In this lesson,
we're going to explore lateral movement
with any network using Remote Desktop Protocol or RDP,
Virtual Network Computing or VNC, Secure Shell, SSH,
and Windows Management Instrumentation, WMI.
These are common techniques attackers use to move
through a network once they have established a foothold.
Now by understanding how these protocols work
and how they can be exploited,
you can better defend your network
and perform more effective penetration tests.
Let's start with Remote Desktop Protocol or RDP.
RDP is a protocol developed by Microsoft that allows users
to connect to another computer over a network connection.
Now attackers often use RDP to move laterally
by exploiting weak passwords or unpatched vulnerabilities.
For example, the BlueKeep vulnerability, CVE-2019-0708,
is a well-known exploit that allowed attackers
to execute arbitrary code on vulnerable systems.
Now imagine you have gained initial access
to a network through a phishing attack.
You can then use stolen credentials
to attempt a RDP connection
to other machines within the network.
If these machines are not properly secured,
you can log in and potentially access sensitive information
or install additional malicious software.
Next, we have Virtual Network Computing or VNC.
VNC is a graphical desktop sharing system
that uses the Remote Framebuffer or RFB protocol
to remotely control another computer.
Like RDP, VNC can be exploited if weak passwords are used,
or if the VNC server is not properly secured.
As a penetration tester,
you might scan the network
for VNC servers using tools like Nmap.
Once you identify VNC servers,
you can try default or commonly used passwords
to gain access.
For instance, some VNC implementations might use password
as the default password.
Once connected, you can control the system
and potentially pivot to other systems within the network,
exploring file shares, sensitive documents,
and other network resources.
Now let's discuss Secure Shell or SSH.
Now as we know,
SSH is a protocol used to securely connect
to a remote system over an unsecured network.
It provides a secure channel
over an unsecured network by using encryption.
Attackers often use SSH for lateral movement
by exploiting poor key management practices
or using stolen credentials.
For instance, if you've captured a private SSH key
through phishing or social engineering,
you can use it to log into other systems
where the key is authorized.
SSH tunneling can also be used
to create encrypted connections
to bypass network security controls.
Let's say you've compromised an SSH key
for a critical server.
You can set up an SSH tunnel
to route your traffic through this server,
effectively bypassing firewalls and other security measures,
and then access other internal systems.
Lastly, we have Windows Management Instrumentation or WMI.
WMI is a set of specifications for Microsoft
for consolidating the management of devices and applications
in a network from Windows computing systems.
It is a powerful tool for administrators,
but can be used by attackers for lateral movement.
WMI allows for remote execution of commands,
which can be leveraged to execute malicious payloads
on other systems within the network.
For example, an attacker
with administrative approaches can use WMI
to execute a PowerShell script on a remote system
to establish persistence
or to harvest additional credentials.
Imagine you have admin access on a compromised system.
You can just simply use the WMI
to remotely execute a PowerShell script
that adds a new user account with administrative privileges
on another system in a network,
effectively expanding your control within the network.
So remember, understanding the methods for lateral movement,
such as using RDP, VNC, SSH,
and WMI is crucial for securing your network
and for pen testing.
These techniques are commonly used
by attackers to move through a network
and gain access to critical systems and data.
By learning how these protocols work
and how they can be exploited,
you can better defend
against lateral movement in your network.
Effective penetration testing involves
not only identifying vulnerabilities,
but also understanding how they can be exploited
to move laterally and escalate privileges,
giving you a comprehensive view
of your network security posture.