Attack Methodology Frameworks

0:00What's going on everybody in this skill we're taking a look at how to attack and I know we've been waiting for this point Especially if you've been in previous courses with me and you know that I love getting to this part But first let's go over some rules Because this skill is going about how to attack in the name of pen testing to strengthen our defenses Making sure that nothing's open over here that got me head to head edit the last couple of skills But we're gonna be taking a look at three different models in this skill and those are basically methods on how to attack and plot Everything out for that attack now the reason that we do this is to make sure that we're following Proper guidelines and edicates and those edicates are usually or and the guidelines are usually set by our organizations SOP or standard operating procedure and or policy So the CIO the CEO the C ISO that C suite upstairs is gonna be able to help us map out what our left and right limits are and Basically this comes down to we don't want to wreck the organization We want to test to make sure our defenses are really good but not so much to where we actually inhibit ourselves from being able to communicate or provide services that our organization is utilized for and Even though there are different frameworks that we're gonna be going over here

1:18and they have their own flow They all generally point to the same direction and outcome and Understanding our organizations cybersecurity defenses and learning how we can approve it is at the center point of all three of these Now I do want to go over one little thing real quick you and your organization out there It may already have your own way of doing this and that's okay because the use of a different model is not necessarily out of this world as far as you know a taboo or anything like that because that helps you understand your defenses that you have in place for your organization and that's okay But we all want to make sure that we have a general understanding of the three frameworks that we're gonna be going over For a couple of reasons one It's proper defenses and testing procedures for those that may not be familiar with what's actually going on Let's see the next reason would be let's see It's for the comptious certification. We're studying for so hint hint nudge d utch wink wink on that one And then we also want to make sure that we're within industry practices Now when I specifically point out industry practices and I this is probably the last time you hear me bang on about this in this particular skill We're talking about in the previous skills when we went over specifically ISO 27001 and ISO 27000 too now if you're a little bit of lost on what's actually

2:37going on there and Along with those in this standards I would encourage you to go back and take a look review a couple of those skills Just to make sure that we're all on the same sheet of music Because even though we're studying for a certification here We're gonna pass it and then after we get that certification and we are sitting in the cyber security analyst position We need to make sure that we don't break any rules or regulations just in case for an organization that has a tightened sense of Let's see Responsibility towards those laws in case like financial industry or anything like that or government work And it just so happens that one of the frameworks is for that Government contractor out there. So if you're in the DoD you'll be really familiar with this one So let's go ahead and do it to it and get familiar with our three framework references and start to understand how we can start doing some Pentesting on our own. Let's go

0:00Great to the point, the meter attack framework is basically a spreadsheet and documentation for us to use as a reference to figure out how to plot out an attack. Now keep in mind when I'm going through this and talking about attacks, we're talking about internal pen testing within our organization to strengthen our defenses. We're not actually sitting here and making it to where I'm encouraging people to actually go out and attack stuff. That's not the case. So please don't go out and attack stuff and if you're using what we're talking about here to be able to do your own pen testing, please make sure that you have full permission from the system or network owner to be able to do this.

0:39I want to point out one last thing before we go into the attack framework models and that is if you're testing in your own or let's say home and you have a regular ISP coming in for your internet service, you can only do some of this within your own household. Once that attack traverses the gateway of your router slash modem for your ISP, then we start getting into some legal issues where we need permissions, usually in the express written consent form. So please keep some of those things in mind as we start going through this.

1:12Now that takes us to going through this and the first step that we do or our partake in is threat awareness where we're staying informed about the individual threats that are out there to our particular systems. And we need to make sure that we're always accounting for the different systems types of hardware types of software and the utilization of those different platforms that we have within our organization. And we do this by going to different resources such as O Wasp and the meter attack framework link that I have right above this video that we'll be getting into momentarily.

1:48And that leads us into asset protection where we just talked about knowing everything within your organization. And we've been over inventory a good bit already, but asset protection is making sure that we crucially identify and protect those critical assets with our security measures . And then we get into the actual vulnerability management. And this is where we start actually getting into some of the legwork for pen testing. And if we're doing a good job on vulnerability management and making sure our systems are up to date with all the relevant security patches and policies that we implement within the organization, then we can start building out our research for what we're exactly going to be pen testing with.

2:30And we hinted on this in previous skills where we're using Nessus to be able to do vulnerability analysis against a particular system, this host that we were using. And we will come back to that. But when we do all this, this allows us to be able to go in and properly measure how it is we're going to be able to attack things. And then we get into incident response. Now as we're doing our pen testing, we're going to make sure that if our organization has an incident response team, that they're keeping track of everything.

3:01And if they catch us doing it to see and make sure that they're utilizing proper incident response procedures or protocols that we've laid out within our organizations, this is specifically getting into developing plans to detect and respond to the intr usions that are happening, whether they be from us or outside threat vectors. And then when we're going through our pen testing and attack frameworks, it's also enforcing the access controls and the security education of the organization.

3:31Access controls being anything to implement strong authentication or authorization mechanisms. We're talking like AAA models here, radius, TAC-X plus if that's within the organization and also logging into different systems, whether they be local logins or domain models like Kerberos inside of Windows. And as this is happening, let's say we're sending out emails to test the environment, that's where that security education comes into place. And then we have to research and develop plans on how to attack for pen testers , the endpoint security workarounds.

4:09So as we've seen in skills past that semantic on this particular host system likes to light up like Christmas tree because the definitions are up to date. When we start actually getting into pen testing this particular box later on, we're going to see where that endpoint protection will come into play and potentially some of the other policies and services that we have inside of here. But that all leads us to the reason that we're doing this and that is making sure that our defenses are strengthened to be able to stop outside attacks from happening along the lines that we're plotting to do things out with.

4:43And that requires continuous monitoring and compliance to the protocols that we have within our organization. So with all that being said, let's go ahead and take a dive into the meter attack framework that I have the link for again right above this video. And I wanted to point out how to be able to flow through this and utilize the attack framework for our benefit inside of pen testing for our organization.

5:16So here we are. We have it pulled up on the screen right over there. And we're looking at a kind of a squinshed down view because I'm only able to capture so much of my screen without making it look entirely weird. So let's go ahead and start walking through these one by one with a very brief bullet point on what they are and how we can utilize these. And the first thing we have on the far left, let me make sure I can zoom in for you here is reconnaissance. Now we've no we know generally what reconnaissance is and we utilize tools already throughout this course to be able to do reconnaissance.

5:49And the one that we go to the most is usually Zinn map, which is the GUI equivalent of in map or we use Nessus to do asset inventory and a lot of other things. And here inside of the reconnaissance tab, you can see that there are different options for how to participate in that reconnaissance. And that will be the growing theme of the meter attack framework as we utilize it to go through the different areas that it has. Now inside of reconnaissance, the first one that we have in the techniques and let me zoom in here, you can see is active scanning.

6:22And that's generally what we've been doing with Zen map to be able to go through and get host information for what it is that we want to plot out our Pintas for. Now they have other stuff in here as well too that you could definitely utilize for your reconnaissance, but in the reconnaissance phase of gathering everything up for our attack, it's getting information more than anything else to make sure that we are able to utilize any kind of exploit to be able to Pintas. And if we can't, that's even better because that means the defenses are where they need to be.

6:54But when we do our scanning, like we've done in Zen map before, this right here is an outline of how to do proper asset management and vulnerability assess. Now as an example of the actual reconnaissance phase, we're here using Zen map again against this particular host. You could see that we have a lot of ports opened up. It gives us a lot of information about the actual host itself and the services that are running within. Now this lines up with the meter attack framework. Let me open that up here for you and see if I can get it for you.

7:25There we go. And you can see him in here inside of our reconnaissance that this falls within the active scanning and also gathering victim host information. Now I'm going to go inside the victim, gather victim host information to give you a little bit more clear and concise way of understanding this. And when we go inside of it, you can see that when we first open it up, there are sub techniques listed below too, because when we talk about the actual victim host, we're talking about the system itself and not necessarily any particular hardware software answer.

7:56And that's where the sub techniques come into play at here, where we have hardware, software, firmware and client configurations. Now does Zen map give us all of this? No. It gives us a general idea of network and hardware information to be able to start utilizing for a pen test. But as we go down inside of here, we can look at not only the possible methods and ways of conducting a reconnaissance on a particular host or network, but we can also look at some mitigation as well too, and how to do proper detection.

8:36And that allows us to be able to not only be able to conduct a pen test, but also give cybersecurity defenses a good resource of information as well. So understanding the meter attack framework is not just for attacking only. It's also for being able to build those proper defenses. Now if we go back to our framework here on the screen, we can see that this is done for many different areas. And bear with me, I'm going to have to slide my screen over left and right, but I will zoom in for you. So zooming in here, we can see that after reconnaissance, we have resource development with its sub techniques listed underneath, same for all the others, the initial access and we're actually getting inside the system itself to gain access for that initial foothold execution to be able to start our way into the system to make sure that we're actually going through and looking at what we need to.

9:30And also this gives us a different command options and kind of techniques for being able to do this. And then persistence, that's where we're talking about maintaining access to that individual system inside of our Pintas itself, because just because we get inside of a system doesn't mean that the defense folks aren't already trying to kick us out. And then we through the other attack methods, we go into privilege escalation. And this allows us to not only see things as a user, but also to grant further access into other resources that we may be able to utilize on the actual system overall and do that pivot in order to be able to move into other systems.

10:11Now once that escalation happens, we move into defensive evasion to make sure that we're not being targeted by the cybersecurity blue team. And the reason for this is we don't want to be caught because if we're caught and booted out of the system before we can implement that farm foothold and start doing our pivoting, the whole point of this exercise, if we're an attacker, is done. And for Pintas team purposes, this tells us that our cybersecurity defense teams are doing their job in proper actual detection and utilization of resources.

10:45And by our powers combined put together, we can build those better defenses because up to a certain point, we were able to gain access theoretically. And if we were, we still need to report this, log it, make sure that everybody is aware. So that way, even though cybersecurity defenses were able to boot us out before we did any harm, we were still able to get in and we can prevent that in the future. And that's moving into credentialed access, discovering more systems and also lateral movement, which is that pivoting I was talking about while ago, the actual collection of information where we start doing technique for techniques for capturing information, whether they be like it says right below man in the middle or getting into files and data collections, and then command and control to be able to maintain access even further and utilize the system.

11:36And we can do something like using a hash cat to be able to reverse shell into the other system on the other side. And then exfiltration, as I scroll down here and move this all the way over to the right for the last one, is making sure that we can get all of that data off the system that we're actually looking for for any potential information or intel to let us into other systems resources. And we're not just talking about actual systems themselves. It could be that we're looking for financial gains like bank account numbers, P II, etc, etc.

12:07And then once it's all said and done, what was the overall impact of what it is that we were doing? Now yes, this is a lot to take in on the meter framework, which is why I'm about to wrap this video up because this is getting kind of lengthy. But the point that I wanted to make is that the attack framework that we have here is a good guideline for us to be able to follow through the steps of doing proper pen testing and defenses together in a joint environment and having different resources to be able to go through here and understand not only what they are, but learn about techniques to be able to properly utilize some of these attack methods.

0:00- No, no, no, no, no. - I did them. - Yeah, I wanted to point something out to you real quick as far as reconnaissance goes. And the meter attack framework website actually has a great example for this. So when we talk about reconnaissance, we're not just talking about learning information from resources like ZenMap. We can get information from just about anywhere. And this is the perfect example because their website here at attack.meter.org and I hope I'm saying that correctly. If you notice, let me zoom in and see if I can show this to you as HTTPS.

0:31But if you look on this particular page right here, we have the exact same site. Let me see if I can zoom in for you. We have HTTP and it's not secure. Let me bring that down real quick. You can see right here, let me, there we go. There's the HTTPS, there's HTTP. And when we do reconnaissance, that tells us that there is a possible attack method through port 80 versus port 443. And if we know our tools, we can utilize things like Metasploit to be able to come in and use Burp Suite against port 80 because we don't have any encryption for that data in motion.

0:00Of the same folks that brought you the meter attack framework and everything that we just did in the previous couple of videos up above, we have one of my favorite named models, the diamond model. Now, so like this one, because it's a little bit more clear in what the steps are in understanding the actual flow of an attack and the defenses that go with it. And to be able to demonstrate this, I'm going to put it up on screen for you right now. So we're taking a look here at the diamond model, broken down into five steps, and you'll notice that we have the four pillars of the diamond starting down on the bottom with the victim, because whenever an attack happens to our organization, that system and the owner of that system, whether it be the individual or the organization overall, is the victim. And then we move on working clockwise with infrastructure being next, because the infrastructure is the system or systems and network that is associated with that actual victim. And we're not talking about just one particular system , it could be inside of the entire organization, especially if that attacker gains a little and is able to pivot through the rest of the systems with elevated credentials. And then we start to kind of

1:16ID who the adversary is based on different logs that we'll get into in just a second, and then wrap it up with their capability to see if it's something that we need to have more help or assistance with containing. All right, first and foremost, down on the bottom right, where victim is on the right side of the diamond, you can see where it says number one, victim discovers the compromise. Now, this could be the cyber defense cell, looking at different alerts that come through the different systems that we have in place to be able to notify us of different things like logs and whatnot, or it could be even the actual individual user on the system within the organization that says, hey, this may not look right and this doesn't smell right for whatever reason.

1:59So that can lead us to being able to discover the actual compromise itself. Now, could the compromise be something like hashcat taken over the system and starting to send wonky commands could be, or it could be something as simple as we notice a little bit abnormality in the way that a program operates versus how it's supposed to operate. Regardless, it sends us up to the capability of the actual attack that's actually going on. Now, I know I just said capabilities last. I'll swing back around to that in a second. But that's why I have the arrows here as well too. Now, this is my rendition of the actual diamond model and a simplification of what it actually is.

2:37I have some resources for you that I'll get to in a second. But the capability of the attacker is based on what it is that they're using to be able to access that said vulnerability or exploit inside the individual system, which moves us on to number two, where we start in cyber defense world, start looking at the logs of the exposed system and we expose the IP of the attacker. Now, could that be the overall IP of the attacker, you know, end all be all, no, they could be spoofing their IP address, but this starts to narrow down the hunt. And we start getting into more detailed ID S IPS logging from the actual perimeter of the network and intern als to the systems network or organization's network. And we could start to figure out where that actual IP address legitimately came from. Now, I mentioned all that because that leads us into the actual infrastructure side, where we start looking at the seem to show other network activity. See, it all starts to come together under the diamond because let me tell you, diamonds are forever. But the scene shows us the network activity of the attacker or attackers and to be able to ID some more network information from the attack itself within the infrastructure of the organization. And that leads us

3:56to number four on the top left of the IP points to the actual threats identity. And this could be that we do a who is or a reverse lookup or go into the icon database to be able to figure out who owns this actual block of IP addresses. Now that's specifically talking about IPV for there are other methods out there that we can get into later on about IPV six. I just want to give you the general idea right now. And that is using resources that are open source and even maybe some proprietary stuff out there, but more open source because I'm chief, to be able to find us who owns that IP block to be able to point to the where the attacker is coming from. Now why is this important? Well , in this phase right here, while we're trying to contain the actual threat inside the organization, we could also be working on access control list and other control methods in reference to the actual meter attack frame model that we referenced in the video set above because we want to try to incorporate both of these together. See, this is a generalization model that we 're looking at here.

5:03And we would actually reference these different areas that we're looking at in the diamond model to the meter attack model to get more details as to what we can use in terms of techniques that is recommended for us to be able to leverage these different areas of the diamond model even better. And when we get the IP of the threats identity, we can start to build network access controls, better firewall rules to be able to block attacks from that particular system, or if we need to blacklist an entire block of IPs. But this gives us to the top of the diamond model of the actual adversary themselves. And as far as like getting a name to the actual attacker, that's detailed stuff for way later on, we're just looking for an IP and IP block at this point.

5:54But the adversary leads us to number five, which is the threat identity helps ID security threat. Now this goes into more of the understanding your attacker than anything else. And for those that have department of defense experience, especially in SIGINT, signal intelligence, this is very familiar to us because knowing who or what the attacker is builds more of a database as to what our defenses need to be, because if we have a known attacker or known attack method, then we can start building defenses out for that generalized attack method to bring it back to me.

6:31Now when I talk about threat identity helps, let me give you an example here. We're talking about script kitties in particular, because I've already brought them up, or if I haven't, I will, I promise. But when we talk about the attacker and we go into, let's say script kitties, let's say we've identified through our logs the actual string of text that they used to be able to gain access. It wouldn't be a bad idea to be able to take some of these commands or some of these outputs that we get from these commands and run them against Google or other known databases of known exploits. And the reason that is, is it may come back and give us more intel on what program is being utilized, let's say it's hash cat or let's say it's metasploit or let 's whatever the case may be. And then we can get a better idea of how to round up our defenses against those particular programs, because script kitties are known to be able to utilize the Google or now with AI. And this is not a day get the CBT folks, I promise. But to be able to get us a quick and easy method to be able to utilize some of these programs that the script kitt ies may not truly understand their the full potential of. So when we start put piece in the puzzle together with different command strings that we gather from down at number three in our scene network activity logs and start doing the research on those, we may be able to cut some of these

7:49attacks off at the past. And that's why using a broken down version of the meter attack framework model in the diamond model gives us a standardized flowchart of what's actually going on and how to process and attack within the organization. Now the flip side of that is, is that as an attacker that's working on pentesting an organization with permission, we can utilize this model right here to be able to go through and use it for a visionary tactics. Now again, what takes us right back to the meter attack framework model up above to where we can start looking at a visionary tactics to be able to help us out in something like number two, where log exposes IP of the attacker. This is just a generalized idea of what we just went over in the meter attack framework model. This allows us to be able to simplify and understand the different more intricate steps in a broader sense to be able to give us an idea of how to not only do our defenses, but also do a proper attack for the purposes of pen testing.

0:00The last model we're taking a look at is something that is a little familiar inside the DoD world, especially once you start working with CyberCom or Cyber Command. And that is the Lockheed Martin Cyber Kill Chain. Now, this is a kind of a combination between the meter attack framework and the diamond model, where we go into seven steps of understanding the actual kill process to an attack. Now, I'm just going to run through these very briefly and kind of give an explanation to what each of these are. So that way we kind of understand what's going on here because I don't really feel the need to go too deep in the weeds on this and just want to introduce it to make sure that we're familiar with it, just in case there was a certification and ask about it.

0:42And step number one is reconnaissance and you're starting to see a theme here where no matter what we do, there's always the actual research portion of the attack or defense overall. And we want to make sure that we also include target selection, research for vulnerability identification and the like, because not only are we trying to identify the actual system itself, but also the vulnerability that we're going to be using to exploit. And where do we get some of this information from? Well, I'm glad you asked.

1:12Now, this should look familiar. We're inside of our NESIS terminal here, inside of the CaliBox, inside of our VM environment. And we're going to go back to our first scan that we ran initially in the previous skills and go back to our one medium vulnerability that we discovered on our host over here right over there and go into the explanation for it. Now, this is SMB signing not required. And I'm not going to get in the weeds because we've already beaten this one with the bat. And when we look at the actual reconnaissance phase for what's happening inside of our cyber kill chain, this is a big portion of the reconnaissance right here because not only does NESIS identify the vulnerability itself, but it also identifies the actual system and other information about the system because I can essentially go back and look at all the other infos that are on here. And this is where we get the reconnaissance for the system overall, for example, if I go down to our info that's about Windows, I can see here that we have DCE service enumeration and I got more info about what's actually happening inside of the RPC protocol itself to give us more information about the particular of what kind of windows we're running, what kind of information that we're getting for the actual services that are

2:29available on the system. And all sorts of different applications that are running as well. Now, this may seem a little bit jarble as far as the output is concerned, but this all ties into that research that we were just talking about. Step number two inside of our cyber kill chain is weaponization. I hope I'm pronouncing that correctly. And that is basically the creation of tools to be able to exploit what we found in our reconnaissance of load abilities and the system overall. So we've discovered the vulnerability. How do we want to exploit it? Well, this is where research comes in yet again, but we can also reference something pretty easy.

3:05And let me open that up for you real quick. The meter attack work frame model. I know it's been a while since we touched on this, but we can look at initial access for this particular phase of our weaponization, because we know it's SMB exploit. Well, how do we get research to be able to go in and tell us how to pop exploits for SMB? Well, what's SMB? Well, that's server messaging block and has a lot to do with file sharing. And if we look under the initial access, we can see that we have, let me move my mouse there for you for a second.

3:38Command, ejection, drive by compromise exploit, public facing applications. External remote services, hardware fishing, remote through removal media supply chains, compromised trusted relationship. That may be one right there, trusted relationship, because SMB is usually associated with some type of credentialing, and that credentialing is usually maintained by either the local system or a domain itself. Now, we could go into execution phase of the meter attack framework and be able to get more information concerning that. But this just gives you a general idea of the different steps that we're going.

4:14Number three, delivery. And once we realize how we're going to leverage that SM B attack, we're going to be working on delivery. Now, it just so happens that our man in the middle technique inside of our attack framework allows us to be able to do a SMB attack, not directly, but this is kind of pointing out and using that framework to be able to identify where SMB can be utilized to leverage a system in the name of pen testing. And it's under adversary in the middle, and there's a lot of different techniques that we could use here, and you can look at the sub techniques, but inside of our actual cyber kill chain.

4:55This is where we start moving into exploitation and using the attack framework model to be able to go in and kind of do our research. We move into, we move from a step three, which is delivery on how we're going to weaponize to the target itself. How are we going to do it in this case, I'm going to pick metasploit. And then the exploitation is actually utilizing metasploit to be able to attack . So to our Cali box. Now we get to do stuff a little bit of fun stuff. We're going to hit start on our metasploit, Cali box and type in metasploit. You can see it come up here, metasploit framework.

5:34Now when it first opens up, there's two things that's going to happen. First, it's going to ask for your pseudo password. And then right after that, it's going to fire up its database. Now, if you've opened up metasploit already while the system is running, you'll be able to skip this part right here, but this could take a minute or two, depending on the type of system you have, resources allocated to it, and the depth of the actual database that you've updated or configured inside of your metasploit. Experiences may vary, but here we are inside of metasploit and we're going to start trying to leverage SMB attacks against the actual host system itself, based on our Nessus report that SMB signing is not required.

6:13Now there's a few steps that we're going to go through. And first one is understanding that inside of our metasploit database, we're going to be typing search. And I'm going to put these commands below to make sure that we are following along at home. And that way, I can verify my spelling as well to slash SMB. Now inside of this right here, we're just getting an idea of what different options metasploit has. Based on the database that's installed for SMB exploits that are preloaded inside of our system here. Now you can see that inside of our different options here that we have the actual address or yeah address would be a good way to say it when we start doing the use command of the different types of vulnerabilities that we can potentially exploit against the system.

7:06So if you're ever in need of being able to search for something inside of metas ploit, this is option number one. So now we're going to see if we can use one of these and I'm using a UX and tab bing so you can tab inside of metasploit. And I'm going to type in scanner. If I could spell correctly here SMB and then SMB underscore version. Now if I scroll up, I'm going to highlight right here pop out and zoom in for you. You see this number 12 on our options here.

7:41What is this going to do for us? Well, it's going to identify the actual versioning of the SMB that's being used on the target. And the target in this case is the actual host itself. So when we hit enter on this, you're going to see that our command line has changed from msf six to msf six auxiliary because now we have utilized an auxiliary command and subroutine. Now inside of here, I'm going to go show options. Oops, I wasn't inside the actual terminal or the VM type show options.

8:18And we can see here that where options are kind of limited. But more importantly, we're just paying attention to the R host. And that is what is the actual host that we're going to be doing this to. And that is the this system right here. Now if you'll remember, this is the kind of default gateway for our VM network. We're going to set our host to go to 192.168.247.1 and that's our our host. You can see right there, it has set the actual R host and making it to where that's our target. Now, as far as threads.

8:52I believe it current set current setting them one. And that's just basically how many times are how we're going to query the actual SMB of the target itself . Now, so we're just getting into the basics of how to do this. So now we're just going to simply type run. And it's going to run against the actual host system itself. And you could see that scanned one of one has completed at 100%. And right above that is our output.

9:22Now, this is telling us, if let me zoom in for you real quick, that we're utilizing SMB 3.1.1 on the actual system itself. So we have limited options on how we're going to exploit that. Now, why is all this important? Well, let me get down to it in that when we ran our Zen map slash in map and our vulnerability assessment inside of Nessus itself. We didn't really get a lot of information concerning the SMB versioning and information concerning the actual SMB protocol. All we got was is that SMB signing is not required and utilizing Metasploit to be able to scan that SMB in more detail tells us the exact type of SMB that we need to start leveraging for our exploitation step inside of the kill chain of the cyber kill chain.

10:18Sorry, I have a little bit of a stutter there. And later, we can start getting into more exploitative measures to be able to go to our next step of installation. And this allows us to be able to utilize information that we've gained so far to leverage, in this case, Metasploit, to go in and find ways to install tools and create back doors for our actual exploitation. Now, I do want to show you this for a second. Let me pop out and show you this right here. And if we go back into our meter attack framework model and we look at the adversary in the middle, which is going into our SMB relay exploitation here.

10:58Under our techniques, if we scroll down, we can go and look at procedure examples on how to actually go and leverage this particular vulnerability inside of the system itself and the different models and software suites that you can actually utilize as well. Now, right below that is some of the mitigation for this, which would actually help us out a little bit. You can see right here that we filter network traffic . That's always an option, but we can disable a remove feature program itself to, and we can even go in and configure to be able to non respond to that SMB version query to narrow down our options in the exploitation and installation portion of this.

11:38So where do we go from here. Now that I've properly figured out how to swap my screens here for a second, we move into command and control. And the reason that we move into that C2 aspect is to be able to understand that not only have we gained access to the particular system itself, but we've also gained command and control of that system to be able to give us administrative or elevated rights to that particular system. Because as a user, we may not have access to everything, especially like system files and all the like, but we have command and control to be able to gain access into that and potentially be able to pivot across the actual network itself.

12:16And this leads us into our final step of the kill chain model. And that is actions on objectives, and this is where we start to do extraction of data to be able to gain more access to start to all this over again into other systems as we pivot throughout the organization or different systems inside of a smaller network. So that's basically the ins and outs of that and how we utilize all three of these different models together if we want to.

12:47But overall, the meter attack framework is where we want to reference for more information if we ever get stuck like I do a lot.

0:00Alright everybody, we've come to the end of the skill and we're going to be doing a challenge together. Now this challenge is going to be less technical than what we're used to, especially in the courses that you've had with me together in the past, and that's okay because this one is more of a choose your own adventure and thinking about how we would actually exploit something to attack it, defend against it, and basically build our attack frame model around it. So I'm going to put up on the screen now. Earlier in the skill, we were taking a look at an vulnerability that was found on our Kali box.

0:32Now I have on the left of this the actual Nessus plugin that found it if you want to do a little bit of research on your own as well. This is Nessus plugin 5.1.1.9.2 that came up in one of our Nessus scans. And this is pertaining to an SSL certificate that cannot be trusted. Now the probability behind this is that it may be that the root CA certificate may not be in the trusted CA on the actual system itself. There could be a whole host of different reasons why this may be, but it is an exploit because somebody could potentially go in and attack the system based on that SSL certificate not being trusted.

1:13Now of course when we run our scans and find stuff like this, we have all the information on the system because we are already on the network and we have the information already from whether we run it through Nessus or we get the information of the system through something like ZenMap, nMap, or even Wireshark if we're sniffing the network. But in this particular challenge, it's going to be taking a look at the information that we have about this plugin and vulnerability on the system and deciding which framework we're going to be choosing.

1:46Now there is no wrong answer to this other than no answer at all. So this requires critical thinking on all of our parts to see what the preference actually is of the cybersecurity analyst that's going to be examining how to attack for the purposes of pen testing and better security. Now there are three that we covered in this entire skill and that would be the meter attack framework, the cyber kill chain and my favorite the dive and model. So I'm going to pop up on the screen real quick.

2:18Let's remember when we're using the meter attack framework that we can go through and have a step-by-step guide of how to actually go through and figure out how we're going to exploit or better protect against vulnerabilities such as the one found for this challenge. So as an example, if you're when you're in the reconnaissance step and you're doing your active scanning, it doesn't necessarily mean that you're done in the reconnaissance step. Now the same can be said in the actual cyber kill chain itself, which I have pulled up here on the side screen and I want you to note that whenever you go through each page of the cyber kill chain that is kind of like the meter attack framework except these are different preferences.

2:59And I'm going to come back to that in just a second as well because we also have the diamond model, which is still my favorite and we have more of a simplistic breakdown of how we would actually go through the different steps. Now if you'll notice here that we don't have the detailed sub steps or subcategories that are within the actual diamond model. This is just an overall guideline of which process step and the process that we are in for our attack framework.

3:30Now do you remember this is a choose your own adventure? So when we come back into the solution, I'll be taking a look at something that I won't prefer as far as going through and analyzing how we're actually going to possibly exploit the vulnerability found in the rest of the skill. So see you there.

0:00Alright, it's solution time. So let's take a look at what the actual problem was in our challenge and we have here our NESSIS scan, which we had a vulnerability identified on our Kali system for SSL certificate not being trusted. So let's go into how I would take a look at this and remember this is one of many possible solutions in this choose your own adventure. You at home may decide to go about this a different way, but I want to co and utilize one if not more of the attack framework models.

0:32Now of course, since I've been saying it from the beginning that the diamond model is my favorite, that's what I'm going to be utilizing when I start building out a plan on how to attack this vulnerability potentially attacked this vulnerability. And as you see here on the screen, I have the diamond model pulled up. Now, first thing I need to identify is who the victim is and that's down on the bottom and our number one step in the actual diamond model itself. Victim discovers compromise. That's we discover a compromise on the actual victim's system.

1:04And then we move on to actual number two, which is right in the middle of it. And it says logs exposed IP of the attacker. Now, throughout the process of this, we've been using Nessus to identify that vulnerability. So we have a lot of the machine information or target information already available to us, such as the system name IP address operating system, and also the CVSS scoring and all this other great information. So that's taken care of by number two. Number three of this would be the scene shows other network activity.

1:38So in this particular case, we would actually be looking at logs from other security systems placed within the network and seeing if this SSL vulnerability has been identified elsewhere for different connections, different parts of the network. If this particular system that we're looking at right now has been going out and trying to do other connections across the network. Now, this particular vulnerability is the SSL on the actual system itself. So in this particular instance, it would be more of a connection going to that particular Kali box and not necessarily back out.

2:16But that's diving deeper into the report that you get from the actual vulnerability assessment itself. Now, of course, inside the diamond model, we have a very rough overview of how we would actually take a look at the attack phase or pin testing phase of this vulnerability on our Kali system. So my preference would be to clear up some of that vagueness. I would actually be going to the meter attack framework . Just for me, that's not a correct answer to wrap everything up. That's just how I want to do.

2:47Now, taking a look at the meter attack framework here, we know that we're past the reconnaissance and kind of the resource development, we're actually into the initial access of what's actually going on for this vulnerability. We would look at the different techniques listed under the initial access and start going through and trying to get some more information on how we would actually exploit this vulnerability for the purposes of pin testing. And then from there, we would really start building out not only how we're going to get into the initial access, but also the execution , the persistence and privilege escalation, basically just following through the different steps of the meter attack framework.

3:27Now, again, I want to close this solution out by saying that this is just the way that I would do it. There is no wrong answer other than having no answer at all for this solution. And as a cybersecurity analyst, it's up to us to figure out how the different methods of being able to go through and do a security assessment with the vulnerability side being tested, how we're going to be able to put all this together to be able to patch up at the end of the day, and make sure that outside factors and all the different organizations that are against us aren't able to penetrate that vulnerability or even see it at all if that's the case.

4:09So again, personal preference in this or shooter's preference, as we used to say in the Army, and just keep in mind that it has to be within the guidelines of the organization within the SOP and or jurisdiction that you're in, because sometimes you may not be able to use the diamond model, because the preference of our organization could be that we only use the cyber kill chain. So I hope this has been informative for you, and I'd like to thank you for viewing.