Lateral Movement and Pivoting
These are the general techniques used by the attackers within a network or domain. Penetration testers should make themselves familiar with these tactics.
Pivoting Through the Network
Lateral movement is a tactic used by attackers to move within a network. Although, it is typically considered an additional step in a linear process, but it is actually part of a continuous cycle. In this cycle, the attacker uses any available credentials to move from one system to another within the network, gaining access to new machines and attempting to elevate their privileges and extract extra credentials. This process can be repeated using the obtained credentials.
There are many methods that an attacker can use to move laterally. One such simple method is to use standard administrative protocols like WinRM, RDP, VNC, or SSH to connect with other systems. This method can mimic behavior of regular users as long as the connections are not suspicious. Recently, attackers have invented methods for lateral movement that are more difficult to detect for security teams.
Firstly, the difference between Local Accounts and Domain Accounts part of the local Administrators group. Local accounts are created and managed on a single computer and they can only be used to access resources on that specific machine. They can perform tasks like installing software, modifying system settings, and creating other local accounts. On the other hand, Domain accounts are created and managed in AD. They can access resources within AD domain depending upon their permissions.
Additionally, penetration testers should be more interested in the permissions restricted by User Account Control (UAC) instead of local administrators. Only the default administrator account will full privileges. However, domain accounts with local administration privileges will be logged in with full administrative privileges.
This security feature can be disabled if desired, and sometimes it will make no difference between local and domain accounts in the administrator's group. Still, it should be remembered that some of the lateral movement techniques fail, it might be due to using a non-default local administrator where UAC is enforced.
Spawning Processes Remotely
To achieve spawning processes and run commands on machines, penetration tester must have valid credentials. Some of the tools that can used to achieve this task are Psexec, WinRm, sc, Scheduled Tasks, etc. Psexec is a commonly used tool used to remotely execute processes on PCs where the administrator has access. It allows the administrator to remotely run commands on a PC, which can be useful for a variety of tasks such as managing and troubleshooting systems remotely.
WinRm (Windows Remote Management) is a web-based protocol used to send PowerShell commands to Windows hosts remotely. By default, most Windows Server installations have WinRm enabled. Hence, the penetration tester can achieve the same from PowerShell, but to pass different credentials he will need to create a PSCredential object.
Similarly, Windows services can also be leveraged to run arbitrary commands since they execute a command when started. The penetration tester can create a service on a remote host with sc.exe, a standard tool present in Windows, that will run a command of his choice on startup.
Another feature that can be used is Scheduled Tasks. The penetration tester can create and run one remotely with schtasks which is available in any Windows installation. Additionally, since the system will run the scheduled task, the command's output won't be available to see, making it a blind attack. Finally, to delete the scheduled task, the tester should clean up after himself.
Conclusion:
Here, the methods of lateral movement and pivoting are discussed.
Comments
Post a Comment