Instructions

After collecting enough information about the target during Deliverable 2 (Reconnaissance and Scanning Plan), you will describe how to use that information to gain access to Haverbrook’s systems. Your one- to two-page plan on gaining access should include:

details of the gaining access process in regards to the techniques commonly used to exploit low-privileged user accounts by cracking passwords through techniques such as brute-forcing, password guessing, and social engineering, and then escalate the account privileges to administrative levels, to perform a protected operation.

an implementation outline of any software that will be used in gaining access to the network(s) or system(s) You may include open source and commercial tools available to execute the actual exploit: Burp Suite, Cain and Abel, Core Impact, John the Ripper, Metasploit, and others. You can also use some programming languages, such as Javascript, Perl, Python, Ruby, or C++, if you choose to develop custom exploits.

As you are developing the Gaining Access Plan, keep these questions in mind:

How would you escalate your privileges?

How would you establish a command and control communication channel?

Penetration Test Proposal

Deliverable 3: Gaining Access Plan

Name:

Course Number and Section:

Instructor:

Date:

Gaining Access

Overview

Provide a summary of the Gaining Access phase.

Vulnerable Resources

Identify the resources where vulnerabilities can be located and include a brief description of those resources. Be sure to include a reference to the vulnerability, i.e., NVD.

Techniques and Software

Provide the techniques and any software, applications, or scripts that will be used in gaining access to the network(s) or system(s) along with a description of each technique. Refer to Chapter 6 in the textbook for additional information.

References

Penetration

Test Proposal
Deliverable 2: Topic

Name:

Course Number and Section:

Instructor:

Date:

Topic

Overview

Privilege Escalation is a threat vector which permits hackers to enter into the infrastructure of organizations to gain access to sensitive information and steal from organizations.

Scope

Privilege escalation becomes easy when organizations do not have an adequate security system to keep hackers from entering into their systems easily.

Privileges can be escalated using the following techniques

Checklist

Access token handling: In this technique Hackers can gain access tokens by stealing them, creating process with them or by making and impersonating them. By the use of Duplicate Token(Ex), a new token can be created that can duplicate an already existing token.

Bypassing the user access control: The UAC (User Account Control) often has security gaps and if the protection level is not set to the highest level, hackers can often gain access to personal information.

Valid Accounts:

Users can hack into various systems and gain access to valid user accounts which helps them look authorized users on the internet, through these valid accounts they can contact companies and ask for confidential information without being detected.

Ethical Considerations

I would establish my command and control communication channel by choosing from connection proxy, data encoding, commonly used port, multi-hip proxy, data obfuscation or fallback channels. My first choice would be connection proxy because it evades any direct connection that could link me to my infrastructure. It also helps in building trusted communications by riding over existing paths that sidestep doubt between targets.

References

Banach, Z. (2019, August 2). What Is Privilege Escalation and Why Is It Important? Retrieved February 20, 2020, from https://www.netsparker.com/blog/web-security/privilege-escalation/

.