DURATION: 2 DAYS
CAPACITY: 20 pax
SEATS AVAILABLE: N/A
EUR1899 (early bird)
EUR2599 (normal)
Early bird registration rate ends on the 28th of February
Overview
This is an immersive hands-on course that simulates a full-scale enterprise attack scenario. It allows
students to assess the situation at every stage of a complex multi-layered penetration test and
teaches them multiple ways to identify, enumerate, exploit and compromise an organisation.
Students will have access to a cloud-based LAB containing multiple networks, some of which are
hidden. The theory and exercise content reflect real-world encounters rather than text book
challenges and students will complete a vast number of exercises including everything from OSINT
and reconnaissance, to creating and executing phishing campaigns against our in-LAB live bots, all the
way through to post-exploitation, lateral movement and C2 exfiltration.
Each Student Will Receive:
We realise that 2-days is not a lot of time and therefore students are also provided with our hackpack to keep the learning going!
- 14-day extended LAB access after the course finishes
- Access to a new LAB subnet and CTF style board with challenges to further test your skills
- 14-day Slack support channel access where our security consultants are available
- A Raspberry Pi with Kali Linux pre-installed
- A portable wireless keyboard/mouse
- A hard copy of the RTFM
Key Learning Objectives
- Performing effective OSINT activities
- Identifying live hosts and services over IPv4 and IPv6
- IPv4/IPv6 enumeration and exploitation of targets from unauthenticated/authenticated
perspectives
- Cracking hashes from a variety of targets including Linux, Windows, DBs and password vaults
- Performing effective post exploitation attacks, enumeration and data gathering
- Creating and executing effective phishing campaigns
- Performing lateral movement and routing traffic to hidden networks
- Exploiting application weaknesses over tunnels, routed connections and shells
- Understanding how Active Directory trusts operate, are structed and can be abused
- Gaining persistence and exfiltrating data via out of band channels
- Understanding how defensive monitoring can be used to identify malicious activities
Who Should Attend
This training is suited to a variety of students, including:
- Penetration Testers
- Security Professionals
- IT Support, Administrative and Network Personnel
- Anyone looking to enter the world of technical security
Prerequisite Knowledge
- Familiarity with Windows and Linux command line syntax
- A basic understanding of networking concepts
Hardware / Software Requirements
- Students will need to bring a laptop to which they have administrative/root access, running
either Windows, Linux or Mac operating systems
- Students will need to have access to VNC, SSH and OpenVPN clients on their laptops
Agenda – Day 1
Introductions and LAB Overview
- Overview of the LAB, subnets, challenges and targets
- Introduction to infrastructure and application security assessments
- Introduction to monitoring and alerting using our in-LAB ELK stack
Leveraging OSINT Activities
- Data scraping: Certificate transparency logs, forums, social media, Shodan/Zoomeye, Google
dorks and publicly disclosed data breaches
- Extracting document metadata
Enumerating and Targeting IPv4 and IPv6 Hosts
- IPv4/IPv6 construction and addressing schemes
- ARP, ICMP, TCP, UDP
- Identifying local and remote IPv4/IPv6 hosts using tools and manual techniques
- Port scanning, service enumeration and fingerprinting using nmap and atk6 toolsets
- Using common tools including dirb, wpscan and Metasploit to target IPv6 hosts
- Parsing and interpreting scan output
Exposure to Vulnerability Assessment Toolsets
- Manual and automated approaches to vulnerability identification
- Options for infrastructure/web
- Differences in unauthenticated/authenticated scanning
- Limitations of vulnerability tools vs manual methods
Linux Enumeration
- Enumerating and targeting application servers
- Identifying and enumerating services including SSH, IMAP, SMTP, HTTP/S
- Using Metasploit, nmap scripts and public code
Linux Shells, Post Exploitation and Privilege Escalation (Covered in Days 1 and 2)
- Exploiting weak file/folder permissions, ownership, SUID, SGID and sudo configurations
- Hacking non-interactive shells and utilising binary breakouts/GTFOBins
- Permission misconfigurations
- Leveraging binary vulnerabilities to escalate privileges
- Using Metasploit, hydra, ncrack and LinEnum
P@ssw0rd Cracking (Linux)
- Shadow file construction, hashing and salting (bcrypt, SHAx, MD5)
- Online/offline attack differences, limitations and tool options
- Keyspace, attack types and pros/cons of each
- Utilising hashcat
Windows Enumeration
- Targeting SMB/LDAP for user enumeration
- Explaining differences in data enumerated from unauthenticated/authenticated perspectives
- User enumeration using recent Sensepost research (2018), built-in toolsets and nmap
scripting
Phishing
- Phishing campaign infrastructure (domains, SMTP, landing pages)
- Campaign creation and execution against in-LAB live bots
- Payload options and attacker motives
- Gaining access to OWA mailboxes and target hosts on different networks
Agenda – Day 2
Windows Shells, Post Exploitation and Privilege Escalation
- Authenticated local/network enumeration
- Local privilege escalation techniques
- Kerberoasting
- AMSI considerations and recent bypasses
- Leveraging PowerView, Metasploit, Unicorn, SharpSploit and GhostPack
- Extracting LAPS passwords
- Domain Pass-the-Hash (PtH) and local PtH limitations/workarounds
- Extracting clear-text passwords, tokens and LSA secrets
- RDP session hijacking (time dependant)
- Data exfiltration using PowerShell
- Leveraging Mimikatz
P@ssw0rd Cracking (Windows)
- Local and Active Directory storage
- LM/NTLM/NTLMv1/v2/cached creds/Kerberos
- Interactive/non-interactive challenge/response processes
- Further hashcat usage including rules and mask attacks
Defensive Monitoring
- Introduction to Kibana
- Investigating events e.g. Windows Defender shutdown, process spawning, task execution and
associated metadata
Overcoming Restrictions/Policies Within an Active Directory Environment
- AppLocker policies/configurations, PowerShell enumeration
- Leveraging publicly disclosed methods/code and tools (GreatSCT)
Situational Awareness, Lateral Movement and Pivoting
- Network segmentation, routing and ingress/egress controls
- Locating, enumerating and targeting hosts on different networks
- Metasploit routing and Meterpreter port forwarding
- SOCKS proxies and proxychains
- SSH tunnelling (Windows and Linux) for inter-network routing
- Targeting hosts using common tools over tunnels
- Mapping with Bloodhound
Application and Database Enumeration and Exploitation
- Web application enumeration and vulnerability identification over pivots/tunnels
- Web browser developer tools and BurpSuite
- Database structures and enumeration
- SQL 101 and different types of SQL injection
- Exploiting recent SQL injection vulnerabilities using manual techniques and sqlmap
- Database password hash cracking
Abusing domain trusts to compromise the enterprise
- Understanding Windows domain trusts
- Enumerating trusted domains using PowerView
- Leveraging Metasploit and built-in Windows functionality to enumerate target domains
- Further Mimikatz usage
Gain Persistence & Data Exfiltration Over OOB Channels
- Persistence mechanisms including registry, services, scheduled tasks, ADS
- Backdooring hosts to establish out-of-band persistent C2 channels out of an organisation
