Penetration Test Report (OffensiveSecurity): penetration testing sample report 2013

Penetration Test Report
MegaCorp One
August 10th, 2013
Offensive Security Services, LLC
19706 One Norman Blvd.
Suite B #253
Cornelius, NC 28031
United States of America
Tel: 1-­‐402-­‐608-­‐1337
Fax: 1-­‐704-­‐625-­‐3787
Email: info@offsec.com
Web: http://www.offensive-­‐security.com
PENETRATION TEST REPORT – MEGACORP ONE
Table of Contents
Executive Summary 1
Summary of Results 2
Attack Narrative 3
Remote System Discovery 3
Admin Webserver Interface Compromise 6
Interactive Shell to Admin Server 9
Administrative Privilege Escalation 12
Java Client Attacks 13
Escalation to Local Administrator 15
Deep Packet Inspection Bypass 16
Citrix Environment Compromise 20
Escalation to Domain Administrator 24
Conclusion 28
Recommendations 29
Risk Rating 30
Appendix A: Vulnerability Detail and Mitigation 31
Risk Rating Scale 31
Default or Weak Credentials 31
Password Reuse 32
Shared Local Administrator Password 32
Patch Management 33
DNS Zone Transfer 33
Default Apache Files 33
Appendix B: About Offensive Security 34
PTR-­‐20130513 Copyright © 2013 Offensive Security Services LLC. All rights reserved. Page i
PENETRATION TEST REPORT – MEGACORP ONE
Executive Summary
Offensive Security was contracted by MegaCorp One to conduct a penetration test in order to
determine its exposure to a targeted attack. All activities were conducted in a manner that simulated a
malicious actor engaged in a targeted attack against MegaCorp One with the goals of:
o Identifying if a remote attacker could penetrate MegaCorp One’s defenses
o Determining the impact of a security breach on:
o Confidentiality of the company’s private data
o Internal infrastructure and availability of MegaCorp One’s information systems
Efforts were placed on the identification and exploitation of security weaknesses that could allow a
remote attacker to gain unauthorized access to organizational data. The attacks were conducted with
the level of access that a general Internet user would have. The assessment was conducted in
accordance with the recommendations outlined in NIST SP 800-­‐1151 with all tests and actions being
conducted under controlled conditions.
1 http://csrc.nist.gov/publications/nistpubs/800-­‐115/SP800-­‐115.pdf
PTR-­‐20130513 Copyright © 2013 Offensive Security Services LLC. All rights reserved. Page 1 of 34
PENETRATION TEST REPORT – MEGACORP ONE
Summary of Results
Initial reconnaissance of the MegaCorp One network resulted in the discovery of a misconfigured DNS
server that allowed a DNS zone transfer. The results provided us with a listing of specific hosts to target
for this assessment. An examination of these hosts revealed a password-­‐protected administrative
webserver interface. After creating a custom wordlist using terms identified on the MegaCorp One’s
website we were able to gain access to this interface by uncovering the password via brute-­‐force.
An examination of the administrative interface revealed that it was vulnerable to a remote code
injection vulnerability, which was used to obtain interactive access to the underlying operating system.
This initial compromise was escalated to administrative access due to a lack of appropriate system
updates on the webserver. After a closer examination, we discovered that the compromised webserver
utilizes a Java applet for administrative users. We added a malicious payload to this applet, which gave
us interactive access to workstations used by MegaCorp One’s administrators.
Using the compromised webserver as a pivot point along with passwords recovered from it, we were
able to target previously inaccessible internal resources. This resulted in Local Administrator access to
numerous internal Windows hosts, complete compromise of a Citrix server, and full administrative
control of the Windows Active Directory infrastructure. Existing network traffic controls were bypassed
through encapsulation of malicious traffic into allowed protocols.
PTR-­‐20130513 Copyright © 2013 Offensive Security Services LLC. All rights reserved. Page 2 of 34
PENETRATION TEST REPORT – MEGACORP ONE
Attack Narrative
Remote System Discovery
For the purposes of this assessment, MegaCorp One provided minimal information outside of the
organizational domain name: megacorpone.com. The intent was to closely simulate an adversary
without any internal information. To avoid targeting systems that were not owned by MegaCorp One, all
identified assets were submitted for ownership verification before any attacks were conducted.
In an attempt to identify the potential attack surface, we examined the name servers of the
megacorpone.com domain name (Figure 1).
Figure 1 – Information gathering for megacorpone.com reveals three active name servers.
With the name servers identified, we attempted to conduct a zone transfer. We found that
ns2.megacorpone.com was vulnerable to a full DNS zone transfer misconfiguration. This provided us
with a listing of hostnames and associated IP addresses, which could be used to further target the
organization. (Figure 2) Zone transfers can provide attackers with detailed information about the
capabilities of the organization. It can also leak information about the network ranges owned by the
organization. Please see Appendix A for more information.
PTR-­‐20130513 Copyright © 2013 Offensive Security Services LLC. All rights reserved. Page 3 of 34
PENETRATION TEST REPORT – MEGACORP ONE
Figure 2 – A misconfigured name server allows a full and unrestricted DNS zone transfer.
The list of identified hosts was submitted to MegaCorp One for verification, which verified that the
entire 50.7.67.x network range should be included in the assessment scope. These systems were then
scanned to enumerate any running services. All identified services were examined in detail to determine
their potential exposure to a targeted attack.
PTR-­‐20130513 Copyright © 2013 Offensive Security Services LLC. All rights reserved. Page 4 of 34
PENETRATION TEST REPORT – MEGACORP ONE
Through a combination of DNS enumeration techniques and network scanning, we were able to build a
composite that we feel reflects MegaCorp One’s network.
The target network is shown below in Figure 3. Additional details regarding controls such as deep packet
inspection were discovered later in the assessment but are included here for completeness.
Figure 3 -­‐ Target Network
PTR-­‐20130513 Copyright © 2013 Offensive Security Services LLC. All rights reserved. Page 5 of 34
PENETRATION TEST REPORT – MEGACORP ONE
Admin Webserver Interface Compromise
The admin.megacorpone.com webserver was found to be running an Apache webserver on port 81.
Accessing the root URL of this site resulted in the display of a blank page. We next conducted a quick
enumeration scan of the system looking for common directories and files (Figure 4).
Figure 4 – Enumeration of the admin.megacorpone.com host partially discloses the webserver’s folder structure.
The scan results revealed that along with common Apache default files (Please see Appendix A for more
information), we identified an “/admin” directory that was only accessible after authentication. (Figure
5).
Figure 5 – Access to the “admin” folder is password-­‐protected.
PTR-­‐20130513 Copyright © 2013 Offensive Security Services LLC. All rights reserved. Page 6 of 34
PENETRATION TEST REPORT – MEGACORP ONE
To prepare a targeted brute-­‐force attempt against this system, we compiled a custom dictionary file
based on the content of the www.megacorpone.com website. The initial dictionary consisted of 331
custom words, which were then put through several rounds of permutations and substitutions to
produce a final dictionary file of 16,201 words. This dictionary file was used along with the username
“admin” against the protected section of the site.
Figure 6 – Using a custom word dictionary it is possible to discover the administrative password for the “admin” folder.
This brute-­‐force attack uncovered a password of “nanotechnology1” for the admin user. We were able
to leverag