WIXLIB

Scripting for Penetration TestingTable of ContentsScripting for Penetration Testing . 2Scripting for Penetration Testing . 3Recon & Enumeration Scripting Example -1 . 5Recon & Enumeration Scripting Example -2 . 7Exploit Checking -1 . 10Exploit Checking -2 . 12Data Exfiltration Scripts -1 . 15Data Exfiltration Scripts -2 . 17Notices . 20Page 1 of 20

Scripting for Penetration TestingScripting for Penetration Testing62**062 Next section will be a little bitabout how you can use this, being apen tester myself, some of the waysthat you can use scripting to helpyourself through a vulnerableassessment or a pen test.Page 2 of 20

Scripting for Penetration TestingScripting for Penetration TestingUsing scripts just make “sense”.Usually several tasks can be automated.Reconnaissance Enumeration Exploit checking Pivoting Data ExfiltrationIf it is a manual process going to be done a lot of times, it is aprime candidate for automation. 63**063 For pen testing, there's a lotof repetitive things. You're checkingout a network so you're trying toreach out to multiple hosts. Soscripting just makes a lot of sense.Once you figure out what it is youwant to try, you can make yourself areally good script, similar to whatChris made, and you can use itconsistently. The general stepsduring a pen test is you go out andyou do a reconnaissance. That'swhere you go out and find whathosts are alive out there, and thenyou do an enumeration of servicesand ports that are open. So you goout, check out what it is they haveavailable for you to actually possiblyPage 3 of 20

exploit, and then you use something,a tool, to go out and check anyexploits for the versions of theservices or the protocols that you'retrying to take advantage of.Pivoting is where you try to movefrom host to host, also known aslateral movement. So sometimes youcan do that in a scripted way as wellto make it a little easier. Sometimesthe pivoting involves cleaning upafter yourself. If you're not backtracking out and you're actuallymoving, kind of like leapfrogging to alily pad, if you will, and you want toclean up the box behind you, itmakes sense to use a script. As youmove to another box, you can wipeclean the box that you were onbefore.And of course the crown jewels ofwhatever it is that you're trying toget, data exfiltration-- try to get thatstuff out of their network so you canget it home and take a look at it. Alot of this can be done and is donefairly frequently, actually, in a manualway sometimes because, again, thatlaw of diminishing returns. If you'reonly hopping to one box or you'reonly doing something to one or twoboxes, sometimes trying to figure outhow to get it right in a script takes awhile, so. But for the most part, a lotof these, especially when you'redoing an assessment on a largenetwork, it makes a lot of sense touse batch scripting.Page 4 of 20

Recon & Enumeration Scripting Example -1Recon & Enumeration Scripting Example -1You “own” 20 Windows boxes and want to collect as muchinformation from them as possible. You could do it all by hand,individually OR, you could write a script. Inputs: List of IP addresses to run script on Outputs: Text file containing enumeration dataProcess Connect to each IP address (batch, net use). Copy and run enumeration utilities (net, sc, tasklist, enum,netdom, global, and anything else in the Windows ResourceKits). Output results to a text file (batch, redirection). Copy file to “dropbox” and delete all other traces of activity(batch).64**064 During the recon andenumeration stage, if you own orhave already compromised 20Windows boxes and you want to dosome data gathering, obviously itmakes sense to go ahead and writeyourself up a script. So this is writtenin such a way that the input is whatyou'll need-- a list of IP addresses torun your script on-- and then youroutput is what you're going to receiveat the end of it. It'll be a text file ortext files containing the enumerationdata that you're looking for.The process, kind of the step-bystep, is connecting to each IPaddress using net use and your batchPage 5 of 20

file, similar to the one that I justdemonstrated. You can copy and runenumeration utilities like the Net orSC or Enum. There's quite a few ofthem. Obviously the WindowsResource Kit has lots and lots of toolsthat are meant for good that can besubverted to do things that aren't sogood.For outputting the results to a textfile, you can use your redirection thatwe talked about in your batch script,and then copy your file to what wecall a drop box, but essentially it's ahost somewhere on the networkthat's usually in a quiet part of thenetwork that doesn't get used, andmaybe no one's even logged on sono one's going to catch you on thathost, so we use a drop box, and thenyou delete all traces of where you'vebeen. You can do that with a batchscript as well. Questions?Page 6 of 20

Recon & Enumeration Scripting Example -2Recon & Enumeration Scripting Example -2You are wandering around a facility and find an open workstation –quick – what do you do? You could try to remember what to do OR, you could put in your USB drive or CD and run a script. Inputs: None Outputs: Text file of enumeration data, user accounts created,“malware” installedProcess Run the enumeration from the last slide. Create a new user and try to add it to the local admins group(batch). Install your remote access program and set it to run (batch).65**065 So another way with reconand enumeration. This one's a littlemore, how shall I say, targetedopportunity. I used to also be part ofa red team organization, sosometimes we were told to checksomewhat physical security, andphysical security of course is if youwalk up to a machine and, "Oh, it'slogged in," and no one's there-- youdon't want to sit there and try tofigure out what it is you want to do.It would be very nice if you had ascript already built and put on a USBdrive that you could slap in and run,or perhaps even if they have a USBpolicy and you're not sure if theyhave a CD policy, you can put yourPage 7 of 20

script on a CD and you can run yourscript that way. No real inputs tospeak of because you should haveeverything on your drive or your CD,and then you can also get all yourenumeration data and perhaps someother things; if you're on thatmachine and it happens to be anadmin account, you might want to tryto set yourself up with an accountthat you can use later during theassessment. So you could end upwith user accounts created, andshould you have a Trojan orsomething that you want to use, youcan go ahead and install that.Very similar to the last slide, run thatenumeration to get the data, andthen, like I said, you want to goahead and try to create a user. Youmight be able to do that, and if youcan do that, go ahead and try to addthem to the local admin's group.That would be very nice. You can dothat in your batch script as well. Andthen the remote access program, orRemote Access Trojan, or RemoteAccess Tool-- the RAT-- you can goahead and set that in and get thatrunning so it can call back to yourhome machine or whatever you haveset up for that. Any questions?Chris, you have something to add?Instructor 2: I just have anexample of this. We used to do atraining scenario for all the pentesters, and we would sit them downat a computer and say, "Go." Andwhat we would ask them to do-what they were presented with onthe screen was a countdown timer.Page 8 of 20

"This box is rebooting in twominutes," but you've got completeaccess to it. You have a commandprompt, it's logged in, whatever-- dosomething. Whatever it is that youwant to do, you've got completeadministrator access. What wouldyou do? And we ran through thisparticular scenario, because out on apen test I actually had this happen. Iwent up to a box, moved the mouse,the window came up, I celebrated,and then panicked because uppopped the "You've received patches.This box will be rebooting in tenminutes." And I went, "Oh great.Well, what am I going to do?"So I'm sitting there scratching myhead trying to think through all thepossible things that I can dowatching this countdown clock gofrom ten minutes down to zero, andit struck me that, "Wow, I really wishI had a batch file with me," that Ihad a USB stick or something that Icould just plug in and run all myenumeration piece. I could add mylocal administrator account. I coulddo all this stuff, and instead here Iam trying to hand-jam it at thecommand prompt trying to do thingsquickly while this clock, thisdoomsday clock basically, is tickingdown until it's going to boot me offthe system. So just from a pentesting perspective, this was a reallygood case to run and it shows howbatch scripting-- you can take thatmoment of panic out of it. You onlyhave to know, "Plug in my USB stick,run my batch file," and the computerdoes the work for you. You don'tPage 9 of 20

even have to think about it. So,again, another really good usage of ascript.Instructor: Thank you.Exploit Checking -1Exploit Checking -1May be a little too “loud” for a pen test. Inputs: Metasploit exploit module to run, list of IP addresses Outputs: List of IP address exploit was successful onProcess Control loop (bash) Exploit checking (msfconsole) Output parsing (bash with redirects)66**066 Exploit checking. This maybe a little bit-- with the amount oftraffic and the type of traffic that'll betraversing a network, not unlike whatRyan said with Nessus doing itsthing, this may not be the best way,unless you get permission to run thiswith a pen test. But the implicit thingthat you will need is the Metasploitframework and the exploit module.I'm not sure if people are familiarPage 10 of 20

with Metasploit, but it is a pen testingframework that essentially makestesting exploits for a particular typeof-- if it's a Windows host, a Linuxhost, and a particular type of systemor software that's running-- you canput in all the required pieces of it andjust hit Exploit, and it'll actually sendeverything to the appropriate ports orwhatever it is. So it makesexploiting, or testing exploits, very,very easy. It's a very niceframework. It's very common.Now that it's so common, many ofthe attacks are blocked because theykind of know that people useMetasploit, not just for pen testingbut to try to hack other people.So you would Metasploit and a list ofIPs, and then you would-- youroutput-- you would end up with a listof IP addresses where the exploitswere successful. And the process ispretty simple. You set up a controlloop using bash because Metasploitruns on Linux. Specifically it runs onsomething called Kali Linux, which isa Debian-based Linux, and you goahead and do the exploit checkingwith-- the MSF is the MetasploitFramework console-- and then yououtput, or you parse the output, andyou can do your redirects and youcan send it to grep or to some ofthose other text parsing type of tools.That'd be helpful. Any questions onthis one?Page 11 of 20