1. Module 8 – What's Next?  Phase II  Controls Assessment  Scheduling ○ Information Gathering ○ Network Mapping ○ Vulnerability Identification ○ Penetration ○ Gaining Access & Privilege Escalation ○ Enumerating Further ○ *Compromise Remote Users/Sites ○ *Maintaining Access ○ *Cover the Tracks

2. Compromise Remote Systems  Systems within an internal network may have additional access Remotely-mounted drives Trust relationship between servers  Users within a network may have additional access ssh private/public certificates Network Information Systems (NIS) database

3. Maintaining Access  Systems and Networks constantly change (patches, re-boots, firewall rules)‏  Syslogs / Alerts tip off sysadmins  You accidentally lock yourself out

4. Maintaining Access  Covert Channels  Back Doors  Rootkits Sometimes, just another account is sufficient

5. Cover the Tracks  Hide Files File name obfuscation Rootkits Unaccessible directories (windows)‏  Clean log files Syslog History files  Anti-Virus software  Integrity software (Tripwire)‏

6. Module 8 – Conclusion  Phase II  Controls Assessment  Scheduling ○ Information Gathering ○ Network Mapping ○ Vulnerability Identification ○ Penetration ○ Gaining Access & Privilege Escalation ○ Enumerating Further ○ Compromise Remote Users/Sites ○ Maintaining Access ○ Cover the Tracks

7. Final Comments  Thank you for participating!!!  If you have any questions, contact me at: PTF@heorot.net  Please use the “Discussions” tab in the Course wiki  We need you help!!!  Suggestions on how to improve Course Slides Whatever