Getting Started with Core Impact | Workspace Management

Core Impact workspaces organize information surrounding a single, self-contained pen test or vulnerability management engagement. Since Core Impact allows you to work with multiple workspaces, this video is designed to share some helpful workspace management techniques.

 

 

 

 

Technical Specifications

Core Impact uses Microsoft SQL Server Express for the database back end, which has a 10GB per database limit. Workspaces will vary in size based on the number of hosts and the extent of information gathering and attack activities that you conduct against them.

Common Scenarios with Workspace Management

Live workspace with deployed agent

After attempting to close a workspace by selecting File --> Close Workspace, the user is prompted with a message notifying that there is still a module and agent connected.

close Core Impact export prompt

The user can either:

  • Close the workspace and leave the module running with the agent connected, but will prevent the user from being able to delete the workspace later
  • Stop the running module and disconnect the agent. The agent will still be deployed onto the target machine and will follow the reconnect policy.

Export a workspace

  1. Choose Tools --> Import/Export Workspaces
  2. You'll need to make sure that the datasource type is set to Impact's Database.
  3. Then, select the workspace you want to copy. In this case, we'll export two different workspaces into one file.
  4. For data destination type, select Microsoft SQL Server.
  5. Name your file and choose a destination.
  6. This will generate a MDF file that can be imported into a separate Microsoft Sequel server installation or archive it using whatever process you like.
  7. Once completed, you can remove the workspace from the Core Impact database by selecting File --> Delete Workspace. Note: Workspaces that have tasks running cannot be deleted.

Import a workspace

  1. Choose Tools --> Import/Export Workspace
  2. Change datasource type to Microsoft SQL server
  3. Navigate to your file. Note: If you receive an error regarding a permission error, check to make sure the file is not saved to your desktop. The Core Impact service does not have access to a user's desktop.
  4. Select Impact database for data destination.
  5. The workspace can now be accessed by choosing 'Open Workspace.'