1 of 14

Final Engagement

Attack, Defense & Analysis of a Vulnerable Network

Shem, Ken, Senthil, Coneisha

1

2 of 14

Table of Contents

2

This document contains the following resources:

Network Topology & Critical Vulnerabilities

Exploits Used

Alerts Implemented

Hardening

3 of 14

Network Topology

& Critical Vulnerabilities

4 of 14

Network Topology

​

Network Address Range: 192.168.1.0/24

Gateway: 192.168.1.1

​

Machines

IPv4: 192.168.1.90

OS: Debian Kali 5.4.0 Hostname: Kali

​

IPv4: 192.168.1.110

OS: Debian GNU/Linux 8 Hostname: Target 1

​

IPv4: 192.168.1.105

OS: Ubuntu 18.04 Hostname: Capstone

​

IPv4: 192.168.1.100

OS: Ubuntu 18.04 Hostname: ELK

5 of 14

Critical Vulnerabilities: Target 1

Vulnerability

Description

Impact

​

Weak Passwords

Find passwords using brute force against web form

Which allows attacker to gain access on protected web platform

Wordpress User Enumeration

Utilized Linux to get the information of web server

This is in run will allow attacker to gain access to the Web server.

Privilege Escalation

Used Stevens sudo Python access to

escalate from ‘Steven to root’

Allowed privilege escalation to root

5

Our assessment uncovered the following critical vulnerabilities in Target 1.

6 of 14

Exploits Used

7 of 14

8 of 14

Exploitation: Unprotected and Unsalted Hash

8

Summarize the following:

  • How did you exploit the vulnerability?
    • Used JohnTheRipper to brute force the hash located within the MySQL database.
  • What did the exploit achieve?
    • Gained the ability to ssh from Michael to Steven to gain further privileges

9 of 14

Exploitation: Privilege Escalation

9

Summarize the following:

  • How did you exploit the vulnerability?
    • Used sudo -l to gain information needed to perform escalation
    • Used sudo Python access to escalate to root
      • sudo python -c 'import pty; pty.spawn("bin/bash")'
  • What did the exploit achieve?
    • Achieved root access on the machine

10 of 14

Avoiding Detection

ALERT, RESPONSE, DETECTION & SOLUTION

11 of 14

DOS Attacks ��Count each log “Source IP” if count > 10 per Source IP in 10 seconds, then alert a DoS Attack�The Metric the alert responds is COUNT�To bypass detection you can use Wireshark to find and verify the origin IP. Navigate to the domain and verify the origin of the ip.��

ALERTS

12 of 14

Weak Passwords Easy cracking��Unusual activity by unauthorized login.�Kibana can detect Logging Action Index threshold: Alert when an aggregated query meets the threshold followed by an account lockout�By pass detection by hash cracking�

ALERTS

13 of 14

Net Bios ��Using SEIM In it Kibana can detect tag / log and send email alerts.�The metric alert is COUNT�A Way to bypass the detection is to stay in the cloud services. SEIM logs data from inside its parameter and usually doesn’t monitor cloud activity.�

ALERTS

14 of 14

THE END