Persistence and lateral movement techniques not working about caldera HOT 2 CLOSED

@moxilo Thanks! Several of the Steps depend on other Steps to work effectively. persistence and lateral movement techniques both fall into this category. In general most of the persistence techniques need the RAT to be running as elevated. Easiest way to achieve this is by setting "Starting User" as "System" when creating a new Operation. In practice I've seen processes start as elevated, if the current logged in user is the Domain Admin. You could get this by logging into the starting computer as the Domain Admin and then setting "Starting User" to "Active User". It sounds like what you're doing is explicitly giving CALDERA the credentials ("Starting User" == "Logon User"). My memory is hazy but I think this won't start the process as elevated (which is what it sounds like is happening to you).

A harder, but more realistic way of getting the RAT running as elevated would be to use a privilege escalation step, although most of those require special (mis)configurations to be done, so if you just want to test things out it's a hassle.

Lateral movement is a little different. For all of the lateral movement techniques we have, you need credentials or password hashes (which you'd get from enabling the "get_creds" step). You generally need a way to copy the (RAT) file. Any of the below Steps would work for that:

• "copy_file", (which in turn requires net_use)
• "xcopy file", (also requires net_use)
• "pass_the_hash_copy"

You also want a Step to execute the rat once copied. For that you could pick from one of the following:

• "remote_process(WMI)"
• "schtasks", (this one takes a minute or two to execute)
• "pass_the_hash_sc"

Note that you can mix and match one or more copy Steps with one or more remote execution Steps.
If you do pick multiple Steps, CALDERA will choose whichever one it thinks is best.

Another option is "psexec_move" which automatically does both the file copy and the remote execution in one go. (Although it still requires "get_creds", and you have to download the psexec binary manually from the Settings menu).

And finally, if you choose one of the built-in Adversaries that we have, (Alice, Bob, Charlie, or Lazarus Group) the Steps should already be setup in a sane way. All of the adversaries will exhibit Lateral Movement, and Charlie and Lazarus Group will exhibit Persistence.

from caldera.

Also leaving a note here for myself to update the docs with this information :)

from caldera.