Red Team and Blue Team Penetration Test and Reporting Project

The tactics, techniques, methods and procedures in this repository were used during an authorized penetration test and were compiled into a written report.

This project was split into three phases to provide insight about how an attack may occur, how the incident response team analyzes the logs to discover the attack, and provide a report detailing the attack along with mitigation strategies.

The Red Team phase will cover:

• Network Discovery
• OSINT
• Brute Force Attacks
• Breaking encryption
• Researching vulnerabilities
• Creating and deploying exploits

The Blue Team phase will cover analyzing:

• Metricbeat log data for operating system metrics
• Filebeat Log data for folder and file data
• Packetbeat log data for network traffic

The reporting phase will provide a report summariazing the egagement and providing:

• The methods and tools used to exploit the vilnerabilities disovered
• The log data used to discover evidence of the attack
• Mitigation strategies for hardening the network from future attacks

Network Topology

This is a virtual network created within Microsoft Azure for educational purposes.

This virtual network is depicted below:

• Network Diagram

The main purpose of this network is to expose a web server to an penetration test and have the ELK machine capture log data for data analysis to gain visibility of the attack vectors. It should be noted that for this project all machines were located on the same subnet.

The configuration details of each machine may be found below.

Name	Function	IP Address	Operating System
Kali	Attacker	192.168.1.90	Linux
Capstone	Target	192.168.1.105	Windows - Apache
ELK	Elk Stack	192.168.1.100	Windows

The attacker machine used was a VM operating with 5.10.0-Kali7-amd64 The target machine used was a VM operating with Windows as an Apache web server. The Elk Stack machine was a VM operating Windows as an Elk Stack server.

The Capstone machine (apache server) was configured with Kibana and utilized the following log data capture agents:

• Metricbeat
• Filebeat
• Packetbeat

Red Team Phase

To gain a picture of the network landscape we first determined our ip address using the command line entry:

• IP addr provided an IP address of 192.168.1.90/24 as shown with this Screenshot

Nmap was used to perform a scan of the subnet using the command line entry:

• nmap -sX 192.168.1.0/24 as seen in this Screenshot

With the identification of a web server at 192.168.1.105, firefox was opened and an OSINT investigation found the following page with open sensitive data:

• This page is viewable in this Screenshot

• Upon entering the path to the "Secret Folder", we were provided a login page depicted in this Screenshot

A brute force attack was initiated against this page using the hydra tool, with the username "ashton" as discovered by OSINT. The hydra command was hydra -l ashton -P /usr/share/wordlists/rockyou.txt -f -vV http-get://192.168.1.105/company_folders/secret_folder.

• We discovered ashton's password as shown In this Capture

Upon entering the credentials and gaining access, we located the following page which provided the user name ryan.

• We broke the encryption using the website CrackStation and learned Ryan's password

We researched vulnerabilities with WebDav and discovered:

• CVE 2006-2849, which provides for remote file inclusion.

Using msfvenom, we created a PHP payload:

• A reverse_tcp connection to our kali machine.

We then logged into to the web server via WebDav:

• Placing the payload, opening the connection and discovering the flag

Final Report

The Blue Team analysis and the final report can be seen Here