Penetration Testing Report
Executive Summary
This penetration testing report documents the findings from a simulated attack on a subset of machines
in the Blah-Blah Enterprise network. The purpose of this test was to identify vulnerabilities, exploit them,
and recommend remediation steps. The test revealed several critical vulnerabilities, which, if left
unaddressed, could lead to unauthorized access and data breaches.
Scope and Methodology
The machines that are the focus of this report for Blah-Blah Enterprise include five targets selected from
the network. The methodology followed a structured approach, including reconnaissance, enumeration,
exploitation, and post-exploitation activities. Various tools such as Nmap, Metasploit, and custom scripts
were utilized to identify and exploit vulnerabilities. The aim was to simulate real-world attacks and assess
the security posture of the network.
Findings
1. Web Server (Thoth)
o Vulnerability: Unsecured HTTP Service
o Description: The HTTP service on port 80 was found to be open and accessible without
authentication. This allows an attacker to exploit directory traversal vulnerabilities to
access sensitive files on the server.
o Exploitation: Exploited the service using directory traversal to access sensitive files. This
vulnerability was leveraged to read the /etc/passwd file, which contains user account
information.
o Evidence:
Nmap scan result showing open port 80.
Directory traversal command: curl [Link]
Output showing the contents of the /etc/passwd file.
o Recommendation: Implement proper access controls and secure directory traversal
vulnerabilities by configuring the web server to restrict access to sensitive directories.
2. Internal Application Server (Fawn)
o Vulnerability: Misconfigured SSH
o Description: The SSH service on port 22 allowed weak passwords, providing
unauthorized access to the system. This could enable an attacker to gain administrative
access and control over the server.
o Exploitation: Used brute force attack with Hydra to gain SSH access using weak
credentials. Once access was obtained, critical configuration files were explored.
o Evidence:
Nmap scan result showing open port 22.
Hydra command used for brute force attack: hydra -l root -P [Link]
ssh://<IP>
Successful SSH login showing command-line access.
o Recommendation: Implement strong password policies, disable root login via SSH, and
consider using SSH key authentication for enhanced security.
3. Database Server (Archetype)
o Vulnerability: Default Credentials
o Description: The MySQL database was using default credentials, allowing unauthorized
access to the database. This could lead to data theft or modification of sensitive
information.
o Exploitation: Logged in using default credentials (root/password) and extracted
database contents, including user data and application configurations.
o Evidence:
Nmap scan result showing open port 3306.
MySQL login command: mysql -u root -p
Output showing a successful database dump.
o Recommendation: Change default credentials immediately, enforce strong password
policies, and limit database access to trusted IP addresses only.
4. Network Services (Responder)
o Vulnerability: LLMNR/NBT-NS Poisoning
o Description: The network was susceptible to LLMNR and NBT-NS poisoning attacks,
allowing an attacker to capture NTLM hashes of network users. These hashes could then
be cracked to reveal user passwords.
o Exploitation: Used Responder to capture NTLM hashes of network users. Cracked the
captured hashes using Hashcat to obtain plaintext passwords.
o Evidence:
Responder command: sudo responder -I eth0
Hashcat command: hashcat -m 5600 ntlm_hash.txt [Link]
Output showing cracked NTLM hashes.
o Recommendation: Disable LLMNR and NBT-NS services on the network to prevent
poisoning attacks and enforce the use of secure authentication methods.
5. Additional Machine (Sequel)
o Vulnerability: Remote Code Execution via Outdated Software
o Description: The machine was running an outdated version of a software package, which
was vulnerable to remote code execution. This could allow an attacker to execute
arbitrary code on the server, potentially leading to a full system compromise.
o Exploitation: Exploited the vulnerability using Metasploit to gain remote shell access.
The outdated software version was identified using Nmap and verified through further
research.
o Evidence:
Nmap scan result showing the vulnerable software version.
Metasploit command: use exploit/windows/smb/ms17_010_eternalblue
Screenshot of the exploit execution and gained access.
o Recommendation: Regularly update software to the latest versions to mitigate known
vulnerabilities. Implement patch management policies to ensure timely updates.
Exploitation Steps
1. Web Server (Thoth):
o Reconnaissance:
Scanned for open ports using Nmap: nmap -sV -p 80 <IP>
Identified HTTP service running on port 80.
o Exploitation:
Exploited directory traversal vulnerability: curl [Link]
Obtained contents of the /etc/passwd file.
2. Internal Application Server (Fawn):
o Reconnaissance:
Scanned for open ports using Nmap: nmap -sV -p 22 <IP>
Identified SSH service running on port 22.
o Exploitation:
Used Hydra for brute force attack: hydra -l root -P [Link] ssh://<IP>
Gained SSH access and explored critical configuration files.
3. Database Server (Archetype):
o Reconnaissance:
Scanned for open ports using Nmap: nmap -sV -p 3306 <IP>
Identified MySQL database running on port 3306.
o Exploitation:
Logged in using default credentials: mysql -u root -p
Extracted database contents: mysqldump -u root -p database > [Link]
4. Network Services (Responder):
o Reconnaissance:
Identified network susceptibility to LLMNR/NBT-NS poisoning.
o Exploitation:
Poisoned network using Responder: sudo responder -I eth0
Cracked captured NTLM hashes using Hashcat: hashcat -m 5600 ntlm_hash.txt
[Link]
5. Additional Machine (Sequel):
o Reconnaissance:
Scanned for vulnerabilities using Nmap: nmap -sV -p <vulnerable_port> <IP>
Identified outdated software version.
o Exploitation:
Exploited remote code execution using Metasploit: use
exploit/windows/smb/ms17_010_eternalblue
Post-Exploitation Activities
1. Web Server (Thoth):
o Navigated file system and identified sensitive files, such as configuration files and user
data. Analyzed the impact of unauthorized access to these files.
2. Internal Application Server (Fawn):
o Explored SSH session and identified critical configuration files, including SSH keys and
sensitive system configurations. Documented the potential risks associated with
unauthorized access to these files.
3. Database Server (Archetype):
o Extracted user credentials from the database. Analyzed the potential impact of
compromised user credentials on the security of the application and the overall
network.
4. Network Services (Responder):
o Captured and cracked NTLM hashes. Documented the potential risks associated with the
use of weak authentication methods and the impact of compromised credentials on
network security.
5. Additional Machine (Sequel):
o Gained remote shell access and explored file system. Identified and documented critical
files and system configurations that could be compromised through remote code
execution.
Recommendations
1. Secure HTTP Service:
o Implement proper access controls to restrict unauthorized access to sensitive
directories. Configure the web server to prevent directory traversal vulnerabilities and
ensure regular security audits.
2. SSH Security:
o Enforce strong password policies and disable root login via SSH. Consider implementing
multi-factor authentication and SSH key authentication to enhance security.
3. Database Security:
o Change default credentials immediately and enforce strong password policies. Limit
database access to trusted IP addresses and regularly audit database configurations for
potential vulnerabilities.
4. LLMNR/NBT-NS Protection:
o Disable LLMNR and NBT-NS services on the network to prevent poisoning attacks.
Educate users about secure authentication practices and enforce the use of secure
authentication methods.
5. Software Updates:
o Regularly update software to the latest versions to mitigate known vulnerabilities.
Implement patch management policies to ensure timely updates and conduct regular
security assessments.
Conclusion
The penetration test identified several critical vulnerabilities across the tested machines. Immediate
action is recommended to remediate these issues and secure the network. Regular penetration testing
and security assessments should be conducted to maintain a robust security posture.