And one more thing I want to do before we completely wrap this, I just wanted to map this attack to
the bioterror attack.
Framework, right?
So we gained initial access and we did that actually through a couple of ways.
One developed accounts, right?
Remember, we found a valid credentials for the defector user and we were also able to, you know,
get those credentials to log in.
But we also the main the main method of getting those credentials was through exploiting a public facing
application.
Right.
You see here every type of skill.
You'll see the sequel injection is in here.
So this happens a lot, a lot of groups use sequel injection to compromise systems.
Yeah, this is still an old school technique that still works in many ways and we use to map as well.
But we did a lot of manual exploitation.
So that's the initial access piece execution.
We didn't really execute me malware or do any persistence before privilege escalation.
We did use valid accounts.
Right.
Which can make it relatively difficult to discover.
Right, and we didn't really modify a system process, we modified the registry value, so these two
things aren't a perfect mapping, but we did use valid accounts for escalation here.
And so that's something you would also want to check out.
Now, defensive Asian didn't have to worry about that because Aviva's was disabled credential access.
You know, as far as that's concerned, you know, you didn't really do anything specific there, but
for lateral movement.
We used the which is valid, a valid account for lateral movement, so I'm not sure why it doesn't show
that here within the collection for command and control.
Again, we didn't institute any malware, so we weren't really controlling the application of that way.
But for exfiltration, we did exfiltrate over a Web service.
Right.
Which is expatriated through the sequel injection Attack Vector.
Which is common because, you know, web stuff usually is it can just blend in with the noise when you
do it that way.
And lastly, in terms of impact, of course, we can we could account access removal.
We had access to a hectors account.
We got deleted it.
We could destroy data, you know, be very easy to deface the website since we had access to the directory.
You know, we could completely deny service to that box, stop all the services and shut down the server,
right.
We own the box completely.
So that's just a rough mapping to Miter.
And I hope that brings things into perspective.
You know, make sure that, you know, this could have been prevented if the server was properly not
not patched specifically, but if the Web application was properly sanitizing the right fields, right,
SQL injection would have been possible.
And on top of that, it also would have helped if the Web application developers weren't using access
control through custom headers.
Right.
You know, you don't need custom headers to get to restrict access to the application because those
headers can be fuzzed, which is what we did to gain access, unauthorized access to the target app.
All right.
That's all.
And I hope you enjoyed this lecture.
All right.