1

I've read that accessing a remote directory or file is enough of a proof-of-concept for most pentests. When and why would a POC/pentest require downloading files from a system, not simply accessing them remotely?

Curiosity about this was motivated by another question I asked, (Methods to copy files from a remote Linux system by order of detectability (assuming remote shell with root privleges)), in which many responses implied that caring about how to covertly download files from a remote system was strange or unorthodox. From an intuitive perspective, it would seem to me that local copies of certain remote files might be useful or required inputs for analysis that could be used to gain access to other parts of the target network.

3
  • 4
    If you accessed the file, you downloaded it. Right?
    – ThoriumBR
    Sep 19 '16 at 16:20
  • If I have shell on a remote system and I use that to access a directory on that remote system I haven't downloaded the files in that directory. If I run an executable in that directory, it would run on that remote machine, not on my local machine. So I don't believe that's a necessary condition.
    – Info5ek
    Sep 19 '16 at 16:24
  • How do you prove that you accessed the file without having a copy of its contents? Getting read access is usually easier than write or execute, and demonstrating read access is sufficient.
    – OrangeDog
    Sep 20 '16 at 18:35
3

This depends on the rules of engagement. A solicited penetration test is done within a very strict set of guidelines (rules of engagement) so that it doesn't cause more harm than good. This sets limits as to what can be done; exfiltrating files is pretty risky since they might contain sensitive or regulatory-encumbered info, which is good to know is available during a pentest, but bad to actually start dragging around the internet. So, always follow the rules of engagement and if they aren't clear to this aspect, have them clarified before you start.

To be specific to your question, if the pentest guidelines state that it's allowable to exfiltrate, AND state that the positive confirmation objective is to obtain a copy of the file, then that's what you do.

1

Sometimes a pentest is performed to excercise the IT staff responsible to monitor and maintain the systems (blue team). If the pentester (red team) gained access to the assets he was after without being noticed by the blue team, and if the rules of engagement allow (as stated in other answers), he may try to exfiltrate the data to further test and train the blue team.

It need not be the real data that is exfiltrated but can be some representative sample data. Once the pentester has successfully exfiltrated the data he can go back and make as much noise as possible until the blue team detects or stops him.

This all assumes that one of the goals of the pentest is to be in an active adversarial role with the blue team. This is often done to test incident response, effectiveness of tools and procedures. The end goal is to be better prepared when a real attacker strikes.

1

Sometimes the engagement requires you to simulate a real attack and reach certain part of the network, like a database, in those cases downloading files in order to discover network users through the metadata may be possible (Just an example). But it depends on the engagement and it should be clarified with the client, never download files without acquiescence

1

When your job in a pentest is to penetrate as deeply as possible then you could download files to 1. compromise a windows machine / domain by downloading backups of the SAM hive in the c:\windows\repair directory, in case it exists 2. download php config files with database passwords 3. download various other stuff with passwords / confidential information that will ease lateral movement or in general gather information for whatever target comes next in your infiltration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.