Capstone Engagement
Assessment, Analysis, �and Hardening of a Vulnerable System
Gezahegn Hora, February 8, 2022
Table of Contents
This document contains the following sections:
01
02
03
04
Network Topology
Red Team: Security Assessment
Blue Team: Log Analysis and Attack Characterization
Hardening: Proposed Alarms and Mitigation Strategies
Network Topology
3
Network Topology
Network
Address Range:192.168.1.0/24
Netmask:255.255.255.0
Gateway:192.168.1.1
Machines
IPv4:192.168.1.90
OS:Linux
Hostname:Kali
IPv4:192.168.1.100
OS:Linux
Hostname:ELK
IPv4:192.168.1.105
OS:Linux
Hostname:Capstone
IPv4:192.168.1.1
OS:Windows
Hostname:Red Vs Blue
Red Team
Security Assessment
5
Recon: Describing the Target
Nmap identified the following hosts on the network:
Hostname | IP Address | Role on Network |
Elk Server | 192.168.1.100 | Logs activity data from the target machine (Capstone) |
Kali | 192.168.1.90 | Attacker Machine |
Capstone | 192.168.1.105 | Vulnerable (Target) machine |
Windows | 192.168.1.1 | Hypervisor, hosts all the Virtual Machines. |
Vulnerability Assessment
The assessment uncovered the following critical vulnerabilities in the target:
Vulnerability | Description | Impact |
Unrestricted file upload(.php) | Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step. | The attacker uploaded .php file into the website and executed the code to get access to hidden folders. |
Brute Force password attack | A method of accessing an obstructed device/system by attempting several combinations of numeric/alphanumeric passwords. | The attacker brute forced Ashton’s password, which is leopoldo and access the secret folder. |
Open port 80 | An open port of 80 can give the attacker access to the victim’s machine. | The attacker used port 80 to connect to the victim’s machine and access a restricted file. |
Exploitation: [Open port 80]
Tools & Processes
The attacker used nmap to scan for any open port in the network
01
02
Achievements
The attacker found out that a machine with an ip address of 192.168.1.105 has an open port 80. He was able to connect into the website and have access to important company folders.
03
Exploitation: [Brute Force Attack]
Tools & Processes
The attacker used one of brute forcing tools, hydra to crack Ashton’s password from word lists of passwords.
01
02
Achievements
The attacker was able to crack Ashton’s password and ssh into ashton’s machine to be able to access a secret_folder.
Exploitation: [Brute Force Attack]
Tools used and Processes:
Exploitation: [Unrestricted File Upload]
Tools & Processes
The open port 80 allowed the attacker to connect to the company website so that he uploaded .php file by using local file inclusion (LFI)
01
02
Achievements
The attacker uploaded the .php file onto the website. This allowed the execution of the file to initiate reverse shell.
03
Blue Team
Log Analysis and �Attack Characterization
12
Analysis: Identifying the Port Scan
Analysis: Finding the Request for the Hidden Directory
Analysis: Uncovering the Brute Force Attack
Analysis: Uncovering the Brute Force Attack
Search command: user_agent.original : "Mozilla/4.0 (Hydra)" and not http.response.status_phrase : "unauthorized"
Analysis: Finding the WebDAV Connection
Blue Team
Proposed Alarms and �Mitigation Strategies
18
Mitigation: Blocking the Port Scan
System Hardening
Alarm
Mitigation: Finding the Request for the Hidden Directory
System Hardening
Alarm
Mitigation: Preventing Brute Force Attacks
System Hardening
Alarm
Mitigation: Detecting the WebDAV Connection
System Hardening
Alarm
Mitigation: Identifying Reverse Shell Uploads
Store files in a non public accessible directory if possible.
System Hardening
Alarm
24