Vulnerability Assessment (Nessus)

Here in this lab we will be using the Nessus tool by tenable, to perform a vulnerability assessment and possibly exploiting the vulnerability.

Description

In this lab you will have to use and configure Nessus in order to perform a vulnerability scan against the target machine. However you are not told where the target machine is in the network. You only know it is in the same lab network you are connected to.

Goal

The goal of this lab is to learn how to properly configure Nessus depending on the services running on the target machine.

Tools

The best tools for this lab are:

  • Nmap

  • Nessus

  • Metasploit

Steps

Find a target in the network

Since we do not have any information about our lab network and the hosts attached to it, the first step is to find our target!

Identify the target role

Now that we know there is a host on the target network, let us scan the host and gather as much information as we can in order to properly configure the Nessus scan.

Configure Nessus and run the scan

You should have identified few services running on the machine. Configure a new Nessus policy and scan depending on the scan results of the previous step.

Analyze and export the scan results

Once the scan completes, open the results and analyze them. You will find something very interesting! Moreover export the scan results, you may need them!

[OPTIONAL] Exploit the machine

The target machine has few critical vulnerabilities. Once you finish studying the Metasploit module, start the lab over again and try to exploit the machine.

Solutions

lets verify if we are connected to the enterprise environment. That can be checked by checking the ip address.

connected to enterprise environment via tap0 interface.

we now know that we are now connected to the network with ip 192.168.99.70/24.

so now i'll do a ping sweep to detect other devices that are present in the network

Apart from our ip we have other ip 192.168.99.50.

so, now we have a target lets try to gather information of the above ip from nmap so that we can configure rules in the nessus for further vulnerability assessment.

Looking at the output from the nmap, we can detect that the os that is running is windows. So, now we can go ahead and configure the nessus custom rules for scanning the windows os.

Assuming that the nessus is already installed in the system, i am proceeding with running the scans.

in order to start nessus we can either start from the Applications or u can run the following in a terminal.

  • systemctl start nessusd

that command should start the nessus in the system and then go ahead to browser and visit https://127.0.0.1:8834/ this should show a nessus login screen.

Login with the nessus credentials

we should navigate to Scans and choose New Scan -> Advanced scan.

We only need to specify the target and the desired name of the scan. Now, we are ready to launch the scan.

Policy -> New Policy -> Advanced Scan and configure the below.

selecting only windows specific scan in order to save time

Then navigate to My Scans -> New Scan -> User Defined and launch the scan.

Analyze and export the scan results

From the scan results obtained in the previous step we can see that the machine has some critical vulnerabilities.

The most interesting one is the MS08-067:

This vulnerability allows attackers to execute code remotely! Keep it in mind if you want to exploit the machine!

This completes the lab, if interested on how to exploit the machine u can proceed further. This may be a little advanced for newbies.

Exploitation

So, now i have the vulnerability that allows me to attack the machine, so lets go ahead and try to attack the machine using Metasploit.

so Metasploit is a tool from rapid7 it helps in automating the payloads and in attacking. You can read more on that in Google.

so inorder to start metasploit we should use the command

  • msfconsole (-q switch is optional, i use it as it helps me save the time)

i went and searched for the ms08-067 exploit and found a search result for that.

Select the exploit

use the exploit and set the required fields as shown below

its time to run the exploit so

Succesfully exploited the system, returing with the meterpreter session

as you can see we are in the windows system, now lets check the ip address of the system.

Privilege Escalation

after that we escalated our role to the system.

Yay!!!! we have successfully exploited the windows system!!!

{BONUS} Hashdump & Cracking

Now lets get the SAM table entries form the system and crack the hashes

If you are wondering what SAM table is, it is a place where all the account usernames and passwords are stored. It stands for Security Account Manager.

ok now that we have the SAM table, we will go ahead and load them on a file for cracking the hashes

created a file named sam.txt with the data of the sam database table

now in order to crack the hashes, I'll use my favorite tool John the ripper with rockyou.txt wordlist.

Boom !!!! there you go we have the password "Administrator".

That it for today see ya, until next time bye 🥰.

PreviousScanning and OS FingerprintingNextDirectory Enumeration

Last updated

Was this helpful?