Trevor Nugent SEC - 335 Initial Access and Execution

Task One

1-3) https://drive.google.com/file/d/1YwggHe2bPKUl2CK2PVhfUgiLKSppMzfL/view?usp=sharing

4. How does it achive code execution?: It uses words built in macro system to download a file from a server before running it to establish a connection.

5. MITRE ID: T1059.005

Q1) Why is the name significant?: Word automatically runs whatever macro has that name once the file is opened, so this script would run immediately if someone opened this word file.

Q2) How can organizations defend against these attacks?: Use attachment filtering so that no suspicious files with these macros attached are ever even downloaded, prevent macros from running entirely, or simply educate their employees better such that they know what to look out for.

Task Two

1. https://drive.google.com/file/d/1jH7PCodyz2Vik9-PUqamkFEeZQbAyy85/view?usp=sharing

2. This attack achieves persistence by opening a shell session to an outside source and stays hidden by hiding itself within a typical non-malicious file.

3. T1195.002

Q1) Antivirus has a difficult time detecting backdoored software because it won't match any files already marked as viruses, and because it would need to scan the whole program, which can be quite large, to find a small bit of injected malicious code.

Q2) They could distribute this at scale primarily by compromising some typical distribution method for a given software.

Q3) Unsigned and unverified software makes it dramatically easier for backdoors such as this one to exist, and it makes it dramatically harder for a system to detect them.

Task Three

1. getuid MITRE: T1033 Explanation: Identifies the device and user the current session is operating through.

2. sysinfo MITRE: T1082 Explanation: Provides info about the compromised system. Largely would be used to know what architecture and operating system someone is working with in order to plan further actions.

3. ps MITRE: T1057 Explanation: Lists currently running processes. This information could be used to determine what antiviruses or other detection methods are currently deployed on the system, or it could be used as I do to migrate to a different context.

4. netstat -an MITRE: T1049 Explanation: Displays active network connections and listening ports. Largely useful to determine if a given system could be used for lateral movement or if there might be any interesting information being transfered.

5. pwd MITREL: T1083 Explanation: Tells the attacker the current directory. Could be used to determine the next path of action.

6. ls MITRE: T1083 Explanation: Displays files and directories in the current directory. Can reveal potentially interesting files within the current accessible directory.

7. getprivs MITRE: T1069 Explanation: Displays the currently accessible permissions. Allows the attacker to assess what they are currently capable of within a system and plan further moves.

8. route MITRE: T1016 Explanation: Displays system routing information. Can be used to determine what is reachable from the compromised machine and possibly look for lateral movement.

9. whoami MITRE: T1033 Explanation: Tells the account from which the current window is operating. An attacker can use this to determine if the current window is elevated or is of any interest.

Screenshare & 9 Commands: https://drive.google.com/file/d/1quBA5qOV1ohSDLDR2V7L4DX5Zx76x1nI/view?usp=sharing

Q1) Reverse HTTPS is dramatically more common traffic and thus it's far easier to blend into typical traffic or just otherwise be unseen in the flood of packets.
Q2) Using a non-default port makes the activity less notcieable or at least less obvious. Like, since Metasploit typically uses 4444, avoid it since it is too easy to detect.
Q3) Netstat -an showed the most important info specifically for lateral movement because it shows ports and connections already established on the compromised system.
Q4) Getuid confirms the infiltration was successful because it shows us what actual computer we are connected to/on instead of just IP along with a username.

Task Four

1. https://drive.google.com/file/d/1XzqUuskFnUYKTDhItJK5lUpl6eJvytrN/view?usp=sharing

2. RDP provides attackers with direct and full access to a system the same as they would get with just logging in on a normal monitor. This allows them to see everything within the system and, in some cases, opens lateral movement by using it as a new point of operations from which to interact with the network.

3. MITRE T1021.001

Q1) RDP provides full visual access and interaction to a system while Meterpreter is restricted to largely CLI.

Q2) RDP allows an attacker to actually interact with the graphical environment rather than simply allowing them to watch and monitor.

Q3) Largely any unexpected connections to 3389 would indicate unauthorized RDP access. However, you might also watch logins as well.

Q4) The simplest method to secure RDP is simply to disable it when it is not needed, or by restricting its use to specific scenarios and users. You can also use a firewall to restrict where people can actually RDP from, as champlain does.