Pentera™
Pentera™
Pentera™
Penetration
Test
Penetration
Penetration
Test
Test

Pentera™
Penetration Test

Executive
ReportSummary
ReportExecutive
Executive
ReportReportExecutive Report24, 2022| testhashhash
Nov.Nov.
24,Nov.
2022
24,| test
2022
hash| testThe
Nov.Pentera™
24,Pentera™
2022|automatedtestautomatedhashpenetration
Pentera™
automatedpenetration
penetration
testtest test
reportsummarizes
vulnerabilities,
reportsummarizes
reportsummarizes
the thevulnerabilities,
thevulnerabilities,
Pentera™ automated penetration test
exploitachievements
remediation
exploit
exploitachievements
achievements
andandremediation
andremediation
report summarizes
the vulnerabilities,
actionitems
recommended
in youractionitems
actionrecommended
items
recommended
in yourin your
exploitachievements
and remediation
network
based
on thelatestethicalnetwork
network
based
on
based
the
lateston theethicallatestethicalactionitems
recommended
in yourhacking
pentesting
techniqueshackinghacking
pentesting
pentesting
techniques
network
basedonthetechniqueslatestethicalThe
Pentera™
automatedpenetration test report summarizes
hacking
pentesting
techniques
the vulnerabilities, exploit achievements, and remediation action items
recommended in your network based on the latest ethical hacking
pentesting techniques.

Disclaimer:
For security reasons, this report is anonymized and excludes sensitive data

CONFIDENTIAL AND PROPRIETY INFORMATIONCONFIDENTIALANDCONFIDENTIALPROPRIETYINFORMATION
AND PROPRIETY INFORMATIONCONFIDENTIAL
AND PROPRIETY
INFORMATION

Penteraprovidesthe Pentera™
servicereport“AsIs”, without
PenteraprovidesPenterathe Pentera™
providesservicethe Pentera™
andservice
“As
Is”,
and
withoutreportany“As Is”,any
without any
Penteraprovidesthe Pentera™
serviceandreport“Asreport
Is”, andwithoutanyof anykind.
Penteramakes
nomakes
warranty
that
the information
warranty
of anykind.
warranty
Pentera
of no
any
makes
kind.
no
Penterawarranty
that nothewarranty
informationthat the information
warranty
of anywarranty
kind.
Penteramakes
warranty
that theinformation
contained
in thisisreport
is report
completeor
error -or
free.
contained
in thisreportcompleteor this
error
- or
free.
contained
in thisiscontained
reportcompleteinerror
is complete- free.
error - free.
2022 Pentera
Copyright
2022CopyrightPenteraLtd
Copyright
2022 Pentera
Copyright
Ltd20232022Ltd
Pentera Ltd

TABLE OF CONTENTSEXECUTIVE SUMMARY

4

EXTERNAL ATTACK SURFACE - KEY FINDINGS

5INTERNAL ATTACK SURFACE - KEY FINDINGS

6

VULNERABILITY PRIORITIZATION

7IDENTITY STRENGTH

8RANSOMWARE READINESS

9MITRE ATT&CK HEAT MAP

10

REMEDIATION WIKI

11

| BB
- SA 90 SUMMARYEXECUTIVE| BB - Tanya

Executive Summary
Executive Summary
Cyber Resilience Score & Settings

Canceled
Completed successfully

Cyber Resilience Score & Settings
BB- SA 90
BB-StealthyBB- Tanya
Black
Box
BB
- SA
90 Test - Stealthy Attacker - Weekly
BB
Penetration Testing (Black Box)
Penetration Testing (Black Box)
Jul 07 2022
2023 12:02 - Jul 07 2022
2023 14:30, 02:28
Jan 11 2023 11:02 - Jan 11 2023 12:15, 01:13
192.168.90.0 - 192.168.90.9, 192.... 2 Ranges
192.168.90.0 - 192.168.90.9, 192.... 4 Ranges
1 / 152- 0%
20%– 30/152
9 / 171 - 5%
2 - IP Range(s)1Name:
Test Name:
Description:
Description:
Type:
Type:
Time & Duration:
Time & Duration:
Included IP Range(s):Included IP Range(s):Action Approval Score:
Action Approval Score:
User Input:
User Input:

R esilience
Score
R esilience
Score

C+
C+

2 - IP Range(s)Resilience Score Over Last 8 Tasks
Resilience Score Over Last 3 Tasks| BB - Tanya

Executive Summary

Completed successfully

Cyber Resilience Score & Settings
Resilience Score Card
Resilience
Score
Card
CriticalR esilience
AssetsTest Name:

BB - Tanya

Description:

BB

Type:

Penetration Testing (Black Box)

Score
Congratulations! Pentera wasn’t able to compromise
any &criticalassets in your network
Time
Duration:

Jan 11 2023 11:02 - Jan 11 2023 12:15,Low01:13

Congratulations!
Penterawasn’t able to compromise
any criticalin your network
Included
IPassets
Range(s):Credentials
and AccountTakeover192.168.90.0 - 192.168.90.9, 192....

Congratulations! Pentera wasn’t able to take over your accounts and credentials

9 / 171 - 5%C+

Critical Assets

Credentials and Account Takeover

Action Approval Score:

4 Ranges
CriticalGained access to 16 accounts (14 of them privileged): 14 Local administrator user(s), 1 Unix/Linux
User Input:
Sniffing
2 - IP Range(s)user(s) and 1 network service user(s)Sniffed 1 credentials and performed 13 relay attacks

MediumMediumSniffing

Resilience
Score
Over Last
Tasks 11 relay attacks
Sniffed1 credentials
and 3
performed

MediumPassword Strength

Cracked 4 out of 25 passwords: 4 easy
High

Password Strength
LateralCrackedMovement
14
out ofof 16
14 passwords:
passwords: 14
easy
Cracked
5 out
4 Strong,
1 EasyCongratulations! Pentera wasn’t able to perform lateral movement in your network
MediumCritical

Lateral Movement
Accessible
PerformedData
lateral movement to 1 Windows Workstation(s), 1 Windows Server(s) and 1 Unix/Linuxhost(s) access to 351802 File(s) and 10 Hosts (with complete access)GainedCriticalCriticalAccessible
Data
Host
TakeoverGained accessto 358660
completeand 1Workstation(s),Network service(s)Penterawas ableto ‘takeFile(s),over’¹ 11
10 Hostsout of(with
20 hosts(50%): access)5 Windows
4 Windows
Server(s) and 1 Unix/Linux host(s)CriticalHigh

Host Takeover
AV/EDR
Pentera Bypass
was able to ‘take over’¹ 11 out of 28 hosts (39%): 5 Windows Workstation(s), 4 Windows

Server(s) and 2 Unix/Linuxhost(s)able to bypass your Antivirus/EDR solutions
Congratulations!
Pentera wasn’t
Resilience
Score Card

High
Low

AV/EDR
Bypass
Critical Assets

Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions
Congratulations! Pentera wasn’t able to compromise any critical assets in your network

Action Approvals
152 Total
Credentials and Account Takeover1013 Total Actions

Not Approved (99%)
Total(1%)Action 151
Approvals
1711 Approved

420 Successful
Total(42%)
Actions 593 No-results (58%)
1423

CriticalGained access to 16 accounts (14 of them privileged): 14 Local administrator user(s), 1 Unix/Linuxuser(s) and 1 network service user(s)Sniffing

Sniffed 1 credentials and performed 11 relay attacks

9 Approved (6%)

162 Not Approved (94%)

612 Successful (43%)

811 No-results (57%)

Medium4

Test Name

Surface Scan

| BB
- SA 90 ATTACK SURFACE – KEY FINDINGSEXTERNAL

Executive Summary

External Attack
Surface – Key Findings
Executive
Summary

Canceled

Asset
Inventory
Cyber
AssetResilience
InventoryScore & Settings
Name:

BB - SA 90

10 Domains

Description:

R esilienceScore

1,094C+BB - SA 90

Type: 163 Subdomains

Penetration Testing (Black Box)

361

Time & Duration:
IP Addresses

Jul 07 2022 12:02 - Jul 07 2022 14:30, 02:28

Included IP Range(s):192.168.90.0 - 192.168.90.9, 192....

Action Approval Score:1 / 152 - 0%

5 Networks

324 ServiZesUser Input:
Resilience Score Over Last 8 Tasks

2 Ranges

1 - IP Range(s)231 Websites

56

231 Websites

Critical

324 ServiZes

Critical

361 IP Addresses

Critical

37

25

175
High

55

High

3

High

85

57

Medium

Low

34

568

Medium12

Medium

Low

81

Low

Resilience
Score Card
Achievements
Critical Assets
Congratulations! Pentera wasn’t able to compromise any critical assets in your network

Provisioning
Credentials and Account Takeover

Congratulations! Pentera wasn’t able to take over your accounts and credentials

1,2un Total
Provisioning
Sniffing

43 Total AZtions

MediumSniffed 1 credentials and performed 13 relay attacks
864 successful (66.35)

423 Not successful (33.66%

31 approved (71.24%)

12 not approved (28.16%)

MediumPassword Strength

Vulnerabilities

Cracked 4 out of 25 passwords: 4 easy

Lateral Movement
Congratulations! Pentera wasn’t able to perform lateral movement in your network
CriticalAccessible Data
Gained access to 351802 File(s) and 10 Hosts (with complete access)CriticalHost Takeover
Pentera was able to ‘take over’¹ 10 out of 20 hosts (50%): 5 Windows Workstation(s), 4 Windows
Server(s) and 1 Unix/Linux host(s)High

AV/EDR Bypass

Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions
Attractions

152 Total Action Approvals
1 Approved (1%)

151 Not Approved (99%)

1013 Total Actions
420 Successful (42%)

593 No-results (58%)

5

| BB
- SA 90 ATTACK SURFACE - KEY FINDINGSINTERNAL

Internal Attack
Surface – Key Findings
Executive
Summary

Canceled

AttackResilience
Vectors Score & Settings
Cyber

R esilience
Score

C+

Name:

BB - SA 90

Description:

BB - SA 90

Type:

Penetration Testing (Black Box)Time & Duration:

Jul 07 2022 12:02 - Jul 07 2022 14:30, 02:28

Included IP Range(s):192.168.90.0 - 192.168.90.9, 192....

Action Approval Score:1 / 152 - 0%

User Input:

1 - IP Range(s)2 Ranges

Resilience Score Over Last 8 Tasks

Resilience Score Card
Critical Assets
Congratulations! Pentera wasn’t able to compromise any critical assets in your network| BB - SA 90

Credentials and Account Takeover

Congratulations! Pentera wasn’t able to take over your accounts and credentials

Sniffing| BB - SA 90

MediumSniffed 1 credentials and performed 13 relay attacks

158 Achievements

20

Critical

69

High

37

MediumPassword Strength

PenteraCracked
accomplished
158 achievements in total. Every achievement represents a discrete successful action
4 out of 25 passwords: 4 easy
20
69
37
Achievements
158
Achievements
performed
by Pentera.
CriticalHigh

Medium32

Low
Medium32

Low

Lateral Movement(Listing 34 of 34 items).
Penteraaccomplished 158 achievements in total. Every achievement represents a discrete successful action
Congratulations! Pentera wasn’t able to perform lateral movement in your network
performed
byPentera.
Severity
Details
Critical

Data(Listing 34 Accessibleof 34 items).
Gained access to 351802 File(s) and 10 Hosts (with complete access)10

Severity

Details(1) Created Domain Admin user

An attacker may create a user with domain admin privileges in order to persist his existence in the network. It is
recommended to monitor activity in privileged user groups and keep track of any changes in privileged users Critical
Severity Pentera was able toespecially‘take over’¹when
10 outaddingof 20 hosts(50%):
5 Windows
Workstation(s), 4 Windows
a newdomainadmin.

Host Takeover(1) Created Domain Admin user

Server(s) and 1 Unix/Linux host(s)10
9.8 AV/EDR Bypass
Severity
Severity

An attacker may create a user with domain admin privileges in order to persist his existence in the network. It is
recommended
to monitor
activity in privileged
groupsand server
keep track of any changes in privileged users High(1) Exploited
CVE-2019-19781
onuserCitrixADC
especiallywhenaddinga new domain
admin.
By exploiting
thisvulnerability,
an unauthenticatedattacker could execute arbitrary code remotely as high privileged

Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions

9.8
9.4
Severity

user via a directory traversal vulnerability.

(1) Exploited CVE-2019-19781 on Citrix ADC server
By exploiting this vulnerability, an unauthenticated attacker could execute arbitrary code remotely as high privileged(10)viaGatheredvaluable
information from hostuser
a directory traversal
vulnerability.

152 Total Action Approvals
Severity

9.4
1 Approved (1%)
9.0
Severity
Severity

9.01013 Total Actions

An attacker might find sensitive information and credentials on the host that might help in further attacks(10) Gathered valuable information from host
(1)attacker
ValidateddomainAnmight findsensitive credentials
information and credentials on the host that might help in further attacks

151 Not Approved (99%)

420 Successful (42%)

593 No-results (58%)

An attacker may abuse the domain credentials to login to hosts and gather information about the users and possibly
take-over the host and escalate his attack.

(1) Validated domain credentials
An attacker may abuse the domain credentials to login to hosts and gather information about the users and possibly(1) Obtained user’s cleartext password
take-over the host and escalate his attack.

6

| BB - SA 90

Detailed Report
21
8
8
22
| BB
| -BB
SA -90
SA 90
CriticalHigh
MediumLow- SA 90
VULNERABILITYPRIORITIZATION
59 Vulnerabilities| BB
Detailed Report8822Pentera identified a total of 59 vulnerability occurrences across 4 severity levels 21
CriticalHigh
MediumLow
59
Vulnerabilities
Listing
24 of
24 items.
Vulnerabilities
Detailed
Detailed
ReportReportExecutive
Summary
21 21
8 8
8 8
22 22
CriticalCritical High High Medium
Medium Low Low
Penteraidentified
a
total
of
59
vulnerability
occurrences
across4
severitylevels59 Vulnerabilities
59
Vulnerabilities
Cyber
Resilience Score & Settings
Host can be forced to authenticate by a rogue server
Canceled#1

Listing 24 of 24 items.

4.7

1 occurrences

PenteraPenteraidentified
identified
a totala totalof 59ofvulnerability
59 vulnerability
occurrences
occurrences
acrossacross
4 severity
4 severity
levelslevelsRemediation
Severity
Priority ¹
ListingListing
24 of 2424items.
of 24 items.

BB - SA 90

Name:

Host can be forced to authenticate by a rogue server

4.7

#1

In cases where the DNS server fails in name resolution
queries, the LLMNR, NetBIOS-NS
Description:
BB - SAand
90 mDNS services attempt to resolve them. Since
1 occurrences
those are a broadcast protocols, anyone can respond to the query. An attacker may refer the request to a machine in his control using a manRemediation R esilience
Severity
Testing (Black Box)
in-the-middle attack, And obtain sensitive dataType:such as username and password Penetration
hash.

#1 Priority
#1 ¹

Score
4.7 4.7

C+

Host
Host
cancanbe forced
be forced
to authenticate
to authenticate
by abyroguea rogueserverserverTime & Duration:
1 occurrences
1 occurrences

Jul 07 2022 12:02 - Jul 07 2022 14:30, 02:28

Incases where the DNS server fails in name resolution queries, the LLMNR, NetBIOS-NS and mDNS services attempt to resolve them. Since
PENTERA.LAB
Remediation
Remediation
Severity
Severity
Included
IP Range(s):192.168.90.0- 192.168.90.9,
192....
2 Ranges
those are a broadcast protocols, anyone can respondto thequery. An attacker may
refer the request
to a machine
in his control
using a manPriority
Priority¹¹

in-the-middle attack, And obtain sensitive data such as username and password hash.
Action Approval Score:1 / 152 - 0%
In cases
In cases
wherewhere
the DNS
the server
DNS server
fails infails
namein nameresolution
resolution
queries,queries,the LLMNR,
the LLMNR,NetBIOS-NS
NetBIOS-NS
and mDNS
and mDNS
services
services
attempt
attempt
to resolve
to resolve
them.them.
SinceSince
thosethoseare a arebroadcasta broadcast
protocols,
protocols,
anyoneanyonecan respondcan respond
to
the
to
query.
thequery.
An
attackerAn
attacker
may
refer
may
refer
the request
the request
to a machine
to a machine
in hisin
control
his control
usingusing
a mana manUser Input:
PENTERA.LAB
1 - IP Range(s)in-the-middle
in-the-middle
attack,attack,And obtain
And obtain
sensitive
sensitive
data suchdata assuch
username
as username
and password
and password
hash.hash.

#2

5.8

#2

5.8

SMB server on endpoint does not validate clients

Resilience
Score Over
Last 8 Tasks
PENTERA.LAB
PENTERA.LAB
Remediation
Severity
Priority ¹
PENTERA.LAB
Remediation
Priority ¹#2 #2

Severity

5.8 5.8
9.8

PENTERA.LAB
PENTERA.LAB
Remediation
Priority ¹

Severity

SMB server on endpoint does not validate clients
1 occurrences

SMB
SMB
serverserveron on
endpoint
endpoint
does
does
notnotvalidate
validateclients
clients
1 occurrences
1 occurrences

Remediation
Remediation
Severity
PENTERA.LAB Severity
Priority
Priority¹¹#3

1 occurrences

CVE-2019-19781
1 occurrences

CVE-2019-19781
9.8 | BB - SA 90#3

An attacker might look for vulnerable applications in the organizational network. By exploiting this vulnerability, an unauthenticated attacker
1 occurrences
could execute arbitrary code remotely via a directory traversal vulnerability.
Remediation

Severity

Priority#3Resilience#3 ¹ Score
9.8Card9.8
192.168.90.50

CVE-2019-19781
CVE-2019-19781

1 occurrences
1 occurrences
An attacker might look for vulnerable applications in the organizational network. By exploiting this vulnerability, an unauthenticated attacker

Critical Assets
Remediation
Remediation
Severity
Severity
could execute arbitrary code remotely via a directory traversal vulnerability.
Congratulations!
Pentera wasn’t able to compromise any critical assets in your network
Priority
Priority¹¹351802 Accessible
Shared Files
Accessible
Shared Files

An attackerAn
attacker
might
might
look
for
look
vulnerable
forgainvulnerable
applications
applicationsin theinfiles,
organizational
the organizational
network.
Byover
exploiting
By1exploiting
this vulnerability,
this vulnerability,
an unauthenticatedan unauthenticatedattacker
attackerPenterawasable
toaccessto 351802
101290network.
folders,
sharesCredentials
andAccount
Takeover192.168.90.50
couldcould
executeexecutearbitrary
arbitrarycode
remotely
codewasn’t
remotelyvia
via
a overdirectory
traversal
traversal
vulnerability.
vulnerability.
Congratulations!
Penteraableatodirectory
take
your
accounts
and credentials

1.0

#4

Shares with Anonymous User access

SMB message signing is disabled
11 occurrences Shares with Domain User access

Medium192.168.90.50
192.168.90.50
Remediation
Severity
Sniffing
Priority Sniffed¹
1 credentials and performed 13 relay attacks

1.0

#4

SMB message signing is disabled

An attacker could abuse the unsigned SMB servers to relay NTLM challenges from other hosts and gain shell access.
11 occurrences
Password StrengthRemediation
Severity

Medium00101290
SMB
SMB
messagemessagesigningsigning
is351802
disabled
is disabled192.168.90.8 (FILE2012.PENTERA.LAB)
192.168.90.34(WIN10D.PENTERA.LAB)
192.168.90.5(CRM2016.PENTERA.LAB)
Priority ¹#4Folders#4

1.0 1.0

Cracked 4 out of 25 passwords: 4 easy

Files
FoldersFiles
11 occurrences
11 occurrences
192.168.90.40
192.168.90.33 (WIN10G.PENTERA.LAB)
192.168.90.7 (CA.PENTERA.LAB)
An attacker could abuse the unsigned SMB servers to relay NTLM challenges from other hosts and gain shell access.
Lateral Movement(WIN10MCKAFEE.PENTERA.LAB)
Remediation
Remediation
Severity
Severity

Congratulations!
Pentera wasn’t able to perform lateral movement in your network
Priority
Priority¹¹
192.168.90.35 (WIN10C.PENTERA.LAB)
192.168.90.12 (PRTG.PENTERA.LAB)
192.168.90.32 (WIN10H.PENTERA.LAB)
192.168.90.34 (WIN10D.PENTERA.LAB)
192.168.90.5 (CRM2016.PENTERA.LAB)
192.168.90.8 (FILE2012.PENTERA.LAB)
An attackerAn
attacker
couldcould
abuse
abuse
the unsigned
the unsigned
SMB servers
SMB servers
to192.168.90.41
relay
to relay
NTLMNTLM
challenges
challenges
from otherfrom otherhosts hosts
and gainand shell
gain shell
access.
access.
192.168.90.30(WIN10A.PENTERA.LAB)(AVTEST.PENTERA.LAB)
Critical
192.168.90.40
192.168.90.33 (WIN10G.PENTERA.LAB)
192.168.90.7 (CA.PENTERA.LAB)
Accessible Data
(WIN10MCKAFEE.PENTERA.LAB)
Gained access to 351802 File(s) and 10 Hosts (with complete access)192.168.90.34
192.168.90.34(WIN10D.PENTERA.LAB)(WIN10D.PENTERA.LAB) 192.168.90.5
192.168.90.5(CRM2016.PENTERA.LAB)(CRM2016.PENTERA.LAB) 192.168.90.8
192.168.90.8(FILE2012.PENTERA.LAB)(FILE2012.PENTERA.LAB)
192.168.90.35 (WIN10C.PENTERA.LAB)
192.168.90.12 (PRTG.PENTERA.LAB)
192.168.90.32 (WIN10H.PENTERA.LAB)
192.168.90.40
192.168.90.40
192.168.90.33
192.168.90.33(WIN10G.PENTERA.LAB)(WIN10G.PENTERA.LAB)
192.168.90.7
192.168.90.7(CA.PENTERA.LAB)(CA.PENTERA.LAB)
CriticalHost Takeover
192.168.90.30(WIN10A.PENTERA.LAB)
192.168.90.41 (AVTEST.PENTERA.LAB)(WIN10MCKAFEE.PENTERA.LAB)(WIN10MCKAFEE.PENTERA.LAB)
Pentera was able to ‘take over’¹ 10 out of 20 hosts (50%): 5 Windows Workstation(s), 4 Windows

Open
DomainUser
Access1 OpenShares
Shareswith
With
DomainUser
AccessHost
Share
Server(s)and
1 Unix/Linux host(s)192.168.90.35
192.168.90.35(WIN10C.PENTERA.LAB)(WIN10C.PENTERA.LAB)
192.168.90.12
192.168.90.12(PRTG.PENTERA.LAB)(PRTG.PENTERA.LAB)

Details
192.168.90.32
192.168.90.32(WIN10H.PENTERA.LAB)(WIN10H.PENTERA.LAB)

192.168.90.30
192.168.90.30(WIN10A.PENTERA.LAB)(WIN10A.PENTERA.LAB) 192.168.90.41
192.168.90.41(AVTEST.PENTERA.LAB)(AVTEST.PENTERA.LAB)

WIN10B AV/EDR Bypass

C$

Contains 101290 folders and 351802 Highfiles.

Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions

152 Total Action Approvals

1013 Total Actions¹ Remediation priority recommendations factor in the number of hosts affected by a vulnerability, the number and severity of achievements
caused by it, and whether the vulnerability provided access to your Critical Assets, as configured in Pentera.

1 Approved (1%)

151 Not Approved (99%)

420 Successful (42%)

593 No-results (58%)

Page 6 / 19

¹ Remediation priority recommendations factor in the number of hosts affected by a vulnerability, the number and severity of achievements
caused by it, and whether the vulnerability provided access to your Critical Assets, as configured in Pentera.

Page 6 / 19

¹ Remediation¹ Remediation
prioritypriority
recommendations
recommendations
factor factor
in the innumberthe numberof hostsof affected
hosts affectedby a vulnerability,
by a vulnerability,
the number
the number
and severity
and severityof achievementsof achievements
causedcausedby it, andby it,
whether
and whether
the vulnerability
the vulnerability
providedprovidedaccessaccessto yourtoCriticalyour Critical
Assets,Assets,
as configured
as configured
in Pentera.
in Pentera.

Page 6 Page
/ 19 6 / 197

Non-privileged

Privileged

15 Non-privileged (94%)| BB- SA 90STRENGTHIDENTITY

1 Privileged (6%)

¹ Refers to the state when Pentera was able to access an account’s plaintext password, password hash (that can be used without cracking) or credentials
successfully used in a relay attack.

| ADPA with CE

IdentityStrength
Executive
Summary
IdentityStrength

Canceled

5 Cracked
Passwords
CrackedPasswords
Cyber Resilience
Score & Settings
CrackedPasswords
Password
can becrackedusinga total
a customdictionary
andGPU
29% of your passwords
were cracked
in under30 minutes,
of 5 accounts
were cracked
by low
Penterain 1 hours.
6.7
effortSeverity
Cracking Success
32Rateoccurrences

BB - SA 90

Name:
Cracking
Difficulty

Description:
BB common- SA 90 passwords (such as Aa123456 or P@ssw0rd) andMany password cracking tools rely on dictionary
rulesets, so it is important to avoid
regular, unmodified
dictionary terms. InsertingType:intentional, idiosyncratic misspellings
or using acronyms
is the recommended
best practice.
R esilience
Penetration
Testing (BlackBox)
You can enhancePentera's cracking abilities by uploading a custom wordlist to Pentera's Custom Dictionary and retest to uncover passwords
Score
Time
Duration:
07 2022 and
12:02
07 2022
02:28
that could be predicted or guessed by attackers
who&invest
in social engineering Jul
techniques
are- Jul
familiarwith14:30,
their targets.

C+

31%
leaked email: stone@blackstone.com

Included IP Range(s):leaked email:mary.jor@blackstone.com

koffler
User
Input:

mindi.newman

192.168.90.0 - 192.168.90.9, 192....

leaked email:ActionApproval Score:
Koffler@blackstone.com

5/16

1 / 152 - 0%

young.kim

1 - IP Range(s)| ADPA withleaked
CE email:

Resilience Score Over Last 8 Tasks

leaked email: reid@blackstone.com

axel.herberg@blackstone.com

saurabh.dhoble

leaked email:david.riddell@blackstone.com

LeakedCredentials
leaked email:Non-privileged Users:

2 Rangesleaked email: brownc@blackstone.com

trivialeasymediumleaked email: Menon@blackstone.com

strongprivileged users

leaked email: kuroda@blackstone.com

leaked email: moy@blackstone.com

Lauinger@blackstone.com

leaked email:Young.Kim@blackstone.com

sandersonmoycartertdanielle.desatnik

leaked email:desatnik@blackstone.com

leaked email:zachary.zwarenstein@blackstone.com

leaked email: Deck@blackstone.com

LeakedCredentials
leaked email: bandak@blackstone.com
leaked email:Compromised
Accounts Table
pokhriyal@blackstone.com

48(Listing
15 of 15
items).
leakedemail:
Danielle.Desatnik@Blackstone.com

welanetz

1,186

Compromised
Dataemail:
Total
LeakedleakedUsers
email:
leakedleakedemail:
duff@blackstone.com
Username
Type by the Leaked
Obtained naer@blackstone.com
Password Cracking
Difficulty
Host /Data
Domain Name
bronwen.baumgardner@blackstone.com

Resilience Score Card

Active Directory users that Pentera was able to compromise
themary.jorleaked using
email:
administrator
Local User
PasswordSprayleaked data.
cartert@blackstone.com

Critical Assets
administrator

Local User

Leaked data entries associated with your organization gathered from
192.168.80.12
third parties, the darknet, and other sources.

PasswordSpray

192.168.80.29

Exploit192.168.80.33

Congratulations! Pentera wasn’t able to compromise any critical assets in your network

administrator
Local User
Credentials and Account Takeover

6.2

Password can be cracked leveraging leaked username and medium
Local User
PasswordSpray
192.168.80.34
GPU effort
MediumCongratulations! Pentera wasn’t able to take over your accounts and credentials

administrator

SeveritySniffing 21 occurrences

Sniffed 1 credentials and performed 13 relay attacks
administrator
Local User

PasswordSpray

192.168.80.40

Identity Exposure Breakdown

Attackers can leverage leaked usernames found or sold on the darknet to gain initial access into the organization. Leaked usernames pose arisk because they can be leveraged in dictionary attacks and enhance password cracking techniques.
MediumPassword Strength
Page 5 / 22
Cracked 4 out of 25 passwords: 4 easy
leaked email:william.swank@blackstone.com
william.***@******.com

leaked email:matt.***@******.com| ADPA withmatt.rickard@blackstone.com
CE

Lateral Movement

leaked Congratulations!
email:
leakedemail:
Pentera wasn’t able to perform lateral
movement
in your network
javier.alvarez@blackstone.com
jennie.shapira@blackstone.com
javier.***@******.com
jennie.***@******.com

Valid username-password pairs

leaked email:chris.an@blackstone.com
chris.***@******.com
leaked email:

Valid Unpaired
Passwords
jacob.bayer@blackstone.com
jacob.***@******.com

The
numberof Active Directory users whose credentials
are fully
The number of Active
Directory
users whose password
Critical matches a leaked
leakedemail:
leakedemail:
leakedemail:
Accessible Data
exposed.
matthew.skurbe@blackstone.com
henry.kober@blackstone.com password.
dakota.szabo@blackstone.com
Gained access to 351802 File(s) and 10 Hosts (with complete access)leaked email: dowd@blackstone.com
leaked email:Password can be cracked
using a custom
dictionary
and high GPU
Cleartext passwords lucas.kollmann@blackstone.com
Hashed passwords
4.7 Host Takeover
Criticaleffortleaked Pentera
email:
email:
leaked email:was able to ‘take over’¹ 10 out of 20 hosts leaked(50%): 5 Windows
Workstation(s), 4 Windows

leaked email:desikan@blackstone.com
Credentials

48
Severity
david.ugalde@blackstone.com
3 occurrences

manhao.tang@blackstone.com

andriy.noble@blackstone.com

leaked email:leaked email:leaked email:leaked email:elizabeth.meriwether@blackstone.com
elizabeth.***@******.com

monty
***

Server(s) and 1 Unix/Linux host(s)High
Many password cracking tools rely on dictionary rulesets, so it is important to avoid common passwords (such as Aa123456
or P@ssw0rd) and
AV/EDR Bypass
tiffany.milano@blackstone.com
ritwik.lodhiya@blackstone.com
scott.sacci@blackstone.com
regular, unmodified dictionary terms. Inserting intentional, idiosyncratic misspellings or using acronyms is the recommended best practice.
Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions
leakedemail: duff@blackstone.com
email:
leakedemail:
You
can enhancePentera's cracking abilities byleaked
uploadinga custom wordlist to Pentera's Custom
Dictionary
and retest to uncover passwords
cederqvist@blackstone.com
that could be predicted or guessed by attackersjuan.piedra@blackstone.com
who invest in social engineering techniques andare familiar with their targets.

152 Total Action Approvals
1 Approved (1%)

4.5

151 Not Approved (99%)

anna.makris***

1013 Total Actions
Identity Exposure Trend

420 Successful (42%)

593 No-results (58%)

Several non-admin users are reusing passwords
46 occurrences

8Testing Results for 2 Targeted Hosts
AV / EDR Bypass

Ransomware CompletedRansomware Interrupted

Found No Files To Encrypt

Performed all campaignrelated actions

Interrupted by security
controls or network
connectivity
issuesCanceled

Targeted standard userrelated files| BB- SA 90
RANSOMWARE
READINESS

0 Hosts

0 Hosts

Encrypted files while
bypassing endpoint
security controls

0 Hosts

Ransomware
Readiness
Executive Summary

1 Hosts

Cyber Resilience Score & Settings

Resilience Score over Last 1 Runs

2023

Name:
Description:
R esilience
Score

C+

2023

BB - SA 90
BB - SA 90

20042023

Type:

Penetration Testing (Black Box)Time & Duration:

Jul 07 2022 12:02 - Jul 07 2022 14:30, 02:28

Included IP Range(s):192.168.90.0 - 192.168.90.9, 192....

| Ransom -Action
Anders- Lockbit
Approval Score:

2 Ranges

1 / 152 - 0%

User Input:

1 - IP Range(s)ResilienceSuccess
Score Over
Last 8 Tasks
Rate
ActionExecutive
Summary

55% (6Canceledof 11)

Payload LaunchFile Enumeration
R esilience
Score

LockBit Ransomware EmulationTime

Jan 05 2023 11:55 - Jan 05 2023 12:09 100%
0%Test Name

Ransom - Anders - Lockbit
ransom0%

IP ranges

1

100%
0%

Data Exfiltration to

Designated C2Targeted Hosts of Testing Candidates*

100% (2 of 2)

Process Manipulation Description

100%

Encryption
Data Exﬁltration

Percentage Scoreof hostsCard
that proved
Resilience

resilient to ransomware.
ExcludesHost Modiﬁcation
hosts withfiles to test
Criticalno
Assets55%

Type| Ransom - Anders - Lockbit

0%
100%
0%
100%

Congratulations! Pentera wasn’t able to compromise any critical assets in your network

Credentials and Account Takeover

Testing Results for 2 Targeted Hosts

Congratulations! Pentera wasn’t able to take over your accounts and credentials

Introduction
Sniffing
AV / EDR
BypassRansomware CompletedRansomware Interrupted
0 Hosts
0 Hosts
0to Hosts
Ransomware
your organization prepare15
65
HostsEmulation aims to help
60
Hosts
Hosts
Sniffed 1 credentials and performed 13 relay attacks

Candidates - Live hosts found to be suitable for ransomware emulation. May require user approval to execute the attack.
Targeted Hosts - Hosts tested against the ransomware emulation kill chain following automatic/user approval.

withstandagainstthe most damaging cyber attacks known today. The
Password
Strength
Encrypted
files
while
Performed all campaignInterrupted by security
Cracked 4anout end-to-endof 25 passwords: attack
4 easytest executes
ﬂow of a well-known ransomware
bypassing endpoint
related actions
controls or network
campaign,
built to mirror the attack as observed in the wild. Theconnectivity
goal ofsecurity controls
issuesthe testLateralis toMovement
validate the antivirus and endpoint detection and response
Congratulations! Pentera wasn’t able to perform lateral movement in your network
tools deployedin your network.

MediumFound No Files To Encrypt

51 Hosts

Page 3 / 14

MediumTargeted standard userrelated files

Resilience
Score
Accessible
Dataover Last 1 Runs

CriticalGained access to 351802 File(s) and 10 Hosts (with complete access)CriticalHost Takeover
Pentera was able to ‘take over’¹ 10 out of 20 hosts (50%): 5 Windows Workstation(s), 4 Windows
Server(s) and 1 Unix/Linux host(s)High

AV/EDR Bypass
Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions

152 Total Action Approvals
Action Success Rate
1 Approved (1%)

151 Not Approved (99%)

Payload Launch

Original Point of Entry

1013 Total Actions
420 Successful (42%)

593 No-results (58%)

55% (6 of 11)
55%

9

|
| BB
- SA ATT&CK
90
MITRE
HEAT MAP

MITRE ATT&CK Matrix for Enterprise - Heat Map (2 of 2)

MITRE
ATT&CK
Heat Map
Executive
Summary
Cyber
Resilience
ScoreDiscovery& Settings
Credential
AccessRemote System

Adversary-in-the-Discovery

MiddleR esilienceT1018
Score

T1557

LLMNR/NBT-NS

C+

System Information

Lateral Movement

Name:

Remote Services

Description:
T1021 Type:

Collection

T1071
Penetration
Testing T1020(Black Box)

Data from Local

T1082

T1021.001

Network Sniffing

Network Service

T1040

T1046

ForcedNetwork Share

Authentication

Discovery

Web Protocols

User Input:

1 - IP Range(s)File Transfer

Component Objec…

Protocols

T1021.003

T1071.002

Windows Remote

T1135

Credential Dumping

Network Sniffing

Unencrypted/Obf…
T1048.003

Remote File Copy

Admin Shares
T1021.002

T1105

Exploitation of
Cloud Service

Manager
Resilience
Score Card
Discovery
T1003.002

Exfiltration Over

T1095

T1040

Security Account

T1048

Application Layer…

SMB/Windows

T1003

2 RangesStandard Non-Management
T1021.006

T1187

Exfiltration Over192.168.90.0 - 192.168.90.9,
192....
Alternative…
1 / 152- 0%
T1071.001

Distributed

Exfiltration

Jul 07 2022 12:02 - Jul 07 2022 14:30, 02:28

Action Approval Score:
T1005

ImpactAutomated

T1039

T1557.001

Resilience Score Over Last 8 Tasks

Application Layer

BB -Protocol
SA 90

Included IP Range(s):ProtocolSystemScanning

BB - SA 90

Exfiltration

Shared Drive

Discovery

Poisoning and SM…

Command and Control

Data from Network

Time & Duration:

Remote Desktop

Canceled

Remote Services
T1210

Critical Assets

T1526

Congratulations! Pentera wasn’t able to compromise any critical assets in your network

LSASS Memory

Taint Shared Content

Gather Victim

Credentials and Account Takeover

Identity Information

Congratulations! Pentera wasn’t able to take over your accounts and credentials

T1003.001

T1589

T1080

MediumSniffing
Sniffed 1 credentials and performed 13 relay attacks
Credentials
fromFile and Directory
Password Stores
Discovery

T1555

MediumPassword Strength
Cracked 4 out of 25
passwords: 4 easy
T1083

Credentials from

Lateral Movement System Owner/User

Web Browsers

Congratulations! Pentera wasn’t able to perform lateral movement in your network

T1555.003

Accessible Data

Discovery

Critical

T1033

Gained access to 351802 File(s) and 10 Hosts (with complete access)Steal or Forge
Kerberos Tickets

Host Takeover

T1558

Permission Groups

CriticalDiscovery

Pentera was able to ‘take over’¹ 10 out of 20 hosts (50%): 5 Windows Workstation(s), 4 Windows
Server(s) and 1 Unix/Linuxhost(s)
T1069

Brute Force
AV/EDR Bypass

High

Password Policy

Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions

Discovery

T1110
T1201

152 Total Action Approvals
UnsecuredCredentials

Query Registry1013 Total Actions

T1552

1 Approved (1%)

T1012
151 Not Approved (99%)

420 Successful (42%)

593 No-results (58%)

10Page 19 / 22

Name Resolution Protocols (LLMNR/NBNS/mDNS)

Page 1 of 5

| BB
- SA 90
REMEDIATION
WIKI

Name Resolution Protocols (LLMNR/NBNS/
mDNS)
Name
ResolutionScore
Protocols(LLMNR/NBNS/mDNS)
Cyber Resilience& Settings
Remediation
Executive Summary
Remediation
WikiWiki

MITRE
MITRE
R esilience
LLMNR/NBT-NSScore
Poisoning and Relay (T1171)

Insight
Insight

C+

Canceled

Name:

BB - SA 90

Description:

BB - SA 90

Type:

Penetration Testing (Black Box)Time & Duration:

Jul 07 2022 12:02 - Jul 07 2022 14:30, 02:28

Included IP Range(s):192.168.90.0 - 192.168.90.9, 192....

Action Approval Score:1 / 152 - 0%

2 Ranges

Input:LLMNR (Link-Local Multicast Name Resolution),User
NBNS(Netbios Name Service) and(Multicast Domain Name Service) are
1 -mDNS
IP Range(s)Microsoft Windows protocols which serve as alternate methods of Name Resolution. If a machine tries to resolve a particularhost,
but DNS
resolution
fails,
the machine will then attempt to ask all other machines on the local network for the correct
Resilience
Score
Over Last
8 Tasks
address via LLMNR, NBNS or mDNS. Since this operation is performed using broadcast or multicast queries with no means ofvalidation, it is susceptible to malicious answers distributed by an attacker, effectively poisoning the network.

ImpactImpact
An attacker can listen on a network for these LLMNR (UDP/5355) or NBNS (UDP/137) broadcasts and respond to them,pretending that the location of the requested host is at the attacker’s machine.
Let’s look at an example in the diagram below:

Resilience Score Card
Critical Assets
Congratulations! Pentera wasn’t able to compromise any critical assets in your network

Credentials and Account Takeover
Congratulations! Pentera wasn’t able to take over your accounts and credentials
MediumSniffing
Sniffed 1 credentials and performed 13 relay attacks

MediumPassword Strength
Cracked 4 out of 25 passwords: 4 easy

1.
2.
3.
4.
5.
6.
7.
8.

Lateral Movement

The Congratulations!
victim machine
wants
to go
print server
at \\ftpserver,
but mistakenly types in \\frpserver
Penterawasn’tabletheto perform
lateral movement
in your network
The DNS server responds to the victim that no dns record was foundCriticalThe Accessible
victim turn
Data to the network and asks by using LLMNR or NBNS if there is anyone knows the location of \\pntserver
The Gained
attacker
responds
theandvictimthat\\pntserveris his own IP address
accessto 351802 toFile(s)10 Hosts(withcomplete access)
The victim believes the attacker and starts a session with him
CriticalThe Host
attackerasks the victim to authenticate
Takeoverwas ableits
to ‘takeover’¹ 10 out
of 20 hosts(50%): 5 Windows Workstation(s), 4 Windows
The Pentera
client sends
credentials(NTLMv1/ NTLMv2)
Server(s) and 1 Unix/Linux host(s)The attacker can now crack the hash to discover the password
High

AV/EDR Bypass

Recommendations
Recommendations

Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions

Disable the protocols: mDNS, LLMNR, and NBNS.

152 Total Action Approvals
1 Approved (1%)

151 Not Approved (99%)

1013 Total Actions
420 Successful (42%)

COPYRIGHT AND PROPRIETARY CONFIDENTIAL INFORMATION OF PENTERA® LTD. 2021

593 No-results (58%)

11

| BB
- SA 90
REMEDIATION
WIKI
Name Resolution Protocols (LLMNR/NBNS/mDNS)

Executive Summary

Page 2 of 5

Canceled

DisablemDNS
Cyber Resilience
DisablemDNSScore & Settings
There is a mDNSResponder.exe process that belongs to the Bonjour Service in Windows, which is Apple’s “Zero- SAand
90 others. It can be disabled by using
Configuration Networking” application, typicallyName:
installed automatically by iTunes,BB
Skype
GPO.

Description:

BB - SA 90

R esilience
Disable LLMNR
Score via GPO

Type:

Penetration Testing (Black Box)Time & Duration:

Jul 07 2022 12:02 - Jul 07 2022 14:30, 02:28

Included IP Range(s):192.168.90.0 - 192.168.90.9, 192....

Action Approval Score:1 / 152 - 0%

User Input:

1 - IP Range(s)Disable LLMNR via GPO

C+

2 Ranges

Resilience Score Over Last 8 Tasks

1.
2.
3.

Create a new GPO record for all computers in the environment.
Navigate to Local Computer Policy / Computer Configuration / Administrative Templates / Network / DNS Client.
Set Turn Off Multicast Name Resolution to Enabled.

Resilience
Score
DisableNBNS
a DHCP
environment
DisableNBNS
in CardainDHCPenviroment
Critical Assets
Congratulations! Pentera wasn’t able to compromise any critical assets in your network

Credentials and Account Takeover
Congratulations! Pentera wasn’t able to take over your accounts and credentials
MediumSniffing
Sniffed 1 credentials and performed 13 relay attacks

MediumPassword Strength
Cracked 4 out of 25 passwords: 4 easy

Lateral Movement
Congratulations! Pentera wasn’t able to perform lateral movement in your network

1.
2.
3.
4.
5.
6.
7.

Go to DHCP Management
Accessible Data
Go toGained"scopeoptions"
forFile(s)theandnetworkyouarechanging
accessto 351802
10 Hosts(withcomplete
access)Right click and Configure Options
SelectHostAdvanced
Takeover tab and change "Vendor class" to "Microsoft Options"
In the"Available
Options"frame,
selectand checkbox Workstation(s),"001 Microsoft
Disable Netbios Option"
Penterawas ableto ‘take over’¹
10 outof 20 hosts(50%): 5 theWindows
4 Windows
Server(s) and 1 Unix/Linux host(s)In the"Data Entry" frame, change the data entry to 0x2
Click "OK". The new settings will take affect when the clients renew their addresses.
AV/EDR Bypass

CriticalCriticalHigh

DisableNBNS
NBNS
a single
Disableonon
a single
hosthost

Congratulations! Pentera wasn’t able to bypass your Antivirus/EDR solutions

1.
2.

Open the Control Panel > Network and Sharing Center.
Select Change adapter settings.

152 Total Action Approvals
1 Approved (1%)

151 Not Approved (99%)

1013 Total Actions
420 Successful (42%)

593 No-results (58%)

12

w w w. Pe n t e r a . i o