University:
Campbell University
Course:
HSEC 444 | Cybersecurity
Academic year:

2024
Views:

39

Pages:

10
Author:

Leilani Contreras

Cyber Operations Section 8 – Lateral Movement and Pivoting 1 Lateral Movement and Pivoting ● Lateral movement, generically, is any “advancement” in the network that is not an “elevation”. ● If you are able to gain access to another computer or another account on the same computer, that’s lateral movement. ● PrivEsc to root or admin wouldn’t really be lateral movement. ● Think of “promotion” versus “lateral move” in a company’s org chart. 2 Lateral Movement and Pivoting ● Pivoting is specifically moving to different hosts in the network, and therefore a subset of lateral movement (although the two terms are often used interchangeably). ● Pivoting is what we will be focusing on now. ● The host where you obtain initial access is likely not the host where your goal resides. ● Also, if you stay still, you will get caught. We need to move! 3 Lateral Movement and Pivoting ● There’s no one “right way” to perform pivoting. Some examples are: ○ Obtaining a reverse shell on a system through an exploit ○ Pivot with credentials 4 Pivot Method 1: SSH ● SSH is a simple way to get around environments with Linux machines. ● It is occasionally found on Windows machines also, although this is less common. ● Most Linux servers will have SSH servers installed on port 22 and can be accessed this way. 5 Pivot Method 2: RDP ● RDP is not enabled by default, but you will often find it on Windows networks. ● It is on port 3389. 6 Pivot Method 3: Psexec ● This is a Sysinternals tool, which means it’s provided by Microsoft as a way to execute commands on Windows systems without a special client. ● How it works: 1. Drop a “service” executable on the Admin$ SMB share 2. Connect to the Service Control Manager (SCM) to create and run a service 7 Pivot Method 3: Psexec ● Requires: ○ 445/tcp (SMB) ○ Attacker must have creds for a user in the Administrators group. ○ Runs as SYSTEM because the service runs as SYSTEM 8 Pivot Method 3: Psexec Ways to use PsExec: 1) From Windows, use the Sysinternals tool (you’ll have to install it): ○ PsExec.exe \\X.X.X.X -u Administrator -p Password1 -i cmd.exe 2) From Kali (or Windows if you install Python), use Impacket: Remember, this could be “impacket-psexec” or just “psexec.py” 9 Pivot Method 3: Psexec Ways to use PsExec: 3) From Kali, you can also use Metasploit 10