1. A Comprehensive Security Assessment of the Westminster College Unix Lab
Jacob Shodd

2. Overview
Goal: To discover security vulnerabilities in order to ensure user privacy and data integrity
Testing Environment
Project structure
Tools used
Vulnerabilities found

3. Testing Environment
Utilized the Kali Linux operating system running within virtualbox
The test machine is located within the network, not attacking from outside

4. Enumeration
Enumeration is the act of acquiring information about a network and it’s clients.
Information to gather:
Open ports
Running services
Operating system versions
Unencrypted Packets
Sample of tools:
Nmap
Wireshark
Metasploit
Sparta

5. Evaluation
Using the information gathered from Enumeration to search for possible exploits
Basic vulnerabilities:
Default settings
Default passwords
Well known security flaws
Metasploit
Large database of confirmed security flaws
Integration of multiple tools
To be used for common flaws
Manual evaluation
For vulnerabilities specific to the Unix Lab

6. Exploitation Confirming and measuring severity of vulnerabilities
Record what level of access was given by the vulnerability
Information about exploit will help repair the issue
Sample of tools to use:
Metasploit
Custom Python
Hydra
Ettercap

7. Vulnerabilities Found
No authentication needed to mount network drives
No defense against arp poisoning
Misconfiguration for LDAP sending all information in plain text
All NFS traffic could be viewed in plain text using Wireshark
All keystrokes made during a VNC session are transmitted in plain text
Using Scapy library, a Python script was made to search packets.

8. ARP Poisoning Man in the Middle attack
Allows the attacker to capture packets going to and coming from the target
Main tool used: Ettercap
This attack made several others possible

9. ARP Poisoning

10. ARP Poisoning

11. NFS
Network drives can be mounted by an attacker’s machine simply by changing it’s IP address
After performing an ARP poisoning attack, file contents can be seen in network traffic.
Both Vulnerabilities can be solved using Kerberos to provide authentication and encryption

12. LDAP All LDAP authentication was communicated over plain text
Ettercap has a built in functionality to handle this vulnerability
This was solved by configuring LDAP to utilize encryption for authentication

13. VNC
Utilizing ARP Spoofing, all keystrokes are communicated over plain text
After observing the pattern for network traffic, the process could be automated
To avoid this vulnerability, the user can tunnel through SSH

15. Other Attempts Password attacks with Hydra PostgreSQL with Metasploit
Utilized an extensive password list for a multithreaded dictionary attack
PostgreSQL with Metasploit
Searched for misconfigurations and default passwords

16. Questions?