This week I did read the great book The Hacker Playbook 3 by Peter Kim. The focus of the book lies on Red Teaming, it makes sense to read also the first two books if you do not have prior knowledge to penetration testing.
Difference between pentesting and red teaming
MITRE ATT&CK framework
optional lab setup & exercises
about web attacks like node.js, nosql injections, deserializiation attacks and more
hacking the (windows) network for example with responder, password spraying
privilege escalation with misconfigured services, exploit suggester and more
mimikatz magic of course
attacks on macs with empire
bloodhound and sharphound
lateral movement using different techniques
social engineering campaings & physical attacks
recompile meterpreter dlls for avoiding detection
write your own droppers
I highly recommend this book, especially if you are into Red Teaming it is a good resource. Maybe a report about owing the Cyber Space Kittens lab would have been nice, since reporting in Red Teaming is a non trivial task.
After the getting started article, here is a walkthrough for hackthebox netmon, to get an impression how to pwn machines. This was a nice one and I guess one of the the easier.
Nmap 7.70 scan initiated Thu May 23 21:38:11 2019 as: nmap -A -oA netmon 10.10.10.152
Nmap scan report for 10.10.10.152
Host is up (0.043s latency).
Not shown: 995 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-03-19 12:18AM 1024 .rnd
| 02-25-19 10:15PM inetpub
| 07-16-16 09:18AM PerfLogs
| 02-25-19 10:56PM Program Files
| 02-03-19 12:28AM Program Files (x86)
| 02-03-19 08:08AM Users
|02-25-19 11:49PM Windows
| SYST: Windows_NT
80/tcp open http Indy httpd 22.214.171.12446 (Paessler PRTG bandwidth monitor)
| http-title: Welcome | PRTG Network Monitor (NETMON)
|_Requested resource was /index.htm
|_http-trane-info: Problem with XML parsing of /evox/about
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
Network Distance: 2 hops
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 1723/tcp)
HOP RTT ADDRESS
1 54.00 ms 10.10.12.1
2 54.08 ms 10.10.10.152
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done at Thu May 23 21:38:40 2019 -- 1 IP address (1 host up) scanned in 29.10 seconds
Connect via FTP
The user hash is easily found:
Now we have a look at the running web server. A PRTG instance is running here. After some searching the web it was clear that this might be a vulnerable version of PRTG (https://www.codewatch.org/blog/?p=453). No login with std creds (prtgadmin/prtgadmin) possible…
But we have the FTP server, which gives us some infomation:Some interesting stuff in the windows dir:
Here the credentials are encrypted. Some research show that in older versions that might be a problem (TODO, link). So I spent some time in finding valid credentials.
Also in c:\windows:
c:\ProgrammData is hidden but can be seen if you access it directly:
Get netmon prtgadmin credentials:
Something interesting in PRTG Configuration.old.bak:
After some trying I found out that the new password was: PrTg@admin2019, so this is something you have sometimes in real life, finding some credentials but still need to try around a bit. Then I followed mostly this description of the vulnerability: https://www.codewatch.org/blog/?p=453
Add a notification:
Leave defaults and choose “Execute Program” with the following settings:
Success, we can now get the hash from the test,txt file:
Pwnd! What I liked on this machine was that you needed to combine vulnerabilities. First find the credentials, then alter them to the working credentials. After that you had RCE.
Penetration Testing – “A method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security, using the same tools and techniques as an adversary might.” (From wikipedia)
The scope of the article is to help to get your first job as a penetration tester. If you have more great links or recommendations please add them in the comments section. Becoming a good penetration tester requires much more skills than described here. It also means that you never stop learning.
If you don’t know the IT- and IT security basics yet, please have a look here. When you want to start a career in Penetration Testing you should know that most of the penetration tests performed today are Web Application tests. Therefore this article is focusing on this topic. Later I will add new posts with Specializiation Paths for more advanced topics like exploitation, red teaming and so on.
As already mentioned in the article Career
Path Security Basics, I strongly suggest that you make a plan what goal you
want to reach. For example playing CTF all the time might be fun for some
people, but if you need the OSCP it might not be helpful to waste too much
Web App Penetration Testing
Port Swigger: Web Security Academy Content: Teaches the basics of Web Application Security, so far SQL Injection, XSS, OS command injection and File Path traversal. Comes with small labs. Career: Penetration Test but I recommend it also for everyone interested in security Level: Beginner Price: Free
OSCP If you want to start a career in Penetration Testing you might consider to make the OSCP certification. But you should have in mind that the OSCP is extremely time consuming and it is not a must have, but definitely a door opener. Therefore I recommend to do the OSCP certification. Here is an article about pros & cons of certifications.
Here are some hands on for labs and learning. Some of them are online, others have to be installed and run by yourself.
The Web Application Hackers Handbook Authors: Daffy Stuttard, Marcus Pinto Content: The standard book about hacking Web Applications, goes into depth about the most important topics. Authors also created the BurpSuit. Career: Penetration Tester Level: Good for beginners, but also useful for experienced penetration testers Buy at Amazon U.S. Buy at Amazon Germany
Penetration Testing: A Hands-On Introduction to Hacking Author: Georgia Weidman Content: A great introduction into penetration testing. Career: Penetration Tester Level: Beginner Buy at Amazon U.S. Buy at Amazon Germany
Metasploit: A Penetration Tester’s Guide Authors: David Kennedy, Jim O’Gorman, Devon Kearns, Mati Aharoni Content: Introduction to Metasploit and penetration testing Career: Penetration Tester Level: Beginner, Intermediate Buy at Amazon U.S. Buy at Amazon Germany
The Hacker Playbook 2 Author: Peter Kim Content: Book for penetration testing, hands on hacking, pivoting, evasion and so on. Career: Penetration Tester Level: All Buy at Amazon U.S. Buy at Amazon Germany
German Book: Hacking mit Metasploit Author: Michael Messner Content: Great introduction to penetration testing and metasploit. Career: Penetration Tester Level: Beginner/Intermediate Buy at Amazon U.S. Buy at Amazon Germany
Career Path, Labs: Penetration Tester Challenges: Penetration Tester, Forensics, Malware Level: All
Until now I never realized that hackthebox also offers free accounts, so I decided to test it and write a short post.
After a challenge here you can create your login. With the connection pack for openvpn it is possible to connect to the labs with a Kali machine (or any other Linux I guess), easy.
With the free account you can solve challenges and active machines.
Active machines For owning systems and users there are flags that are stored in files on the machines, for example:
The labs remind me about the OSCP labs, and lots of people are using them for training before the OSCP certification (which might be a good idea, though I did not) or to get an impression about the labs and the exam.
For more information and getting an impression about owning boxes look here, lot’s of walkthoughs for retired boxes.
At the time of this writing 20 machines were online, with different OS versions (Linux, Windows, BSD) and different scenarios. I had a closer look at some boxes and solved one so far in a couple of hours.
The lab looks really fun, and I would recommend it for everyone who wants to train and learn hacking.
Challenges The challenges also look quite good, i had a look but honestly, I am much more into owning. Here are the categories for the challenges:
For solving for example the Stego challenges, you download a file with a hidden message and have to find it. I was surprised that there are also some Forensics challenges, I will defilnetly have a look into those too.
Conclusion This is definetly a great playground for everyone who is into solving challenges and pwn boxes. I am not sure if hackthebox is good for total beginners, there are no big explanations or tutorials for the machines or what is to do. There are the official forums with hints and some websites offering more in depth explanations, although the rules say that this should not be done, and somehow as an OSCP taker (“Try harder”) this feels like cheating. With the VIP membership you also have the retired machines with walkthroughs.
For your career hands-on and solving challenges is a very important part, so I recommend: sign up.
My first job The first job as a penetration tester was pretty exciting for me. I was lucky to have many collegues that engaged very much with the newcomers, and for the beginning everyone got at least three workshops lasting 2-4 days, if I remember correctly. The OSCP prepared me pretty well to the thinking of solving the day to day problems on the job. The job was at a consultancy company that mainly is doing penetration testing engagements in Germany. During that time I also started researching about antivirus evasion (in my free time btw). I most consultant jobs time on the job is short. For me that was a huge advantage, I was able to do web app testing in short time. Besides learning from colleagues I also read some books like The Web Application Hackers Handbook, The Shellcoder’s Handbook and Network Security Assessment. I had my first presentation (in German at the Backtrack Day 2013) about antivirus evasion, which made me very proud of course. During the first job that lasted 18 months I also visited the CCC Congress twice, had several chances to conduct interesting pentests (mostly web and mobile) and did an interesting online course (Malicious Software and its Underground Economy: Two Sides to Every Story). Because I liked the hole exploitation topics I made the SLAE certification, which was a lot of fun and I highly recommend, also for preparing the OSCE. Now there is also a 64 Bit version.
My second job I learned a lot and had great colleagues, but for me it was time to move on to my second job as a penetration tester, where I had the chance to travel more and to work for clients on site. Further I had the chance to do some Digital Forensics and Indident Response (DFIR) under the condition I do any certification, so I choosed the one the looked easiest for me, that was the CHFI (Certified Hacking Forensics Investigator). I would not necessarily recommend it, but at this time it helped me improving my career and also to do some forensics and incident response work. For the preparations I bought “The Official CHFI Exam Study Guide”. For gaining more in depth knowledge about forensics I attended a course at the University of Applied Sciences Albstadt-Sigmaringen about data storage forensics. Besides the work I continued my research on antivirus evasion and gave a talk at the Deepsec conference 2014 (“Why Antivirus Software fails“). Also I had the chance to speak at public and closed events from my employer and started to visit the OWASP chapter Cologne. For education and to get from professional to expert level I decided to make the OSCE certification. That was a blast for me. I never had such a challenging time in my career and I fell through the first test and had to take a second shot. The OSCE is highly recognized especially in the Red Team and Exploitation community. Like the OSCP for me it is not about teaching certain techniques, but training the right attitude you need for breaking stuff (Try harder). I was glad when I got the famous mail from offensive security after the second exam. After 17 months on that job I took my chance and hired at a CERT, this will be the story for part 3.
Conclusion & some notes
be grateful for the knowledge and support of friends and colleagues – sometimes I forget to say this… so to everyone who helped me during my career: thank you!
when it is time to move on, move on, after all it is about business and your personal development
Giving talks gave me the great opportunity to network in the community and also to improve self esteem and public speaking
Be flexible, I moved for each job in the IT security field
for more networking I started to use twitter
Don’t give up, “Try harder”, the motto by offensive security also applies to searching for jobs and many more lessons in life, this attitude helped me also with my research
Working at a consultancy company is helpful, since it teaches you to be effective (time and costs), you learn to deal with pressure