Penetration Test Report (SPoC): A LIGN SPoC Penetration Test

Client
Penetration Test Report
Fernando Leon
[PII_REDACTED]
fleon@singlepointoc.com
CONTENTS
Executive Summary ....................................................................................................................................... 1
Findings ........................................................................................................................................................... 2
1. Weak Credentials (Critical) ................................................................................................................. 2
2. IPMI v2.0 Password Hash Disclosure (High) .................................................................................... 4
3. IPMI Cipher Suite Zero Authentication Bypass (High) .................................................................... 5
4. Oracle TNS Listener Remote Poisoning (High) ................................................................................ 6
5. SMB Null Session (High) ..................................................................................................................... 7
6. SNMP Agent Default Community Name (Medium) ........................................................................... 8
7. FTP Anonymous (Low) ....................................................................................................................... 9
Methodology ................................................................................................................................................. 10
Planning ...................................................................................................................................................... 10
Discovery .................................................................................................................................................... 10
Attack .......................................................................................................................................................... 11
Reporting .................................................................................................................................................... 11
Scope ............................................................................................................................................................. 13
Internal Network Testing ............................................................................................................................. 13
Internal Testing Starting Points ............................................................................................................... 14
Constraints .................................................................................................................................................. 14
Attack Narrative ............................................................................................................................................ 15
Proprietary and Confidential
EXECUTIVE SUMMARY
(cid:54)(cid:76)(cid:81)(cid:74)(cid:79)(cid:72)(cid:3) (cid:51)(cid:82)(cid:76)(cid:81)(cid:87)(cid:3) (cid:82)(cid:73)(cid:3) (cid:38)(cid:82)(cid:81)(cid:87)(cid:68)(cid:70)(cid:87) Compliance and Security, Inc(cid:3) conducted a penetration test for CLIENT
(“the Company”)(cid:3)from DATE based upon the Authorization to Test document provided by the Company.
(cid:54)(cid:76)(cid:81)(cid:74)(cid:79)(cid:72)(cid:3)(cid:51)(cid:82)(cid:76)(cid:81)(cid:87)(cid:3)(cid:82)(cid:73)(cid:3)(cid:38)(cid:82)(cid:81)(cid:87)(cid:68)(cid:70)(cid:87) followed a(cid:3)testing methodology that sought to identify vulnerabilities and, through
exploitation, determine the impact to(cid:3)the Company’s business operations. (cid:54)(cid:76)(cid:81)(cid:74)(cid:79)(cid:72)(cid:3)(cid:51)(cid:82)(cid:76)(cid:81)(cid:87)(cid:3)(cid:82)(cid:73)(cid:3)(cid:38)(cid:82)(cid:81)(cid:87)(cid:68)(cid:70)(cid:87) assigned a
risk level based on goals achieved during testing.
Internal Network Testing overall risk: HIGH
Description Goal Result
Simulate a malicious Compromise internal (cid:54)(cid:76)(cid:81)(cid:74)(cid:79)(cid:72)(cid:3)(cid:51)(cid:82)(cid:76)(cid:81)(cid:87)(cid:3)(cid:82)(cid:73)(cid:3)(cid:38)(cid:82)(cid:81)(cid:87)(cid:68)(cid:70)(cid:87) abused a known
insider that has systems, elevate to vulnerability to gain a list(cid:3)of all usernames, guessed
internal network administrative access and a weak password and(cid:3)used that account obtain
access. obtain sensitive data. sensitive data that was on(cid:3)internal network shares.
Over the duration of the goal-based testing, (cid:54)(cid:76)(cid:81)(cid:74)(cid:79)(cid:72)(cid:3)(cid:51)(cid:82)(cid:76)(cid:81)(cid:87)(cid:3)(cid:82)(cid:73)(cid:3)(cid:38)(cid:82)(cid:81)(cid:87)(cid:68)(cid:70)(cid:87) attempted to identify and leverage
vulnerabilities that put the Company at the greatest risk. The count of vulnerabilities for the entire
penetration test is shown below:
Vulnerabili(cid:415)es
Total Vulnerabili(cid:415)es 1 4 1 1
Total Vulnerabili(cid:415)es
Cri(cid:415)cal 1
High 4
Medium 1
Low 1
(cid:54)(cid:76)(cid:81)(cid:74)(cid:79)(cid:72)(cid:3)(cid:51)(cid:82)(cid:76)(cid:81)(cid:87)(cid:3)(cid:82)(cid:73)(cid:3)(cid:38)(cid:82)(cid:81)(cid:87)(cid:68)(cid:70)(cid:87)(cid:3)prioritized attack paths that maximized the impact to the Company’s business and
therefore did not(cid:3)attempt to identify or validate every vulnerability that existed in the environment. The
Company should review(cid:3)the results of the engagement, remediate identified weaknesses and continue to
perform regular security(cid:3)reviews, including vulnerability scanning and penetration testing.
Findings from penetration testing often indicate systemic underlying problems. The Company should
investigate the root cause that allowed vulnerabilities to go undetected (e.g., lack of regular vulnerability
scans) or unfixed (e.g., slow patch management).
Penetration testing is also a useful exercise for measuring detection and response capabilities. The Company
should review their alerting and logging processes to identify whether systems detected testing actions and
whether personnel took the appropriate actions.
Proprietary and Confidential 1
FINDINGS
Summarized below are the findings that (cid:54)(cid:76)(cid:81)(cid:74)(cid:79)(cid:72)(cid:3)(cid:51)(cid:82)(cid:76)(cid:81)(cid:87)(cid:3)(cid:82)(cid:73)(cid:3)(cid:38)(cid:82)(cid:81)(cid:87)(cid:68)(cid:70)(cid:87)(cid:3)identified during testing:
1. Weak Credentials (Critical)
Description Devices and user accounts used weak or default credentials and allowed unprivileged
access to the environment.
Found During Internal testing
Instances Host Port Notes
Sample Report – 443/tcp, 623/udp iDRAC root user with default password
Inten(cid:415)onally blank
Sample Report – 443/tcp, 623/udp iDRAC root user with default password
Inten(cid:415)onally blank
Sample Report – 445/tcp authentx, warez, wellpoint domain
Inten(cid:415)onally blank accounts have the same password as the
username
Sample Report – 443/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Sample Report – 80/tcp printer
Inten(cid:415)onally blank
Proprietary and Confidential 2
1. Weak Credentials (Critical)
Solution Consider implementing the following recommendations, which are based off NIST
Special Publication 800-63B:
(cid:120) Lock out accounts after 10 invalid logon attempts
(cid:120) Require passwords to be at least 12 characters in length
(cid:120) Use passphrases (e.g., “Secure the summit with (cid:54)(cid:76)(cid: