Post-Exploitation
Talks about the list of things we need to follow after a successful exploitation.
The Post-Exploitation stage aims to obtain sensitive and security-relevant information from a local perspective and business-relevant information that, in most cases, requires higher privileges than a standard user. This stage includes the following components:
Pillaging
Vulnerability Assessment
Privilege Escalation
Persistence
Data Exfiltration
Evasive Testing
If a skilled administrator monitors the systems, any change or even a single command could trigger an alarm that will give us away. In many cases, we get kicked out of the network, and then threat hunting begins where we are the focus. We may also lose access to a host (that gets quarantined) or a user account (that gets temporarily disabled or the password changed). This penetration test would have failed but succeeded in some ways because the client could detect some actions. We can provide value to the client in this situation by still writing up an entire attack chain and helping them identify gaps in their monitoring and processes where they did not notice our actions. For us, we can study how and why the client detected us and work on improving our evasion skills. Perhaps we did not thoroughly test a payload, or we got careless and ran a command such as net user or whoami that is often monitored by EDR systems and flagged as anomalous activity.
Note: It is ok if some of our attacks gets noticed as it would mean the clients defenses are working. But our goal here is to emulate an attacker and try to learn how we got detected and work on our evasive skills, so we can find the blind spots on our clients networks.
Evasive testing is divided into three different categories: Evasive, Hybrid Evasive, Non-Evasive.
Information Gathering
Now that we are in the Post-Exploitation stage, we are in a new environment. So here we go through the Information Gathering and Vulnerability Assessment stages again.From the inside (local) perspective, we have many more possibilities and alternatives to access certain information that is relevant to us. Therefore, the information gathering stage starts all over again from the local perspective. We search and gather as much information as we can. The difference here is that we also enumerate the local network and local services such as printers, database servers, virtualization services, etc. Often we will find shares intended for employees to use to exchange and share data and files. The investigation of these services and network components is called Pillaging.
Pillaging
Pillaging is the stage where we examine the role of the host in the corporate network. We analyze the network configurations, including but not limited to:
Interfaces
Routing
DNS
ARP
Services
VPN
IP Subnets
Shares
Network Traffic
Understanding the role of the system we are on also gives us an excellent understanding of how it communicates with other network devices and its purpose. From this, we can find out, for example, what alternative subdomains exist, whether it has multiple network interfaces, whether there are other hosts with which this system communicates, if admins are connecting to other hosts from it, and if we can potentially reuse credentials or steal an SSH key to further our access or establish persistence, etc. This helps, above all, to get an overview of the network's structure.
For example, we can use the policies installed on this system to determine what other hosts are using on the network. Because administrators often use particular schemas to secure their network and prevent users from changing anything on it. For example, suppose we discover that the password policy requires only eight characters but no special characters. In that case, we can conclude that we have a relatively high probability of guessing other users' passwords on this and other systems.
During the pillaging stage, we will also hunt for sensitive data such as passwords on shares, local machines, in scripts, configuration files, password vaults, documents (Excel, Word, .txt files, etc.), and even email. Our main goals with pillaging are to show the impact of successful exploitation and, if we have not yet reached the goal of the assessment, to find additional data such as passwords that can be inputs to other stages such as lateral movement.
Persistence
Once we have an overview of the system, our immediate next step is maintaining access to the exploited host. This way, if the connection is interrupted, we can still access it. This step is essential and often used as the first step before the Information Gathering and Pillaging stages.
It is recommended that we work flexibly during this phase and adapt to the circumstances. For example, suppose we have used a buffer overflow attack on a service that is likely to crash it. In that case, we should establish persistence to the system as soon as possible to avoid having to attack the service multiple times and potentially causing a disruption. Often if we lose the connection, we will not be able to access the system in the same way.
Vulnerability Assessment
If we can maintain access and have a good overview of the system, we can use the information about the system and its services and any other data stored on it to repeat the Vulnerability Assessment stage, but this time from inside the system. We analyze the information and prioritize it accordingly. The goal we pursue next is the escalation of privileges (if not already in place).
Privilege Escalation
This is basically getting the highest privilege in a system. We want to get the privileges of the root (on Linux-based systems) or the domain administrator/local administrator/SYSTEM (on Windows-based systems) because this will often allow us to move through the entire network without any restrictions.
However, it is essential to remember that the escalation of privileges does not always have to occur locally on the system. We can also obtain stored credentials during the information gathering stage from other users who are members of a higher privileged group. Exploiting these privileges to log in as another user is also part of privilege escalation because we have escalated our privileges (quickly) using the new set of credentials.
Data Exfiltration
During information gathering and piillaging we will find lots of personal data. Our client might ask us to check if data exfiltration is possible. Security systems such as Data Loss Prevention (DLP) and Endpoint Detection and Response (EDR) help detect and prevent data exfiltration. In addition to Network Monitoring, many companies use encryption on hard drives to prevent external parties from viewing such information.
Companies must adhere to data security regulations depending on the type of data involved. These include, but are not limited to:
Credit Card Account Information
Payment Card Industry (PCI)
Electronic Patient Health Information
Health Insurance Portability and Accountability Act (HIPAA)
Consumers Private Banking Information
Gramm-Leach-Bliley (GLBA)
Government Information
Federal Information Security Management Act of 2002 (FISMA)
Some frameworks companies may follow include:
(NIST) - National Institute of Standards and Technology
(CIS Controls) - Center for Internet Security Controls
(ISO) - International Organization for Standardization
(PCI-DSS) - The Payment Card Industry Data Security Standard
(GDPR) - General Data Protection Regulation
(COBIT) - Control Objectives for Information and Related Technologies
(FedRAMP) - The Federal Risk and Authorization Management Program
(ITAR) - International Traffic in Arms Regulations
(AICPA) - American Institute of Certified Public Accountants
(NERC CIP Standards) - NERC Critical Infrastructure Protection Standards
Last updated