Home

Reel

Penetration Test Report

Introduction

The penetration test report contains all efforts that were conducted during client engagement. The purpose of this report is to ensure that the client has a full understanding of penetration testing methodologies as well as the technical knowledge to remediate any security flaws.

Objective

The objective of this assessment is to perform an internal penetration test against the network. The student is tasked with following methodical approach in obtaining full control of the network. This test should simulate an attacker and how an attacker would start from beginning to end.

Requirements

The pentester will be required to fill out this penetration testing report fully and to include the following sections:

  • Overall High-Level Summary and Recommendations (non-technical)

  • Methodology walkthrough and detailed outline of steps taken

  • Each finding with included screenshots, walkthrough, sample code, and root.txt if applicable

  • Any additional items that were not included

High-Level Summary

I was tasked with performing an internal penetration test towards the client network. An internal penetration test is a dedicated attack against internally connected systems. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate internal systems. My overall objective was to evaluate the network, identify systems, and exploit flaws while reporting the findings back to the client.

When performing the internal penetration test, there were several alarming vulnerabilities that were identified on client's network. When performing the attacks, I was able to gain access to multiple machines, primarily due to outdated patches and poor security configurations. During the testing, I had administrative level access to multiple systems. All systems were successfully exploited and access granted. These systems as well as a brief description on how access was obtained are listed below:

  • 10.129.15.19 (Reel) - Microsoft Office/WordPad Remote Code Execution Vulnerability CVE-2017-0199

Recommendations

I recommend patching the vulnerabilities identified during the testing to ensure that an attacker cannot exploit these systems in the future. One thing to remember is that these systems require frequent patching and once patched, should remain on a regular patch program to protect additional vulnerabilities that are discovered at a later date.

Methodologies

I utilized a widely adopted approach to performing penetration testing that is effective in testing how well the environments is secured. Below is a breakout of how I was able to identify and exploit the variety of systems and includes all individual vulnerabilities found.

Information Gathering

The information gathering portion of a penetration test focuses on identifying the scope of the penetration test. During this penetration test, I was tasked with exploiting the client network. The specific IP addresses were:

Network

  • 10.129.15.0/24

Penetration

The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. During this penetration test, I was able to successfully gain access to all systems.

System IP: 10.129.15.19

Service Enumeration

The service enumeration portion of a penetration test focuses on gathering information about what services are alive on a system or systems. This is valuable for an attacker as it provides detailed information on potential attack vectors into a system. Understanding what applications are running on the system gives an attacker needed information before performing the actual penetration test. In some cases, some ports may not be listed.

Server IP Address
Ports Open

10.129.15.19

TCP: 21,22,25,135,139,445,593,49159

UDP:

Nmap Scan Results:

Initial Shell - Microsoft Office/WordPad Remote Code Execution Vulnerability (CVE-2017-0199)

Vulnerability Explanation:

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Vulnerability Fix:

Update to the latest software release

Severity: Critical

Proof of Concept:

I see ftp allows anonymous logins and can see that there are files of interest

I proceed to download the readme.txt file and the word document

Reading the readme file indicates that a user is reading word documents which also indicates for a potential phishing attack

Furthermore, reading the output from using exiftool on the word document reveals user/email address

With this information I proceed to utilize the CVE-2017-0199 Exploit toolkit by creating the HTA and RTF payloads

Starting the webserver and netcat listener

Sending our malicious email and gaining initial foothold

Local.txt Proof Screenshot

user proof

Local.txt Contents

Privilege Escalation

Additional Priv Esc info

Upgrading to powershell and catching the new shell

Listing the files in nico's desktop shows a file of interest

I proceed to uncover what appears to be a password string

With SSH open I gain access using tom's credentials

Before enumerating the active directory domain I will load PowerView, a powershell tool, in memory.

I begin checking for non-default groups with one being of interest is the backup_admins group

I look into what users/group and the permissions associated and I see that claire has an interesting permission of WriteDacl

I proceed into searching for tom's user who may have object access to claire's user. According to the output tom has WriteOwner permissions to claire.

With this information I can abuse the WriteOwner and WriteDacl permissions as follows

Now I can see claire under the Backup_Admins group

With claire's password changed I now gain access as claire using SSH

With claire's permissions I am able to view the administrator's directory. Furthermore, I encounter a Backup Scripts directory that includes interesting files, powershell scripts.

My initial thought is to search for passwords in these scripts and what looks to be the administrator is revealed

I attempt to SSH into the administrator user with these credentials and gain administrator access

Vulnerability Exploited: Insecure Access Control Lists

Vulnerability Explanation: Weak permissions of Active Directory Discretionary Access Control Lists (DACLs) and Acccess Control Entries (ACEs) that make up DACLs.

Vulnerability Fix: Remove Unesescary Permissions To Prevent Compromise

Severity: Critical

Proof Screenshot Here:

Root.txt

Proof.txt Contents:

Maintaining Access

Maintaining access to a system is important to us as attackers, ensuring that we can get back into a system after it has been exploited is invaluable. The maintaining access phase of the penetration test focuses on ensuring that once the focused attack has occurred (i.e. a buffer overflow), we have administrative access over the system again. Many exploits may only be exploitable once and we may never be able to get back into a system after we have already performed the exploit.

House Cleaning

The house cleaning portions of the assessment ensures that remnants of the penetration test are removed. Often fragments of tools or user accounts are left on an organization's computer which can cause security issues down the road. Ensuring that we are meticulous and no remnants of our penetration test are left over is important.

After collecting data from the network was completed, I removed all user accounts and passwords as well as the Meterpreter services installed on the system. the client should not have to remove any user accounts or services from the system.

Additional Items

Appendix - Proof and Local Contents

IP (Hostname)
Local.txt Contents
Proof.txt Contents

10.129.47.91

b38b9329fcdc4ea8887eb109c05c8afd

b2e35251f711471d971e9a660604353d

Appendix - Badge

PreviousHackTheBoxNextSearch

Last updated