In this lesson, we will learn
about Initial Access and Escalation Methods.
Initial access and escalation methods are the techniques
attackers use to first gain entry into a system,
and then elevate their privileges
to gain broader network control.
Initial access and escalation methods include
threat actor tactics, techniques, and procedures,
such as injections, credential dumping,
and privilege escalation.
Injections such as SQL injection
or command injection are common methods attackers use
to insert malicious code into a system
to gain initial access.
Next, credential dumping involves extracting
stored usernames and passwords from compromised systems.
Finally, privilege escalation is the process
by which an attacker, having gained initial access,
exploits vulnerabilities or misconfigurations
to increase their access rights.
Let's learn more about injections,
credential dumping, and privilege escalation,
then we will conduct a demonstration of credential dumping.
First, we have injections.
Injections are techniques
where attackers insert malicious code into a system
to gain access or execute unauthorized actions.
Common forms of injection include structured query language,
or SQL injection, and command injection.
SQL injection occurs when an attacker inserts
harmful SQL code into a user input field,
allowing them to interact with the backend database
in unintended ways, such as viewing unauthorized data
or even modifying database contents.
Command injection is another technique
where attackers insert harmful commands
into a vulnerable application to execute arbitrary code
on the server, leading to unauthorized access.
In SQL, sometimes called SQL injection attacks,
attackers use tools like sqlmap, which automate the process
of injecting SQL or SQL code into vulnerable fields
to explore and manipulate backend databases.
sqlmap further enables attackers to identify
and exploit SQL injection flaws,
retrieving sensitive data, modifying records,
or even deleting databases
if proper permissions are available.
So preventing injection attacks involves
securing input fields through parameterized queries
and validating user inputs through input validation,
ensuring no executable code can pass through.
These processes limit the possibility
of malicious code being executed through injection paths.
Additionally, web application firewalls,
or WAFs, can also be used to identify
and block injection attempts.
Finally, regularly testing applications for vulnerabilities
and ensuring that database systems are configured
with the principle of least privilege can reduce the impact
of injection-based exploits.
Second, we have credential dumping.
Credential dumping is the extraction of stored usernames
and passwords from compromised systems.
Attackers use credential dumping techniques
to acquire legitimate user credentials,
allowing them to bypass security measures
by impersonating legitimate users.
Once credentials are stolen, attackers can use them
for further network penetration or lateral movement,
making it a powerful tool for sustained access.
A well-known tool
that enables credential dumping is Mimikatz.
Mimikatz allows attackers to extract plaintext passwords,
hashes, and Kerberos tickets from memory,
enabling them to gain access to high-value accounts
within a Windows-based organization.
Once the credentials are acquired, attackers can use them
to move laterally within the network,
access critical assets, and even escalate their privileges
by finding administrator-level accounts.
So to prevent credential dumping,
organizations should consider disabling outdated protocols
like LM, or the LAN Manager,
and NTLM, or NT LAN Manager,
in favor of stronger encryption methods.
Additionally, implementing
multi-factor authentication can also reduce risk,
as attackers will need more than just the stolen credentials
to gain full network access.
Finally, limiting the ability to read from memory
by disabling unnecessary administrator rights
and using secure, updated password policies can also help
mitigate credential dumping risks.
Third and last, we have privilege escalation.
Privilege escalation is the process
of exploiting vulnerabilities
to increase access rights on a compromised system.
This is a critical step for attackers,
as it allows them to perform unauthorized actions
that require higher privileges
than their initial access level permitted.
Privilege escalation can be vertical,
where attackers gain administrator or root level access,
or horizontal, where they gain access to accounts
with different resources and similar levels of access
to further their control over the network.
One example of privilege escalation utilizes Metasploit,
an open-source platform that attackers use
to exploit known vulnerabilities.
With Metasploit, attackers can search for
and exploit privilege escalation flaws
in the operating system, such as outdated software
or misconfigured permissions.
This often leads to attackers obtaining full control
over the compromised system, enabling actions
like data exfiltration, system reconfiguration,
or malware deployment.
So preventing privilege escalation attacks involves keeping
systems and applications up-to-date with the latest patches
and to address known vulnerabilities.
Next, organizations should employ the principle
of least privilege, granting users and services
only the minimum access rights needed for their roles.
And finally, monitoring systems for unusual behavior
such as attempts to access sensitive files
or execute commands with elevated privileges can help
in detecting privilege escalation attempts early on.
Now let's conduct a demonstration of credential dumping
and password cracking.
In this demonstration, I have a Kali Linux machine running
on the same virtual network
as an intentionally vulnerable Metasploitable 2 machine.
In order to start my exploration,
I'll first run an Nmap service version scan
to determine which ports are open
on the Metasploitable 2 machine.
There we go.
Now, looking at this, I happen to know
that VSFTPD version 2.3.4 is vulnerable to attack,
and that there is a Metasploit exploit already written
to attack this vulnerability,
so that's what we're going to use.
I'll open up Metasploit on this Kali Linux machine
and load up the correct module.
We'll open up Metasploit with the MSFconsole command.
Next, I'm going to search for ftpd 2.3.4,
and there it is.
That's the exploit that I'd like to use,
exploit/unix/ftp/vsftpd_234_backdoor.
I could write out use and then that entire string,
exploit/unix/ftp/vsftpd_234_backdoor,
or I can look just to the left of that line
and see that it's been given a number, zero,
so I'm just going to say use zero.
Now it's loaded up.
Next, I will configure the IP address
of the vulnerable machine as my R host, or my remote host.
I'll do this by setting RHOSTS to 192.168.56.105.
Our host is set.
Now all I need to do is run the exploit.
I've got a shell.
It looks like it'll be a root level shell,
and I've got a shell opened in session one.
So this exploit has gotten me a root shell,
but to make things a little easier, I'm going to upgrade
to a Meterpreter shell, which is an attacker shell
with prebuilt malicious functions.
To do this, I need to put my current shell
in the background.
I'll do that with Control Z,
and then answer yes to the question.
Now I'm back at a command line,
and my shell is running in the background.
Now I just need to upgrade my session, which is session one.
I'll do this with the sessions upgrade session one command.
It is attempting to upgrade my session,
and a Meterpreter under session two is open.
I can take a look at my sessions
with the session list command, or session -l,
and I can see that I do have a Meterpreter shell
under session ID two.
Now I need to interact with it,
so I'll say sessions -i for interact with session two.
There you go, now I have a Meterpreter shell.
Now that I have a Meterpreter shell,
I'm going to download the passwd and shadow files
from the Metasploitable 2 machine to my local machine.
This is done with two commands,
download /etc/password,
and download /etc/shadow.
Both files are now downloaded
and they're in my home Kali folder,
so now I'm going to go to another shell
and look for those files.
There they are, they've been downloaded,
the passwd and the shadow file.
In order to do password cracking,
I need to combine these two files into one,
so I'll use a command called unshadow,
unshadow the passwd and the shadow file
into a new file called unshadowed.
That created a directory, which is home/kali,
and then a hidden directory, .john.
That's because the unshadowed command is associated
with John the Ripper, which is the tool
that I will next use to crack these hashes.
Now all I need to write is john and unshadowed.
There you go, John has cracked some usernames
and passwords from the Metasploitable 2 machine.
Specifically, it looks like there were
six different passwords
that were cracked by John the Ripper.
So remember, attackers use initial access
and escalation methods to first enter a system,
and then increase their control
by gaining higher privileges.
They often achieve entry by injecting harmful code
or stealing credentials,
both of which grant them access without raising alarms.
Techniques like SQL injection allow attackers
to manipulate databases,
where credential dumping lets them extract stored usernames
and passwords to bypass security measures.
Once inside the network,
attackers may use privilege escalation
to exploit vulnerabilities and gain broader access,
even administrative rights,
enhancing their ability and control of the network.
In the end, organizations can mitigate these risks
by securing inputs, using multi-factor authentication,
and keeping systems up-to-date to reduce vulnerabilities.