Book 5

Question 1

Pivoting

Answer 1

allowing attacker to go from initial compromise to attack other internal hosts within an organization.

Question 2

Meterpreter pivoting

Answer 2

Meterpreter C2 framwork - attackers reuse c2 to pivot to new hostss within the network

Question 3

Meterpreter C2 framework

Answer 3

deployed as initial exploit(PsExec lab) or through an independent payload generated using msfVenom

Question 4

Meterpreter Pivoting options

Answer 4

1. start a proxy server with auxillary/server/socks4a, connect through pivot ( proxy listens on attacker, sends through pivot)
2. Reuse Meterpreter session with a new ROUTE to internal target
3. Forward a specific port on the attacker to a remote destination port

Question 5

portfwd

Answer 5

used to specify a specific port and ip address within a network that the attacker wants to connect to. Can be used for any combitation of IP address and TCP port desired.

Question 6

portfwd example

Answer 6

attacker listen on attacking system port 8000. Any connection to port 8000 will forward through the Meterpreter C2 link to the victim system at 10.10.10:80.

Question 7

portfwd add -l 8000 -p 80 -r 10.10.10.100

Answer 7

“listen on my local attacker system on port 8000. Foward all that activity to port 80 on the remote host 10.10.10.100 . Any connection to 8000 will pivot meterpreter session to 10.1010.100

Question 8

route

Answer 8

meterpreter command. Sets up a pivot through the victim.

Question 9

arp_scanner

Answer 9

used after the route command to enumerate hosts on the network (IP & MAC)

Question 10

SSH -D

Answer 10

start a SOCKS proxy server on attacker system. allows for the use of any SOCKS proxy-aware client to communicate through he SSH tunnel to a destination target system

Question 11

ssh port forwarding

Answer 11

very flexible for port fowarding. listening port is on atttacker.

Question 12

netsh port forwarding

Answer 12

netcat and named pipes. listening port is on victim NOT attacker. unlike meterpreter port foward or ssh tunneling.

Question 13

Invoke-WebRequest

Answer 13

is an alias for curl and wget but on windows.

Question 14

Lateral movement

Answer 14

act of exploiting targets through pivots.

Question 15

lateral movemment types of attacks

Answer 15

MITM

Local Password harvesting ..

Question 16

Pivoting techniques

Answer 16

1. meterpreter route
2. meterpreter portfwd
3. meterpreter auxillary modules