Penetration Test Report (Volkis): Volkis   Anonymous Client   Penetration Test May 2023

™
Penetration Test
PreparedforClient,26February2023
Table of Contents
Executivesummary 3
Overview 6
Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Rootcauseanalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Effectivesecuritypractices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Additionalrecommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
AttackWalkthrough 16
Reconnaissance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Gainingalow-privilegedaccount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
PrivilegeEscalation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Post-Exploitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
DetailedVulnerabilities:External 24
Vulnerability1:Unpatchedsystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Vulnerability2:SSHmisconfigurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Vulnerability3:TLSmisconfigurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
DetailedVulnerabilities:Internal 28
Vulnerability4:ADCSattacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Vulnerability5:DHCPv6poisoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Vulnerability6:Kerberoasting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Vulnerability7:Nameresolutionpoisoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Vulnerability8:Unpatchedandunsupportedsystems . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Vulnerability9:Weakpasswordpolicy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Vulnerability10:Coercedauthentication(authenticated) . . . . . . . . . . . . . . . . . . . . . . . . 45
Vulnerability11:Machineaccountquota . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Vulnerability12:NTLMrelay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Vulnerability13:Passwordstoredinuserdescription. . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Vulnerability14:Unconstraineddelegationconfiguration . . . . . . . . . . . . . . . . . . . . . . . . 53
Vulnerability15:RDPterminallevelauthentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
DetailedVulnerabilities:Wi-Fi 55
Vulnerability16:Eviltwinattack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Vulnerability17:MFABypassthroughGuestwirelessnetwork . . . . . . . . . . . . . . . . . . . . . . 57
Appendices 58
AppendixA:SSHmisconfigurationdetails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
AppendixB:TLSmisconfigurationdetails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
AppendixC:Externalpenetrationtestingmethodology . . . . . . . . . . . . . . . . . . . . . . . . . 63
AppendixD:Internalpenetrationtestingmethodology. . . . . . . . . . . . . . . . . . . . . . . . . . 65
AppendixE:Wirelesspenetrationtestingmethodology . . . . . . . . . . . . . . . . . . . . . . . . . 68
PenetrationTest-Client Page1
Version1.0,released26February2023
AppendixF:Riskassessmentmethodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
AppendixG:Documentcontrol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
PenetrationTest-Client Page2
Version1.0,released26February2023
Executive summary
ParentCompany(Client)engagedVolkistoperformpenetrationtestingontheirinternal,externalandWi-Fi
infrastructure.
Volkisusedthesamehackingtoolsthathackerswillusetoinvestigateandunderstandthescope,thenfindand
exploitidentifiedsecurityvulnerabilities.Thetestinginvestigatedtheinternalandexternalinfrastructurefor
securityvulnerabilitiesthatcouldpresentrisktoClient.Suchasviewingsalesdata,viewing/editingemployee
personalidentifiableinformation(PII),businessstrategydocuments,financialfraudanddisruptiontoemployee
dailyoperations.
VolkiswereunabletocompromiseClient’sexternalenvironmentwithinthedurationoftheengagement.However,
Volkiswasabletocompletelycompromisetheinternalenvironmentduetothepresenceofseveralhighrisk
vulnerabilities.
TheconsultantwasactingasathreatactorwhohadaplanteddeviceontheClientinternalnetwork.Chaining
multiplevulnerabilitiestogetherallowedtheconsultanttocompromisetheclient.net.audomainwhichgavethe
controlofallWindowsserversinthedomain,accesstoemployeePII,salesdataandstrategicdocuments.Theroot
causesofthecompromisecanbeattributedtoweakpasswordpractices,insecuremulti-factorauthentication
(MFA)policyandvulnerableactivedirectoryconfigurations.
Client’spasswordpolicyallowsforshortandcommonpasswords. Whenpairedwithalackofawarenessin
passwordmanagement,theresultswerepasswordsthatwereeasyforanattackertoguessandcrack.Thisaided
incompromiseofaccountswithintheActiveDirectoryenvironment.Afterinterceptingandcrackingemployee
passwords,theconsultantswereabletoaccessemployeeMicrosoft365(M365)servicessuchasSharePoint,
MicrosoftTeamsandOneDriveduetoaninsecureconditionalaccesspolicybypassingtheMFArequirementif
anindividualisonanClientofficenetwork.Furthermore,theActiveDirectoryenvironmentcontainedvarious
defaultandvulnerableconfigurationswhichallowforprivilegeescalationtothehighestlevelofaccess(Domain
Admin)withintheenvironment.ThisindicatesthattheActiveDirectoryenvironmenthasnotbeenhardened
againstthreatactors.
AnattackerwithDomainAdminprivilegescanexecuteattacksagainstClientwiththehighestpossiblelevelof
impact.Thisincludessignificantdisruptiontobusinessoperationsbyexecutingaransomwareattackagainst
thewindowsserversintheinternalenvironmentfromwhichitmaybeimpossibletofullyrecover.Additionally,
accesstotheDomainAdminaccountallowstheattackertoextractandcrackthepasswordsofalluseraccounts.
PenetrationTest-Client Page3
Version1.0,released26February2023
ThiscouldleadtocompromiseofemployeeMicrosoft365accountswhichareusedtoauthenticatetothirdparty
systemssuchasPayrollsoftwareanddocumentverificationsoftware.Exfiltrationandsaleofemployeepersonal
information,sensitivedataorintellectualpropertymaycausefinancial,legal,andreputationaldamagesfor
Client.
Theexternalpenetrationtestidentifiedtwosignificantissueswithinthetargetenvironment.Firstly,thereare
unpatchedsystems,whichpresentvulnerabilitiesthatcouldbeexploitedbymaliciousactorstogainunau-
thorizedaccesstosensitiveinformationorcauseadisruptiontotheservice. Secondly,cryptographyissues
wereidentified,whichcouldpotentiallyleadtotheexposureofsensitivedataandcompromiseofthesystem’s
confidentiality.
Toimprovetheoverallsecurityposture,Clientshouldfollowtherecommendationslaidoutinthisreport.Volkis
recommendsperformingthefollowinghighleveltasks:
• Improvethepasswordpolicy.
• HardentheActiveDirectoryenvironment.
• Conductinformationsecurityawarenesstrainingforallemployees.
• DisallowMFAexceptionsifyouareonthelocationonaClientofficenetwork.
Formoreinformationaboutthisreport,theidentifiedvulnerabilities,andadditionalservicesthatcouldhelp
youinyoursecurityjourney,pleasecontactyourVolkisconsultant:
VolkisConsultant
• Email:consultant1@volkis.com.au
• Mobile:[PII_REDACTED]
External
Title Risk
1 Unpatchedsystems High
2 SSHmisconfigurations Low
3 TLSmisconfigurations Low
Internal
Title Risk
4 ADCSattacks High
5 DHCPv6poisoning High
6 Kerberoasting High
7 Nameresolutionpoisoning High
8 Unpatchedandunsupportedsystems High
9 Weakpasswordpolicy High
Continuedonnextpage
PenetrationTest-Client Page4
Version1.0,released26February2023
Title Risk
10 Coercedauthentication(authenticated) Medium
11 Machineaccountquota M