-The article is concerned with the procedure for ethical testing of computer systems' resource security. The capabilities of the Metasploit Framework testing tool are considered. The key “pain points” of modern corporate systems are identified. The general scheme and the security testing procedure are suggested. Vulnerability collection phases, checking the probability of exploiting discovered vulnerabilities, influence zone extension and privilege escalation are discussed in detail. It is shown that the proposed approach allows the maximum number of vulnerabilities to be detected.
INTRODUCTION
Very few experts specializing in security testing have ever
faced the situation when they were unable to fully compromise
a network in the course of internal penetration testing [7]. The
reasons for ethical hackers to succeed are trite: weak passwords,
no critical security updates, configuration errors [
Before coming to grips with engineering problems, we should understand what may interest potential attackers and how they will act.
II.
INFORMATION ATTACKERS ARE INTERESTED IN
As a rule, cyber-attackers are motivated by money earned on successful hacking (theft of funds, blackmail, carrying out orders for a party concerned) or by their own curiosity and willing to check what they are capable of. Attackers may aim at whatever permitting them either to steal or earn. Apart from any system operated by an organization, their aim may be folders on file servers and documents on users’ workstations.
III.
HIGH RISK AREAS
The main reason why somebody fails to update security or change a default password is a lack of responsible and proper 1. 2. 3. 4. 5. 6.
METASPLOIT FRAMEWORK GENERAL HANDLING
PROCEDURE
As we have chosen Metasploit Framework as a security testing tool, we need to describe the basic algorithm of handling its constituent modules.
The module is handled by performing the following steps: Search for a suitable module using the search command or Google.
Select the module by the use command.
View the chosen module settings using show options or show advanced commands.
Specify a specific setting using the set command.
Set verbose output using the set verbose true command. Run the module using the run command.
Security testing of information systems is often a creative
process that, nevertheless, can and should be structured to
obtain comparable and complete testing results [
The following sources provide a good description of
security testing methodologies [
Penetration Testing Execution Standard (PTES); Open Source Security Testing Methodology Manual (OSSTMM); Technical Guide to Information Security Testing and Assessment (NIST SP 800-115);
OWASP Testing Guide.
PTES offers a detailed structure of the tasks to be tackled during security testing and exemplifies the use of various tools, while giving hardly any details of Metasploit Framework. OSSTM is largely intended for information security managers and contains a very restricted amount of technical information. NIST SP 800-115 was adopted in 2008 and only partially covers modern approaches to security testing. OWASP Testing Guide is only concerned with security testing of web applications and contains a detailed and structured description of testing methods and a variety of tool options.
The following diagram (figure 1) depicts a generalized structure of the proposed security testing process.
VI. INFLUENCE ZONE EXTENSION AND PRIVILEGE
ESCALATION
Security testing of any IT infrastructures starts with task definition. In our case we will confine ourselves to searching for the maximum number of real vulnerabilities that may be exploited by potential attackers having physical access to an organization’s computer network.
In order to perform security testing, experts are provided with access to a company’s network. In the course of preliminary information gathering, they will scan subsystems, identify computers’ names, and find public network locations and critical resources.
Ports can be scanned using the “db_nmap – wrapping utility” command for nmap in Metasploit Framework, which allows scanning results to be saved to the database.
It should be borne in mind that if we do not specify the port range explicitly, 1,000 most commonly used ports will be scanned; if we specify the keys -F or -p-, 100 or 65,535 ports will be scanned, respectively.
What we can learn from port scanning results is not only which network ports are open, but also service versions (if the key “-sV” has been used) as well as the presumable OS version (key “-О”) and the equipment manufacturer by the MAC address.
The completed port scanning shows which IP addresses hide domain controllers, DBMS servers, WEB, network equipment and workstations.
As discussed above, public network locations may contain a wealth of information useful for an attacker. It makes sense to search for such locations both with an anonymous credential (blank login/blank password) and a normal user’s credential.
The “auxiliary/scanner/smb/smb_enumshares” and “auxiliary/scanner/nfs/nfsmount” modules should be used to search for SMB and NFS resources, respectively.
It is worth using the “auxiliary/scanner/mssql/mssql_ping” module to search for DBMS MS SQL as it helps not only find DBMS servers by the open UDP port 1434, but also identify the TCP port, via which the database is waiting to be connected.
It is often useful to define NetBIOS names (as they may also contain helpful information, for example, on which system a subsystem pertains to) by taking advantage of the auxiliary/scanner/netbios/nbname module.
The table below lists the key vulnerability detection methods.
From this list, Metasploit Framework implements modules for the methods “Exploitation attempt”, “Fuzzing” and partially “Identifying vulnerabilities by product version”.
The reason why “Identifying vulnerabilities by product version” is not fully implemented in Metasploit Framework is because it primarily uses vulnerability scanners, such as one from Scanner VS, to automatically detect potential vulnerabilities. Note, however, that some exploitation modules in Metasploit Framework support the “check” method that can be used to identify a vulnerability before its exploitation.
Data on network service versions obtained at the port scanning phase is suitable for manual vulnerability analysis. A security tester generates Google search queries of the "service Examples Identifying a product version by the network service banner and browsing for information on the known vulnerabilities of the product Attempting to connect to the Windows system through a zero session and unloading the list of user credentials Starting an exploit against a network service without its prior analysis for conformity to the service Attempting to intercept traffic by means of ARP poisoning Analyzing the Windows register contents Disassembling an executable file to study the logic of program execution and data handling Searching the php code for fragments related to filtration of data entered by the user to get around filtration rules and introduce JavaScript code Entry into a web form of SQL queries and analysis of received error messages version +vulnerability +exploit” type to find pages of specialized resources describing vulnerabilities and exploits.
Metasploit Framework contains a set of fuzzing modules to execute protocols, such as dns, ftp, http, smb, smtp, ssh etc. These modules are available at auxiliary/fuzzers/.
It should be noted that, since security testing projects are normally restricted to a period of 2-3 weeks, security testers confine themselves to automated and manual search of vulnerabilities by version and to exploitation attempts.
In order to exploit vulnerabilities, network services and applied software make use of exploits from Metasploit Framework exploit section. The current number of Metasploit Framework’s ready-to-use exploits is nearing 2,000.
In order to find suitable exploits, security testers utilize the “search” command by the CVE code, service name or version (for example, search vsftpd).
When exploiting a vulnerability, the so-called payload is to be specified. The payload is a code run on a compromised machine. There are a variety of payloads in Metasploit Framework, such as a remote command line, creating a credential, booting a remote administration system etc. Using the remote command line is often the best choice. Metasploit Framework has an extended command line version, Meterpreter, which is now particularly popular with testers.
Password brute forcing has been the most dangerous attack over decades. Metasploit Framework contains a lot of modules designed to execute such attacks. The table below lists the modules that experts typically come across in security testing.
When executing such an attack, the attacker seeks to “poison” ARP tables of two subsystems, the traffic between which he wants to intercept. An attack is often undertaken against the workstation of a particular user (system administrator, chief accountant etc.) and a domain controller or router. Once ARP tables are poisoned, both victim subsystems share network packets via the attacker’s computer. Having run a sniffer, the attacker captures the data of interest, for example, sessions of authentication with password hashes.
An ARP poisoning attack in Metasploit Framework can be executed by making use of the “auxiliary/spoof/arp/arp_poisoning” module.
Successful authorization when executing the NTLM protocol does not require knowing the password – it is enough to have the password hash and credential name. Any operating system using the NTLM protocol can be susceptible to this vulnerability.
A pass-the-hash attack can be executed “exploit/windows/smb/psexec” module. using the
This security testing phase provides us with a list of vulnerabilities that can be exploited by attackers remotely. The exploits run and attacks executed have provided us with access to various systems and with information about compromised credentials.
Testers collect screenshots confirming access as evidence of successful penetration.
The existing access to a system often allows it to be extended to other systems. Privilege escalation permitting a normal user to become an administrator is also possible sometimes.
Let us consider two standard situations that a tester should be aware of to make security testing easier.
Users like utilizing identical passwords in different systems, so it is worth checking once selected pairs “login:password” in all accessible systems.
Serious systems implemented by major companies normally have a test environment used to try out modifications, train users etc. Test environments are often created by restoring from production backups. Because they are test environments, administrator sometimes fail to pay due attention to information security issues. For example, they may create an administrator’s credential with an easily guessed password or fail to set critical OS updates. Upon receiving access to a test environment, security testers unload user data (logins/password hashes) that are largely consistent with those employed in a production system.
Metasploit Framework has a set of so-called postexploitation modules designed to perform the following tasks for access extension and privilege escalation:
(post/multi/recon/local_exploit_suggester); Running a keylogger (post/windows/capture/keylog_recorder); Gathering credentials and hashes (post/windows/gather/credentials/credential_collector) etc.
With this step performed, security testers obtain maximum access and pinpoint actual local vulnerabilities.
The outcome of security testing is a report on discovered vulnerabilities. The report’s key component is information on vulnerabilities, which is normally provided to the customer in the structured form:
Detection – information on vulnerability name and codes and a list of vulnerability-prone subsystems.
Exploitation – screenshots and logs demonstrating vulnerability exploitation; Risk – what vulnerability exploitation may result in; Recommendations – technical and organizational recommendations on elimination of vulnerabilities.
Since Metasploit Framework has no security testing report generation feature, the report is developed by testers.
VII.
We have considered a comprehensive approach to security testing, which can be implemented through Metasploit Framework. Metasploit Framework is an aid in completing the key phases of security testing, except for automated vulnerability search and report generation. These phases, however, are implemented in the Scanner VS complex that comprises Metasploit Framework. When used in conjunction, the described methodology, Scanner VS and Metasploit Framework help discover the maximum number of actual vulnerabilities.
Methodology
Manual.
Online [18] OWASP Testing Guide. Online https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_o f_Contents [19] Penetration testing execution standard. Online standard.org