Este blog e resultado do trabalho de conclusao do curso de Sistemas de Informacao, com objetivo de apresentar procedimentos para realizacao de analise forense utilizando ferramentas livres. Neste poste estao os procedimentos utilizados pra realizar a analise online. Esta analise foi realizada com os software openVAS e Greenbone.Ambos os softwares mencionados estao disponiveis na distribuicao backtrack. O processo de de configuracao e um pouco demorado mas nao apresentou maiores problemas.Nesta imagem apresentado esta o menu para acesso ao openvas siga de cima para baixo, e depois execute a opcao check, caso seja mostrado que a configuracao esta correta pode iniciar os scans.Na tela abaixo segue a tela obtida apos o scan executado no honeypot.Abaixo o relatorio extraido pelo openvas:I Summary=========This document reports on the results of an automatic security scan.The report first summarises the results found.Then, for each host, the report describes every issue found.Please consider the advice given in each description, in order to rectifythe issue.Overrides are on. When a result has an override, this report uses thethreat of the override.Notes are included in the report.This report might not show details of all issues that were found.It only lists hosts that produced issues.Issues with the threat level "Low" are not shown.Issues with the threat level "Log" are not shown.Issues with the threat level "Debug" are not shown.Issues with the threat level "False Positive" are not shown.This report contains all 2 results selected by thefiltering described above. Before filtering there were 28 results.Scan started: Mon Nov 7 22:02:46 2011Scan ended: Mon Nov 7 22:10:03 2011Host Summary************Host High Medium Low Log False Positive192.168.100.10 1 1 0 0 0Total: 1 1 1 0 0 0II Results per Host===================Host 192.168.100.10*******************Scanning of this host started at: Mon Nov 7 22:02:47 2011Number of results: 2Port Summary for Host 192.168.100.10------------------------------------Service (Port) Threat Levelmicrosoft-ds (445/tcp) Highnetbios-ns (137/udp) MediumSecurity Issues for Host 192.168.100.10---------------------------------------Issue-----NVT: Microsoft Windows SMB Server NTLM Multiple Vulnerabilities (971468)OID: 1.3.6.1.4.1.25623.1.0.902269Threat: High (CVSS: 10.0)Port: microsoft-ds (445/tcp)Description: Overview: This host has critical security update missing according to Microsoft Bulletin MS10-012. Vulnerability Insight: - An input validation error exists while processing SMB requests and can be exploited to cause a buffer overflow via a specially crafted SMB packet. - An error exists in the SMB implementation while parsing SMB packets during the Negotiate phase causing memory corruption via a specially crafted SMB packet. - NULL pointer dereference error exists in SMB while verifying the 'share' and 'servername' fields in SMB packets causing denial of service. - A lack of cryptographic entropy when the SMB server generates challenges during SMB NTLM authentication and can be exploited to bypass the authentication mechanism. Impact: Successful exploitation will let the remote attackers to execute arbitrary code or cause a denial of service or bypass the authentication mechanism via brute force technique. Impact Level: System/Application Affected Software/OS: Microsoft Windows 7 Microsoft Windows 2000 Service Pack and prior Microsoft Windows XP Service Pack 3 and prior Microsoft Windows Vista Service Pack 2 and prior Microsoft Windows Server 2003 Service Pack 2 and prior Microsoft Windows Server 2008 Service Pack 2 and prior Fix: Run Windows Update and