Module 7 - Exploitation

Question 1

Undesired Effects of Exploitation

Answer 1

crash a service or server

cause a server to hang

Question 2

Web Servers (Common Ones)

Answer 2

Microsoft Internet Information Services
Apache
Tomcat

Question 3

Web Server Misconfigurations

Answer 3

directory browsing
read/write/execute permissions
enabled parent paths

• not necessarily identified as vulnerabilities

Question 4

SQL Injection

Answer 4

Web application doesn’t check input
‘1=1
allows processing of command
most popular and effective to attack websites

Question 5

Cross Site Scripting (XSS)

Answer 5

injecting scripts into web applications

forces redirection

Question 6

Content Management Servers

Answer 6

Joomla

Question 7

Symantec’s Top 5 Web App Vulnerabilities

Answer 7

1. Remote Code execution
2. SQL Injection
3. Format string vulnerabilities
4. Cross Site Scripting (XSS)
5. Username enumeration

Question 8

Physical Security

Answer 8

Conference Rooms - open network drops
Unlocked LAN closets
Unlocked server rooms
Unattended - unlocked - desktop computers

Question 9

User Accounts

Answer 9

Download from SAM or AD
Create user accounts
Change group memberships

Question 10

User Accounts -> File Access

Answer 10

Cain and Abel
John the Ripper
SAMinside
Elcomsoft

Question 11

Metasploit

Answer 11

~300 exploits
2003 Perl -> Ruby
Rapid7

Metasploit Express
Metasploit Pro

Question 12

Metasploit Framework Commands

Answer 12

USE
SHOW PAYLOADS
SET PAYLOAD
SHOW OPTIONS
SET RHOST
SET LHOST
EXPLOIT
HELP

Question 13

BIND Connection

Answer 13

Establishes direct connection from Tester to the Target

Bind does not work if going through external firewall due to NATing. (works if already on the network)

Question 14

Reverse Shell

Answer 14

When not already inside the network
Machine calls back to IP that is identified

there is evidence on target computer: TCP 4444

Question 15

Meterpreter

Answer 15

interface for executing commands in Metasploit

Question 16

Gain Persistence

Answer 16

• gain user names and passwords to accounts
• install malware with autorun location
• install netcat and set to restart
• install a device, such as WAP

Question 17

Creating Account (Windows)

Answer 17

NET USER

Question 18

Permissions (Windows)

Answer 18

NET LOCALGROUP /ADD

Question 19

CSVDE

Answer 19

command line tool
%windir%/system32
available for AD LDS (local directory services)

csvde -r objectClass=user -f usersonly.csv (outputs users)
csvde -i -f input.csv (imports)

Question 20

psexec

Answer 20

Sysinternals

telnet tool to execute processes