Penetration Test Report (ProCheckUp): CHECK 1 2012

Penetration Test Report
Anonymised
15/11/2011
CONFIDENTIAL
Non-Disclosure Statement: All information obtained during a ProCheckUp assessment about our customer’s systems and assets including,
but not limited to, its procedures and systems, is deemed privileged information and not for public dissemination. ProCheckUp Ltd pledge
their commitment that this information will remain strictly confidential. This information will not be disclosed or discussed to any third
party without the express written consent of the customer. ProCheckUp Ltd is fully committed to maintaining the highest level of ethical
standards in its business practice.
Legal Notice: It is impossible to test for 100% security. This report does not constitute and should not be construed as a guarantee of the
target’s security.
ID Author Date Account Manager
AN151111 Security Consultant 15/11/2011 Account Manager
AN151111
Table of Contents
Non-Disclosure Statement & Legal Notice ............................................................................................................. 5
Non-Disclosure Statement .................................................................................................................................. 5
Legal Notice ........................................................................................................................................................ 5
How to use this report ............................................................................................................................................ 6
Management Summary ...................................................................................................................................... 6
Summary of Findings .......................................................................................................................................... 6
Test Results ......................................................................................................................................................... 6
Severity Scale ...................................................................................................................................................... 6
Document Control .................................................................................................................................................. 7
1 Management Summary .................................................................................................................................. 9
2 Technical Results .......................................................................................................................................... 11
2.1 Reconnaissance Phase ........................................................................................................................ 11
2.1.2 Network sniffing ............................................................................................................................. 11
2.1.3 NetBIOS Name Service & Session Enumeration ............................................................................. 12
2.1.5 Service Discovery ............................................................................................................................ 14
2.2 Exploitation Phase ............................................................................................................................... 15
2.2.1 Network Devices .................................................................................................................................. 15
2.2.2 Windows Vulnerabilities ...................................................................................................................... 15
2.2.3 Password Policy ................................................................................................................................... 17
2.2.4 Remote Control Services ..................................................................................................................... 18
2.2.5 Linux Vulnerabilities............................................................................................................................. 19
2.3 Overview of Findings ........................................................................................................................... 20
3. Test Results ....................................................................................................................................................... 21
3.1. Network Devices - EthernetBoard OkiLAN 8100e ..................................................................................... 21
10.10.10.1 ..................................................................................................................................................... 21
10.10.10.2 ..................................................................................................................................................... 21
10.10.10.3 ..................................................................................................................................................... 21
 VxWorks Debug Service Enabled .......................................................................................... 21
3.2. Windows infrastructure ............................................................................................................................. 22
3.2.1. Domain Controllers – Domain ‘Anonymised1’ – Windows 2008 Server R2 ........................................... 22
10.10.10.70 ................................................................................................................................................... 22
10.10.10.71 ................................................................................................................................................... 22
 Lack of password complexity requirements ......................................................................... 22
 Domain Administrator password cracked ............................................................................. 23
 LAN Manager (LanMan) supported....................................................................................... 24
 NetBIOS leaks sensitive information through the use of null sessions ................................. 25
3.2.2. Additional Servers – Domain ‘Anonymised1’ – Windows 2003 Server R2 ............................................. 26
10.10.10.47 ................................................................................................................................................... 26
10.10.10.49 ................................................................................................................................................... 26
2
AN151111
10.10.10.50 ................................................................................................................................................... 26
10.10.10.51 ................................................................................................................................................... 26
 Remote Desktop Protocol Server Private Key Disclosure Vulnerability ................................ 26
10.10.10.210 ................................................................................................................................................. 27
10.10.10.143 ................................................................................................................................................. 27
 Local Administrator password cracked ................................................................................. 27
10.10.10.110 ................................................................................................................................................. 28
10.10.10.111 ...........................................................................................