Capstone Engagement

Assessment, Analysis, �and Hardening of a Vulnerable System

Prepared By: Sooji Lee, Aug 12, 2021

Table of Contents

​

This document contains the following sections:

Network Topology

Red Team: Security Assessment

Blue Team: Log Analysis and Attack Characterization

Hardening: Proposed Alarms and Mitigation Strategies

Network Topology

3

Network Topology

Network

Address Range: 192.168.1.0/24

Netmask: 255.255.255.0

Gateway: 192.168.1.1

​

Machines

IPv4: 192.168.1.1

OS: Windows

Hostname: (Red vs Blue) ML-REFVM-684427

​

IPv4: 192.168.1.105

OS: Linux

Hostname: Capstone

​

IPv4: 192.168.1.100

OS: Linux

Hostname: ELK

​

IPv4: 192.168.1.90

OS: Linux

Hostname: Kali

​

​

​

​

​

​

[Insert Here]

​

Use draw.io to create a diagram of the network.

Add your diagram to this slide and fill out the data in the sidebar.

​

​

Red Team

Security Assessment

​

5

Recon: Describing the Target

Nmap identified the following hosts on the network:

Vulnerability Assessment

The assessment uncovered the following critical vulnerabilities in the target:

Vulnerability Assessment

The assessment uncovered the following critical vulnerabilities in the target:

Vulnerability Assessment

The assessment uncovered the following critical vulnerabilities in the target:

Exploitation: [Open Port 22 (SSH) & 80 (HTTP)]

Tools & Processes

I used nmap to scan for the open ports and services in the network.

​

Command used:

Nmap –sS 192.168.1.105

​

Achievements

Found that this IP address had open port 22 & 80.

Exploitation: [CWE-23: Relative Path Traversal]

Tools & Processes

I used dirb command to launch an attack against the web server. DIRB command is used to find existing and/or hidden web directories.

​

Command used:

Dirb http://192.168.1.105

​

Achievements

This command gave 2 hidden directories within the server.

• server-status
• webdav directories

Exploitation: [CWE-307: Improper Restriction of Excessive Authentication Attempts]

Tools & Processes

I used hydra command to run a brute force attack on secret_folder directories that was discovered when clicking through the website

​

Command used:

hydra -l ashton -P /usr/share/wordlists/rockyou.txt -s 80 -vV 192.168.1.105 http-get /company_folders/secret_folder

Achievements

With this command, it revealed the credentials

• Login: ashton
• Password: leopoldo

To the secret_folder directory

Exploitation: [CWE-434: Unrestricted Upload of File with Dangerous Type]

Tools & Processes

With the secret_folder directory exposed, I was able to move into the actual web server directory where I could have access to the server.

Achievements

I was able to drag and drop the malicious php shell script to the web server

Screenshot on the next slide

Exploitation: [CWE-434: Unrestricted Upload of File with Dangerous Type]

Exploitation: [CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)]

Tools & Processes

Able to upload a reverse shell code without the server restricting the input before its usage.

Achievements

Once the code was executed, it granted access to the target server using a reverse shell.

Blue Team

Log Analysis and �Attack Characterization

16

Analysis: Identifying the Port Scan

• The port scan occurred around 3:00PM.
• Total of 20,008 packets were sent from the IP address 192.168.1.90.
• This indicated that it was port scan when I’ve looked at the destination.port. There were thousands of requests for all different port numbers (screenshot on the next slide)

Analysis: Identifying the Port Scan

Analysis: Finding the Request for the Hidden Directory

• 38,200 requests were made at around 3:30pm.
• Status code 404: Page / File not found

Analysis: Finding the Request for the Hidden Directory

• Seems like some kind of wordlist was used to find the existing/hidden directory from the existing web server, as ‘uri.path’ indicates many different directories were tried – and got the http status code of 404 (as it these directories does not exist).

Analysis: Finding the Request for the Hidden Directory

• Also, there were 4 hits at around 4PM, specific to the secret_folder directory

Analysis: Finding the Request for the Hidden Directory

• And it seems like the file name that was requested and got in was “Connect_to_corp_server” from the secret_folder. As the name of the file states, this file might be highly risky to be exposed to the attacker as it might have the list of steps of how to get into the corporation server.

Analysis: Uncovering the Brute Force Attack

• There were 16,221 hits during the Brute Force Attack.
• (you can use both filters and it gives you the same result of 16,221 hits)
• Status code 401: Unauthorized client error

Analysis: Uncovering the Brute Force Attack

• 16219 hits were made before the attacker discovered the correct password.

Analysis: Finding the WebDAV Connection

• Total of 12 hits were requested to made to the webdav directory.
• Looks like shell.php file was requested several times.

Blue Team

Proposed Alarms and �Mitigation Strategies

26

Mitigation: Blocking the Port Scan

​

We can setup an alarm when detecting more than 10 port scans in a minute and also when there is 100 consecutive ICMP requests from a single source of IP.

​

Most of today’s firewalls and IDS/IPS systems can detect these types of port scanning and drop the packets in real-time. (and/or take an action of what is configured to do so.)

​

To mitigate port scans, we can set a firewall and/or IDS/IPS in our network, which can automatically take action when it detects port scanning.

​

Also, we can configure whitelisted IPs so that only whom are authorized can have access to the specific ports, and deny all the other traffics that are not configured.

​

System Hardening

Alarm

Mitigation: Finding the Request for the Hidden Directory

​

We can setup an alarm when detecting any machine that tries to request for an access to a specific directory or file.

​

The threshold for this should be 1 or more attempt for these kinds of hidden directories or files

​

​

The best practice to harden the system with these types of attack, is to just remove high risk directories and files from the web server, where these are not accessible from the public network.

​

You can use:

rm –r ../company_files command to remove an item or

mv –r ../company_files other_location to move an item to different location.

System Hardening

Alarm

Mitigation: Preventing Brute Force Attacks

​

Alert can be set when it detects 5 attempts of log-in within an 10 minutes of time period.

​

Another way of creating an alarm is when there is a Status code of 401 detected as the response from our server where threshold is 20 attempts in an hour.

​

Also, we can have alert where ‘User_agent.original’ value includes ‘hydra’

​

​

​

To block brute force attacks, we can configure our firewall or IDS/IPS systems to limit failed login attempts, and also limit the logins to the whitelisted IP addresses.

​

When the threshold has been reached, we can have the web server display a warning or a lockout message and have all the source IP from that specific IP to be blocked off from our network for a certain period of time.

System Hardening

Alarm

Mitigation: Detecting the WebDAV Connection

​

We can have alarm set when this directory is being accessed by an IP source that should not have access to this directory.

(As a good practice, all the external source IP should be blacklisted for this directory)

​

Alarm should go off when there is threshold of 1. Any attempt should trigger the alarm.

This directory should not be accessible from the web server or the web interface.

​

We can block all the traffic for this directory and only set designated whitelisted IPs to have access to this directory.

​

Firewalls and IDS/IPS can restrict the traffic and drop the packets in real-time.

​

System Hardening

Alarm

Mitigation: Identifying Reverse Shell Uploads

​

We can set the alarm for any ‘.php’ file that is uploaded to the server.

​

The alarm should trigger when there is any attempt to upload ‘.php’ file.

​

​

​

​

To harden the system, remove ability to upload files to this directory over the web.

​

Also, have only Admin of the local web server have authority to upload the file. (require of authentication)

​

System Hardening

Alarm

32