[SysAdmin]

Network Security Division Help Desk

Welcome to the official help desk of the Samaritans Network Security Division. Here, we will strive to help people that have questions and concerns regarding any and all threads that are covered by Network Security and Beginner Hacking.

Replies will primarily be from members of the Network Security Division, but others may pitch in and help aswell.

Ask away!

[sh4moon]

what's the best .NET windows rat?

lol just kidding. what do you think is a good way to help mitigate the APT threat? also, how do you think the west should respond to aggressive probing/attacks from Russia, China, and North Korea?

[SysAdmin]

what's the best .NET windows rat?

lol just kidding. what do you think is a good way to help mitigate the APT threat? also, how do you think the west should respond to aggressive probing/attacks from Russia, China, and North Korea?

There really is no good way to help mitigate it unless you bring everything offline. You can't really protect everything this day and age, especially with people discovering zero-days and keeping it for their own benefits instead of reporting them.

Let's be honest, the US is doing the same to the countries you mentioned. Just look at the Stuxnet worm. Unless there are international laws in place, you can't really respond to these incidents much and try to point fingers. Those who know what they're doing will not leave any traces anyway.

[sh4moon]

There really is no good way to help mitigate it unless you bring everything offline. You can't really protect everything this day and age, especially with people discovering zero-days and keeping it for their own benefits instead of reporting them.

Let's be honest, the US is doing the same to the countries you mentioned. Just look at the Stuxnet worm. Unless there are international laws in place, you can't really respond to these incidents much and try to point fingers. Those who know what they're doing will not leave any traces anyway.

scenario: you've gotten access to a web server via an exploit and have a reverse shell. lets assume you have a Ubuntu running apache. you've got all the default system tools that come with a Linux install. how would you go about exploring the internal network and pivoting to other machines? keep in mind there's IDS and the network is well monitored.

[phr3ak_]

scenario: you've gotten access to a web server via an exploit and have a reverse shell. lets assume you have a Ubuntu running apache. you've got all the default system tools that come with a Linux install. how would you go about exploring the internal network and pivoting to other machines? keep in mind there's IDS and the network is well monitored.

Hope I ain't hijacking the topic. But would like to discuss this question. I assume we have a meterpreter running in the ubuntu machine? If not then probably we can use arp-scan to reveal all the systems on the internal network. Once we get them we can use route command to route between the default gateway and victim computer.

We can now use that single compromised machine to attack all the systems on the network both within the engineering subnet and all the subnets that use the default gateway.
Finally, we can exploit each of those machines, but we will no longer have to be concerned about Intrusion Prevention Systems (IPS) and firewalls as we are now attacking from INSIDE the network!

This is just a speculation. But I guess it sort of answers your question.

@OP: Great thread. Expecting it to be helpful for many.

[sh4moon]

Hope I ain't hijacking the topic. But would like to discuss this question. I assume we have a meterpreter running in the ubuntu machine? If not then probably we can use arp-scan to reveal all the systems on the internal network. Once we get them we can use route command to route between the default gateway and victim computer.

We can now use that single compromised machine to attack all the systems on the network both within the engineering subnet and all the subnets that use the default gateway.
Finally, we can exploit each of those machines, but we will no longer have to be concerned about Intrusion Prevention Systems (IPS) and firewalls as we are now attacking from INSIDE the network!

This is just a speculation. But I guess it sort of answers your question.

@OP: Great thread. Expecting it to be helpful for many.

I was thinking just a regular command shell. but you could get a meterpreter pretty easily even with just a shell. fyi I know what I would do, just curious what answers I would get.

[phr3ak_]

I was thinking just a regular command shell. but you could get a meterpreter pretty easily even with just a shell. fyi I know what I would do, just curious what answers I would get.

Yeah, I know mate. Though not much activity around here. So, thought of sharing my views.

[sh4moon]

Yeah, I know mate. Though not much activity around here. So, thought of sharing my views.

nobody asks questions when you want them to lol. I might advertise this thread in my signature.

I do have a question though. if you're a pentester by some chance, how often do you come across honeypots or just general traps during pentests?

[phr3ak_]

nobody asks questions when you want them to lol. I might advertise this thread in my signature.

I do have a question though. if you're a pentester by some chance, how often do you come across honeypots or just general traps during pentests?

I don't have a lot of experience but I haven't yet encountered any such yet. But our team claims that almost 2-3 out of 5 networks have a good chance that they are tripped very well. So, we always try to be cautious. We have a set of protocols that we are asked to follow before diving in.

EDIT: Can someone share some good exploit development books or resources. Just looking forward to gain some insights to a problem.

[๖ۣۜCriminal]

There really is no good way to help mitigate it unless you bring everything offline. You can't really protect everything this day and age, especially with people discovering zero-days and keeping it for their own benefits instead of reporting them.

Let's be honest, the US is doing the same to the countries you mentioned. Just look at the Stuxnet worm. Unless there are international laws in place, you can't really respond to these incidents much and try to point fingers. Those who know what they're doing will not leave any traces anyway.

Best mitigation is air gapping the network, only the most dedicated of attackers will get around an air gap and exfiltrate their data back to a C&C somewhere, really ups the ante.

---

Hope I ain't hijacking the topic. But would like to discuss this question. I assume we have a meterpreter running in the ubuntu machine? If not then probably we can use arp-scan to reveal all the systems on the internal network. Once we get them we can use route command to route between the default gateway and victim computer.

We can now use that single compromised machine to attack all the systems on the network both within the engineering subnet and all the subnets that use the default gateway.
Finally, we can exploit each of those machines, but we will no longer have to be concerned about Intrusion Prevention Systems (IPS) and firewalls as we are now attacking from INSIDE the network!

This is just a speculation. But I guess it sort of answers your question.  

@OP: Great thread. Expecting it to be helpful for many.

I have a question for you that always made me curious, say I have a website we'll say it's the internet service provider comcast, say on the subdomain hacktheplanet.comcast.net theres an install of coldfusion that is vulnerable to a coldfusion RCE and I pop the box, however I realize that the interesting data is on accounts.comcast.net because that box has the customer tables in the DBMS NOT the box located at 88.73.21.45 the box at 88.73.21.46 which is pointed to accounts.comcast.net does have the interesting data though so if I use the shell on the hacktheplanet.comcast.net is it possible to pivot to the other server(the accounts.comcast.net one)through the shell since ill be on the internal network at that point or no.

[SysAdmin]

Best mitigation is air gapping the network, only the most dedicated of attackers will get around an air gap and exfiltrate their data back to a C&C somewhere, really ups the ante.

---

I have a question for you that always made me curious, say I have a website we'll say it's the internet service provider comcast, say on the subdomain hacktheplanet.comcast.net theres an install of coldfusion that is vulnerable to a coldfusion RCE and I pop the box, however I realize that the interesting data is on accounts.comcast.net because that box has the customer tables in the DBMS NOT the box located at 88.73.21.45 the box at 88.73.21.46 which is pointed to accounts.comcast.net does have the interesting data though so if I use the shell on the hacktheplanet.comcast.net is it possible to pivot to the other server(the accounts.comcast.net one)through the shell since ill be on the internal network at that point or no.

I could have sworn that I've read that air-gapping networks have been exploited before. Again, if you wanted to be safe, you shouldn't even run an OS, let alone be connected to the internet. Thus, you are never safe.

[sh4moon]

Best mitigation is air gapping the network, only the most dedicated of attackers will get around an air gap and exfiltrate their data back to a C&C somewhere, really ups the ante.

---

I have a question for you that always made me curious, say I have a website we'll say it's the internet service provider comcast, say on the subdomain hacktheplanet.comcast.net theres an install of coldfusion that is vulnerable to a coldfusion RCE and I pop the box, however I realize that the interesting data is on accounts.comcast.net because that box has the customer tables in the DBMS NOT the box located at 88.73.21.45 the box at 88.73.21.46 which is pointed to accounts.comcast.net does have the interesting data though so if I use the shell on the hacktheplanet.comcast.net is it possible to pivot to the other server(the accounts.comcast.net one)through the shell since ill be on the internal network at that point or no.

whether or not you can pivot to it depends on the network. in this example they seem to be on the same network. it would be a simple compromise of the original server then pivot straight to your target. it's not always that easy though. you may have to go to a different subnet in this example because it's just a small /24 network. but if the subdomain's server is on the same network as the one you got into it's just a matter of pivoting.

as for airgapping, that's not an option for a lot of companies these days. internet connectivity is a major part of business.

[phr3ak_]

Best mitigation is air gapping the network, only the most dedicated of attackers will get around an air gap and exfiltrate their data back to a C&C somewhere, really ups the ante.

---

I have a question for you that always made me curious, say I have a website we'll say it's the internet service provider comcast, say on the subdomain hacktheplanet.comcast.net theres an install of coldfusion that is vulnerable to a coldfusion RCE and I pop the box, however I realize that the interesting data is on accounts.comcast.net because that box has the customer tables in the DBMS NOT the box located at 88.73.21.45 the box at 88.73.21.46 which is pointed to accounts.comcast.net does have the interesting data though so if I use the shell on the hacktheplanet.comcast.net is it possible to pivot to the other server(the accounts.comcast.net one)through the shell since ill be on the internal network at that point or no.

Didn't reply since I was working on a similar problem (Not entirely same but was somewhat similar). Since you mentioned hacktheplanet.comcat.com is already vulnerable and exploited. So, you can shell into it. And then you can try pivoting inside the network. The only problem which you might face is with permission elevation. Other than that you can easily attack other systems that are within the primary network.

[sh4moon]

Didn't reply since I was working on a similar problem (Not entirely same but was somewhat similar). Since you mentioned hacktheplanet.comcat.com is already vulnerable and exploited. So, you can shell into it. And then you can try pivoting inside the network. The only problem which you might face is with permission elevation. Other than that you can easily attack other systems that are within the primary network.

granted, you don't necessarily have to escalate privileges depending on what's accessible from that shelled server. getting root never hurt anything though :)

[shelled]

With powershell being caught more and more commonly now even with obfuscation methods, what are your recommendations on making payloads that are less likely to be caught for red team engagements?