ITSY 1300 - Learning Activity Plans

ITSY 1300 - Learning Activity Plans Learning Activity 1

Learning Outcome (Use Legion software to detect and map network shares, and attempt a brute force attack against password protected shares)

Students will deploy Legion software on a work station to collect information about potential vulnerabilities within the network. By utilizing Legion the student will be able to identify network shares and map a drive to that share. This allows several things. First, an administrator can check to ensure that, if permitted, shares have adequate password protection. Second, this simple scan allows administrators to detect holes within the network that can be utilized by an intruder to insert/install additional monitoring software on the target computer.

Recommended Resources for this Learning Activity

Legion Available for download: http://packetstormsecurity.org/groups/rhino9/,

Platforms supported: All versions of Windows and Unix. Legion is a NetBIOS scanner which can enumerate NetBIOS file shares across large ranges of IP addresses. Legion also provides a brute force password cracking component which can be directed against a single NetBIOS file share.

Recommended Instructor Preparation for Learning Activity

Instructor Notes:

Legion performs its scan/enumeration of shares in two phases. First, Legion performs a simple port scan looking for systems which respond to connection attempts on TCP port 139 (NetBIOS-ssn).

Second, Legion reconnects to each system share that responded to the port scan in phase one with a more extensive probe. As each share is probed again, Legion once again establishes a NetBIOS-ssn connection over TCP port 139.

The way this looks to the system is as follows:

9 LEGIONBOX01 *SMBSERVER TCP: D=139 S=2168 SYN SEQ=100114 LEN=0 WIN=8192

10 *SMBSERVER LEGIONBOX01 TCP: D=2168 S=139 SYN ACK=100115 SEQ=173595 LEN=0 WIN=8760

11 LEGIONBOX01 *SMBSERVER TCP: D=139 S=2168 ACK=173596 WIN=8760

***Note*** Legion follows the sequence numbers accordingly. Ask the students if the incremental sequence numbers could be used for something other than just this scan. (ie session hijacking) Once Legion completes the three way handshake it initiates a NetBIOS session request to the destination system using “*SMBSERVER<20>” as the Called NetBIOS name. If the destination system accepts the NetBIOS session request it responds positively and the session is established.

12 LEGIONBOX01 *SMBSERVER NETB: D=*SMBSERVER<20> S=LEGIONBOX01<00> Session request 13 *SMBSERVER LEGIONBOX01 NETB: Session confirm

Once this has been accomplished, the target ends the NetBIOS session but leaves the NetBIOS-ssn TCP connection in place to allow further communication between these two systems in the future.

Instructor Notes: At this point the instructor should have at least two (2) target machines that have at least two (2) network shares configured. One should be password protected and the other should be left open. Make note of the IP addresses for the target machines to give to the students. A more realistic approach would be to give them a small range to scan so they can discover the shares.

Have the students download and install the Legion software. Once the installation is complete, have the students begin their scan. Scanning Using Legion:

When Legion is started the initial screen appears, and gives the user two scan types choose from, “Scan Range” and “Scan List”. The Scan Range option allows the user to scan a range of IP addresses up to an entire class B network. To perform this function the user simply has to check the Scan Range radio button, fill in the starting and ending IP addresses of the range they wish to scan, choose a connection speed, and click the Scan button. In order to scan a list of individual IP addresses, the user needs to check the Scan List radio button, then type each targets IP address into the Scan List box, then click add, select a connection speed, then finally begin the scan by clicking the Scan button. If the user has a large list of target IP addresses to scan, Legion allows importing a list of IP addresses from a standard text file by clicking the Import List button.

***No matter which scan type chosen the results are given in an Explorer-type view. Simply navigating this tree the user can now map any share by highlighting it in the left-hand panel and clicking the Map Drive button at the bottom of the screen.*** Legion will then automatically display the shares detected and present them in a format as seen in the picture above. Instructor Notes:

At this point have the students expand the shares by clicking the “+” in the left pane. This will show all available shares that can be mapped as virtual drives on the students machine. Instructor Notes: Have the students click the Map Drive button and the share will be mapped on their machine. A confirmation will be given. Instructor Notes: Have the students verify the share by exploring My Computer. Instructor Notes: The students can then open and explore the share, and save files or copy files that they need. This is intended to show the students the inherent security risks of not only allowing network sharing, but by having no password protection on the shares. Using Legion to Perform a Brute-force on a password protected share:

When you need to attempt a brute force password cracking attack against a NetBIOS share with share level access, you can initiate the Brute Force Password Cracking Tool by clicking the Show BF Tool button at the bottom of the screen. The Force Share dialog box will appear. The user must type the name of the target share in the Path dialog box and add one or more word lists to the Word Lists dialog box, then click the Start button.

Legion will display a response informing the user whether the brute force attempt was successful or not. If a successful password crack is initiated, Legion will then map the share to the first available drive and let the administrator/hacker know.

Instructor Notes: Show the event viewer logs from the server or target machine so the students become familiar with the pattern/fingerprint that a Legion attack leaves on the machine. This will help the future administrators identify the attack and allow then to fix the problem.

Attack Signature

The true signature of a Legion enumeration attempt, as well as many other enumeration attempts are inbound NetBIOS session TCP connections to TCP port 139. Unfortunately, Microsoft has not implemented a native capability into their platforms which will allow the monitoring and logging of network level events such at these. On systems the share enumeration component of Legion does result in the generation of a Privilege Use Success Event #576 in the Security Event Log, and the brute force password cracking tool results in the generation of Logon/Logoff Failure Events #529 (and potentially #539 if the account gets locked out) in the Security Event Log.

Protect Against Legion

For WinNT/2000/XP Systems:

1) Prevent the anonymous user from connecting to a null session and enumerating system information by setting the RestrictAnonymous registry key. See Microsoft knowledge base article Q143474 for information regarding the implementation of this feature. 2) If you are connected to a LAN and you must use NetBIOS file sharing, adhere to the Principle of Least Privilege when granting access to those shares. (i.e. Share only the directories that are absolutely required, make the share read only if possible, grant user level share access only to required individuals). 3) Install a personal firewall, implement a security policy which denies inbound access to the NetBIOS over IP ports (TCP and UDP ports 135 through 139), and monitor the firewall logs for signs of illicit activity. 4) Ensure that the account policy is configured to lock out all accounts after a small number of unsuccessful login attempts.

For the Network:

1) Block all inbound network traffic destined for the NetBIOS over IP ports (TCP and UDP ports 135 through 139) at the perimeter firewall or perimeter router.

Instructor Notes: At this time, have the students begin their scans.

ITSY 1300 Hands-on Lab

1. Perform a Scan Range scan first. What is the range of the scan? ______

2. How many targets are identified in the scan? ______

3. How long did the scan take? ______

4. How many shares were found during the scan? ______5. Once the scan was complete, were there any shares that had password protection? ______

6. Map a drive to the shares. Are you able to view My Computer and see your new share/ mapped drive? ______

7. Are you able to access that drive as if the mapped drive were on your machine? ______

8. What could be a potential threat associated with a share that is mapped? ______

9. Choose your own IP range for a scan and list the range below. ______

10.Were any shares identified during this scan? If so, what were they? ______11.Are you able to map a drive to these shares? ______

12.Are you able to access the mapped drive that you just created? ______

13.From an Administrator point of view, what hazards does this share impose on the network? ______

14.Are you allowed to copy or save from or to the mapped drives? ______

15.What hazards could this impose on the network? ______

16.Perform a List Scan. What is/are the IP addresses of the scan? ______

17.How many targets are identified in the scan? ______18.How long did the scan take? ______

19.How many shares were found during the scan? ______

20.Once the scan was complete, were there any shares that had password protection? ______

21.Map a drive to the shares. Are you able to view My Computer and see your new share/ mapped drive? ______

22.Are you able to access that drive as if the mapped drive were on your machine? ______

23.Try and copy a file to the shares. Was it successful? If yes, what advantages could this allow an intruder to do? ______

24.Choose your own IP range for a scan and list the range below. Then save the range as a text file. What is the name of the text file? ______25.Were you able to scan that range using the text file? ______

26.In your own words, do you believe that network shares are a hazard or valuable tool that should continue to be utilized on a network regardless of the vulnerabilities?