Automated Effects Scripts

[rylagek]

Ensure effects platform is prepared:

• [x] install postgresql (sudo apt install postgresql)
• [x] ... and turn it on (sudo systemctl start postgresql.service)
• [x] install nmap (sudo apt install nmap)
• [x] launch msfconsole as kali and run (msfdb init)

Scripted effects via msf resource scripts or empire automation:

• [x] simple rat (meterpreter)
• [ ] ps rat (empire)
• [ ] AD sniffing w/ Bloodhound (empire)
• [x] portscan (msf) lateral movement file transfer

https://www.blackhillsinfosec.com/empire-bootstrapping-v2-pre-automate-things/ https://www.rapid7.com/blog/post/2010/03/22/automating-the-metasploit-console/ https://docs.rapid7.com/metasploit/resource-scripts/ https://www.javatpoint.com/generating-a-veil-backdoor https://github.com/Exploit-install/TheFatRat

[rylagek]

Resources included in default msf

[rylagek]

msf portscans aren't great. Using nc instead:

perl -e '@targets=0..254; foreach $target (@targets){`nc -zvvn 172.16.50.$target 1-50000 2>&1 | grep succeeded 1>&2`}'

[rylagek]

We have a port scan (Nmap). Need the 3 other effects

[rylagek]

    vsphere-iso.ubuntu: Run msfconsole to get started                                                                        
==> vsphere-iso.ubuntu: msfdb:287:in `block in ask_yn': undefined method `strip' for nil:NilClass (NoMethodError)            
==> vsphere-iso.ubuntu:         from msfdb:285:in `loop'                                                                     
==> vsphere-iso.ubuntu:         from msfdb:285:in `ask_yn'                                                                   
==> vsphere-iso.ubuntu:         from msfdb:985:in `prompt_for_component'                                                     
==> vsphere-iso.ubuntu:         from msfdb:1064:in `<main>'                                                                      
vsphere-iso.ubuntu: [?] Would you like to init the webservice? (Not Required) [no]:                                      
==> vsphere-iso.ubuntu: Provisioning step had errors: Running the cleanup provisioner, if present...                         
==> vsphere-iso.ubuntu: Clear boot order...                                                                                  
==> vsphere-iso.ubuntu: Power off VM...                                                                                      
==> vsphere-iso.ubuntu: Destroying VM...                                                                                     
==> vsphere-iso.ubuntu: Deleting cd_files image from remote datastore ...                                                    
Build 'vsphere-iso.ubuntu' errored after 56 minutes 13 seconds: Script exited with non-zero exit status: 1.Allowed exit codes are: [0]                                                                                                                                                                                                                                                 
==> Wait completed after 56 minutes 13 seconds                                                                                                                                                                                                            
==> Some builds didn't complete successfully and had errors:                                                                 
--> vsphere-iso.ubuntu: Script exited with non-zero exit status: 1.Allowed exit codes are: [0]          

[marissaeinhorn]

Pivoted to hydra RDP attack. In Windows event viewer, the logs for this brute force attack are in Applications and Services Logs/Microsoft/Windows/RemoteDesktopServices-RdpCoreTS/Operational Event ID 131 shows attackers ip and different RHPs for each connection attempt. If required to add additional logging reference

[marissaeinhorn]

Smb modules article - using smb_login brute force to find local admin creds

[marissaeinhorn]

Automating winrm stuff with python ex

[rylagek]

Data exfil from windows ideas

[marissaeinhorn]

DCO is hoping to have an appraisal and an ITM - looking to implement 2 separate attack chains. Also discuss with DCO team on whether to automate entire attack chain or keep each part as a discrete task