C844 Emerging Technologies in Cybersecurity Task 1

downloaded from

Scholarfriends

https://scholarfriends.com Downloaded by: browsegrades@gmail.com | https://scholarfriends.com/singlePaper/206491/c844-emerging-technologies-in-cybersecuritytask-1 Distribution of this document is illegal.

C844 Emerging Technologies in Cybersecurity Task 1

Western Governors University C844 Emerging Technologies in Cybersecurity Task 1 Nmap Summary  Scan Syntax:

 Logical Network Topology:

 Host Details: 



192.168.27.10 

Hostname: VULNERABLEHYPER



OS: Windows Server 2008 R2 - 2012 (97%)

192.168.27.11 

Hostname: PLABDC01

Page 1

C844 Emerging Technologies in Cybersecurity Task 1  



Page 2

OS: Microsoft Windows Server 2016 build 10586 (97%)

192.168.27.12 

Hostname: PLABDM01



OS: Microsoft Windows Server 2016 build 10586 (96%)

192.168.27.13 

Hostname: Unknown



OS: Juniper SA2500 SSL VPN gateway or Digi Passport console server (95%)





192.168.27.14 

Hostname: Unknown



OS: Linux 3.10 - 4.1 (100%)

192.168.27.15 

Hostname: PLABWIN7



OS: Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, Windows 8, or Windows 8.1 Update 1 (97%)







192.168.27.17 

Hostname: Unknown



OS: Linux 2.6.32 - 3.10 (96%)

192.168.27.18 

Hostname: PLABWIN10



OS: Microsoft Windows 10 build 10074 - 10586 (97%)

192.168.27.20 

Hostname: Unknown



OS: Linux 3.10 - 4.1 (100%)

 Summary: The 192.168.27.0/24 subnet appears to contain a total of nine devices. These devices consist of three Windows Servers, two Windows Workstations, three Linux devices, and one Juniper VPN appliance.

C844 Emerging Technologies in Cybersecurity Task 1

Page 3

A. Nmap Vulnerabilities  Port: 21/tcp 

Service: FTP



Affected Hosts:





192.168.27.12



192.168.27.18

Summary: FTP is an unencrypted protocol that sends all information in plaintext.

This means that anyone performing packet sniffing would be able to view usernames, passwords and the data contained within the files being transferred. In addition, the 192.168.27.18 device allows anonymous FTP logins which enables anyone to access the files on that FTP server without providing any form of authentication or authorization.

 Port: 22/tcp 

Service: SSH



Affected Hosts:





192.168.27.14



192.168.27.20

Summary: Both SSH servers on the network are running OpenSSH 6.6.1. This version is susceptible to a DOS attack through sending numerous duplicate KEXINIT requests causing memory consumption ("CVE-2016-8858," 2016).

 Port: 23/tcp 

Service: Telnet

 

Affected Host: 192.168.27.15 Summary: Telnet is an unencrypted protocol that sends all information in plaintext. This means that anyone performing packet sniffing would be able to view usernames, passwords and any data that is transferred during the Telnet session. Compromised user accounts can be used by an adversary to perform further enumeration and establish persistence.

C844 Emerging Technologies in Cybersecurity Task 1

Page 4

 Port: 80/tcp 

Service: HTTP



Affected Host:





192.168.27.12



192.168.27.18

Summary: HTTP is an unencrypted protocol that sends all information in plaintext. This means that anyone performing packet sniffing would be able to view usernames, passwords and any data that is transferred during the HTTP session. It is common for an adversary to monitor HTTP traffic in order to obtain Personally Identifiable Information, Payment Card Industry Information, and Protected Health Information ("Sensitive Data Guide," n.d.).

 Port: 88/tcp 

Service: Kerberos



Affected Host: 192.168.27.11



Summary: Nmap contains a built-in NSE (Nmap Scripting Engine) program named “krb5-enum-users” that can be used to discover “valid usernames by brute force querying likely usernames against a Kerberos service” ("krb5-enum-users," n.d.).

 Port: 389/tcp   

Service: LDAP Affected Host: 192.168.27.11 Summary: There are multiple NSE scripts related to LDAP that can perform brute force authentication attacks and Active Directory enumeration.

 Port: 445/tcp  Service: SMB 

Affected Hosts: 

192.168.27.10

C844 Emerging Technologies in Cybersecurity Task 1





192.168.27.11



192.168.27.12



192.168.27.15



192.168.27.18

Page 5

Summary: SMBv2 is enabled which is a good security practice, but message signing is disabled which can allow man-in-the-middle-attacks (Beyond Security Inc, n.d.).

 Port: 5555/tcp   

Service: freeciv Affected Host: 192.168.27.17 Summary: Freeciv is a free open-source version of the Civilization empirebuilding strategy videogame. There is a vulnerability with freeciv 2.2 and 2.3 that “allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality, related to the (1) os, (2) io, (3) package, (4) dofile, (5) loadfile, (6) loadlib, (7) module, and (8) require modules or functions” ("CVE-2010-2445," 2010). The result of this manipulation is the ability to perform privilege escalation.

 Port: 5900/tcp   

Service: VNC 3.8 Affected Host: 192.168.27.18 Summary: VNC 3.8 allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server ("realvnc-auth-bypass," n.d.).

B. Wireshark Anomalies  Port Scanning:  

Start Time (UTC): 4/19/2017 16:08:37 End Time (UTC): 4/19/2017 16:57:50



Source IP: 172.16.80.243

C844 Emerging Technologies in Cybersecurity Task 1 



Page 6

Target IPs: 

192.168.27.11



192.168.27.12



192.168.27.13



192.168.27.14



192.168.27.15



192.168.27.17



192.168.27.20

Description: The 172.16.80.243 IP address was observed sending TCP packets with the SYN flag set to all well-known ports on the Target IPs listed above. This is the first part of the TCP three-way handshake and is an easy way to determine what ports are open on a device. If the target responds with a RST/ACK, it means the port is closed, and if it responds with a SYN/ACK it means the port is open ("Port Scanning Techniques," n.d.). If the Source IP received a SYN/ACK response, it would then send an ACK back to the target to complete the three-way handshake and complete the connection. This behavior is consistent with an Nmap TCP connect scan (Nmap -sT).

 Remote Login Attempts from Suspicious External Host:  

Start Time (UTC): 4/19/2017 16:18:20 End Time (UTC): 4/19/2017 16:59:27



Source IP: 172.16.80.243



Target IPs:  192.168.27.15 





192.168.27.17

Target Ports: 

23/tcp



5900/tcp

Target Services: 

Telnet

C844 Emerging Technologies in Cybersecurity Task 1  

Page 7

VNC

Description: The external IP address 172.16.80.243 attempted to log in to the 192.168.27.17 device via VNC multiple times. The connection was refused and returned the message “Too many security failures”. The same external IP address later tried to establish a Telnet connection to the 192.168.27.15 device with the username “Administrator” and password “Passw0rd” but was rejected; they then attempted to log in with username “User” and password “Passw0rd” but were again rejected. This activity is significant because this is the same external address seen performing port scanning and network enumeration.

 NetBIOS Name Service Enumeration:  Start Time (UTC): 4/19/2017 16:19:47  End Time (UTC): 4/19/2017 16:58:05  Source IP: 172.16.80.243 

Target IPs: 

192.168.27.11



192.168.27.12



192.168.27.15



192.168.27.17



Target Port: 137/udp



Target Service: NBNS



Description: Rapid7 has published a blog on this enumeration technique and the information it can provide. In the article, the author says that the attacker will send a “50-byte NetBIOS "node status request" (NBSTAT) probe with a wildcard (*) scope that will return all configured names for the target NetBIOS-enabled node” (Hart, 2017). This behavior is identical to that observed coming from the 172.16.80.243 IP address and is a built-in capability of Nmap.

 Web Server Enumeration:  

Start Time (UTC): 4/19/2017 16:19:47 End Time (UTC): 4/19/2017 16:57:53

C844 Emerging Technologies in Cybersecurity Task 1 

Source IP: 172.16.80.243



Target IPs:





192.168.27.12



192.168.27.14



192.168.27.17

Page 8

Target Ports: 

80/tcp



5800/tcp



9090/tcp



Target Service: HTTP



HTTP User Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine;



https://nmap.org/book/nse.html) Description: The 172.16.80.243 external IP address performed a myriad of GET requests to the three target devices listed above. All of the GET requests contained the default Nmap user agent of “Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)”. There are many NSE scripts that perform this function in order to enumerate web servers.

 SSH Enumeration: 

Start Time (UTC): 4/19/2017 16:56:22



End Time (UTC): 4/19/2017 17:02:23



Source IP: 172.16.80.243



Target IPs: 

192.168.27.14



192.168.27.20



Target Port: 22/tcp



Target Service: SSH



SSH Client Versions:   

SSH-1.5-NmapNSE_1.0 SSH-1.5-Nmap-SSH1-Hostkey SSH-2.0-Nmap-SSH2-Hostkey

C844 Emerging Technologies in Cybersecurity Task 1

Page 9



 SSH-2.0-OpenSSH_7.3p1 Debian-3+b1 SSH Server Version: SSH-2.0-OpenSSH_6.6.1



Description: The 172.16.80.243 IP address enumerated the SSH servers running on the 192.168.27.14 and 192.168.27.20 devices by retrieving their SSH Hostkeys and determining if the SSH servers supported the obsolete and less secure SSH Protocol Version 1. This appears to have been accomplished by running the “SSH Hostkey(s)” (Klemm, 2008) and “NMAP:SSHV1.NSE” (Enright, 2015) scripts.

Both of these are open-source NSE programs. In addition, after performing these enumeration activities the 172.16.80.243 device made a successful SSH connection to the 192.168.27.20 IP address utilizing the “SSH-2.0OpenSSH_7.3p1 Debian-3+b1” SSH client.

 Kerberos Probe:  

Start Time (UTC): 4/19/2017 16:56:28 End Time (UTC): 4/19/2017 16:56:28



Source IP: 172.16.80.243



Target IP: 192.168.27.11



Target Port: 88/tcp



Target Service: Kerberos



Description: The 172.16.80.243 device sent a request for a TGT (Ticket Granting Ticket) for the user NM in realm NM to 192.168.27.11 device on port 88. The “NM” stands for Nmap and is part of the “kerberos-probe.patch” NSE script designed to gather information about the Kerberos network authentication service (Karlsson, 2009).

Implications of Anomalies  Port Scanning: Port scanning allows an attacker to enumerate the target network. This enables the adversary to retrieve a variety of information including what services are running, the different operating systems and versions that are present, and what vulnerabilities exist that can be exploited.

C844 Emerging Technologies in Cybersecurity Task 1

Page 10

 Remote Login Attempts from Suspicious External Host: Although the remote login attempts up to this point have been unsuccessful, if nothing is changed the adversary can attempt to perform brute force attacks on these remote access services and will most likely eventually succeed. In addition, one of the remote access services is Telnet, which sends all information in plaintext. This means an adversary with even the most basic packet sniffing capability would be able to compromise user accounts, gain remote access, and perform further enumeration,  NetBIOS Name Service Enumeration: The NetBIOS Name Service is an excellent source of information for an adversary that is enumerating a network, and this service is enabled on virtually every Windows machine in existence. For example, NetBIOS can provide a system’s hostname and the workgroup or domain it belongs to. This information can often be used as an indicator to the types of services provided by that node (Hart, 2017).  Web Server Enumeration: This activity enables an adversary to fingerprint a webserver in order to determine the specific type and version of web server that is being hosted.

This information can then be used to determine if a web server has any vulnerabilities that can be exploited and develop a plan of attack.  SSH Enumeration: Performing SSH enumeration can allow an attacker to determine exactly what SSH version is being run and if it is vulnerable. In this instance, the scan revealed that OpenSSH 6.6.1 is being used which could be leveraged to perform a DOS attack ("CVE-2016-8858," 2016).  Kerberos Probe: In this scenario, the adversary was unable to determine the Kerberos REALM for the network, which significantly impacted their ability to use this service for enumeration. However, if an attacker was able to determine the Kerberos REALM, the service can be used to discover valid Active Directory usernames. A common tool used to

C844 Emerging Technologies in Cybersecurity Task 1

Page 11

perform this type of attack is the “krb5-enum-users” NSE script ("krb5-enum-users," n.d.).

C. Solutions  Establish a Firewall: All of the port scanning and network enumeration seen in the packet capture could have been prevented with even the most basic of firewall configurations. There are a myriad of firewall solutions, ranging from free open-source products to extremely advanced proprietary solutions. A defense in depth strategy should be implemented on this network in order to increase resistance to attack. This could be accomplished via a border firewall, router ACLs, and host based firewalls. For a small, simple network like this, open-source firewall software such as pfSense or Snort would be adequate, and Windows devices come with Windows Defender Firewall, a host based firewall. Snort or pfSense could also be installed on the Linux hosts to ensure all devices had a host-based firewall solution. All of these changes could implemented with little to no cost to the organization.  Secure Microsoft Core Services: Kerberos, LDAP and SMB are all vital components of a Windows Active Directory environment. This means these services cannot simply be disabled in order to increase security. These services can be protected by enforcing a robust password policy, configuring strong permissions, audit logging, and keeping an inventory of system resources. An anti-malware program should also be running to aid in detection. Windows Defender has evolved into a solid anti-malware service and is included with all Microsoft devices. Enabling Windows Defender on all Microsoft devices within this network is an easy and free way to greatly increase the network’s security posture.  Consolidate and Secure Remote Access: There are a myriad of remote access services present on the network including SSH, Telnet, VNC 3.8, TigerVNC 4.0 and RDP. This is an excessive amount of remote access methods. The administrators should evaluate which remote access services are actually required, and eliminate programs providing duplicate or unnecessary service. For example, Telnet should under no circumstances be

C844 Emerging Technologies in Cybersecurity Task 1

Page 12

enabled, and SSH can provide the same functionality without the security risk. In addition, remote access should never be allowed directly from outside the network. The network already has a Juniper VPN appliance in place that should be utilized. By first establishing a VPN connection and then making the remote connection, the entire session would be encrypted and add an additional layer of protection.  Establish a Patch Management Program: Many of the vulnerabilities present on the network could be eliminated by upgrading to the latest versions of the software and ensuring all security patches are installed. A patch management program should be created to keep track of software versioning, patches, and hotfixes. Assigning responsibility increases the likelihood of software staying up to date and secure.  Replace Unencrypted Protocols: HTTP, FTP and Telnet are all unencrypted protocols that send information in plaintext. This means that usernames, passwords and sensitive data are all exposed and able to be captured by anyone performing packet sniffing. All three of these services have encrypted alternatives that should be used instead. HTTP should be replaced with HTTPS, FTP with SFTP and Telnet with SSH. In addition, anonymous FTP logins should be disabled. While it may be convenient, not forcing users to authenticate in order to obtain files can put sensitive data at risk.  Software Whitelisting: The presence of the Freeciv videogame on one of the devices raises the question of what software is allowed on the network. This appears to be a work/business network of some sort, and the organization may not want employees playing videogames at work. More importantly, if users can install any software they desire, there is a high risk of malicious programs making their way onto the network. An application whitelisting policy should be developed and enforced so that only software approved by the organization can be installed.

C844 Emerging Technologies in Cybersecurity Task 1

Page 13

D. Sources Beyond Security Inc. (n.d.). Finding and Fixing Vulnerabilities in SMB Signing Disabled , a Medium Risk Vulnerability. Retrieved from https://www.beyondsecurity.com/scan_pentest_network_vulnerabilities_smb_signing_di sabled CVE-2010-2445. (2010, August 7). Retrieved from https://www.cvedetails.com/cve/CVE-20102445/ CVE-2016-8858. (2016, December 9). Retrieved from https://www.cvedetails.com/cve/CVE2016-8858/ Enright, B. (2015, November 5). sshv1 NSE Script. Retrieved from https://vulners.com/nmap/NMAP:SSHV1.NSE Hart, J. (2017, September 26). Sonar NetBIOS Name Service Study. Retrieved from https://blog.rapid7.com/2016/09/06/sonar-netbios-name-service-study/ Karlsson, P. (2009, December 16). Kerberos probes for nmap. Retrieved from http://seclists.org/nmap-dev/2009/q4/646 Klemm, S. (2008, August 6). [NSE script] SSH Hostkey(s) SSH1 and SSH2. Retrieved from http://seclists.org/nmap-dev/2008/q3/261 krb5-enum-users. (n.d.). Retrieved from https://nmap.org/nsedoc/scripts/krb5-enum-users.html Port Scanning Techniques. (n.d.). Retrieved from https://nmap.org/book/man-port-scanningtechniques.html realvnc-auth-bypass. (n.d.). Retrieved from https://nmap.org/nsedoc/scripts/realvnc-authbypass.html Sensitive Data Guide. (n.d.). Retrieved from https://www.safecomputing.umich.edu/dataguide/? q=all-data