create account

RE: Covering Tracks on Windows - Link Dump by pwnedu

View this thread on: hive.blogpeakd.comecency.com

Viewing a response to: @zeronumbers/re-pwnedu-covering-tracks-on-windows-link-dump-20170903t230908500z

· @pwnedu ·
$0.36
Tails is great, but this is in reference to post exploitation on a windows device. Being anonymous and covering your tracks are related, but still very different. Just because you are attacking from tails does not mean that you will not leave indications of compromise.
👍  , , , , , , ,
properties (23)
authorpwnedu
permlinkre-zeronumbers-201793t192656958z
categoryhacking
json_metadata{"tags":"hacking","app":"esteem/1.4.6","format":"markdown+html","community":"esteem"}
created2017-09-04 00:26:57
last_update2017-09-04 00:26:57
depth2
children2
last_payout2017-09-11 00:26:57
cashout_time1969-12-31 23:59:59
total_payout_value0.344 HBD
curator_payout_value0.011 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length269
author_reputation38,394,115,304
root_title"Covering Tracks on Windows - Link Dump"
beneficiaries
0.
accountesteemapp
weight500
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id13,794,137
net_rshares104,599,487,660
author_curate_reward""
vote details (8)
@zeronumbers ·
Can you explain this more?
properties (22)
authorzeronumbers
permlinkre-pwnedu-re-zeronumbers-201793t192656958z-20170904t003212523z
categoryhacking
json_metadata{"tags":["hacking"],"app":"steemit/0.1"}
created2017-09-04 00:33:00
last_update2017-09-04 00:33:00
depth3
children1
last_payout2017-09-11 00:33:00
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length26
author_reputation1,085,940,622,400
root_title"Covering Tracks on Windows - Link Dump"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id13,794,449
net_rshares0
@pwnedu ·
Certainly!
Notice the part that says "slows blue team detection." 
Imagine that you have been hired as a penetration tester by some big company. This company not only wants to know if their systems can be compromised, but if their systems CAN be compromised, they also want to test the effectiveness of their incident response team. In your pentest, your goal is to get to their internal file server, but you have only managed to gain access to a rogue mail server set up by a lazy employee. You plan to use the mailserver to pivot into the file server, but you want to make sure that their IR team doesnt notice you using the system. Once you gain access to the file server, maybe you dont want them knowing that you you were attacking from the mail server. Ideally, you cover your tracks after every compromise, and before you leave the system. Then the IR team will never have an opportunity to even know they have been attacked. If the attack is detected, the goal is for forensics to not be able to build a timeline of the attack.
properties (22)
authorpwnedu
permlinkre-zeronumbers-201793t195413972z
categoryhacking
json_metadata{"tags":"hacking","app":"esteem/1.4.6","format":"markdown+html","community":"esteem"}
created2017-09-04 00:54:15
last_update2017-09-04 00:54:15
depth4
children0
last_payout2017-09-11 00:54:15
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length1,035
author_reputation38,394,115,304
root_title"Covering Tracks on Windows - Link Dump"
beneficiaries
0.
accountesteemapp
weight500
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id13,795,600
net_rshares0