We have arrived to the main event.
And here in this final skill of our PIN 200 course, I wanted to offer up a
couple of different key areas put together in one skill to close everything out.
See, this is definitely last in our PIN 200 course, but by far not the least
important as we put together some basic concepts and ideas that we've learned
all throughout of our course together here in this final skill, as we close
everything out and the two areas that we're going to be covering heavily on
in this particular skill are going to be lateral movements and basically
closing up all the gaps in far, as far as post cleanup is concerned.
See, there's a lot of different areas that we have to concern ourselves
with and making sure that we clean things up, not just because we don't
want to get caught and we'll definitely get more on this as the skill unfolds.
But one of the areas that I really wanted to hit on to start things off
with and post cleanup is that we're not doing post cleanup solely to get out of
giving away our tips, tricks, and secrets.
There's many different things that we've done throughout this course together
that you don't want to leave inside the organization that you're PIN testing for.
For instance, dummy.exe, along with some of the macros and other scripts
and tools and things that we've used all throughout this course together.
You don't want to leave that just hanging.
Part of that is because let's say that you get done with the PIN test and you
start making your way towards the next job that you're working on, and then all
of a sudden network traffic is overflown at original PIN test station over here
for callbacks to Metasploit and MSF console, because you decided that you
didn't want to do post cleanup and now you have all these dummy files calling
back home, trying to give you more information and also opening up the
internal network of that previous organization to a lot more attacks from
people that will not be as kind to them as we are.
So, in addition, the security team of that previous organization may also find
some of this stuff and turn it in as being malicious.
Now I'm not saying it is, but if we're abiding by the actual scope of our rules
of engagement and the overall memorandum of understanding, user agreements,
whatever the terminology is that you work with or for inside of your PIN test,
it could hold us civil or criminally liable in terms of not doing a proper
cleanup, and we've gone through previous portions of our course together where
we've talked about how to get rid of the stuff, put it there, and basically
it's just a backtracing of what we've done and keeping proper notes.
Logging is very critical in this area because we have to be sure that we've
taken everything that we've put into that organization and properly retrieved it.
Think of this for a second, right?
Let's say you're a mechanic and you decide to do mechanicing jobs
on site for somebody's vehicle.
When you make it to that location and let's say you're doing a transmission
rebuild, there's a lot of specialized tools at this, and while you may have
rebuilt the transmission, put it back in the car, it works great, you've moved
on to your next job, but you've left tools at the original site.
Now, one of two things can happen here.
Either A, you go back and pick up the tools, or B, you decide to go buy more
tools, and I'm here to tell you that specialized tools for rebuilding
transmissions, especially ones out of an 84 gram marquee station wagon with the
automatic overdrive transmission that Ford so lovingly built with tender care
can cost a whole lot of money because there's tools that you use only on those
specific things that don't really apply anywhere else in mechanicing.
And I bring up Ford as that reason because those that have worked on Ford know that
there are tools sitting in the back of the tool chest that you all use for Fords.
Now, what's a way for us to be able to be able to go back and make sure that we have
everything? It could be accountability by going through and making sure all of our
toolboxes are put back in order, a tool has its place for each and every job, and
you at the end of the job, you go through all your tool chest and you say, okay, I
got all my metric wrenches, I've got all my standard imperial standard, I forgot the
terminology for that, but I've got all those wrenches too.
And then I've got the different tap and die sets for the couple of bolts that broke
off. I have all of that.
You know, it's basically the checks that you do post operation of any particular job.
And computers are no different, especially when it comes to pen testing.
You want to make sure that you have all of your tools, all of your little things that
you've left across this presence on the network and those different systems.
And the one surefire way in order to be able to do that is logging, not even with the
tool checks at the end, because that's like that should be mandatory or should be
common sense, right?
Now, if I go through on that transmission job and I'm taking notes and I say, you know
what, I didn't do all the clutch work for, I think it's the R12 set.
I did that at this table over here and I did three, four over there, three, four overdrive
over there. OK, cool.
Now, if I go through at the end of the job and I don't look at those notes and then I
come back and say I got everything or I think I do, I could have just easily gone back to
my notebook and said, this is where I kept everything.
This is where I did those particular jobs.
And that's why it's very similar to pen testing, if not exactly the same for logging.
And I've hit on logging in every course that I've done here at CBT Nuggets because it is
that critical, especially in that cybersecurity realm, whether you're on red team or blue
teams. And we'll be talking more about the different teams here later in the skill
because blue teams are our nemesis, co-workers, friendlies.
Yes, friendlies. And it's just important for us to be able to keep track of everything
and make sure that when we leave that organization, we've left nothing of our presence
there. And again, I want to stress that there are some organizations, DOD, will file
charges or launch a formal investigation with some sort of policing agency that if you
leave something behind, it's not supposed to be left behind, especially if you're working
on those higher classified networks.
Now, I'm not saying that to scare you.
I'm saying that for your awareness, so that way you have a plan put in place with your
organization or maybe your pen testing on your own.
That's OK, too. It's just something to keep in your notebook.
So keep that in your back pocket as we go through the rest of the skill and we start
going over lateral movements, how that ties into post cleanup and also just looking at
post cleanup overall as we close everything out.
I'm telling you, I'm going to miss you after this one.