Ethical Hacking and Penetration Testing Guide

Mapping the Internal Network
The attacker has compromised a host on the target network, escalated the privileges, installed 
a backdoor on the target machine, and harvested important data. What’s left is to discover 
other hosts on the internal network so that he can exploit them and penetrate the network 
further.
We would use armitage for this exercise as it makes the postexploitation process, especially 
“pivoting,” easier for us. We can do the same from Metasploit but for the sake of simplicity and 
demonstration, I will use Armitage.
So we will assume another scenario where we have already compromised a box on the target 
network with SYSTEM privileges having an IP 172.16.222.156.

---

264
◾ 
Ethical Hacking and Penetration Testing Guide
Finding Network Information
Our first step would be to take a note of things such as the IP address and the default gateway 
of the target. We can do that with the 
ipconfig
command in Windows and the 
ifconfig
command in Linux.
Since here we have compromised a Windows machine on the network, we will use the 
ipconfig
command to display the information about the network interface card.
We can also use the “
route print
” command to view information about the routing table. 
The same command works for Linux too.

---

Postexploitation
◾ 
265
So in this case we come to know that the subnet mask of the victim is 255.255.255.0 and the 
default gateway is 172.16.222.2. This information would be useful when we proceed to the next steps.
Identifying Further Targets
Now we need to identify further targets on the network. We can use a meterpreter script called 
“ARP_Scanner,” which will perform the ARP scan to determine other hosts on that network. The 
scanner works by sending ARP requests on the network to see who sends an ARP reply.
To launch it, select the “ARP Scan” from the meterpreter menu.
The ARP Scanner has automatically suggested that we scan the whole range 172.16.222.0–255. 
You can define your own ranges or choose a different subnet mask, if your target has a different one.

---

266
◾ 
Ethical Hacking and Penetration Testing Guide
In some time the ARP scan will finish and detect all the other hosts upon the same network. 
We will now try exploiting other targets to penetrate the network further.