CIT 480: Securing Computer Systems Vulnerability Scanning and Exploitation Frameworks CIT 480: Securing Computer Systems

Vulnerability Scanners Vulnerability scanners are automated tools that scan hosts and networks for potential vulnerabilities, including Configuration errors Known unpatched vulnerabilities CIT 480: Securing Computer Systems

Vulnerability Databases

CIT 480: Securing Computer Systems Advantages Vulnerability scanners can identify thousands of potential security issues. Automatically and quickly. On a regular basis, to ensure no systems have become vulnerable. Can identify problems missed by or misconfigured by administrators. Lets security know where problems exist. Essential part of defense in depth. CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Drawbacks Results only as good as vulnerability database. Must keep vulnerability db up to date. Some reported vulnerabilities are false positives. Must check for existence of actual vulnerability. Configure scanner to ignore false +s in future scans. Human threats are better than scanner Can use zero day vulnerabilities not found in db. Can find misconfigurations or combinations of security problems that lead to vulnerabilities that scanner cannot find. CIT 480: Securing Computer Systems

Vulnerability Scanners http://sectools.org/tag/vuln-scanners/ CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems OpenVAS Architecture http://www.openvas.org/about.html CIT 480: Securing Computer Systems

OpenVAS In-progress Scans http://www.openvas.org/img/gsa-screenshot.png CIT 480: Securing Computer Systems

OpenVAS Vulnerability Report http://www.openvas.org/img/gsa-screenshot.png CIT 480: Securing Computer Systems

Exploitation Frameworks Exploitation frameworks allow users to Choose and configure an exploit from a database of exploits. Launch exploits on specified targets to verify whether a vulnerability is present or not. Useful for Verifying vulnerability scanner results. Performing penetration tests. Convincing management that a problem exists. CIT 480: Securing Computer Systems

Exploitation Frameworks CIT 480: Securing Computer Systems

Metasploit Architecture http://www.offensive-security.com/metasploit-unleashed/Metasploit_Architecture http://www.offensive-security.com/metasploit-unleashed/Metasploit_Architecture

Metasploit Interfaces msfconsole Interactive command line interface. msfcli Non-interactive command line interface. msfcli windows/smb/ms08_067_netapi RHOST=192.168.56.101 PAYLOAD=windows/shell/bind_tcp Armitage Interactive graphical interface. CIT 480: Securing Computer Systems

Exploit Configuration OS and Application Version Variants of exploit may need to be chosen. Target selection IP address and port Payload selection Select shellcode type, e.g. shell or desktop. Encoding Encoding of exploit avoids IPS or AV detection. CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Payloads Bind Shell Open a port on the exploited host offering a shell with no password required. Reverse Shell Target makes connection back to listening port on one of your servers, offering a shell. Remote Desktop Remote desktop using RDP, VNC, NX, or X. Meterpreter Advanced payload with post-exploitation modules, including key logging, sniffing, hash dumping, etc. CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Key Points Vulnerability scanners Automatically scan network to find vulnerabilities based on vulnerability database. Results only as good as vulnerability database. Human attackers are better than scanners, so a clean scan doesn’t indicate perfect security. Exploitation frameworks Verify vulnerability scanner results. Assist in penetration testing. CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems References David Kennedy et. Al., Metasploit: The Penetration Tester’s Guide, No Starch Press, 2011. CIT 480: Securing Computer Systems