Capstone Engagement
Assessment, Analysis, �and Hardening of a Vulnerable System
Prepared by Igor Acevski
Table of Contents
This document contains the following sections:
01
02
03
04
Network Topology
Red Team: Security Assessment
Blue Team: Log Analysis and Attack Characterization
Hardening: Proposed Alarms and Mitigation Strategies
Network Topology
3
Network Topology
Network
Address Range: 192.168.1.0/24
Netmask:
255.255.255.0
Gateway:
192.168.1.1
Machines
IPv4:192.168.1.1
OS: Microsoft 10
Hostname:
ML-RefVm-684427
IPv4:192.168.1.100
OS: Linux
Hostname: Elk
IPv4:192.168.1.105
OS: Linux Apache
Hostname: Server1
IPv4:192.168.1.90
OS:Kali Linux
Hostname: Kali
Red Team
Security Assessment
5
Recon: Describing the Target
Nmap identified the following hosts on the network:
Hostname | IP Address | Role on Network |
Kali -Kali Linux | 192.168.1.90 | Attacking Machine |
Server1 (Capstone) -Ubuntu | 192.168.1.105 | Victim Machine |
Elk -Linux | 192.168.1.100 | SIEM Machine (Monitoring Machine) |
ML-RefVm-684427 -Windows 10 | IPv4:192.168.1.1 | Getaway and Hyper-V |
Vulnerability Assessment
The assessment uncovered the following critical vulnerabilities in the target:
Vulnerability | Description | Impact |
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Allows hidden files to be exposed | Web Server |
Sensitive Data Exposure | When application, company or other entity inadvertently expose personal information | Company’s information |
CWE-307: Improper Restriction of Excessive Authentication Attempts | Product does not disconnect or time out after multiple failed logins (Brute Force) | User privacy |
CVE-2005-1868 Vulnerability on uploading files | Upload and execution of .php file | Web server share folder |
CWE-656: Reliance on Security Through Obscurity | An attacker with network access to the web server executes system commands with administrative privileges | Web Server Hijacking |
Exploitation: [Path Traversal]
Tools & Processes
Using Nmap easily find directories on the web server
Version on the ports
Nmap –sV –T4 –A 192.168.1.105
01
02
Achievements
Discover all directories on the server. Plus, we discover open port.
03
Exploitation: [Improper Restriction of Excessive Authentication Attempts]
Tools & Processes
Using hydra tool makes brute force easy step.
hydra -l ashton -P rockyou.txt -s 80 -f -vV 192.168.1.105 http-get /company_folders/secret_folder/
01
02
Achievements
With no Improper Restriction of Excessive Authentication Attempts, the private data can be breached.
03
Exploitation: [CWE-656: Reliance on Security Through Obscurity]
Tools & Processes
Using msfvenom to make the payload, and msfconsole as a listener makes a connection between to systems without authentication.
01
02
Achievements
The biggest achievement is that the attacker have access to all data to read write and execute. That can finish with hijacking.
03
Blue Team
Log Analysis and �Attack Characterization
11
Analysis: Identifying the Port Scan
Analysis: Finding the Request for the Hidden Directory
Analysis: Uncovering the Brute Force Attack
Analysis: Finding the WebDAV Connection
Blue Team
Proposed Alarms and �Mitigation Strategies
16
Mitigation: Blocking the Port Scan
The alarms are the first things that need to notify if there is an ongoing attack. This can be easily seen by high traffic coming from one IP address in a short time.
The threshold would be set for more than 10,000 requests, to trigger the alert.
The best System Hardening against port scanning is a well configure firewall that will block ( drop) ping requests.
With this two commands:
iptables –A INPUT –p icmp –icmp-type echo-request –j DROP
iptables –A INPUT –p icmp –icmp-type echo-reply –j DROP
The iptables are managing the traffic, and with this commands, the ping will be disabled to and from server.
System Hardening
Alarm
Mitigation: Finding the Request for the Hidden Directory
There was 127 thousands requests to the hidden directory. And most od them were failed. Setting up alarm for this directory will be after 100 request to trigger the alarm.
The threshold for this should be after 100 failed request in a certain period to trigger the alarm.
This System Hardening can take more actions:
By moving the sensitive data out of publick reach and stronger validation on user credential, it's complicated breaches, but with encrypting, only the authorised people can read the data.
System Hardening
Alarm
Mitigation: Preventing Brute Force Attacks
Alarms for preventing brute force should be monitoring for the time, Ip address, and status code 401.
The threshold should trigger after three failed logins (status code 401), from the same Ip address, within 30 seconds.
With password complexity, brute force is taking more time, adding two factor identification is improvs Confidentiality.
Even if two factor identification is breached, limiting failed attempts will stop brute force for a while.
System Hardening
Alarm
Mitigation: Detecting the WebDAV Connection
Whitelisting n authorized Ips will be the best alarm.
In the threshold would be any unauthorized Ip address to trigger the alarm.
Configuring the WebDav connection will be set on whitelist Ips.
Stronger solution on WebDav will be adding password complexity on whitelisted Ips.
System Hardening
Alarm
Mitigation: Identifying Reverse Shell Uploads
Alarming on uploads on any kind of files from not trusted sources.
The threshold will activate the alarm after filtering the files, find executable commands.
First hardening is going to be on uploaded files that has proper authentication.
The other hardening is going to be using certain applications that are going to detect reverse shell.
Authentication on file will determine if the file is malicious or not. And applications that are detecting the reverse shell will continuously checking the telnet connections by analyzing the process and determined if the connection is bad or is legitim.
System Hardening
Alarm
22