You're reading from The Ultimate Kali Linux Book - Third Edition

Product type Book

Published in Apr 2024

Publisher Packt

ISBN-13 9781835085806

Pages 828 pages

Edition 3rd Edition

Languages

Concepts

Cybersecurity

Author (1):

Glen D. Singh

Table of Contents (21) Chapters

Preface

1. Introduction to Ethical Hacking

2. Building a Penetration Testing Lab

3. Setting Up for Advanced Penetration Testing Techniques

4. Passive Reconnaissance

5. Exploring Open-Source Intelligence

6. Active Reconnaissance

7. Performing Vulnerability Assessments

8. Understanding Network Penetration Testing

9. Performing Network Penetration Testing

10. Post-Exploitation Techniques

11. Delving into Command and Control Tactics

12. Working with Active Directory Attacks

13. Advanced Active Directory Attacks

14. Advanced Wireless Penetration Testing

15. Social Engineering Attacks

16. Understanding Website Application Security

17. Advanced Website Penetration Testing

18. Best Practices for the Real World

19. Index

Appendix

Delving into Command and Control Tactics

This chapter focuses on the Command and Control (C2) stage of the Cyber Kill Chain, which then leads to the threat actor completing the Actions on Objective phase of the cyber-attack. As an aspiring penetration tester, it is essential to understand the fundamentals of performing C2 operations from a threat actor’s perspective. This technique also helps penetration testers determine whether their clients’ security solutions are sufficient to detect a real-world cyber-attack and stop a threat actor’s C2 operation.

During the course of this chapter, you will learn the fundamentals of C2 operations during a cyber-attack and how penetration testers can utilize such techniques during their penetration test exercises during a real-world security assessment. Furthermore, you will gain the skills to set up a C2 server and perform post-exploitation techniques on a compromised host on a network.

In this chapter, we will cover...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirements:

Kali Linux – https://www.kali.org/get-kali/
Metasploitable 3 – https://app.vagrantup.com/rapid7/boxes/metasploitable3-win2k8

Understanding C2

The battle between cybersecurity professionals and threat actors is always a continuous race against time as to whether the threat actors are going to discover a security vulnerability on a system and exploit it before the cybersecurity professionals are able to identify the security flaw and implement countermeasures to prevent a cyber-attack. As each day goes by, cybersecurity-related news reveals how organizations are discovering their systems and networks have been compromised and how they are working on eradicating threats such as malware and recovering their systems to a working state.

However, while organizations are not always able to detect security incidents in real time and stop an attack, threat actors can live on their victims’ networks and systems for a long time. This enables threat actors to move around the network using lateral movement, escalate their user privileges with vertical movement, exfiltrate the organization’s data, install...

Setting up C2 operations

As an aspiring ethical hacker and penetration tester, it is essential to learn and gain the skillset to use popular C2 tools to help you improve your penetration testing skills and strategies during a real-world exercise. Empire C2 is a framework widely used by red team personnel and malicious threat actors and is the tool we will consider in this chapter. Empire is a post-exploitation framework that enables penetration testers and red teamers to set up C2 operations during their penetration tests.

Currently, a security group known as BC Security (www.bc-security.org) is maintaining a forked version of the original PowerShell Empire framework known as Empire v5. BC Security has been providing updates and new features that allow penetration testers to perform never-before-seen techniques such as polymorphic payloads, stealthy C2 communication, memory-only execution, and living-off-the-land techniques during their live penetration tests on their customers...

Post-exploitation using Empire

In this section, you will learn how to set up Empire to perform post-exploitation techniques on a compromised host on a network. Additionally, you will learn how to establish C2 connections between an agent on the compromised host and the Empire server.

To get started with performing post-exploitation using Empire, multiple Terminals will be used during this exercise, please use the following instructions:

Power on both your main Kali Linux and Metasploitable 3 (Windows-based) virtual machines.
On Kali Linux, open the Terminal (#1) and use the following commands to start the MariaDB service and the Empire server:
```
kali@kali:~$ sudo systemctl start mariadb.service
kali@kali:~$ sudo powershell-empire server
```
Once the Empire server is running, open a new Terminal (#2) and use the following commands to connect the Empire client to the local Empire server:
```
kali@kali:~$ sudo powershell-empire client
```

Working with Starkiller

Starkiller is the graphical user interface created to allow multiple penetration testers to connect and control the Empire server. Similar to working with the Empire client, which provides command-line access, using Starkiller provides a graphical interface that helps penetration testers to work more efficiently.

The following diagram shows a typical deployment of Starkiller and the Empire server:

Figure 11.43: Starkiller client-server model

During this exercise, we will be using the main Kali Linux virtual machine that will be running the Empire server with Starkiller. The targeted system will be Metasploitable 3 (Windows-based) on the PentestNet (172.30.1.0/24) topology, as it was already set up as one of the targeted systems within our lab environment.

Part 1 – Starkiller

To get started with this exercise, please use the following instructions:

Power on both the main Kali Linux and Metasploitable 3 (Windows-based...

Summary

In this chapter, you learned how threat actors use C2 operations to maintain and control multiple compromised hosts simultaneously. Furthermore, you have discovered how cybersecurity professionals such as penetration testers and even red teaming professionals can use C2 operations to improve their security testing and emulate real-world cyber-attacks on their target’s network.

You have gained the skills to set up Empire 5 using Kali Linux and have learned how to perform post-exploitation tasks on a compromised system. Additionally, you have discovered how to work with Starkiller as a graphical interface for Empire 5 to simplify many tasks on the Empire server.

I trust that the knowledge presented in this chapter has provided you with valuable insights, supporting your path toward becoming an ethical hacker and penetration tester in the dynamic field of cybersecurity. May this newfound understanding empower you on your journey, allowing you to navigate the industry...