Blue Team Self-Inspection | Summary of Red Team Real-World Attack and Exploitation Techniques

To help the blue team better perform capability self-checks and improvements, SenXun Verification has comprehensively summarized and refined the practical attack and exploitation techniques in daily red team scenarios. Starting from different penetration phases, we have sorted out the techniques that may be used in each phase. We will discuss the tactics and techniques of each phase of the red team more comprehensively in subsequent articles. This article aims to serve as a summary overview that the blue team can use as a checklist to assess whether they have corresponding defensive measures or response plans for various behaviors in each phase of the red team. It is hoped that the blue team can better understand the various technical means adopted by the red team in offensive and defensive exercises through the following content, foresee potential threats in advance, improve the overall defense level, and build a more solid network security defense line.

▍Understanding the Red Team

1. The difference between red team scenarios and penetration testing: Red team attacks differ from traditional penetration testing in that they focus more on how to actually breach systems and gain access or achieve specific goals without being strictly limited by time, technology, and paths, which is closer to real intrusion activities.

2. Technical sorting and practical exploitation: We have detailed the techniques that may be used in different penetration phases, and pointed out that these techniques are often not used in isolation in actual operations, but are flexibly combined with each other for cyclic utilization. This indicates the high flexibility and complexity of red team attacks.

3. Defense strategies and challenges: In the face of red team attacks, defenders need to have rich practical confrontation experience and technical depth. Traditional tool-based defense methods are often difficult to work because attackers can easily modify or customize tools to bypass the detection rules of existing defense measures.

4. In-depth analysis and source defense: The blue team needs to conduct an in-depth analysis of each core attack technique and defend against it from the source. Although the short-term cost of this method is high, it is a more effective and lasting defense strategy in the long run.

5. Core capabilities of offensive and defensive personnel: As offensive and defensive personnel, mastering tools proficiently is only a very small part; more importantly is the deep understanding of various exploitation principles and the capability of secondary customization. This capability is the key for offensive and defensive personnel to remain invincible when facing complex and volatile attacks.

Red Team Attack Flow

▍01 Initial Access [Pre-reconnaissance]

Defense Importance Level: ★ This phase is the early stage of reconnaissance and gathering, so there is no need to focus on defense.

▶ Phase Attack Behaviors

• Bypass CDN to find all real IP ranges of the target

• Look for various Web management backend login portals of the target

• Batch crawl all real Class C Web banners of the target

• Batch perform basic service port scanning, detection, and identification on all real Class C ranges of the target

• Try whether the target DNS allows zone transfers; if not, continue with sub-domain brute-forcing

• Omitted 20 other methods, see the detailed report for details

▍02 Initial Access [Nday Vulnerability Exploitation]

Defense Importance Level: ★★★★ This phase is the focus of external defense, mainly targeting various known Nday vulnerabilities of mainstream "middleware + open source programs + Web service components" themselves. For the blue team, managing external exposure of the boundary and vulnerability management are the keys to defense in this attack phase.

The following are some relatively common "middleware", "open source programs", "boundary security products", and "office components" that can indeed effectively assist in quickly getting a shell in actual combat.

▶ Phase Attack Behaviors

1. Target various known Nday vulnerabilities of different Java middleware

Unlike other script-based Web programs, the execution privileges of Java are usually relatively high, and most of them even directly use root, administrator, or system privileges. Therefore, the shell privileges obtained are generally very high, usually directly server privileges. The red team generally prefers these points and uses them as a breakthrough to obtain a stable jump host entry privilege.

• Struts2

• WebLogic

• JBoss

• WildFly (JBoss 7.x)

• Omitted 10 types of middleware, see the detailed report for details

2. Target various Windows PHP integrated environments

Because obtaining Webshell privileges in such environments is relatively high, they are usually the preferred breakthrough point for red team members.

• AppServ

• Omitted 3 types of PHP, see the detailed report for details

3. Target known Nday vulnerabilities of various open source programs (Supply Chain Attacks)

• DedeCMS

• ThinkPHP 5.x

• PHPCMS

• Omitted 8 types of open source programs, see the detailed report for details

4. Target known Nday vulnerabilities of other Web office components (Supply Chain Attacks)

• Tongda OA

• Weaver OA

• Kingdee EAS

• Omitted 5 types of office components, see the detailed report for details

5. Target various exploits of boundary networks and security devices (Supply Chain Attacks)

• Pulse Secure VPN

• eSafeNet

• Fortinet VPN

• Omitted 3 types of security devices, see the detailed report for details

Common Attack Methods against All of the Above Vulnerability Exploitations

We have compiled data on the red team's attack methods during this phase over the years, listed in descending order of frequency of use:

• Injection

• Remote Code Execution

• Weak passwords for backends and databases

• Omitted 5 types of attack techniques, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Reduce exposure surface; patch vulnerabilities or upgrade software; achieve defense by optimizing the detection rules of WAF products or evaluate the applicability of RASP products in your company; enable real-time file detection of HIDS.

Medium and long-term recommendations: Increase privileged account management to improve identity security; add multi-factor authentication; strengthen the control of Internet access and download file detection, and strengthen threat file transmission detection in internal network traffic; deploy NIPS between various internal security zones to enhance detection and defense; do application isolation well.

▍03 Initial Access [Various Get-Shell Exploits Specifically Targeting Basic Service Ports]

Defense Importance Level: ★★★ The following are some services that can truly assist in quickly getting a shell in actual combat; other relatively marginal services are not mentioned. They have been sorted by the criteria of "difficulty of actual attack exploitation" and "level of shell privileges obtained".

▶ Commonly Scanned Ports

• Mssql: Defaults to tcp port 1433, weak passwords, sensitive account password leaks, privilege escalation, remote execution, backdoor implantation

• SMB: Defaults to tcp port 445, weak passwords, remote execution, backdoor implantation

• WMI: Defaults to tcp port 135, weak passwords, remote execution, backdoor implantation

• Omitted 20 types of commonly used ports, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Deploy NIPS between various internal security zones to enhance detection and defense. Medium and long-term recommendations: Fully deploy NTA (Network Traffic Analysis) products to enhance threat detection where budget permits.

▍04 Initial Access [Traditional Phishing Attack Exploits]

Defense Importance Level: ★★ Extremely frequently used in actual offensive and defensive exercises, involving various details. Social engineering methods have also been common attack methods in recent years. In addition to purely technical methods, on-site personnel attacks are now often carried out, so physical defense of the environment also needs to be strengthened.

▶ Phase Attack Behaviors

1. Preparation before sending emails

• Enumerate lists of valid target email usernames

• Batch detect weak passwords of target emails

• Forge the sender [Set up mail sending service]

Phishing emails, targeting different industries, are generally prepared in advance with various targeted email content templates to improve the actual success rate of sending.

2. Phishing email attack methods

Directly send various conventional Trojan attachments or phishing links to targets, and use them to obtain account passwords of various internal network systems, such as: OA, email, VPN, or knowledge base, etc.

• Office file macros

• Office file encryption

• Multiple compression of attachments

• Omitted 10 email attack methods, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Add local blacklist policies for email security gateways based on malicious file hashes; add local blacklist policies for email security gateways based on malicious link URLs; strengthen physical defense of office areas and data centers. Medium and long-term recommendations: Increase the integration of sandbox and email security gateway; strengthen control over Internet access and download file detection, and strengthen detection of threat file transmission in internal network traffic; strictly enforce password policies; integrate various application system logins with MFA; deploy NIPS between various internal security zones to enhance detection and defense; increase the frequency of phishing drills for all staff, and strengthen employee security awareness training.

▍05 Host Security [Privilege Escalation Exploits]

Defense Importance Level: ★★★★★ The following lists some common, stable, easy-to-use vulnerabilities and methods with high success rates

▶ Phase Attack Behaviors

1. Windows system vulnerabilities Local Privilege Escalation

The prerequisite for success is to ensure that various targeted antivirus bypass methods have been prepared in advance.

• BypassUAC [Win7/8/8.1/10]

• CVE-2021-36934

• CVE-2021-1732

• Omitted 5 high-risk vulnerabilities, see the detailed report for details

2. Linux kernel vulnerabilities Local Privilege Escalation [linux-exploit-suggester]

• CVE-2021-22555

• Omitted 3 high-risk vulnerabilities, see the detailed report for details

3. Leverage various third-party services/software tools for privilege escalation

• Mssql

• Oracle

• Mysql

• Omitted 5 types of third-party tools, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: For tools used, add local blacklist policies based on file hashes in endpoint/host security products, and monitor suspicious command execution; strengthen user privilege controls in systems; harden container systems, or upgrade images to patch vulnerabilities. Medium and long-term recommendations: Deploy privileged account management products to enhance detection and protection of identity information systems; evaluate integration between sandbox products and network security products; strengthen Internet access control and download file detection, and enhance threat file transmission detection in internal network traffic; if EDR is not yet deployed, it is recommended to use EDR-type security products to detect and defend against behaviors; execute strict CI/CD processes to reduce the probability of using images with known vulnerabilities.

▍06 Internal Network Security [Sensitive Information Gathering]

Defense Importance Level: ★★ After collecting internal network information, the general topology of the target internal network and the distribution of all critical business machines can be analyzed. Most of these sensitive information gathering operations are "weak signal" operations, and this section strictly limits the execution of various built-in system commands.

▶ Phase Attack Behaviors

1. Gather various sensitive information of the currently controlled "jump host"

Some of the following operations require administrative privileges to proceed normally.

• Check the current shell privileges and detailed system kernel version

• Get the detailed IP configuration of the current system, including domain, IP, mask, gateway, master and backup DNS IPs

• Get the recent user login records of the current system

• Omitted 25 types of information gathering methods, see the detailed report for details

Most of the above information gathering actions are based on system built-in tools and interfaces, so they can completely rely on EDR to capture various sensitive processes in real-time and report malicious operations. Batch capture all Windows machine names and the "domain"/"workgroup name" they belong to in the internal network (SMB detection scanning)

2. Batch crawl Web Banners within the internal network to obtain key target business systems as follows

• Various internal file [sharing] servers

• Various Web servers in the internal network [can be used to leave entries later]

• Omitted 14 types of information gathering methods, see the detailed report for details

3. Batch detection, identification, and exploitation of various known high-risk system RCE vulnerabilities

• CVE-2021-34527

• Omitted 3 high-risk vulnerabilities, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Monitor suspicious command execution; target various high-risk and sensitive service positioning in the internal network, and perform "safe" port scanning (conducting various routine service detections and identifications while avoiding defenses triggering alerts and blocks); for the above routine internal network detection scans, there will be very clear indications in traffic. By deploying probes on key node devices/servers to collect traffic and combining with big data correlation analysis to search for various sensitive characteristics, it can help find traces of various scanning and detection activities. Medium and long-term recommendations: If EDR has not been deployed yet, it is recommended to use EDR-class security products to detect and defend against their behavior; under favorable conditions, strengthen terminal/host log auditing to monitor and alert suspicious command execution behaviors during this attack in the SIEM system; by thoroughly analyzing some typical traffic characteristics and system logs generated by each vulnerability in the actual attack exploitation process, such vulnerabilities can be identified.

▍07 Internal Network Security ["Gathering" and "Stealing" of Various Sensitive Credentials]

Defense Importance Level: ★★★★

▶ Phase Attack Behaviors

1. Active Password Gathering

Some of the following operations require administrative privileges to proceed normally.

• Batch capture "various accounts and passwords stored in the configuration files of various basic services" on the current machine

• Find ways to "control the single machines of target operation & maintenance or technical personnel, and collect account and password tables that may contain various sensitive network assets from these machines"

• Extract various "database connection accounts and passwords saved in database client tools"

• Omitted 15 types of information gathering methods, see the detailed report for details

2. Passive Password Gathering [Defense Focus]

Some of the following operations require administrative privileges to proceed normally.

• Windows SSP [Persistence/Memory]

• Hook PasswordChangeNotify [Persistence/Memory]

• OWA login account and password interception

• Omitted 5 types of information gathering methods, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Add privileged account management products to enhance detection and protection of identity information systems; add AD security products and privileged account management products to enhance detection and protection of identity information systems; strengthen log auditing of terminals/hosts to monitor and alert suspicious command execution behaviors during this attack in the SIEM system; under favorable conditions, strengthen log auditing of terminals/hosts, and add behavior correlation analysis based on various dimensions in the SOC to supplement undetected attacks that existing single-point defense products might not deem harmful.

▍08 Internal Network Security [Internal Network Common "Tunneling" / "Forwarding" / "Proxy" / "Penetration" Techniques]

Defense Importance Level: ★★★ To avoid traffic analysis of various detection devices as much as possible, the red team will adopt various methods to encrypt transmission traffic for many of these tools to ensure stronger penetrability.

▶ Phase Attack Behaviors

• Outbound traffic probing: HTTP, DNS, and some TCP ports with relatively good penetrability. This operation is usually combined with WMI, SMB, and SSH remote execution to quickly identify machines in the internal network that can access the Internet in batches

• Conventional HTTP script proxies: abptts, Neo-reGeorg, reGeorg, tunna, reDuh. Public scripts generally have issues in actual combat, and the red team will deeply improve them according to their actual target environment

• Omitted 6 types of penetration methods, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Deploy NIPS between various internal security zones to enhance detection and defense. Medium and long-term recommendations: Enhance ICMP, DNS, and Socks communication detection on the Internet boundary and between internal security zones through network traffic analysis (NTA) products; proxy all outbound traffic of the internal network through SSL decryption devices, decrypt all traffic, and submit decrypted traffic to detection devices such as NTA and IPS for detection.

▍09 Internal Network Security [Domain Common Attack Techniques (Domain Penetration)]

Defense Importance Level: ★★★★ Generally, information gathering within the domain is mostly a "weak signal" behavior, meaning normal users might also execute these actions. Therefore, checking and auditing these behaviors individually becomes impractical. The domain information gathering methods commonly used by the red team are as follows:

▶ Phase Attack Behaviors

1. Conventional Information Gathering for the Current Domain

In reality, the red team only needs BloodHound & Pingcastle with bypass evasion prepared in advance.

• Obtain the complete domain admin list in the current domain

• Obtain the list of all domain controller machine names in the current domain

• Obtain the list of all DNS server machine names in the current domain

• Omitted 8 types of information gathering methods, see the detailed report for details

2. Conventional Techniques to Quickly Gain Target Domain Controller Privileges

• Collect GPP directories, which may contain domain account passwords, not just those in XMLs, some scripts in the NETLOGON directory may also contain accounts and passwords

• Service ticket hash cracking ("especially for domain admin users") [Kerberoasting]

• Batch try single passwords on domain users [Spraying, utilizing ADSI interface, log ID 4771]

• Omitted 9 types of domain privilege acquisition methods, see the detailed report for details

3. Post-Exploitation Sensitive Information Gathering and Analysis within Domain

• Obtain all DNS records

• Export the complete LDAP database of the current domain

• Extract the ntds.dit of the current domain [Domain account password database]

4. Target User Login IP Positioning within Domain

• Utilize OWA login logs

• Utilize domain controller server login logs

• Designated Service Silver Ticket [Silver Ticket]

5. Targeted Control Techniques for Domain Designated User Machines

• Bind user login scripts

• Utilize GPO distribution

• PTT [Pass-the-Ticket]

6. Various Privilege Maintenance Techniques Targeting Domain Admins

• Golden Ticket

• Skeleton Key

• DSRM Password Sync

• OWA Backdoor

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Add blacklists based on file hashes in security defense products like antivirus or EDR, or alert on suspicious command execution behaviors. Medium and long-term recommendations: Add privileged account management products to enhance detection and protection of identity information systems; add AD security products and privileged account management products to enhance detection and protection of identity information systems; strengthen log auditing of terminals/hosts to monitor and alert suspicious command execution behaviors during this attack in the SIEM system; under favorable conditions, strengthen log auditing of terminals/hosts, and add behavior correlation analysis based on various dimensions in the SOC to supplement undetected attacks that existing single-point defense products might not deem harmful.

▍10 Internal Network Security [Cross-Platform Lateral Movement (Remote Execution)]

Defense Importance Level: ★★★ Generally, after understanding the internal network environment and target area, lateral movement behaviors toward the target area will be attempted. The red team will use some scheduled tasks and remote execution technologies to achieve this goal.

▶ Phase Attack Behaviors

1. Lateral Movement from Windows Platform to Windows Platform

Some of the following remote execution methods can directly use plaintext accounts and passwords, or can be carried out based on PtH (Pass-the-Hash).

• Remote Service Management [SCM]

• Remotely create and execute scheduled tasks [Scheduled Tasks]

• WMI remote execution [WMI]

• Omitted 9 lateral movement methods, see the detailed report for details

2. Lateral Movement from Windows Platform to Linux Platform

plink or develop various remote execution tools based on Windows SSH libraries.

3. Lateral Movement from Linux Platform to Windows Platform

Generally, the commonly used Python scripts in the Impacket suite will be packaged directly into executable files in advance, and then dropped onto the target Linux system for execution. In addition, there are some Go-based tools, which can also be compiled into executable files and dropped for execution.

4. Lateral Movement from Linux Platform to Linux Platform

Linux's native SSH client utility suite can be used for remote execution by default.

5. Various Remote Download Techniques

6. Deprecated Methods

The following built-in system remote download and execution tools will definitely be blocked in some antivirus environments, so the red team will basically abandon them:

• CertUtil.exe

• Bitsadmin.exe

• Regsvr32.exe

• Rundll32.exe

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Strengthen user privilege control for files and directories within the system; strengthen user privilege controls such as installing, uninstalling, executing software, executing scripts, and modifying registries in the system. Medium and long-term recommendations: Increase privileged account management to improve identity security; add multi-factor authentication; strengthen control over Internet access and download file detection, and strengthen detection of threat file transmission in internal network traffic; deploy NIPS between various internal security zones to enhance detection and defense; do application isolation well; if EDR security products are not yet used, it is recommended to evaluate and select EDR products to increase behavior-based analysis, detection, and blocking capabilities; strengthen log auditing of terminals to monitor and alert behaviors during this attack in the SIEM system.

▍11 Internal Network Security [Persistence]

Defense Importance Level: ★★★★

▶ Phase Attack Behaviors

1. Boundary Entry Privilege Maintenance

• OWA login portal [account password, webshell]

• VPN login portal [account password, shell]

• Omitted 3 types of privilege maintenance methods, see the detailed report for details

2. Windows Single Host System Maintenance [Temporary]

• System Scheduled Tasks [High privilege/Low privilege]

• Conventional Registry Autorun keys [User privilege/System privilege]

• MSSQL Stored Procedures [Inherited service privilege]

• Omitted 7 types of privilege maintenance methods, see the detailed report for details

3. Linux Single Host System Maintenance [Temporary]

• Patch SSH

• Replace various basic service shared objects (PAM, Nginx, Rsync, etc.)

• Omitted 3 types of privilege maintenance methods, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Strengthen user privilege control within the system; monitor suspicious command execution; do access control of each security zone in the environment well; strengthen user privilege controls such as installing, uninstalling, executing software, and modifying the registry in the system. Medium and long-term recommendations: Strengthen control over Internet access and download file detection, and strengthen detection of threat file transmission in internal network traffic; add multi-factor authentication products and privileged account management products to enhance detection and protection of identity information systems; if EDR or HIDS is not yet deployed, it is recommended to use EDR or HIDS security products to detect and defend against behaviors; under favorable conditions, strengthen log auditing of terminals/hosts to monitor and alert suspicious command execution behaviors during this attack in the SIEM system; do data backup well and often practice data recovery.

▍12 Clearing Traces

• Web logs [access, error logs]

• Database logs [abnormal connection logs, slow query logs]

• Omitted 3 types of clearing traces methods, see the detailed report for details

▶ Protective Measures and Mitigation Recommendations

Short-term recommendations: Strengthen user privilege control for files and directories within the system; strengthen user privilege controls such as installing, uninstalling, executing software, modifying the registry in the system, as well as executing PowerShell, etc. Medium and long-term recommendations: If EDR has not been deployed yet, it is recommended to use EDR-class security products to detect and defend against their behavior; under favorable conditions, strengthen log auditing of terminals/hosts to monitor and alert suspicious command execution behaviors during this attack in the SIEM system.

▍13 Supplement

1. Various Common C&C/Penetration Frameworks

• Cobalt Strike [Secondary Development]

  • Payload (beacon) reverse engineering/improved rewriting

• Metasploit [Secondary Development]

2. Various Common Webshell Management Tools

• Behinder_v4.0

• AntSword_v2.1

• Godzilla v4.0

3. Antivirus Bypass and Various Firewall Evasions

Static

Obfuscation:

• Manual obfuscation: When source code is available, try to replace namespace names, function names, variable names, strings, etc., which might be key signature strings one by one

• Tool obfuscation: Professional obfuscation tools for various languages, commercial versions available

Packing:

• Some commonly used public packers, commercial packers have better effects

• The red team might try to write packers themselves, which is costly but effective

Dynamic

Reflection:

Shellcode memory encryption/decryption execution, some antivirus software can block the final call

Traffic:

• Domain Fronting [Utilizing major vendors' CDN]

• DNS Encrypted Tunnel

• Omitted 4 types of antivirus bypass methods, see the detailed report for details

▍14 Summary

In the analysis and deployment process of the entire attack chain, the blue team needs to comprehensively respond to attack methods at all stages, and can no longer focus solely on boundary defense. Current offensive and defensive exercises introduce a clear bleeding score mechanism, requiring the blue team to take more proactive defensive measures in the destruction and impact stages. This mechanism is closer to actual hacker attacks, requiring the blue team not only to stop at the surface when responding to attacks, but to deeply analyze and handle each phase of the attack.

First, the blue team needs to comprehensively analyze the attack chain, from initial intrusion and vulnerability exploitation to lateral movement and data exfiltration, to identify attack methods at each stage. Second, strengthen internal defense, prevent attackers from running amok in the internal network by monitoring internal traffic, detecting anomalous behavior, and rapidly responding. The introduction of the bleeding score mechanism means attackers will continue to score during successful intrusion and maintaining control; the blue team must quickly detect and block these behaviors to prevent scores from accumulating. In addition, the blue team needs to rapidly isolate infected systems, restore disrupted services and data, and reduce impact on business during the destruction and impact stages. The establishment of real-time monitoring and response mechanisms can timely detect and cope with latent attack activities, preventing attackers from lurking in systems for a long time. SenXun Verification can perform scenario-based simulations across the entire attack chain, including final destructive attacks. By converting first-hand victim intelligence into attack libraries and scenarios, SenXun Verification provides the blue team with comprehensive defense capability validation and response strategies, helping users elevate their overall defense system capabilities.