You're reading from The Ultimate Kali Linux Book - Second Edition

Product type Book

Published in Feb 2022

Publisher Packt

ISBN-13 9781801818933

Pages 742 pages

Edition 2nd Edition

Languages

Concepts

Cybersecurity

Author (1):

Glen D. Singh

Table of Contents (23) Chapters

Preface

1. Section 1: Getting Started with Penetration Testing

2. Chapter 1: Introduction to Ethical Hacking

3. Chapter 2: Building a Penetration Testing Lab

4. Chapter 3: Setting Up for Advanced Hacking Techniques

5. Section 2: Reconnaissance and Network Penetration Testing

6. Chapter 4: Reconnaissance and Footprinting

7. Chapter 5: Exploring Active Information Gathering

8. Chapter 6: Performing Vulnerability Assessments

9. Chapter 7: Understanding Network Penetration Testing

10. Chapter 8: Performing Network Penetration Testing

11. Section 3: Red Teaming Techniques

12. Chapter 9: Advanced Network Penetration Testing — Post Exploitation

13. Chapter 10: Working with Active Directory Attacks

14. Chapter 11: Advanced Active Directory Attacks

15. Chapter 12: Delving into Command and Control Tactics

16. Chapter 13: Advanced Wireless Penetration Testing

17. Section 4: Social Engineering and Web Application Attacks

18. Chapter 14: Performing Client-Side Attacks – Social Engineering

19. Chapter 15: Understanding Website Application Security

20. Chapter 16: Advanced Website Penetration Testing

21. Chapter 17: Best Practices for the Real World

22. Other Books You May Enjoy

Chapter 12: Delving into Command and Control Tactics

This chapter focuses on the Command and Control (C2) stage of the Cyber Kill Chain, which then leads to the threat actor completing the Actions on Objective phase of the cyber-attack. As an aspiring penetration tester, it's vital to understand the fundamentals of performing C2 operations from a threat actor's perspective. This technique also helps penetration testers to determine whether their clients' security solutions are fine-tuned to detect a real-world cyber-attack and stop a C2 operation being performed by a threat actor.

During the course of this chapter, you will understand the fundamentals of C2 operations during a cyber-attack and how penetration testers can utilize such techniques during their penetration test exercises during a real-world assessment. Furthermore, you will gain the skills for setting up your C2 server and performing post-exploitation techniques on a compromised host on a network.

...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirements:

Kali Linux 2021.2: https://www.kali.org/get-kali/
Empire: https://github.com/BC-SECURITY/Empire
Starkiller: https://github.com/BC-SECURITY/Starkiller
Windows Server 2019: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019

Understanding C2

The battle between cybersecurity professionals and threat actors is always a continuous race against time on whether the threat actors are going to discover a security vulnerability on a system and exploit it before the cybersecurity professionals are able to do so and implement countermeasures to prevent a cyber-attack. As each day goes by, we commonly either read or listen to cybersecurity-related news about how organizations are discovering their systems and networks have been compromised and they are working on eradicating the threat such as malware and recovering their systems to a working state. However, while organizations are not always able to detect security incidents in real time and stop the attack, threat actors are able to live on their targets' networks and systems for a very long time. This allows threat actors to move around the network using lateral and vertical movement, exfiltrate the organization's data, install additional malware on...

Setting up C2 operations

As an aspiring penetration tester, it's vital that you learn and gain the skillset of using popular C2 tools to help you improve your penetration testing skills and strategies during a real-world exercise. Within the cybersecurity industry, Empire 4 is a post-exploitation framework that allows penetration testers and red teamers to set up C2 operations during their penetration test on an organization. Currently, a security group known as BC Security (www.bc-security.org) is maintaining a forked version of the original PowerShell Empire framework since the original developers have achieved the original PowerShell Empire project. However, BC Security has been continuously providing updates and new features that allow penetration testers to perform never-before-seen techniques during their live penetration test on their clients' networks.

Empire 4 allows penetration testers to set up an Empire server that functions as a C2 server and agents are installed...

Post-exploitation using Empire

In this section, you will learn how to set up Empire to perform post-exploitation techniques on a compromised host on a network. Additionally, you will learn how to establish C2 connections between an agent on the compromised host and the Empire server.

To get started with performing post-exploitation using Empire, please use the following guidelines:

Power on both your Kali Linux and Windows Server 2019 virtual machines within the Red Team Lab topology.
On Kali Linux, open Terminal and use the following command to start the Empire server:
```
kali@kali:~$ sudo powershell-empire server
```
On the same Kali Linux, open another Terminal window and use the following command to start the Empire client:
```
kali@kali:~$ sudo powershell-empire client
```
Once the client starts, it will attempt to automatically connect to the local Empire server. Therefore, it's vital you start the Empire server before enabling the Empire client.
Any commands...

Working with Starkiller

Starkiller is the official graphical user interface created to allow multiple penetration testers to connect and control the Empire server. Similar to working with the Empire client, which provides command-line access, using Starkiller provides a graphical interface that helps penetration testers to work more efficiently.

The following diagram shows a typical deployment of Starkiller and the Empire server:

Figure 12.26 – Starkiller deployment model

During this exercise, we will be using a single Kali Linux machine that will be running the Empire server with Starkiller. The target will be Windows Server 2019 on the Red Team Lab topology.

Part 1 – starting Starkiller

To get started with this exercise, please use the following instructions:

Power on both your Kali Linux and Windows Server 2019 virtual machines.
On Kali Linux, open Terminal and use the following command to start the Empire server:
```
kali...
```

Summary

During the course of this chapter, you have learned how threat actors use C2 operations to maintain and control multiple compromised hosts simultaneously. Furthermore, you have discovered how cybersecurity professionals such as penetration testers and even red teaming professionals can use C2 operations to improve their security testing and emulate real-world cyber-attacks on their target's network. You have gained the skills for setting up Empire 4 using Kali Linux and have learned how to perform post-exploitation tasks on a compromised system. Additionally, you have discovered how to work with Starkiller as a graphical interface for Empire 4 to simplify many tasks on the Empire server.

I hope this chapter has been informative for you and is helpful in your journey as an aspiring penetration tester learning how to simulate real-world cyber-attacks to discover security vulnerabilities and perform exploitation using Kali Linux. In the next chapter, Chapter 13, Advanced...