Project:
Red Vs Blue
By: Darnell Antwine & Rishawn Blackwell
Table of Contents
This document contains the following sections:
01
02
03
04
Network Diagram
Red Team (Offense): Security Assessment
Blue Team (Defense): Log Analysis and Attack Characterization
Hardening: Proposed Alarms and Mitigation Strategies
Network Topology
3
4
Red Team
Security Assessment
5
Recon: Describing the Target
Nmap identified the following hosts on the network:
Hostname | IP Address | Role on Network |
Kali | 192.168.1.90 | Hackers Machine |
Ubuntu 18.04 | 192.168.1.100 | Company Server |
Capstone | 192.168.1.105 | Company Machine |
Vulnerability Assessment
The assessment uncovered the following critical vulnerabilities in the target:
Vulnerability | Description | Impact |
Weak Passwords | Strength of password is not strong enough | Allows attackers to easily access someone’s login information |
Compromise Credentials | Privilege Escalation | allows attackers to gain access to sensitive credentials |
Poor Encryption | The conversion of something to code or symbols so that its contents cannot be understood if intercepted. | Allows attackers to gain access to more sensitive data. |
Exploitation: Weak Passwords
Tools & Processes
I used the tool Hydra to exploit and retrieve the password for ashton.
01
02
Achievements
The exploit allowed me to get gain further access into the company’s database using ashtons password.
Exploitation: Poor Encryption & Compromise Credentials
Tools & Processes
Used Crackstation.net to crack the encrypted Hash found using Ashton’s login. Used WebDav. Used php-reverse-shell tool to gain access.
01
02
Achievements
Allowed further access into the company’s data by discovering, manager Ryan’s login credentials. And giving root access to Ryan’s credentials.
Blue Team
Log Analysis and �Attack Characterization
14
Analysis: Identifying the Port Scan
[Insert Here]
Include a screenshot of Kibana logs depicting the port scan.
Analysis: Finding the Request for the Hidden Directory
Analysis: Uncovering the Brute Force Attack
[Insert Here]
Include a screenshot of Kibana logs depicting the brute force attack.
Analysis: Finding the WebDAV Connection
Blue Team
Proposed Alarms and �Mitigation Strategies
19
Mitigation: Blocking the Port Scan
Proactive scanning ports once that is in place, the first step is to fix any known vulnerabilities. Next comes audit every open port available externally through the firewall or on the internal network. Services which the public doesn't need to reach should be blocked at the firewall. If employees need to reach them, perhaps they can use the VPN instead. Internal services are often listening even when they aren't being used. They might have been installed or enabled by default, or were enabled due to past use and never disabled.
Mitigation: Identifying Reverse Shell Uploads
There are certain behaviors and characteristics existed in the process that established reverse shell, which are different from other normal processes. TXHunter’s disposable agent runs on the victim computer, collecting process’s behavior and characteristics, analyzing it and detecting reverse shell attacks. The following lists its hunting result of detecting reverse shell attack, where you can see the attacking sequence along with processes and time.
Mitigation: Finding the Request for the Hidden Directory
Send an Email alert if an unknown MAC address (new device) request the directory.
Have a list of all device MAC address that connect to companies servers.
A MAC address is given to a network adapter when it is manufactured. It is hardwired or hard-coded onto your computer's network interface card (NIC) and is unique to it.
System Hardening
Alarm
Mitigation: Preventing Brute Force Attacks & Detecting the WebDAV Connection
Set up alarm protocols that will notify IT staff by email when an accounts locked out due to 5 failed login attempts. For a staff member to access the account they need to call IT verify them self to get account unlocked
System Hardening
Alarm
Mitigation: Detecting the WebDAV Connection
Set up alarm protocols that will notify IT staff by email when an accounts locked out due to 5 failed login attempts. For a staff member to access the account they need to call IT verify them self to get account unlocked
System Hardening
Alarm