In this section of the course,
we'll focus on the tools and techniques
that enable attackers to move laterally
through an environment after gaining initial access.
Lateral Movement refers to the techniques
that attackers use to navigate through a network,
expanding their foothold
by accessing other systems and accounts
after establishing initial entry.
This stage is important for attackers
to locate high-value targets and achieve deepening
their network penetration without detection.
The domain of this section will be centered around Domain 5,
Post-exploitation and Lateral Movement.
Objective 5.2 will be our main focus in this section,
which states that given a scenario,
we must perform tests to move laterally
through an environment.
First, we'll explore Pivoting and Relaying,
the foundational technique for using one compromised host
to gain access to other hosts,
typically involving techniques
such as port forwarding and tunneling.
Next, we'll conduct a hands-on demo using ProxyChains.
This tool allows for the creation
of a chain of proxy servers,
which an attacker can use to mask their location
and route traffic through compromised hosts,
allowing them to remain undetected
while performing lateral movements.
Following that, Enumerating and Lateral Movement
will be discussed
where you'll learn how to identify potential targets
within a network, including using methods
such as service discovery, network traffic discovery,
credential capturing, credential dumping,
and things like that.
Service Discovery will be covered next,
focusing on how attackers identify services running
on other machines that can be exploited using protocols
such as SMB or RPC to gain access to those systems.
Next, we will move to Protocol Discovery,
discussing methods used to detect network protocols
and used within an environment that might be vulnerable
or can facilitate deeper access.
We'll key in on cleartext protocols
like LDAP, FTP, and Telnet.
Following that, we discuss Remote Access Discovery,
which involves pinpointing remote access capabilities
within the network such as RDP and SSH,
which can be targeted to expand control over the network.
Printer Discovery will be examined after,
explaining how network printers and protocols like LDP
can be exploited for lateral movement.
Then, we will discuss process
of Discovering Internal Websites
to show how attackers can find
and exploit web applications running
through an internal network that might not be as secure
as external-facing applications.
Next, Living Off the Land Tools will be discussed,
focusing on how attackers use built-in tools
such as netstat or MMC to facilitate movement
without needing external software,
which helps avoid detection.
Then, we will jump into a lesson using sshuttle,
which is a tool for creating VPN-like environments
using SSH, which is beneficial
for a stealthy way to move around the network.
And then, to wrap things up,
Covenant will be discussed as a powerful .NET command
and control framework used
for conducting multi-stage attacks
and managing compromised hosts.
Finally, we will take a short quiz to see
what you learned during this section of the course,
and review each of those quiz questions fully
to ensure that you can explain why each answer is right.
So if you're ready to navigate the network environments
like a stealth bomber,
let's begin our section on lateral movement.