Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SEC504 > Exam Prep > Flashcards

Exam Prep Flashcards

1
Q

CeWL

A

website data collector can harvest emails
Web crawl and worklist generation using CeWL = collects web pages and common docs
cewl.rb -m 8 -w file.xtx —meta_file meat.txt -e –email_file email.tst domain.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Nikto

A

Nikto is a cmd vulnerability scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Wappalyzer

A

Wappalyzer is a website profiler to determine how a site is built

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ZAP

A

ZAP is a web app security scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Merterpreter payload

A

Merterpreter payload injects into a running process, can load new modules into memory of the process to change its functionality, communication to the host is encrypted. Does not interact with hard drive by default and does not require an executable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Redirecting Cookie?

A

Redirecting cookie leads to session hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Vloatility

A

Vloatility netscan looks in memory for listening sockets
svscan is Volatility plugin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Name res order

A

DNS, then LLMNR, then NBT-NS (Netbois)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

BeEf

A

Browser exploit = BeEf
BeEF hook.js can simulate a fake browser update

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Msfvenom

A

Msfvenom is part of metasploit to create malicious files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RITA

A

RITA identifies C2 attacks using network anomalies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Responder.py

A

Responder.py is a script to capture creds using SMB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

4732

A

4732 = account added to local group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

4688

A

4688 = start of a new process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

4634

A

4634 = log off

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

4768

A

4768 = kerb token request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Subfinder

A

Subfinder = passive sub domain finder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Harvester

A

The harvester is similar to Subfinder (sub dom finder), broader scope, and can be active/passive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Can PSID and PID be the same?

A

PSID and PID should not be the same

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Netcat port scan command

A

nc -v -w3 -z is a port scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

netstat o

A

netstat o shows the process ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Password Stuffing

A

password stuffing starts with password leaks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Describe a SID

A

The SID has:
A revision level, 1
An identifier authority, 5 (NT Authority)
A domain identifier, 21-1004336348-1177238915-682003330
A relative identifier, 500
S-1-5-21-1004336348-1177238915-682003330-500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

AWS Bucket Tools (3)

A

GCPbucketBrute does not have the ability to list or download the contents of public Google Compute buckets. Gsutil is a Python application used to perform a wide range of bucket and object management tasks including uploading and downloading content. Bucket_finder enumerates AWS S3 buckets and ntdsutil is used to extract the ntds.dit and system registry hives from a Window domain controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

skew

A

skew = interval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Why identify empty LanMan Hash?

A

Running Hashcat is a process that can take several hours or several days, depending on the resources of the system being used. If the LANMAN password hashes contain the string aad3b435b51404eeaad3b435b51404ee, they are empty. There is no need to run Hashcat against the LANMAN hash type.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SQL injection

A

SQL injection attackers start by adding string quotation characters to the user data to see how the system reacts when the data is submitted (i.e., ‘,”, and`).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Enumerating blobs - 2 things needed

A

Enumerating blobs = Account and Container names

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

nmap -A

A

Nmap has a powerful option called -A. This option enables OS detection, version detection, script scanning, and traceroute. It gives you far more information than a simple syn or TCP connect scan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

netstat vs sc vs net view

A

Netstat -nap will show local ports, PID, and program name on a Linux/Unix host. Sc query will list local services on a Windows host. Net view will get a list of shares from a Windows host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

RITA score 1 vs. near 1

A

Some C2 backdoors have a very strong heartbeat. This is where a backdoor will constantly reconnect to get commands from an attacker at a specific interval. The interval consistency of the heartbeat is the RITA Score, where a value of 1 is a perfect timing repetition for connections between the victim and the server for the duration of the capture period. RITA uses the characteristic of beaconing to identify threats in several ways. One reliable detection mechanism is the presence of a Score value near or at 1. In this case the source IP 10.20.234.50 is likely the victim of an attack and running a C2 backdoor with intermittent (not continuous) beaconing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

PICERL

A

PICERL Preparation, Identification, Containment, Eradication (undoing), Recovery (resumption), and Lessons Learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Dynamic Approach to Incident Response (DAIR)

A

Dynamic Approach to Incident Response (DAIR) Preparation, Detection and Verification-Triage (waypoints) leads to a loop of scoping, containment, eradication, recovery, and remediation before incident wrap-up. Red Wheel. Waypoints, outcomes, and activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

DFIR

A

DFIR - Digital Forensics and Incident Response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Detection

A

Detection = First decision is always verification, mentions DFIR - Digital Forensics and Incident Response, possible response when looking at logs is inconclusive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Containment

A

Containment = spot attack, requires proper scoping, isolation, patching, etc. Short-term fix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Eradication, Recovery, Remediation

A

Eradication (undoing) = restoring from backup, assessment
Recovery (resume ops)
Remediation = root cause, monitor, fixing the cause (long term)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

PS command to get process starting with power

A

get-process ‘power*’ | select-object *

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

get-CimInstance

A

get-CimInstance - Class Win32_Process //Provides more info like parent process and execution command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

EncodedCommand

A

Watch for processes started using -EncodedCommand = CyberChef can be used for decoding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Types of encoding

A

Common encoding are base64, URL encoding, UTF-8, UTF 16 little and big endian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

PS for listening TCP ports

A

get-NetTCPConnection -State Listen
Local address “::” means listening on all interfaces configured with IPv6 (or 0.0.0.0 for IPV4)
127.0.0.1 is loopback meaning local-only
Look fop notepad or other local service with outbound (anything other than listening) on port 80 for exam

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

PS to find services

A

get-service (or get-CimInstance - Class Win32_Process) //find services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

PS for registry

A

get-childItem ‘reg key path’ or get-itemProperty ‘reg key path’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

PS for local users & groups

A

get-LocalUser or Get-LocalGroup or get-LocalGroupMember Administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

PS for scheduled tasks

A

get-ScheduledTask and export-SchedueldTask and get-scheduledTaskInfo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

ps for Windws events

A

get-WinEvent -LogName System | where-object -Propeerty Id -EQ 7045

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Sysinternal tools

A

Sysinternals = processExplorer, autoruns, sysmon, procMon, TCPview, and procDump

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

TCPDump

A

TCPDump for packet capture or WinDump on Windows
tcpdump -i interface
tcpdump -i interface -w file
tcpdump -r file -n //Don’t resolve host, can be -nnr
tcpdump -r file -n -A //Don’t resolve host and show human readable ASCII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

BFP

A

Berkely Packet Filters (BFP) for tcpdump = primitives and operators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Web Proxy tools

A

Squid, Blue Coat, Forefront TMG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Dumping memory passwords

A

First collect memory with WinPmem run as admin
Then analyze with Volatility (python framework) with platform.class.PluginName
vol -q -f win10.0.22000.556.raw windows.pslist.PsList

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

List processes using vol

A

PsList = lists processes
PsTree = shows parent tree

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

List network connections

A

NetScan = network connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

CMdLine

A

CMdLine = process command line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

2 online malware analysis tools

A

Virus Total and Hybrid Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Compare registry settings

A

RegShot - compares registry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Core Analysis

A

Core analysis: IDA Pro and optional Hes-Rays decoder, Ghidra by NSA, FOR610, SEC660, SEC760

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

ATT&CK

A

ATT&CK Adversarial Tactics, Techniques, and Common Knowledge

60
Q

Web search as a discovery tool, Web-based recon

A

Search engine results, using site: modifier

61
Q

DNS interrogation tools

A

DNS interrogation with Dig or NSlookup

62
Q

Using dig

A

dig ANY domain.com
dig @nsztml.digi.ninja AXFR domain.com //DNS zone transfer

63
Q

Brute force AXFR

A

Brute force AXFR using nmap with dns-brute script

64
Q

Using Certificate transparency

A

Certificate transparency for example crt.sh/?q=domain.com

65
Q

SubFinder

A

Project discovery Subfinder from https://projectdiscovery.io cn run subdom enumeration
subfinder -d domain.com

66
Q

ExifTool

A

Perl script to extract Windows file metadata, example exiftool file.pdf

67
Q

PowerShell can learn about an Azure hosted domain

A

AADInternals

68
Q

Recon As Outsider

A

Invoke-AADIntReconAsOutsider -Domain domain.com | Format-Table

69
Q

DeHashed

A

DeHashed provides plaintext passwords and PI Ias a service (deper form of HIBP)

70
Q

Showdan

A

Showdan is an advanced domain search, indexing service banners

71
Q

robots.txt

A

Disallow search using robots.txt //examples below are pages not indexed //Use high level directories rather than sensitive names
Disallow: /registration
Disallow: /admin.php
Disallow: /app

72
Q

nmap

A

NMAP is used to discover the network topology (network mapping and port scanning), run as root for best results

73
Q

Sweeping using nmap

A

Sweeping looks for active hosts using ICMP echo request to an IP range (log the replies)
Nmap sweeps before port scanning by default, skip using -Pn
Sends TCP SYNC to 443 and TPC ACK to 80 (must be root to ACK to 80)
sudo nmap -sn 192.168.1.1-254 //-sn only does discovery. no port scan

74
Q

TCP and UDP port range

A

TCP and UDP have ports 65,536 each greater than 0

75
Q

SYN ACK vs. RST ACK

A

SYN ACK = OPEN and RST ACK = CLOSED
Reports open, closed, or filtered (no response)

76
Q

nmap switches

A

-sS = Conventional TCP and -sU = UDP
-sV = Version scan
-oA to specify target host
Nmap SNE (Scripting Engine) Scripts =
-sC = Use default scripts
–script sctiptName (or All) //accepts wildcards

77
Q

Find service providers

A

Use builtwith.com to summarize service providers
Cloud providers publish IP ranges

78
Q

Masscan

A

Masscan is fire-and forget, better for massive IP ranges
masscan 192.168.1.1/24 -p 22,25,80,443,3389

79
Q

TLS-Scan

A

Identify TLS servers on TCP 443 and try to request certificates for recon using OpenSSL (one at a time) or TLS-Scan
TLS-Scan (Linux) rolls through a list of IPs listening to 443 (TLS Servers) to gather info from certs

80
Q

EyeWitness

A

EyeWitness takes website screenshots, run using python
python3 /opt/eyewitness/EyeWitness.py –web -f urllist.txt –prepend-https

81
Q

SMB

A

SMB can be scanned and appears as normal TCP 445 traffic
SMBV1 started with XP, SMBV3 with Win8 and SMB3.3.3 with Win10/Win2016
Didn’t support encryption until SMB3 with lates including pre-auth verification
Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol
Block SMB over 445 and TCP/UDP 135 and 139 on firewalls

82
Q

Query SMB shares (3)

A

get-cminstance -class win32_share -ComputerName hostorIP
net.exe view \192.168.1.1 /all //can work on non-windows
SMBeagle can be used to search through SMB shares.

83
Q

SMBeagle

A

SMBeagle can be used to search through SMB shares.
smbeagle -c results.csv -n 192.168.1.0/24 -uksmith p pass123 -q
SMB also has many CVEs if SMB is not patched.
No backoff delay for password guessing

84
Q

Copernic Desktop Search

A

Copernic Desktop Search also indexes SMB files and does keywork search and OCR

85
Q

Samba

A

Samba smbclient for File Share Access lest you access and browse shares from CMD is you have credentials, even download and upload files
Samba rpcclient (Linux) has over 100 commands over authenticated SMB

86
Q

Enumerate SMB session

A

Identify sessions using get-SmbSession and close-SmbSession
The net.exe command is also available like net view, net share, net session, net use

87
Q

Hayabusa

A

Hayabusa applies sigma to Windows event logs, Velociraptor

87
Q

Sigma

A

Sigma - related to snort, SIEM, Yara, YAML

88
Q

THC Hydra

A

THC Hydra is an online password guessing tool
hydra -L users -P passwords ssh://3.231.163.70

89
Q

Password spray

A

Password spray is a small number of passwords against a large number of accounts

90
Q

PACK

A

PACK = Password Analysis and Cracking Kit

91
Q

Credential Stuffing

A

Credential Stuffing = using leaked passwords to attempt success or improved guessing

92
Q

MSOLSPray & FireProx

A

MSOLSPray is a PowerShell module/command that uses AADSTS response codes for informed password spray
Using AWS API Gateway and AAD Smart Lockout for distribution and anonymity
FireProx is a python tool for creating AWS API Gateway instances can be used to automate a platform for MOLSpray

93
Q

MSASweep

A

Using valid account to find MFA and CA gaps using MSASweep

94
Q

get-MsolUSer

A

get-MsolUSer is PowerShell to inspect individual M365 user license settings for verification

95
Q

Lanman & NT Hash

A

LANMAN = no larger that 7 bytes, split, all caps padded to 14 bytes, based on DES
NT Hash keeps case, can use long passwords, but has no salt, based on MD4, meaning same password = same hash

96
Q

NTDSUTIL

A

NTDSUTIL can be used to get NTDS.dit and SYSTEM registry hive (used for encryption of the file)
They gather both, use activate instance ntdsutil command followed by ifm to create a backup that can be exfilled.
Then a script like secretsdump.py can be used to extract the hashes (decrypt)

97
Q

Obtain hashes from Windows client

A

To obtain hashes from Windows client OS:
1. Use Meterpreter hashdump command against lsass.exe (FROM MEMORY), runs as lsass by running ps -S lsass.exeto get the PD and then migrate into the PID (impersonate)
2. is Mimikatz

98
Q

Break down Windows hash

A

Windows hashes show as username:userid:LANMAN:NTHASH
Empty hashes are useless and are identifiable, possibly a collection issue or disabled account
Example: tom:1002:aad3b435b…..:31d6cfe0d……
Keys being aad_b___b and d_cfe_d

99
Q

Identify Linux hash type

A

Early Linux is DES with no salt (/etc/password), now stronger like MD5 (/etc/shadow/)
Look for 2nd colon delimited field in shadow
No $ is DES, $1 is MD5, $2 Blowfish, $5 SHA256, and $6 SHA512

100
Q

Hash Rounding

A

Hash Rounding = increased complexity. MD5 uses 1000, SHA uses 5000

101
Q

Avoid GPU cracking

A

Password Based Key Derivation Function (PBKDF2) to avoid GPU-based password cracking
Also Scrypt, Argon2, Yescrypt

102
Q

Password Cracking

A

Password Cracking = offline decryption (brute force guessing)
Hashcat is main cracking tool

103
Q

Hashcat

A

Hashcat is main cracking tool
-a 0 = wordlist (default)
-a 1 = wordlist with append
-a 3 = pattern
-a 6 = worklist with mask
-a 7 = prepend mask
Specify -m to define the hash typr or it will try to atuo detect
Test the hash type without cracking using –identify
hashcat -m 1000 -1 0 hashes.txt words.txt
Mask uses ?<filter> like ?l for lower case, ?u for upper, ?d for number, and ?s for special
Hashcat passwords are sent t the potfile haschcat.potfile
You can display cracked with --show, uncreacjed with --left, and user info with --user
Hashcat can also use word permutation rules (-r best64.rule)</filter>

104
Q

PAM

A

UNIX has PLuggable Authentication Modules (PAM) for password complexity

105
Q

Cloud storage URLs

A

Insecure Cloud Storage
https://s3.amazonaws.com/bucketname
https://www.googleapis.co,/storage/v1/b/bucketname
https://accountname.blob.core.windows.net/Containername

106
Q

Bucket Finder

A

Bucket Finder that looks for open AWS buckets

107
Q

CGPBucketBrute

A

CGPBucketBrute for Google is python = to download from a google bucket use gsutil from Google

108
Q

Basic Blob Finder

A

Basic Blob Finder is also python for Azure blobs

109
Q

Netcat

A

Netcat reads and writes data across networks (has variants)
Client mode starts a connection to a specific port, send input to network and response to output
Messages are sent to standard error stderr
Listen mode waits for a connection on a specific port (option -l)
Listener to client;
listener: nc -1 -p port < filename
client: nc listenerIP port > filename
Push file from client to listener
listener: nc -1 -p port > filename
client: nc listenerIP port < filename
WATCH the <> closely

110
Q

Netcat port scanning:

A

nc -v -w3 -z targetIP start-endPort
Netcat backdoor shell examples (-e is execute):
nc -l -p port -e cmd.exe
nc -l -p port -e /bin/sh
For listening, -l is listedn once and -L on windows will restart

111
Q

Netcat relay

A

Netcat relay used to hop systems, requires named pipe on pivot system (mkfifo pipname on Linux)

112
Q

Metasploit Framework, modules, and interfaces

A

Metasploit Framework - collection of tools, runs on Linux, select exploit and payload to run on target
Four modules types: exploits. payloads, aux modules, and post exploit modules
Interfaces are console, command, web, and GUI (Armitage)
Search is an important command

113
Q

Merterpreter

A

Merterpreter is a general=purpose Metasploit payload for gaining access

114
Q

Protect Linux

A

Use SeLinux or AppArmor to protect Linux, patch, use EDR, filter outbound traffic, hunt for long URLs

115
Q

Drive-by vs. Watering Hole

A

Drive-by or client-side is attacking normal web browsing, called watering hole if targeted
Watering hole may involve Windows files with marcos or fake installers

116
Q

MsfVenom

A

Metasploit also has MsfVenom that convers any payload into a standalone file (related to templating)
MsVenom -X can embed payload into legitimate executable

117
Q

Msfconsole

A

Msfconsole is used to prepare a reverse TCP connection (listener)

118
Q

Browser Exploitation Framework (BeEf)

A

Browser Exploitation Framework (BeEf) used for browser exploits, XSS attacks, and social engineering like fake flash update
BeEf runs as sudo on Linux, collection of browser attack tools

119
Q

Command Injection

A

Command Injection = web app sends user input to a command shell and attacker can try to appends a 2nd command using ; on Linux or & on Windows. Can arrive sa HPPT Get or Post. Any system that accepts user input. Attack against a server.
Might involve -h, ; , & , echo, or ‘injected’, manipulating value following id= as example, or a command like ping

120
Q

Cross-Site Scripting XSS

A

Cross-Site Scripting XSS is an attack against users, attacks vulnerability in server input or output, changing what is displayed to the user, could tell the client browser to run code or redirect the cookie location, often JavaScript or HTML

121
Q

Stored vs. Reflected XSS

A

Stored XSS Attack = uploads or stores malicious code on server, drive-by (opportunistic)
Reflected XSS Attack = uses vulnerability in URL of a page (GET-based), sends URL to victim

122
Q

Identify XSS vulnerability

A

XSS demonstrated as page running 

alert('XSS');

Test for XSS vulnerability by fuzzing input like <hr> tag or ‘’;!–“<xss>=&{()} will return alert('XSS') if bad or something close to the input text if safe</xss>
123
Q

Prevent XSS

A

Encode meta character output using (& or &) and limit cookie with HTTPOnly tag
Servers set Content Security Policy (CSP) header

124
Q

SQL Injection

A

SQL Injection exploits input validation to set or retrieve unintended info from DB
Test using ‘ “ ` % %% – /* //) ; for example blake’ OR ‘a’=’a
Tautology is always true condition retunes all records like a=a
Tripping an error code can also reveal info about the server or files.
UNION followed by a new Select is commonly used once vulnerability is verified

125
Q

SQL Injection tools

A

Automated options include a python script called sqlmap, Burp Suite Pro, Acunetix Web Vulnerability Scanner
Testing can be risky, could delete data, backup before

126
Q

sqlmap

A
  1. Always us a valid, non-error-generating URL
  2. Always put the URL in quotes
    Possible EXAM question:
    sqlmap -u https://msn.com //invalid without quotes
    Also followed by –dbs = enumerate databases and -D dbName –tables to list tables followed by –colums or –dump (display)
127
Q

Cloud DB vulnerable to SQL attack

A

Cloud database remain vulnerable to SQL injection attacks, does not escape, no Object Relational Mapping (ORM) system

128
Q

SSFR

A

Server-Side Request Forgery (SSRF) allows attacker to change what is requests from a server to disclose Instance Metadata (IMDS), protected files on the host, URL calls file location, change the file to local path like file:////etc/shadow
Can be evaluated using curl
Access IMDS using virtual server address = curl http://169.254.169.10/latest/user-data
AWS IMDSv1 has a known SSRF vuln used for credential extraction
Some like Azure mitigate using special header requirement

129
Q

Endpoint Security Bypass

A

Endpoint Security Bypass = evading signature detection, encoding, using permitted tools

130
Q

DefenderCheck

A

DefenderCheck splits file into pieces until it cannot be detected (high/low strategy)

131
Q

Code wrapping

A

Code wrapping to build legitimate code around malware, possibly using IronPython, often layering among multiple languages

132
Q

LOTL Example using sysinternals

A

Example provided was using sysinternals procdump to get LSASS dump to use with Mimikatz on another system
.\procdump.exe -accepteula -ma lsass.exe lsass dump

133
Q

Bypass AppLocker

A

Applocker can be bypassed by unusual execution method like InstallUtil /U shellcode.exe (.Net Install Utility)

134
Q

On Linux search for SETUID files

A

On Linux search for SETUID files= find / -perm -4000 -uid 0

135
Q

Pivoting

A

Pivoting, often setting up a proxy on one system to reach another
Merterpreter has portfwd and route that can establish a proxy
Merterpreter doesn’t have port scanner but can use apr_scanner or Metasploit has nmap, db_nmap, and auxiliary scanner modules.
Identify the next hop systems and port scan.
Lateral movement is exploiting targets through pivots

136
Q

Linux port forwarding

A

On Linux this could be SSH port forwarding using SSH -L port1:IP:port2
Linux can also use netcat named pipes discussed earlier

137
Q

Windows pivoting

A

Windows can use netsh interface portproxy but requires admin

138
Q

Hijacking

A

Hijacking attacks (impersonation), exploiting weak protocols, like local MTM, broadcasting service requests and injecting responses

139
Q

Responder

A

Responder is a python script to exploit (Hijacking) LLMNR, can be used to get NTLMv2 auth hash from network response

140
Q

After pivoting comes…

A

Next is persistence to regain access, avoid detection, preserve privileges, and reestablish access at will

141
Q

Prevent Hijacking

A

Disable; LLMNR and NBT-NS, disable mDNS, and SMB lower than 3.1.1

142
Q

Persistence method

A

One options is to create a new user account
merterpreter> execute -f ‘net user /add accessmgmt password123”
merterpreter> execute -f ‘net localgroup administators /add accessmgmt”
Metasploit and others offer various persistence options like a persistent service
WIM can subscribe to events
Also discusses golden ticket attack
Web shells could provide persistence, mod to web page or file

143
Q

Persist with event subscriptions

A

WIM can subscribe to events and execute code like scheduled tasks using mofcomp.exe and can listen on a port for a specific IP as an event trigger. Merterpreter watched for Sec logon failed event 4625 by default.

144
Q

Cloud persistence

A

Cloud persistence could be new resources like VM function, container, new access keys, cloud accounts

145
Q

Identify autoruns

A

Look for autoruns, events 4624, 4634, 4672, 4732, 4648, 4688, 4697, registry startup, use get-ciminstance to detect event subscribers

146
Q

RITA

A

Real Intelligence Threat Analytics (RITA) uses statistical data over time for hunting, used for offline assessment, ingests Zeek logs
Look for long connection durations, consistent packet size, interval, jitter, etc.

SEC504 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions