A Comprehensive Security Assessment of the Westminster College Unix Lab Jacob Shodd

Overview Goal: To discover security vulnerabilities in order to ensure user privacy and data integrity Testing Environment Project structure Tools used Vulnerabilities found

Testing Environment Utilized the Kali Linux operating system running within virtualbox The test machine is located within the network, not attacking from outside

Enumeration Enumeration is the act of acquiring information about a network and it’s clients. Information to gather: Open ports Running services Operating system versions Unencrypted Packets Sample of tools: Nmap Wireshark Metasploit Sparta

Evaluation Using the information gathered from Enumeration to search for possible exploits Basic vulnerabilities: Default settings Default passwords Well known security flaws Metasploit Large database of confirmed security flaws Integration of multiple tools To be used for common flaws Manual evaluation For vulnerabilities specific to the Unix Lab

Exploitation Confirming and measuring severity of vulnerabilities Record what level of access was given by the vulnerability Information about exploit will help repair the issue Sample of tools to use: Metasploit Custom Python Hydra Ettercap

Vulnerabilities Found No authentication needed to mount network drives No defense against arp poisoning Misconfiguration for LDAP sending all information in plain text All NFS traffic could be viewed in plain text using Wireshark All keystrokes made during a VNC session are transmitted in plain text Using Scapy library, a Python script was made to search packets.

ARP Poisoning Man in the Middle attack Allows the attacker to capture packets going to and coming from the target Main tool used: Ettercap This attack made several others possible

ARP Poisoning

ARP Poisoning

NFS Network drives can be mounted by an attacker’s machine simply by changing it’s IP address After performing an ARP poisoning attack, file contents can be seen in network traffic. Both Vulnerabilities can be solved using Kerberos to provide authentication and encryption

LDAP All LDAP authentication was communicated over plain text Ettercap has a built in functionality to handle this vulnerability This was solved by configuring LDAP to utilize encryption for authentication

VNC Utilizing ARP Spoofing, all keystrokes are communicated over plain text After observing the pattern for network traffic, the process could be automated To avoid this vulnerability, the user can tunnel through SSH

Other Attempts Password attacks with Hydra PostgreSQL with Metasploit Utilized an extensive password list for a multithreaded dictionary attack PostgreSQL with Metasploit Searched for misconfigurations and default passwords

Questions?