Ptest Method Documentation Release 1 Villalongue Maxime Dec 13, 2018 The Essentials 1 The Essentials Series 3 1.1 Cybersecurity in an Enterprise......................................3 1.2 Linux Basics............................................... 13 2 Infrastructure Pentest Series 35 2.1 Intelligence Gathering.......................................... 35 2.2 Vulnerability Analysis.......................................... 44 2.3 Exploitation............................................... 142 2.4 Post Exploitation............................................. 184 2.5 Reporting................................................. 211 2.6 Configuration Review.......................................... 212 2.7 Wireless Pentesting............................................ 220 3 Hardening Series 223 3.1 Securing your Debian.......................................... 223 4 Metasploit Documentation 231 4.1 Fundamentals............................................... 231 4.2 Information Gathering.......................................... 286 4.3 Vulnerability Scanning.......................................... 305 4.4 Fuzzers.................................................. 321 4.5 Exploit Development........................................... 326 4.6 Client Sides attacks............................................ 352 4.7 MSF Post Exploitation.......................................... 361 4.8 Meterpreter Scripting........................................... 396 4.9 Maintaining Access........................................... 412 4.10 MSF Extended Usage.......................................... 419 4.11 Post Module Reference.......................................... 454 4.12 Auxiliary Module............................................ 474 5 Other Tools 553 5.1 Pupy................................................... 553 5.2 CrackMapExec.............................................. 565 5.3 Pupy................................................... 573 5.4 Pupy................................................... 585 6 Uncover Active Directory Pentest 597 i 6.1 Kerberoasting............................................... 597 6.2 PassTheHash............................................... 609 6.3 Trusts................................................... 620 6.4 PasstheTicket............................................... 632 6.5 Mitigations_to_Enumeration....................................... 643 7 Obligatory Disclaimer 655 8 Indices and tables 657 ii Ptest Method Documentation, Release 1 This Repo will be my knowledge database about Pentesting skills. It has been inspired by https://bitvijays.github.io and https://ptestmethod.readthedocs.io. Some of the content will be the same as a starting point. Always keep in mind when you have a problem just launch a search over internet about it, 99 % of the time the comunity has already solved this issue. The Essentials 1 Ptest Method Documentation, Release 1 2 The Essentials CHAPTER 1 The Essentials Series The Essentials Series covers the essential concepts/ skills for somebody who wants to enter the field of CyberSecurity. • CyberSecurity in an Enterprise : IT Technical challenges faced by a company during their transformation from a start-up of two people growing to Micro, Small, Medium-sized, larger size company and their solutions. • Linux Basics : Essential linux commands and concepts required in the Infosec field. 1.1 Cybersecurity in an Enterprise This blog is about the Cybersecurity in an Enterprise. We would start with a simple concept of two people (Alice and Bob) starting a new company and building it to Micro (< 10 employees), Small (< 50 employees), Medium-sized (< 250 employees), larger company. We would walkthru scenarios where company is affected by security breaches, vulnerability assessments excercises. At each stage of the company, we would provide • How the company can be made secure? • What are the challenges faced by the administrators? • How we can make things easy/ automate for the administrators of the company. Hopefully this will provide a general life-cycle of what happens and how things/ security evolve at companies. 1.1.1 Nomenclature There are few terms which would come across: • Current Users : Represents the number of people working in that company. • Current Setup : Represents the current IT Infrastructure the company has. • Security Additions : How we can improve the security of the current infrastructure? • Operations Issues : Any challenges for the IT Team managing the IT Infrastructure? • Operations Additions : How we can improve the management of IT Infrastructure? 3 Ptest Method Documentation, Release 1 1.1.2 New Company Two friends Alice and Bob met up and decided to open a company called Fantastic Solutions. Alice loves Linux (Debian) and Bob loves Windows. So, let’s see what they require at this current point of time? Current Users 2 Users Current Setup • Internet Connection • Home Router with builtin Wi-Fi • Two laptops (One Windows, One Linux) Security Additions Home Router with builtin Wi-Fi • WEP (Wired Equivalent Privacy) • WPA (Wi-Fi Protected Access) • WPA2-Enterprise • Hidden SSID (Service Set IDentifier) • Home Router DNS Entry: No-Ads DNS Servers - free, global Domain Name System (DNS) resolution service, that you can use to block unwanted ads. Few examples are • Adguard DNS • OpenDNS 1.1.3 Micro Enterprise The company started well and hired 8 more people (Let’s say two who loves Linux, two who loves Mac and two who loves Windows) Current Users 10 People Current Setup • New Company Setup Included • File Server (Network Attached Storage) 4 Chapter 1. The Essentials Series Ptest Method Documentation, Release 1 Security Additions • Windows - Microsoft Baseline Security Analyzer provides a streamlined method to identify missing security updates and common security misconfigurations. • Linux/ Mac - Lynis is an open source security auditing tool. Used by system administrators, security profes- sionals and auditors to evaluate the security defenses of their Linux and UNIX-based systems. It runs on the host itself, so it performs more extensive security scans than vulnerability scanners. • File Server (NAS) - Access control lists on folders defining which folder can be accessed by which user or password protected folders. • Firewall - Installing a Firewall just after the Router could permit to block unwanted traffic. Operations Issues • The MBSA and Lynis have to be executed on every machine individually. • Administration of every individual machine is tough. Any changes in the security settings will have to be done manually by an IT person. 1.1.4 Small Enterprise Current Users 45 People Current Setup • Micro Company Setup Included Windows Domain Controller Active Directory Domain Services provide secure, structured, hierarchical data storage for objects in a network such as users, computers, printers and services. Domain Name Server A DNS server hosts the information that enables client computers to resolve memorable, alphanumeric DNS names to the IP addresses that computers use to communicate with each other. Windows Server Update Services (WSUS) Server Windows Server Update Services (WSUS) enables information technology administrators to deploy the latest Mi- crosoft product updates. A WSUS server can be the update source for other WSUS servers within the organization. Refer Deploy Windows Server Update Services in Your Organization 1.1. Cybersecurity in an Enterprise 5 Ptest Method Documentation, Release 1 DHCP Server Dynamic Host Configuration Protocol (DHCP) servers on your network automatically provide client computers and other TCP/IP based network devices with valid IP addresses. Others • Company decided to take 8 Linux Servers (Debian, CentOS, Arch-Linux and Red-Hat). • Added two servers hosting three web-application running on IIS-WebServer, Apache Tomcat and Nginx. Operations Issues • How to manage multiple Linux machines and make sure they are hardened and compliant to security standards such as CIS (Center for Internet Security) or STIG (Security Technical Implementation Guide). Minimum Baseline Security Standard (MBSS) • STIG : A Security Technical Implementation Guide (STIG) is a cybersecurity methodology for standardizing security protocols within networks, servers, computers, and logical designs to enhance overall security. These guides, when implemented, enhance security for software, hardware, physical and logical architectures to further reduce vulnerabilities. • CIS : CIS Benchmarks help you safeguard systems, software, and networks against today’s evolving cyber threats. Developed by an international community of cybersecurity experts, the CIS Benchmarks are configura- tion guidelines for over 100 technologies and platforms. Security Additions Security Compliance Manager Security Compliance Manager : SCM enables you to quickly configure and manage computers and your private cloud using Group Policy and Microsoft System Center Configuration Manager. SCM 4.0 provides ready-to-deploy policies based on Microsoft Security Guide recommendations and industry best practices, allowing you to easily manage configuration drift, and address compliance requirements for Windows operating systems and Microsoft applications. However, effective 15th June 2017, Microsoft retired SCM Security Compliance Manager (SCM) retired; new tools and procedures and introduced Security Compliance Toolkit. Security Compliance Toolkit The Microsoft Security Configuration Toolkit enables enterprise security administrators to effectively manage their enterprise’s Group Policy Objects