CCNA Domain Escalation and Persistence Questions

The ~/.ssh/authorized_keys file is the standard location for SSH public keys. By appending a public key to this file, an attacker can log in via SSH using the corresponding private key without needing a password. This is a common, reliable, and stealthy persistence method on Linux systems that allows for repeated, automated access to the compromised server throughout the duration of the test.

Persistence is often detected via common registry keys like Run or RunOnce. Using Windows Management Instrumentation (WMI) event subscriptions allows for persistence that is harder to detect. By creating an EventFilter and EventConsumer, an attacker can trigger a malicious script based on system events, such as a specific time or system uptime, bypassing traditional registry-based forensic analysis and providing a robust, fileless-like execution method.

Creating a systemd service unit is the most reliable method for ensuring a backdoor runs at system startup on modern Linux distributions. Systemd is the standard init system, and service units are executed automatically during boot. This method is persistent, can run with root privileges, and is less likely to be disabled by default than legacy mechanisms like rc.local or cron @reboot.

Indicators of persistence in Windows include unusual entries in startup folders, unrecognized services set to auto-start, and suspicious registry keys. Monitoring these areas is standard procedure for incident response and threat hunting. Detecting these markers early allows defenders to disrupt the attacker's ability to maintain access, effectively ending the persistence phase and forcing the attacker to re-establish a foothold, which increases the likelihood of detection.

A Golden Ticket is forged from the krbtgt hash and validated by the domain's Kerberos service until the krbtgt password is reset twice. This makes it resilient to Domain Admin password changes and reboots, and because it is generated on demand without a persistent binary, it is stealthier than account creation, new services, or ACL modifications. It directly satisfies the scenario's requirements.

Privilege escalation involves exploiting misconfigurations to gain higher access. Common vectors include exploiting SUID binaries, abusing SUDO rules that allow commands to run as root without passwords, and exploiting kernel vulnerabilities that allow arbitrary code execution in kernel mode. Understanding these vectors is crucial for identifying how an unprivileged user can transition to root and maintain control over the compromised Linux infrastructure.

Scheduled tasks are highly configurable, allowing attackers to define specific triggers, user contexts, and repeat intervals. They are natively supported by Windows and appear as legitimate tasks, making them appear less suspicious than custom registry modifications. The ability to run tasks as SYSTEM or as a specific user provides attackers with flexibility in executing their payloads while maintaining a low profile within the system's management tools.

SeDebugPrivilege is a powerful right that allows a user to attach to any process, including those running as SYSTEM. This privilege is instrumental in privilege escalation, as it allows for memory dumping of LSASS to extract credentials or the injection of malicious code into high-privilege processes. Identifying this privilege enables the tester to move from a standard user context to a full system-level compromise effectively.

The SUID (Set User ID) bit allows a file to execute with the permissions of the file owner rather than the user executing it. If an attacker identifies a SUID file owned by root, they can potentially manipulate the execution flow to gain a root shell. This is a primary target for privilege escalation, as it permits users to circumvent standard permission constraints during execution.

The Golden Ticket attack is a powerful persistence technique because it allows an attacker with the KRBTGT hash to forge TGTs for any user, including domain admins, without needing their passwords. This access persists until the KRBTGT password is changed twice, making it highly stealthy and long-lasting.

Leaving a backdoor account creates an unauthorized access path that persists after the engagement ends. This violates the principle of 'cleanup' and can lead to security breaches by third parties who discover the account. It represents a significant liability and risk for the client, as an unsecured backdoor account is a prime target for malicious actors looking to exploit the environment without further effort.

A Golden Ticket is a forged Kerberos TGT signed with the KRBTGT account's NTLM hash. This hash is the ultimate secret in a Kerberos realm; with it, an attacker can impersonate any user, including Domain Admins, and maintain access even after password changes. The KRBTGT hash is obtained by compromising a Domain Controller and extracting it from memory or the NTDS.dit file.

In this scenario, the KRBTGT password's extreme age means the hash is unlikely to be rotated soon. Since Golden Tickets remain valid until the KRBTGT password is changed twice, the attacker can maintain access for years, making this a highly effective and stealthy persistence method.

Persistence ensures that an attacker maintains access to a system even after reboots, credential changes, or other disruptions. This is achieved through various techniques like scheduled tasks, registry modifications, or backdoored services. Persistence is vital for long-term intelligence gathering and ensures that the attacker remains within the environment to pursue their objectives despite potential detection or system maintenance activities performed by legitimate users.