Post Exploitation: Striking Gold with Covert Recon

### Overview In this presentation, the speaker explores stealthy post-exploitation reconnaissance techniques, cautioning offensive security professionals against noisy, default actions such as immediately running Nmap upon gaining a foothold. Grounded in a systems administration background, the speaker advocates for adopting a "packet economy" mindset—minimizing network packets and blending in with standard user behaviors to avoid alerting blue teams and anomaly detection systems.

### Key Topics - **Packet Economy and Avoiding Noisy Scanning:** Why relying immediately on tools like Nmap, full port scans, or heavy VM installations gives away an attacker's presence, and why testing detection monitoring requires discreet behavior. - **Mimicking Normal User Activity:** Understanding normal operational hours, system local time, and baseline tools so post-exploitation activity does not stand out as anomalous. - **Passive Network and Host Discovery:** Utilizing existing host artifacts—such as DNS caches, ARP tables, and mounted remote file systems—to map architecture and vendors without transmitting excessive traffic. - **Internal OSINT and Data Mining:** Extracting metadata from internal documents (using concepts behind tools like FOCA and PowerMeta) and hunting credentials across logs, shell histories, and scripts. - **Cloud Post-Exploitation Hygiene:** Caution regarding cloud metadata endpoints and API logging, advocating for checking scripts and cron jobs before making direct API calls. - **Purposeful Escalation of Noise:** Transitioning from stealthy reconnaissance to intentionally raising noise levels once objectives are met in order to test and improve defensive detection capabilities.

### Technical Details - **Activity Baseline Analysis:** Checking local system time, update/application logs (e.g., yum, apt, crontabs), and authentication records to pinpoint manual user interaction versus automated cron tasks. Application logs also reveal server usage peaks. - **Host Footprinting via Built-in State:** Reading DNS caches to discover hostnames and domain naming conventions. Querying ARP tables (`arp -a`) exposes MAC addresses, allowing identification of hardware vendors (e.g., Cisco, Juniper) or hypervisors like VMware to detect virtualized/sandbox environments without slinging packets. - **Credential Harvesting Artifacts:** Examining developer/debug logs for leaked credentials or failed password entries typed into username fields (such as seasonal passwords like `summer2019!`), reviewing `.bash_history` for passwords or S3 bucket references, and inspecting unencrypted SSH keys, `known_hosts`, and SSH config aliases to map pivoting paths. - **Mounted File Systems and Query Methods:** Exploiting remote mounts (NFS, SMB via `mount` or `/etc/fstab`) to inspect remote systems without triggering active network inspection. On Linux, tools like `netstat`, `lsof`, and `ss` query network state differently (`proc` filesystem vs. direct kernel system calls), providing different operational visibility.

### Takeaways Covert reconnaissance centers on patience, gathering context before acting, and looking for "permission" within the environment before running commands like Windows `net` utilities or specialized offensive tools. Offensive operators should conserve network packets, leverage built-in OS artifacts to infer network architecture, and throttle file downloads or search scripts. Finally, after silently meeting objectives, operators should systematically ratchet up their noise profile to help defenders benchmark their monitoring and response controls.