Penetration Test Report for Internal Lab and Exam
v.1.0
OSID:
Table of Contents
1.0 Offensive-Security Lab and Exam Penetration Test Report
1.1 Introduction
This report contains A SAMPLE ONLY of lab data Done with OSCP Coarse
. The purpose of this report is to ensure that I have a full
understanding of penetration testing methodologies as well as the technical
knowledge to pass the qualifications for the Offensive-Security Certified
Professional.
1.2 Objective
The objective of this assessment is to perform an internal
penetration test against the Offensive-Security Lab and Exam network. The
student is tasked with following methodical approach in obtaining access to the
objective goals. This test should simulate an actual penetration test and how
you would start from beginning to end, including the overall report. An example
page has already been created for you at the latter portions of this document
that should give you ample information on what is expected to pass this course.
Use the sample report as a guideline to get you through the reporting.
1.3 Requirements
·
Overall High-Level Summary and
Recommendations (non-technical)
·
Methodology walkthrough and
detailed outline of steps taken
·
Each finding with included
screenshots, walkthrough, sample code, and proof.txt if applicable.
·
Any additional items that were
not included
2.0 Sample Report – High-Level Summary
I was tasked with performing
an internal penetration test towards Offensive-Security Labs. An internal
penetration test is a dedicated attack against internally connected systems.
The focus of this test is to perform attacks, similar to those of a hacker and
attempt to infiltrate Offensive-Security’s internal lab systems – the THINC.local domain. I’s overall
objective was to evaluate the network, identify systems, and exploit flaws
while reporting the findings back to Offensive-Security.
When performing the internal penetration test, there were several
alarming vulnerabilities that were identified on Offensive-Security’s network. When
performing the attacks, I was able to gain access to multiple machines,
primarily due to outdated patches and poor security configurations. During the testing, I had administrative
level access to multiple systems. All systems were successfully exploited and
access granted. These systems as well as a brief description on how access was
obtained are listed below:
·
Lab Trophy 1 – Gained
·
Lab Trophy 2 – Gained
·
Lab Trophy 3 – Gained
·
Exam Trophy 1 – Gained
·
Exam Trophy 2 – Gained
2.1 Sample Report - Recommendations
I recommends patching the vulnerabilities identified during the testing
to ensure that an attacker cannot exploit these systems in the future. One
thing to remember is that these systems require frequent patching and once
patched, should remain on a regular patch program to protect additional
vulnerabilities that are discovered at a later date.
3.0 Sample Report – Methodologies
I utilized a widely adopted approach to performing penetration
testing that is effective in testing how well the Offensive-Security Labs and Exam
environments are secure. Below is a breakout of how I was able to identify and
exploit the variety of systems and includes all individual vulnerabilities
found.
3.1 Sample Report – Information Gathering
The information gathering portion of a penetration test focuses on
identifying the scope of the penetration test. During this penetration test, I
was tasked with exploiting the lab and exam network. The specific IP addresses
were:
Lab Network
192.168.1.1,
192.168.1.2, 192.168.1.3
Exam Network
172.16.203.133,
172.16.203.134, 172.16.203.135, 172.16.203.136
3.2 Sample Report – Service Enumeration
The service enumeration portion of a penetration test focuses on
gathering information about what services are alive on a system or systems.
This is valuable for an attacker as it provides detailed information on
potential attack vectors into a system. Understanding what applications are
running on the system gives an attacker needed information before performing
the actual penetration test. In some
cases, some ports may not be listed.
Server IP Address
|
Ports Open
|
192.168.1.1
|
TCP: 21,22,25,80,443
|
192.168.1.2
|
TCP: 22,55,90,8080,80
|
192.168.1.3
|
TCP: 1433,3389
UDP: 1434,161
|
3.3 Sample Report – Penetration
The penetration testing portions of the assessment focus heavily on
gaining access to a variety of systems. During this penetration test, I was
able to successfully gain access to 10 out of the 50 systems.
Vulnerability Exploited:
Ability Server 2.34 FTP STOR Buffer
Overflow
System Vulnerable: 172.16.203.134
Vulnerability
Explanation: Ability Server 2.34 is subject to a
buffer overflow vulnerability in STOR field. Attackers can use this vulnerability
to cause arbitrary remote code execution and take completely control over the
system. When performing the penetration test, I noticed an outdated version
of Ability Server running from the service enumeration phase. In addition,
the operating system was different from the known public exploit. A rewritten
exploit was needed in order for successful code execution to occur. Once the
exploit was rewritten, a targeted attack was performed on the system which
gave I full administrative access over the system.
Vulnerability Fix: The publishers of the Ability Server have issued a patch to fix
this known issue. It can be found here: http://www.code-crafters.com/abilityserver/
Severity: Critical
Proof of Concept Code
Here: Modifications
to the existing exploit was needed and is highlighted in red.
Screenshot Here:
|
Vulnerability Exploited: MySQL Injection
System Vulnerable: 172.16.203.135
Vulnerability
Explanation: A custom web application identified
was prone to SQL Injection attacks. When performing the penetration test, I
noticed error-based MySQL Injection on the taxid query string parameter.
While enumerating table data, I was able to successfully extract login and
password credentials that were unencrypted that also matched username and
password accounts for the root user account on the operating system. This
allowed for a successful breach of the Linux-based operating system as well
as all data contained on the system.
Vulnerability Fix: Since this is a custom web application, a specific update will
not properly solve this issue. The application will need to be programmed to
properly sanitize user-input data, ensure that the user is running off of a
limited user account, and that any sensitive data stored within the SQL
database is properly encrypted. Custom error messages are highly recommended,
as it becomes more challenging for the attacker to exploit a given weakness
if errors are not being presented back to them.
Severity: Critical
Proof of Concept Code
Here:
SELECT * FROM login WHERE id = 1 or 1=1 AND user LIKE
"%root%"Screenshot Here: |
3.4 Sample Report – Maintaining Access
Maintaining access to a system is important to us as attackers,
ensuring that we can get back into a system after it has been exploited is
invaluable. The maintaining access phase of the penetration test focuses on
ensuring that once the focused attack has occurred (i.e. a buffer overflow), we
have administrative access over the system again. Many exploits may only be
exploitable once and we may never be able to get back into a system after we
have already performed the exploit.
I added administrator and root level accounts on all systems
compromised. In addition to the administrative/root access, a Metasploit
meterpreter service was installed on the machine to ensure that additional
access could be established.
3.5 Sample Report – House Cleaning
The house cleaning portions of the assessment ensures that remnants
of the penetration test are removed. Often fragments of tools or user accounts
are left on an organizations computer which can cause security issues down the
road. Ensuring that we are meticulous and no remnants of our penetration test
are left over is important.
After the trophies on both the lab network and exam network were
completed, I removed all user accounts and passwords as well as the Meterpreter
services installed on the system. Offensive-Security should not have to remove
any user accounts or services from the system.
No comments:
Post a Comment