Practical Windows Penetration Testing

To define the attack surface, we would like to know as much about the target network as possible.

• Identify all running hosts on the network

• Identify all open TCP ports

• Identify all running UDP port

To be able to exploit services we need to know exactly what they are.

• Find out what kind of service is running on a port

• Identify the program that is running the service

• Identify the exact version of the program

Exploit development is very time consuming and complex. In most penetration tests publicly available exploits are used.

• Find a suitable exploit on the Internet

• Understand and modify the exploit as necessary

• Run the exploit and get access to the machine

A more extensive framework is needed to efficiently do testing. The Metasploit Framework offers various tools that will be used in every stage of a pentest.

• Find suitable exploit in Metasploit

• Choose payload for the exploit

• Run the exploit

Although not real exploitation but lot of real attacks rely on files that are that are executed by a victim user after a social engineering attack.

• Choose a payload that should be executed by the victim

• Create a malicious executable with the payload

• Social engineer the target user to run you executable

Modern Anti-Virus programs such as Windows Defender can detect a wide variety of malicious actions. Evading these tools is a typical cat-and-mouse game.

• Choose a legitimate Windows executable that will be used to carry the payload

• Download and run shelter to inject the malicious payload into the executable

• Run a handler to receive the connect back shell

We learnt a lot in this section and it should be practiced.

• Review what we learnt

• Explain how exploitation can be practiced

• Practice the given steps

We need to understand where we in the penetration test are and what are the at this point.

• Understand what the post-exploitation phase is about

Usable and stable backdoor is needed to properly interact with the exploited machine.

• Create a meterpreter payload

• Execute a payload handler

• Get to know the meterpreter shell

After a successful exploit the attacker inherits the privileges of the exploited application. If that is not administration or system privilege, then further exploits are needed to achieve maximum privileges on the target machine.

• Look for a process that runs as SYSTEM

• Try to find a way to manipulate that process

• Get the SYSTEM process to execute our payload

Credentials are valuable assets that can be used in further attacks. Thus harvesting them on newly compromised machines is essential.

• Harvest Windows password hashes

• Harvest passwords from HeidiSQL

• Collect credentials from memory

Most modern systems only store password hashes. The plain text passwords can be still recovered though.

• Understand how hash functions wor

• Run dictionary attack with hashcat

• Run dictionary attack with John the Ripper

The attackers’ first connection could be broken by various events, such as a reboot. To avoid losing the machine it should be made sure that a persistent backdoor is installed.

• Understand various ways to achieve persistence

• Use PowerSploit to create a persistent backdoor

• Execute the backdoor on the target machine

A compromised machine could allow access to a network segment that was previously not reachable. Using these techniques, the traffic can be tunneled through the compromised host.

• Understand the concept of pivoting

• Use the Metasploit autoroute module to route traffic to the new network

• Use a SOCKS proxy and proxychains to access the internal network by tools outside of Metasploit

Usually only password hashes are stored by Windows. However these can be still used to compromise other machines.

• Understand the legitimate use of using password hashes

• Dump password hashes with mimikatz

• Take over the domain controller with mimikatz

We will see some important measures that should be taken after this course to get success in the penetration testing.