7

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an local administrator account, if nothing else then through offline cracking of the poorly encrypted local passwords.

However, once I have secured access to the local admin account, I do not know how to continue on. The MsCache is strong, and rarely contains anything worthwhile, I even read that most good admins turn caching off.

The most promising things I have seen so far was the pass-the-hash toolkit, based on dumping LSA secrets, which promised to "compromise a whole Windows domain after compromising a single machine that was a member of that domain." However, that failed to work on the Vista domain I am pentesting right now.

What are the general strategies in this situation? What are the specific ones?

7

General strategies - Red Teaming Analysis

  1. Abuse identity and authentication -> Target: People and credentials -> RDP, SSH, more consoles, portals
  2. Exploit privilege and trust -> Target: Infrastructure -> Utility Manager, Sticky Keys, NT Domain administrator, Unix root accounts
  3. Attack data structures and data handling -> Target: Services, Apps -> Client executables, Client-to-server traffic, Server-side controls
  4. Subvert the supply chain -> Target: OEM software and hardware -> "Get there first"

You may want to check out the recent attack vectors and strategies on the Irongeek Derbycon 4 video page.

Specific strategies - Scenario Analysis

Trustwave has a few blog posts that link to some of their homegrown tools, as well as links to other known attack tools/techniques.

For general strategy 1, most professionals tend to employ "social engineering" techniques, perhaps using the Social Engineering Toolkit (SET) or related tools such as recon-ng, esearchy-ng, FOCA, et al.

General strategy 2 is the most common attack vector from your position, and these Trustwave blog posts mostly suggest ways of focusing in on this strategy (or perhaps also general strategy 4, which may require patience or social engineering to get people to act on your well-placed traps). However, a great resource are the first few chapters of the book, "Defense against the Black Arts: How Hackers Do What They Do and How to Protect against It". There are also many Metasploit and nmap mechanisms that can aid in the general strategies. Attacking infrastructure may sometimes begin with a classic vulnerability scan. Custom vulnerability scan development will teach you the basics that network vuln scanners will not, so I do recommend using vulscan over OpenVAS, Tenable Nessus, Rapid7 NeXpose, or Qualys QG if you are a completist.

If you do plan on attacking either networks or apps, I suggest learning a lot about those domains. For example, knowing networks could involve learning Wireshark-related tools and methods, along with strong network engineering skills. You'll typically want to learn all of the internals of traceroute/0trace/lft, sslyze/ike-scan, and bnat/nmap/amap. When you start using firewalk, qscan, osscan-guess, traceroute, and packet-trace with nmap, then you'll understand how to combine methods well -- although basic issues like banner grabbing must also be mastered.

Apps are the hardest domain of penetration testing. My suggestion is to learn as much as you can about your target applications: their primary interfaces (e.g., for webapps, try webshot) and their various configurations. Then, move on to their internals by learning how to build and code apps in a variety of environments. If you understand the entry points to the applications, you can begin to learn to look for low-hanging vulnerabilities and spend an extra amount of time bringing them to full exploitation once you verify a vulnerability. Typically, for web apps, you'll need a good crawler to back up your existing domain knowledge (e.g., the Discovery-section of seclists found in Kali Linux) and a proxychain to analyze and attack using fault injections. My favorite open-source crawler and my favorite open-source fault-injection tool is Arachni (the autothrottle and other plugins are good introductions to web app pen testing). Eventually, you'll want to move to commercial tools such as Burp Suite Professional or Acunetix WVS, but there is no need to rush it when you don't understand the basics (as I alluded to with net vuln scanners above).

  • Subverting the supply chain can be a very-believable and nearly-unstoppable vector. For a few hundred dollars you can convince someone that they have won an iPad. You can even reshinkwrap the box. – atdre Oct 10 '15 at 3:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.