‫So up to now, we learned the exploitation concept and how to exploit systems using an exploitation
‫framework, Metasploit.
‫Now it's time to compromise the exploited systems and gather as much as we can.
‫So welcome to the post exploitation phase.
‫As I mentioned before, putting the reporting and the cleaning steps aside, a penetration test briefly
‫consist of four phases.
‫Reconnaissance is the act of gathering data on your target.
‫Scanning is defined more about the target gaps, vulnerabilities, weaknesses, et cetera.
‫Exploitation is to take control of the network devices.
‫And the purpose of the post exploitation phase is to determine the value of the machine compromised
‫and to maintain control of the machine for later use.
‫The value of the machine is determined by the sensitivity of the data stored on it and the machine's
‫usefulness in further compromising the network.
‫As you can imagine, by the definition of the post exploitation phase, the phases of a penetration
‫test are itor.
‫If you gather more in the post exploitation phase and you use the gathered information to find more
‫systems and to exploit other systems.
‫When you exploit other systems, you gather more in that systems post exploitation phases and you use
‫that information to hack more systems, et cetera, et cetera.
‫So we have now successfully compromised the target system.
‫Now what As I mentioned before, exploitation and post exploitation phases are the phases that separate
‫the penetration test from the ordinary vulnerability assessments.
‫The actions you can take in the post exploitation phase is limited to the contract you signed with a
‫customer before the penetration test.
‫So here are just a few examples of what you can do in this phase.
‫As you may remember, I mentioned before, all the sessions we create between the victim and us via
‫Metasploit Framework run in the memory.
‫That means the session dies when the victim's system is shut down or restarted.
‫Well, you can exploit the same vulnerability again.
‫But what of the vulnerabilities patched?
‫Or what if the signature of your payload is defined into the security measures database?
‫So what I want to say is we'd better have a persistent access to the victim machine.
‫Now, one of the very first things when we hack a system is collecting usernames and passwords or password
‫hashes from the system.
‫Crack the password to see how sufficient the institute's password policy is.
‫And of course, you're able to use that password for other accounts you encounter throughout the test
‫because of the human element.
‫Collecting sensitive data from the computer and the network is another critical point of post exploitation.
‫Really, you won't believe what you've gathered.
‫It's another common case to find some backups inside the computers, and these backups are, well,
‫they're sometimes accessible without an authentication step.
‫You think I'm kidding, but you learn and you will find.
‫So at the end of the post exploitation phase, you'll probably have a lot of data and credentials that
‫you are not authorized to have.