Python for Cybersecurity

CHAPTER 3Achieving Code Execution

In Chapter 2, “Gaining Initial Access,” we explored how an attacker can use Python to gain initial access to a target environment. This chapter focuses on exploiting this initial access to achieve code execution on the target system.

This goal is covered by the Execution tactic within the MITRE ATT&CK framework. Figure 3.1 shows the 12 techniques and various subtechniques associated with this tactic.

Figure 3.1: MITRE ATT&CK: Execution

This chapter will include a deep dive into two of these techniques: Windows Management Instrumentation and Scheduled Task/Job. Code samples in the following sections will demonstrate the use of Python to achieve code execution using these techniques and how defenders can use Python to detect and investigate these attacks.

The code sample archive for this chapter can be found at https://www.wiley.com/go/pythonforcybersecurity and contains the following sample code files:

• WMIExecution.py
• WMIDetection.py
• TaskScheduler.py
• ScheduleTracker.py

Windows Management Instrumentation

Windows Management Instrumentation (WMI) is designed to simplify the life of system administrators. With WMI, administrators can use the same commands to manage both local and remote—via Server Message Block (SMB) and Remote Procedure Call Service (RPCS)—machines.

WMI can be a boon to administrators, but its rich feature set can be invaluable ...