One of the first steps in order for us to be able to maintain persistence
within a system or network during our pentest is understanding what other
systems are out there.
Because let's say for example that we're identified inside of one singular
system that we've popped.
Well, they could take that system offline or they could move it to a purgatory
VLAN or whatever the case may be taken away our access to that particular
system and potentially other network resources.
But if we maintain persistence and start to try to pivot across the network in
lateral movements and also escalation of permissions and then pivot to
something else.
Then we would be able to have a backup to be able to go to in case we were
caught or compromised.
And inside of our example here, we're going to finally start getting into
changing our payloads mid course of a session.
So as you can see, I'm just changed. We already have the session established.
We already know that we're going to be using a new payload called post multi
gather ping sweep.
Now there are some variables that have to be set in this and and commands below
by the way.
If you go ahead and type that in and then say show options.
You will see that there's really just two options that we need to be aware of.
Now, the first one is our host, and this is going to be the IP address of that
particular system.
Based on the IP address and subnet. Now how do you get that?
Well, I'm not going to be doing an example of that because that's pretty self
explanatory. You send a command of IP config through sessions dash C.
Now we just so have to do that and found out that the window system is on the
one nine two one six eight zero zero subnet slash 24.
So our host is going to be configured set our host one nine two one six eight
zero zero slash 24.
And then we're going to pin it to a session because we could have multiple
sessions going on.
But do remember, if you have multiple sessions going on, you need to listen on
multiple different ports.
So session one could be on four four four four session two could be on four
four four five, et cetera, et cetera, or have different machines as well to our
VMS or how we want to get.
So we're going to tag it to a session set sessions one.
Now the other option that I have in here that you don't see is I set set verb
arose true. Let me zoom out there for a second.
So I set the reason I did that is because we want to be able to display what it
is that we're actually doing.
Now in this particular set set up.
We're going to be doing a check on that particular IP address.
And then once we have all of our stuff set up, we're just going to go ahead and
execute a run.
Now the reason that verb the verb rose is set to true.
Or verbose, I'm sorry, I'm getting there is because we want to be able to have
this output right here, which now I'm going to zoom in for you.
You can see that it's given us an ID output of every IP address that's within
that subnet that is currently doing a sweep on.
So we have one, two, one, six, eight, zero, we got one who's found blank blank
blank blank blank blank not found not found zero dot 13.
And we'll be able to identify at least within that subnet that this particular
system has access to that we can figure out what's on and what's not.
Now this will take a second to run. And the other thing I want you to remember
is this creates a lot of ICMP traffic on the network is this normal.
Could be could not be. And this may be something that gets flagged on the ID S
or IPS system.
So this is definitely something to keep in mind when you're running this.
All right, so finally it's ran. And as you can see, it went through the
entirety of that actual subnet.
And now I'm just going to simply type post. And the reason that I'm doing this
is because based on what was actually responding as being connected or online
is going to report back as a host that's active that we can just simply type
post in the command line.
And then looks kind of like this. Now you may notice also that we have www.cbt.
com. That's tied to the actual host VM along with the second one on there.
But now what we do have are multiple IP addresses in the 192 1680 range. So we
have one 13 and 53 which are VMs within the actual realm itself.
And you'll notice that it tries to identify the actual OS on them as well too,
because we can actually do OS fingerprint and using our actual ping suite.
Now this gives us a lot of information to be able to work with as far as
understanding the actual targets in these in the network and organization and
know that I have some of the systems turned off right now.
But it's why you're not seeing it. But now with this information we basically
revert in the pintesty lifecycle back to the beginning to try to be able to
send exploits to those different systems out there.
So that way we may be able to get in those systems as well, along with the fact
that we have users on those systems. And we go even further where we can
actually run in map from within MSF console because it is embedded.
So DB underscore status. And you can see that now we get a connection that we
're in the actual database for MSF. And then we're going to say workspace.
That's a sweep one and that's this is going to be our first sweep that we're
doing across the actual network. And basically we're creating a database for
that. That's why we did the DB status.
Now we're going to say DB underscore in map database in map and just go with a
simple command to do a sweep for us and ID to make sure to get the syntax
correct in this with all uppers and things like that.
And do keep in mind that this works just like in map. So if you're still trying
to familiarize yourself with in-map commands, highly recommend you use zen map
to show what the actual command options are to be able to plug this in.
So now we're just going to go do top ports on our actual scope right here. And
we're going to keep it simple at 100. And we're going to do the range 192.168.0
.0/24.
And we're going to see that in map is starting up. I'll show you that right
there. Boom. There it is. And again, commands below, but this is going to give
us a bit more information than what the actual post right there.
Command gave us a return for what's actually active. This is actually going to
start telling us what systems are open in that standard in map format that we
've been used to so far. For example, let me zoom in for us right here.
We have 192.168.0.1 and all the ports that are open on it, 53.135, etc. etc.
Now, the biggest thing you need to remember here is that although this is stuff
that we are normally doing to be able to do reconnaissance during our fantastic
lifecycle, the big takeaway here is that this is actually happening on that
target system that we are sessioned into.
So the actual Windows system that we're on, the actual host VM in this
particular case is 0.1, is the one that's running all of these commands for us.
We're not doing it from the Kelly box to inside and internal network. We're
actually inside of that network on that system doing it from there.
And the reason that this is happening is because we're taking MSF commands and
pipe it through that backdoor channel we created with the MSF file.
And I know this section is talking about persistence, but this is actually
targeting out those different systems so that we can start spider webbing out
to the rest of the network to be able to try to maintain persistence.
Just because we're on a system doesn't necessarily mean that we're always going
to have access to that system.
These tips and tricks right here allow us to be able to scout out different
potential targets for us to be able to try and exploit in different manners and
situations.
And lastly for this particular section right here talking about persistence, we
do should go through and create user accounts on that particular system and try
to claim them or make them look as normal as possible, which is stuff we've
done in the first
post-exploration tactics.
So we went through and created a user on the system
and based on the permissions that we have for who we're logged in as.
Who am I?
We can only have those level of permissions,
and we found different ways to be able to get that backdoor communication
channel open to allow us to be able to maintain
that persistence if they go ahead and open up that file multiple types,
which is also why we had ways to inject DLLs inside of running programs.
And also, as we're inside of here,
understanding that since we are in an administrative role,
we can send registry commands through the actual sessions for us to be able to,
let's say, put the dummy.exe inside of a startup script
when our listener is always ready to go.
And these are things that we can actually do to maintain persistence on that
one
system and try to spider out and get persistence on the network by having a
backup system or 20 backup systems that we've been able to penetrate and get
into.