Now that we have our persistence established for us to be able to get back into
the system or systems across the network at a later date.
And we've already gone through and done some hash dumping to do some offline
password cracking. We need to take a look at one of the other post exploitation
.
That we use with Metasploit and that is being able to exfiltrate data.
So depending on the scope of the pen test itself, you may or may not be allowed
to do this.
But I have been in pen test where security information and security
classifications for data is one of the key points of actually conducting the
pen test in the first place, not just getting into the actual systems itself.
Data has its own SOP with a lot of those organizations and making sure that
users are maintaining data integrity is and proper data classification is of
the utmost importance for those folks.
So when we do the first few things that we're required to do when we actually
get into the system and if it's within the rules of our pen test, let's start
taking a look at some of the possibilities of finding files across the system.
Now I'm going to hop on over and show you that already ran this command because
it takes a while to do it.
And what it is is we're simply searching for a file on a system. And in this
particular case, as I zoom in, you could see that I searched for
-f corporate with the asterisk on the outside, meaning anything that contains
either in the file name or in the actual data itself.
Now, this is only going to search in files that are plain text.
Why is that important? Well, if there's corporate information for a
organization that we're taking a look at in our account numbers at it, that
file should not be in plain text. It should be encrypted. It should be
protected in some form.
And the fact that we have things in actual plain text on a system could cause
damage if it's not a pen tester, but let's say an actual hacker.
Now, there are common things that users leave on their system in plain text.
And I've been guilty of it too. And I'm sure some of you out there have been.
That's password files folks. Hey, remember passwords and folks hate even more
have been multiple different passwords for multiple different systems out there
.
And one of the things that folks do will create a password documents, usually
text files that sit on the desktop or in some folder.
And we're just kind of mimicking that here with a bit of an example. As you can
see, one of the things that we found by search for corporate is a corporate
info.txt file.
And you can see that it's also came up in the actual reset folder to other
users. That's pretty important to remember because this is a window system that
we're targeting.
And if you were to do a search inside of Windows Explorer for corporate, you
wouldn't get that result. This is actually searching through registry as well
for any key indicators that that for files that may have been created along. So
you see in the first line, you see corporate info.txt.
The timestamp on it and also inside of the user's learner app data roaming, etc
, etc, etc. This was also turned up as a recent file. So that would be if they
deleted the one that's in the cdrot temp.
The one in the in the app data folder would be basically a backup for us to be
able to go and get and it is like a shadow copy, so to speak.
And then you see, you know, last line inside of the windows for, you know,
installation folder and stuff like that.
But there is a corporate info.txt file in the C drive temp folder and I'm just
going to show it to you because I don't want to give away the actual answer.
Because this is a part of the actual quiz question for this section. But if you
look in C drive temp on the actual host itself, you could see that that
corporate info.txt file is in fact there.
Shaka. There it is. Now,
just because it's there doesn't mean that we can't happen.
What do I mean by that? Well, inside of Metasploit in the meterpreter or MSF
console, we can actually download that file.
And so in this instance, we're going to say download since we already have the
file path for that. See, and you're going to use double backspace or backsl
ashes for this because that's just a syntax that's required for a meterpreter.
We're going to say temp, slash slash slash or full writ info.txt. Sorry, I had
to put quotations around it because there's a space in the actual file name
itself.
And when I hit enter, it downloaded the file directly to our callee system for
us to be able to hold on to. Now, this was something you might want to keep in
mind too, because
I opened up the terminal for this on the actual desktop, which is why now as I
zoom in, you see the corporate file right there that's locked.
The corporate info.txt. And again, I'm not going to open it. Yes, yeah, because
it's a part of the actual quiz question, but we were able to download it so I
can actually go into the properties of it.
We show you that it's 45 bytes and inside over here.
Right there. It's one kilobyte.
So it's rounding up on the Windows system. But if we go into the properties,
let's see what it says.
45 bytes. Now, you could verify the hash if you wanted to of the file, but that
's not really necessary in this particular point.
What we're doing is displaying demonstrate in fact that you can actually search
for files on a system.
And you can download those files to your Cali box. Just keep in mind where you
actually open that terminal at
the go into MSF console in the search command goes even further. You can even
search for search dash D. Let's say space dot Astrid.txt.
If you're familiar with looking for file extension, subside of Windows, this
should be no big deal for you because whenever we used to do all searches in
the older versions of Windows.
Astrid.txt will result in any text file that. Oh, I put dash D and set dash F.
I'm sorry.
This will result in any file that ends with a dot txt just as this displayed
here. So this is just something else to keep in mind as well. And
you can look for common file types, docs, Excel, PowerPoint, even PST files
that have emails in them and you can download those PST files to your actual
Cali system.
For you to open up inside of Outlook or inside of some PST, you know, exporter
to see if there are any emails that are in plain text for you to be able to
examine at a later time.
So you don't have to do that online now. You can actually go through and get a
lot of data to examine at a later time. Now,
as pen testers, we need to be a jack of all trades and master of many. I'm mis
phrasing a quote on purpose here because
anybody can just go through and hack into a system and we can. But as a pen t
ester, we are bound to the rules of engagement that the organization has hired
us to do and agree upon.
We have required a little bit of expertise in a whole lot of different areas
and some of the stuff that we're doing here, such as the search requires us to
have
not extensive, but a fair amount of knowledge in the windows world. For
instance, I mentioned the PST file for Outlook.
There's a lot of people out there that hack into systems that don't really
understand how Outlook works or where those default files are saved at
and I've stressed this before and I'll stress it again. It's okay to go to help
files and it's okay to Google stuff.
If you need to go, if you say, "Man, I know somebody saves emails locally or
has a shadow copy of it somewhere on the system. I just don't know where it's
at." That's okay.
Once you've made it into the system to be able to search for files like this,
you can definitely go into the Google and say, "Hey,
does Microsoft Outlook allow users to file emails to a file on the system?" And
you can go from there. With that information, you can then search for that and
download it to your actual system for examination.
One thing to remember here, in addition to everything else, of course, is that
you're limited on space on your particular Kali system. So,
if that PST file is pretty big and you only have an 80 gig hard drive, that's
something to think about because a lot of folks save everything and have a lot
of unread messages.
You know who you are.