All right, welcome back on this lecture, we are going to map everything against attack, a major attack
matrix, which is a vocabulary for basically understanding attackers techniques and procedures.
Let's go ahead and look at the enterprise matrix.
This is a vernacular that every cybersecurity hopeful or expert needs to understand that it would do
you well to actually read through these techniques.
But how do we get access to the box?
I do remember well, it started with the SharePoint site, right.
And there were really just clear text credentials that were sitting around on the SharePoint site.
So we choose valid accounts to get there.
Right, without accounts, which is a valid FTP credentials to FTP in the box.
And then once we stepped in, we were able to look around and we found a password vault, where did
I go?
And then from there we got more ballot accounts than we cracked that.
And then we were able to get to the share of the file share, which included a binary which had clear
text credentials hard coded into that binary.
So that's something to keep in mind.
If you're a developer, you never want to include your clear text credentials inside of a binary executable
because it can always be pulled out.
And for execution, we used util, which is a living off the land binary.
I think that's under command and scripting interpreter.
Let's see if it is certainly to actually let's just go this way, sir.
You tell the search, you tell my lighter and let's see Ingress Tool's music downforce from a given
you earlier to ingress to all transfer is the technical term.
This is under command and control, command and control, ingress, tool transfer.
That's what we use to download files
to our system and to the system so we can go up.
So this right here is the miter attack ingress tool transfer, where we use certain detail to download
Hepcat on to the target system.
From there we got a reversal and we were able to elevate using GC potatoe and that would be underprivileged
escalation, privilege, escalation.
Where is that?
Access to clean manipulation was a technique we use in escalation, and this is where we basically used
a juicy potato, we created the process with the tokin and we were able to achieve as he would impersonate.
Right.
So this is straight out of the miter playbook.
And here's the mitigations.
You can scroll down.
You can see these are some things you could do to limit an attacker like me from doing this in your
environment.
And you'd go down further and see, you know, how you can detect this.
We already kind of looked at that in the event log A, it doesn't actually include the detection that
we we saw for Florian Roth in the signal role here.
But it's good to, you know, basically search for Miter and sigma when you want to look at detections,
references down below.
So that is it.
I hope you enjoyed this lecture.
There's a lot here.
You know, make sure you carefully go through it.
You understand what we're doing and, you know, continue to continue to learn and to continue to be
awesome.
All right.
Bye.