P aul Asadoorian Founder & CEO, PaulDotCom Enterprises POST Exploitation Going Beyond The Happy Dance Carlos Perez HP / PaulDotCom
Who am I? I had this really boring slide about who I am Then I realized that’s not really who I am What follows is the “Powerpoint” version of “a little about me”...
Podcast Present ~ 200 episodes Awards, blah Thursdays 7PM EST
Hack Naked Why Hack Naked?
Beer
Computer Destruction
PaulDotCom John “Father John” Strand Paul “Salad Shooter” Asadoorian Larry “Dirty Uncle” Pesce Mick “Jr. Salad Shooter” Douglas Carlos “Dark0perator” Perez Mike “The Original Intern” Perez Darren “Girly Mustache” Wigley ? “Byte_Bucket” Mark Baggett
“Hail Nessus!” My day job: I work for Tenable Network Security as a “Product Evangelist” I use Tenable products and write blogs, publish podcasts, teach courses, and produce videos Hail Nessus !
I Hacked The Gibson Do the happy dance!
Hacking the Gibson is quite the accomplishment Congratulations, your penetration test has begun Like sex, the importance is on what happens after you get in
“POST-Exploitation” This is actually a really bad term as it doesn’t accurately describe the process The process begins with a penetration tester, or attacker, getting shell or remote command execution on the system From there, there are several things that must be done in order to make it worth your while and your clients money!
STOP! Some say they don’t need to exploit anything They also say they don’t need you to go further In general, these are the exceptions and likley have an advanced and well-defined security program In every test, you should tell you client something they didn’t know about their network
Categories Local Enumeration Network Enumeration Privilege Escelation Pivoting MiTM Attacks Hiding & Covering Your Tracks
Focus We will focus on the local and network enumeration Automation in this space needs some work This is where Carlos comes in :)
Local Enumeration Accounts & Passwords List defenses - Firewall, A/V, etc.. General System Information - Screen capture, video screen capture - Open ports, file shares, running processes - Registry / configuration data - Device data - Mic, webcam, USB, Wireless
The Trick Being able to do this across multiple platforms Windows - Has great coverage, especially in Metasploit thanks to Carlos Linux - Not too much exists to automate OS X - Seems to want to behave differently thank Linux/UNIX - Each release changes the commands!
Local Enum - Manual Without advanced Cylon technology, the following is still done manually: - Go through file system and shares look for good stuff - Backup files, configuration files, clear-text password files
Re-Configure The System Change settings - DNS, hosts file Disable defenses - Drop shields, disable anti- virus Add file shares Add access methods (RDP, VNC, Telnet)
Network Enumeration Packet sniffing Port scanning
Windows Enumeration Examples
Linux Enumeration Examples
OS X Enumeration Examples
Don’t Forget: Presentations: Radio: Live Stream: Forum: Mailing List: Webcasts: Insider: