Introduction to Vulnerability Scanners Lab

Transcription

1 Introduction to Vulnerability Scanners Lab Introduction: Lets take enumeration (and scanning) to the next level and automate what we have been doing manually. Lets use a tool that does just what we have been doing: scanning for hosts we can communicate with; port scan those live hosts; get those ports to tell us more (think banner grabbing or NetBIOS enumeration); AND then do the vulnerability research for us, via its own on vulnerability database. Lets use a vulnerability scanner! Special Note: the actual scan can take minutes to complete, so you should plan on a break in the lab where you get coffee. Lab Overview Nessus is probably one of the most well known open source vulnerability scanners. It has been around and developed for years and does a great job. It comes as part of the Kali distribution so we already have access to it. We will use Nessus to enumerate Target.com further (again, that s the Target.com on our remote lab, not the real one on the Internet). Remote Connection See the previous lab (01A-NPS00 Introduction to the Lab) and log onto your remote host. Preparation Procedures: We need to do a little work to get Nessus ready. 1. Log on to our remote lab network. 2. From within your lab Windows VM, start up a VNC connection to your Kali host. 3. Set up the Kali host to go out to the Internet (see lab Lab 01A-NPS03 Introduction to Metasploit for how to do this, it s steps 5a-i) 4. On the Kali host now open a web browser (Iceweasel) and surf over to 5. Select the Products link. 6. Under the products page, choose the Nessus link then on the resulting page go to the Download link on the right of the page 7. Choose the Nessus Home edition 1

2 8. Download the Linux AMD64 version 9. Open a shell terminal. 10. Switch user to root su - {password Password1} 11. Locate the downloaded file (should be either in the /home/student/downloads of /root/downloads directory). 12. Issue the dpkg i command command: dpkg i the Nessus package 13. Lets see if Nessus is already running netstat an grep 8834 a. If that command comes back with a LISTEN line (or two), skip to step 6. b. If it s not running (nothing returned), start it with command /etc/init.d/nessusd start {note that this goes into the etc directory, into the initialize daemon directory, and starts up the nessus daemon nessusd} 14. Now use Iceweasel web browser to connect to Nessus {note that here kali:8834 is point to local host ( ) port 8834} 15. Select I Understand the Risks and Add Exception 2

3 16. Choose to Continue 17. And then use the User Account of student and password of Password1 then Continue 18. Now under the window that pops up, right-click on the link that says Registering this scanner and choose to Open in a New Tab and then go into that new tab and register for an activation code. 3

4 19. Now go back to your 1 st tab in Iceweasel and put in the registration activation code you get via . IF you get an error message, DOWNLOAD FAILED /opt/nessus/sbin/nessuscli update AND then do a /etc/init.d/nessusd restart and then refresh your web page. NOTE THE INIALIZATION MAY TAKE 20 MINS TO COMPLETE 20. Once initialization completes, log in with a. Username: student b. Password: Password1 21. NOW BE SURE TO CHANGE YOUR NETWORK INTERFACE BACK TO THE INSIDE OF THE LAB, you no longer what it to access the Internet (see lab Lab 01A-NPS03 Introduction to Metasploit for how to do this, it s steps 5k) 4

5 Lab Procedure: 1. Start a New Scan. It will inform you to set up a New Policy first and take you there. a. Perform a Basic Network Scan b. Step 1: Policy Name use Basic Network Scan, Description Basic network scan c. Step 2: Scan Type: External d. Step 3: accept defaults presented (windows), click on Save 2. Now you can start your actual scan by going to the Scans tab a. Start a New Scan b. For Name use Target.com c. For Policy, use Basic Network Scan d. For Folders, leave the given default of My Scans e. For Targets, enter f. Click on Launch Take a break now for coffee as it will take minutes to complete the scan. 3. When the scan is complete it will show as Completed on the screen. 4. Explore the results by clicking into the scan. Be sure to click into at least one critical vulnerability and scroll to the bottom looking for the Exploitable With section! 5. 5

6 Lets export these results into metasploit a. Selecting the Export dropdown allows you to choose the format b. Select Nessus as the file format. c. Save the file as the offered nessus_report_target_com.nessus (it stores it under Student s home directory, into the Downloads directory) 6. Lets import the results into metasploit a. Open a shell terminal. b. Switch user to root su - {password Password1} c. Start the database server service postgresql start d. Start metsploit msfconsole e. Once metsplot is running, lets look at our prior results for Target.com (our default workspace is currently being used for Target.com) f. Perform the import (this will go into our default workspace which we are currently using for Target.com) db_import /home/student/downloads/nessus_report_target_com.nessus {NOTE: The name of the file is just the name of the file (if you used a capital T when you named it, you need to use a capital T when you load it, if you used a lower case t when you named it, you need to use a lower case t when you load it (remember, Linux is case sensitive)!} 6

7 7. Lets make sure the vulnerabilities discovered by Nessus were imported as well. a. Inside of metasploit, issue the vulnerabilities listing command vulns b. You should see the list of vulnerabilities list out. That s it for this lab! We will use the information we inputted further in the next module on Gaining Access!! Deliverables: Please submit a Done message via Assignments button in Sakai. 7