depend on the target operating
system and its configuration.
So starting off with the first phase, which
is local enumeration, we'll be enumerating system information,
users and groups, network information services,
and will take a look at how to automate local enumeration
with various tools and scripts.
All right?
So that's the first phase.
We'll then move on to transferring files.
We'll take a look at how to set up a simple web
server with Python so that you can transfer the files that you
want to transfer onto your target systems.
We'll explore various tools and utilities
that can be used to download these files from the web server
that you have set up.
And of course, we'll be exploring this
both in the case of Windows and Linux.
We'll then move on to upgrading shells.
We will be exploring how to upgrade a standard command
shell to an Meterpreter session, how
to spawn TTY shell on Linux.
And that's fairly simple.
We'll then move on to privilege escalation.
We'll be taking a look at how to identify privilege escalation
vulnerabilities.
And then we'll take a look at a few examples
of how you can elevate your privileges on both Windows
and Linux.
After we've elevated our privileges,
we can then move on to persistence.
So we're going to be exploring how
to set up persistent access on Windows and Linux systems.
Once that is done, we'll then move on
to dumping and cracking hashes.
So we'll take a look at how to dump and crack Windows hashes
and how to dump and crack Linux hashes.
So again, you can actually see how
this will work when we actually follow through it
and why using this methodology is so important.
We'll then move on to pivoting.
So we'll take a look at how to perform internal network
reconnaissance to discover other systems on the target
network or the internal network that the system you
have compromised is a part of.
And we'll explore how to pivot to these other systems
that you've been able to identify.
And then, of course, finally, we'll
actually end this course by taking
a look at how to clear your tracks on both Windows
and Linux.
So once you're done with a target system,
how to make sure that you can't actually be detected.
You get rid of your exploit files that you copied over
and any other artifacts that might be left over that
could, again, give the incident responders an idea as to where
this attack originated from and what the attacker is doing.
All right?
So that is the post-exploitation methodology.
And I've broken it down into each of the various phases.
And I've also further broken it down
into what we'll be covering in each of these phases.
So we'll be utilizing this methodology moving forward.
So the next section of this course
will cover local enumeration.
More specifically, we'll start out
by exploring local enumeration on Windows.
Once that is done, we'll then move
on to local enumeration on Linux.
So I'll be seeing you in the next video.