In this lesson,
we're going to cover the post-exploitation phase
of a penetration testing engagement.
This phase comes
after you've successfully exploited a vulnerability
and gained access to the target system.
The goal here is to understand the level of access you have,
maintain that access,
and gather additional information
to further your penetration test.
First, you need to establish persistence.
This means setting up a way to maintain access to the system
even if it's rebooted
or your initial exploit is discovered and closed.
One common method is to create a new user account
with administrative privileges.
For example, if you've gained access to a Windows server,
you might use the command line to create a new user
and add it to the Administrators group.
Another technique is to use scheduled tasks or cron jobs.
These can be configured to run at regular intervals
and reestablish your connection if it's lost.
For instance, on a Linux system,
you might set up a cron job
that starts a reverse shell every hour,
ensuring you regain access if needed.
Next, you'll want to escalate privileges.
If your initial access was a regular user,
you need to find a way to gain administrative
or root privileges.
This can be done by using various techniques
like exploiting local vulnerabilities,
password cracking,
or using tools like Mimikatz to extract credentials
from memory on Windows machines.
For example, Mimikatz can be used to dump passwords,
hashes, PINs, and Kerberos tickets from memory,
which can then be used to elevate your access.
With higher privileges,
you can start lateral movement.
This involves exploring other systems on the network
to see what else you can access.
Tools like PsExec for Windows
or SSH for Linux can help you move between systems.
For instance, if you've compromised a workstation,
you might use PsExec to execute commands
on other machines in the network, expanding your reach.
During post-exploitation,
it's crucial to gather as much information as possible.
This includes capturing sensitive data
such as documents, databases, and emails.
We can then use sneaky exfiltration methods
to transfer data stealthily from a compromised server.
For example, after identifying a valuable customer database,
you could use DNS tunneling
to covertly exfiltrate the data,
bypassing traditional security monitoring systems
that might detect more overt methods.
It's also important to clean up after yourself.
Leaving behind obvious traces of your activities
can alert the target
and lead to the access being cut off.
This means removing any tools that you've uploaded,
clearing logs where possible,
and undoing any changes that are not necessarily
for maintaining access.
For instance, if you created new user accounts,
consider removing them
once you've set up more covert methods of access.
So remember, during the post-exploitation phase,
focus on establishing persistence, escalating privileges,
and moving laterally within the network.
Gather and exfiltrate sensitive information
while being careful
to clean up any evidence of your activities.
This phase is about maximizing the value of your access
while minimizing the risk of detection.