1. Module 7 – Gaining Access & Privilege Escalation  Phase II  Controls Assessment  Scheduling ○ Information Gathering ○ Network Mapping ○ Vulnerability Identification ○ Penetration ○ Gaining Access & Privilege Escalation ○ Enumerating Further ○ Compromise Remote Users/Sites ○ Maintaining Access ○ Cover the Tracks Heorot.net

2. Gaining Access & Privilege Escalation  Gain Least Privilege  Gain Intermediate Privilege  Compromise  Final Compromise Problem: We don't have access Heorot.net

3. Enumerating Further  Phase II  Controls Assessment  Scheduling ○ Information Gathering ○ Network Mapping ○ Vulnerability Identification ○ Penetration ○ Gaining Access & Privilege Escalation ○ Enumerating Further ○ Compromise Remote Users/Sites ○ Maintaining Access ○ Cover the Tracks Heorot.net

4. *Enumerating Further  E-mail address gathering  Perform Password attacks  **Sniff traffic and analyze it  **Gather cookies  **Identifying routes and networks  **Mapping internal networks *ISSAF does not cover this topic in great detail **Advance topics not covered in this class Heorot.net

5. E-mail Address Gathering  May already have some ○ WHOIS information ○ Forums ○ archive.org  Blind e-mails ○ Admin@... ○ Webmaster@... ○ abuse@... ○ Asdfasdf@...  Web site Heorot.net

6. E-mail Address Gathering Web page Demonstration

7. Perform Password Attacks  Remote Attack Hydra Unicorn  Local Attack John the Ripper (JTR)‏  Additional resources required: Wordlists Patience Heorot.net

8. Remote Attack Hydra Demonstration

9. Enumerating Further  Perform Password attacks Hydra results: Access Gained  What to do next? Continue on with Enumeration Return to “Gain Access & Privilege Escalation” Heorot.net

10. Gaining Access & Privilege Escalation  Gain Least Privilege  Gain Intermediate Privilege  Compromise  Final Compromise We now have access Heorot.net

11. Gaining Access & Privilege Escalation  Gain Least Privilege through: Exploitable vulnerability Mis-configured system Poor security practices “In general when someone has physical access to the local host the game is over, because there is usually one or more ways to get all information from the system.” -ISSAF Heorot.net

12. Gaining Access & Privilege Escalation  Gain Least Privilege  Gain Intermediate Privilege  Compromise  Final Compromise “How to do this” is not covered in any methodology Heorot.net

13. Gain Intermediate Privilege  Exploitable vulnerability Application exploit  Mis-configured system Application running at higher-than-needed privileges Access to applications they shouldn't have Improper maintenance (core dumps)‏  Poor security practices Users given elevated privileges Heorot.net

14. Gain Intermediate Privilege sudo Demonstration

15. Gaining Access & Privilege Escalation  Gain Least Privilege  Gain Intermediate Privilege  Compromise  Final Compromise Heorot.net

16. Compromise “A system is fully compromised anywhere in the target network and further attack from this system can be performed. This system can be used as a step stone for other attacks to the final goal.” Best example of this is “Got Root?”

17. Gaining Access & Privilege Escalation  Gain Least Privilege  Gain Intermediate Privilege  Compromise  Final Compromise Heorot.net

18. Final Compromise “ In this step, the “real” victim like the company master DB or a specific system/file is compromised. ” - ISSAF Database Web Pages Mail Servers etc.

19. Module 7 – Gaining Access & Privilege Escalation  Phase II  Controls Assessment  Scheduling ○... ○ Vulnerability Identification ○ Penetration ○ Gaining Access & Privilege Escalation Gain Least Privilege Gain Intermediate Privilege Compromise Final Compromise Heorot.net