Hands-on penetration testing on Windows : unleash Kali Linux, PowerShell, and Windows debugging tools for security testing and analysis / Phil Bramwell.

Format:

Book

Author/Creator:

Bramwell, Phil, author.

Language:

English

Subjects (All):

Microsoft Windows (Computer file).

Kali Linux.

Penetration testing (Computer security).

Physical Description:

1 online resource (452 pages)

Edition:

1st edition

Place of Publication:

Birmingham : Packt, 2018.

System Details:

text file

Summary:

Master the art of identifying vulnerabilities within the Windows OS and develop the desired solutions for it using Kali Linux. Key Features Identify the vulnerabilities in your system using Kali Linux 2018.02 Discover the art of exploiting Windows kernel drivers Get to know several bypassing techniques to gain control of your Windows environment Book Description Windows has always been the go-to platform for users around the globe to perform administration and ad hoc tasks, in settings that range from small offices to global enterprises, and this massive footprint makes securing Windows a unique challenge. This book will enable you to distinguish yourself to your clients. In this book, you'll learn advanced techniques to attack Windows environments from the indispensable toolkit that is Kali Linux. We'll work through core network hacking concepts and advanced Windows exploitation techniques, such as stack and heap overflows, precision heap spraying, and kernel exploitation, using coding principles that allow you to leverage powerful Python scripts and shellcode. We'll wrap up with post-exploitation strategies that enable you to go deeper and keep your access. Finally, we'll introduce kernel hacking fundamentals and fuzzing testing, so you can discover vulnerabilities and write custom exploits. By the end of this book, you'll be well-versed in identifying vulnerabilities within the Windows OS and developing the desired solutions for them. What you will learn Get to know advanced pen testing techniques with Kali Linux Gain an understanding of Kali Linux tools and methods from behind the scenes See how to use Kali Linux at an advanced level Understand the exploitation of Windows kernel drivers Understand advanced Windows concepts and protections, and how to bypass them using Kali Linux Discover Windows exploitation techniques, such as stack and heap overflows and kernel exploitation, through coding principles Who this book is for This book is for penetration testers, ethical hackers, and individuals breaking into the pentesting role after demonstrating an advanced skill in boot camps. Prior experience with Windows exploitation, Kali Linux, and some Windows debugging tools is necessary Downloading the example code for this book You can download the example code files for all Packt books you have purchased from your account at http://www.PacktPub.com. If you purchased this book elsewhere, you can visit http://www.PacktPub.com/support and register t...

Contents:

Cover

Title Page

Copyright and Credits

Dedication

Packt Upsell

Contributors

Table of Contents

Preface

Chapter 1: Bypassing Network Access Control

Technical requirements

Bypassing MAC filtering - considerations for the physical assessor

Configuring a Kali wireless access point to bypass MAC filtering

Design weaknesses - exploiting weak authentication mechanisms

Capturing captive portal authentication conversations in the clear

Layer-2 attacks against the network

Bypassing validation checks

Confirming the Organizationally Unique Identifier

Passive Operating system Fingerprinter

Spoofing the HTTP User-Agent

Breaking out of jail - masquerading the stack

Following the rules spoils the fun - suppressing normal TCP replies

Fabricating the handshake with Scapy and Python

Summary

Questions

Further reading

Chapter 2: Sniffing and Spoofing

Advanced Wireshark - going beyond simple captures

Passive wireless analysis

Targeting WLANs with the Aircrack-ng suite

WLAN analysis with Wireshark

Active network analysis with Wireshark

Advanced Ettercap - the man-in-the-middle Swiss Army Knife

Bridged sniffing and the malicious access point

Ettercap filters - fine-tuning your analysis

Killing connections with Ettercap filters

Getting better - spoofing with BetterCAP

ICMP redirection with BetterCAP

Chapter 3: Windows Passwords on the Network

Understanding Windows passwords

A crash course on hash algorithms

Password hashing methods in Windows

If it ends with 1404EE, then it's easy for me - understanding LM hash flaws

Authenticating over the network-a different game altogether

Capturing Windows passwords on the network.

A real-world pen test scenario - the chatty printer

Configuring our SMB listener

Authentication capture

Hash capture with LLMNR/NetBIOS NS spoofing

Let it rip - cracking Windows hashes

The two philosophies of password cracking

John the Ripper cracking with a wordlist

John the Ripper cracking with masking

Reviewing your progress with the show flag

Chapter 4: Advanced Network Attacks

Binary injection with BetterCAP proxy modules

The Ruby file injection proxy module - replace_file.rb

Creating the payload and connect-back listener with Metasploit

HTTP downgrading attacks with sslstrip

Removing the need for a certificate - HTTP downgrading

Understanding HSTS bypassing with DNS spoofing

HTTP downgrade attacks with BetterCAP ARP/DNS spoofing

The evil upgrade - attacking software update mechanisms

Exploring ISR Evilgrade

Configuring the payload and upgrade module

Spoofing ARP/DNS and injecting the payload

IPv6 for hackers

IPv6 addressing basics

Local IPv6 reconnaissance and the Neighbor Discovery Protocol

IPv6 man-in-the-middle - attacking your neighbors

Living in an IPv4 world - creating a local 4-to-6 proxy for your tools

Chapter 5: Cryptography and the Penetration Tester

Flipping the bit - integrity attacks against CBC algorithms

Block ciphers and modes of operation

Introducing block chaining

Setting up your bit-flipping lab

Manipulating the IV to generate predictable results

Flipping to root - privilege escalation via CBC bit-flipping

Sneaking your data in - hash length extension attacks

Setting up your hash attack lab

Understanding SHA-1's running state and compression function.

Data injection with the hash length extension attack

Busting the padding oracle with PadBuster

Interrogating the padding oracle

Decrypting a CBC block with PadBuster

Behind the scenes of the oracle padding attack

Chapter 6: Advanced Exploitation with Metasploit

How to get it right the first time - generating payloads

Installing Wine32 and Shellter

Payload generation goes solo - working with msfvenom

Creating nested payloads

Helter Skelter evading antivirus with Shellter

Modules - the bread and butter of Metasploit

Building a simple Metasploit auxiliary module

Efficiency and attack organization with Armitage

Getting familiar with your Armitage environment

Enumeration with Armitage

Exploitation made ridiculously simple with Armitage

A word about Armitage and the pen tester mentality

Social engineering attacks with Metasploit payloads

Creating a Trojan with Shellter

Preparing a malicious USB drive for Trojan delivery

Chapter 7: Stack and Heap Memory Management

An introduction to debugging

Understanding the stack

Understanding registers

Assembly language basics

Disassemblers, debuggers, and decompilers - oh my!

Getting cozy with the Linux command-line debugger - GDB

Stack smack - introducing buffer overflows

Examining the stack and registers during execution

Lilliputian concerns - understanding endianness

Introducing shellcoding

Hunting bytes that break shellcode

Generating shellcode with msfvenom

Grab your mittens, we're going a NOP sledding

Further Reading

Chapter 8: Windows Kernel Security

Kernel fundamentals - understanding how kernel attacks work.

Kernel attack vectors

The kernel's role as time cop

It's just a program

Pointing out the problem - pointer issues

Dereferencing pointers in C and assembly

Understanding NULL pointer dereferencing

The Win32k kernel-mode driver

Passing an error code as a pointer to xxxSendMessage()

Metasploit - exploring a Windows kernel exploit module

Practical kernel attacks with Kali

An introduction to privilege escalation

Escalating to SYSTEM on Windows 7 with Metasploit

Chapter 9: Weaponizing Python

Incorporating Python into your work

Why Python?

Getting cozy with Python in your Kali environment

Introducing Vim with Python syntax awareness

Python network analysis

Python modules for networking

Building a Python client

Building a Python server

Building a Python reverse shell script

Antimalware evasion in Python

Creating Windows executables of your Python scripts

Preparing your raw payload

Writing your payload retrieval and delivery in Python

Python and Scapy - a classy pair

Revisiting ARP poisoning with Python and Scapy

Chapter 10: Windows Shellcoding

Taking out the guesswork - heap spraying

Memory allocation - stack versus heap

Shellcode whac-a-mole - heap spraying fundamentals

Shellcode generation for the Java vulnerability

Creating the malicious website to exploit Java

Debugging Internet Explorer with WinDbg

Examining memory after spraying the heap

Fine-tuning your attack and getting a shell

Understanding Metasploit shellcode delivery

Encoder theory and techniques - what encoding is and isn't

Windows binary disassembly within Kali

Injection with Backdoor Factory.

Code injection fundamentals - fine-tuning with BDF

Trojan engineering with BDF and IDA

Chapter 11: Bypassing Protections with ROP

DEP and ASLR - the intentional and the unavoidable

Understanding DEP

Understanding ASLR

Testing DEP protection with WinDbg

Demonstrating ASLR on Kali Linux with C

Introducing return-oriented programming

Borrowing chunks and returning to libc - turning the code against itself

The basic unit of ROP - gadgets

Getting cozy with our tools - MSFrop and ROPgadget

Metasploit Framework's ROP tool - MSFrop

Your sophisticated ROP lab - ROPgadget

Creating our vulnerable C program without disabling protections

No PIE for you - compiling your vulnerable executable without ASLR hardening

Generating a ROP chain

Getting hands-on with the return-to-PLT attack

Extracting gadget information for building your payload

Finding the .bss address

Finding a pop pop ret structure

Finding addresses for system@plt and strcpy@plt functions

Finding target characters in memory with ROPgadget and Python

Go, go, gadget ROP chain - bringing it together for the exploit

Finding the offset to return with gdb

Writing the Python exploit

Chapter 12: Fuzzing Techniques

Network fuzzing - mutation fuzzing with Taof proxying

Configuring the Taof proxy to target the remote service

Fuzzing by proxy - generating legitimate traffic

Hands-on fuzzing with Kali and Python

Picking up where Taof left off with Python - fuzzing the vulnerable FTP server

The other side - fuzzing a vulnerable FTP client

Writing a bare-bones FTP fuzzer service in Python

Crashing the target with the Python fuzzer

Fuzzy registers - the low-level perspective.

Calculating the EIP offset with the Metasploit toolset.

Notes:

Includes bibliographical references.

Description based on print version record.

OCLC:

1080998873