This is a work of fiction. Any resemblance to actual persons, living or dead, or any other event, or events, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations, or situations
music
Ha ha!
music
Now, if you've been with me before on previous courses and skills, you know I have a thing for physical access, and I absolutely love being able to break into a place and actually capture the device physically for analysis at a separate location and with more ample time.
And by ample time, I mean having the ability to have a physical piece of hardware with you at a separate location at your leisure to be able to work with it as far as getting data off that physical device, cloning it, doing whatever the case may be.
But it goes without saying that physical pen testing has to be allowed inside of the rules of engagement. And I point this out because a lot of pen test organizations out there do their testing remotely. So you may have an organization in Texas that you want pen tested and you contact CBT Nuggets based out of Oregon.
So there's not a lot of possibility that somebody from the physical location of CBT Nuggets in Oregon is going to make the trek all the way down to Texas to do a physical attack.
But if you're geolocated with the organization you're pen testing, you could, as a pen tester, try to get this included in part of your rules of engagement. I've done so before many times. And there's a lot of different things that you can pull out of a physical attack against an organization inside of ROE.
Now, our purpose in being able to do a physical attack is to be able to go in and try to find devices that we can either take with us to a separate location to do our analysis and run our tools outside of the purview of the network. This allows us to be able to circumvent being caught on network traffic captures because we wouldn't actually be on the network.
For instance, if I bring a hard drive back to this location right here, I have a couple of hard drive sleds that I can run duplicates and get the forensics hash on that hard drive. And I could take the physical one, the original one, back to the organization that I pen tested against. And now that I have a copy of it, I can run all of my tests against that.
In the previous couple of skills, we were getting into password attacks. Well, trust me, this all ties into that password attacking learning inside of this physical skill because we can take a couple of hard drives and go through and exploit passwords on a physical system if we have access to it. We'll run through some demonstrations throughout this skill and get an idea of what we can do.
But I do want to point out a couple of other things, too. And this is of note to think about. A lot of folks that aren't cyber savvy, especially security savvy, love to have sticky notes. And those sticky notes will sometimes be under the keyboard, on the monitor, in a notebook, or just plain out in the open on a desk. And they include passwords, logins, usernames, all that other great information.
Because the user doesn't want to try to remember all of that. It's an inconvenience. And I'm not picking on users. I'm just stating facts here. It happens even in the DoD. I can't tell you how many times I found this in secure locations. And their thought process was, well, I'm in a skiff. Nobody will be able to come in here and get my sticky note off the monitor that has my password. Well, guess what? This pen tester had a clearance to be able to go in there and grab that.
Now, there's other things you can do, too. Again, rules of engagement here. You could also be looking for thumb sticks, because a lot of folks like to put important documents that contain PII and proprietary information on removable media and just have it laying around.
Or you could put your own removable media out there, just leave it on a desk in a meeting room or maybe a coffee table or something like that and have files in there like we've done in previous skills already that are embedded with things like reverse shell access inside of Metasploit.
So when they run that actual thumb stick thinking it's theirs and they see files on there that are named very similar to what they have within their organization or has names on it or other information like that, they get the secure feeling within their bellies thinking that they're doing the right thing.
We could even embed a Netcat reverse shell inside the actual autorun. This allows us to test things like the security policy within the organization. Does the organization allow or prevent removable media from autorunning whenever it's plugged in?
If it doesn't, then the moment that they plug it in and that autorun.inf hits, then guess what? It's going to find a way back to us. And that back to us also circumvents other types of preventions that we've been having to deal with before.
For instance, let's say that we are trying to attack a firewall and get into an organization's private network. Well, that opens us up to being caught on the network traffic captures.
But if a user initiates a reverse shell from within that private network and we actually have a listener ready for it in our pentesting domain or Batcave, if you will, then guess what? We're already inside of that private network and we can start doing enumeration based on that connection that was given to us.
But this skill is going to focus on password attacks at that physical form. And we're going to go through a couple of ways to do this, provided that we have that physical media with us inside the ROE, of course. I can't stress that enough. So let's go ahead and do it to it.