LAB7_VA

FILE ANALYSIS - SCANNING RESULT

Subject: Vulnerability Analysis
Code: IKB21403
Name: Ammar Shauqi Bin Nor Amran
ID: 52215125018

---

Question 1: Analyse packet1.pcap and find the flag.

U1VDVEYyMDIze2FpX2lzX2Nvb2x9 = SUCTF2023{ai_is_cool}

Question 2: Analyse packet2.pcap and find the flag.

(No flag provided in document)

---

Question 3: Interpret an Nmap Output

Nmap Scan Results

PORT	STATE	SERVICE	VERSION
21/tcp	open	ftp	vsftpd 2.3.4
22/tcp	open	ssh	OpenSSH 5.3p1
80/tcp	open	http	Apache 2.2.8
139/tcp	open	netbios-ssn
445/tcp	open	microsoft-ds	Windows 7 Professional 7601 SP1

1. Attacker Capabilities

PORT	SERVICE	ATTACKER CAPABILITIES
21/tcp	FTP (vsftpd 2.3.4)	Brute-force credentials; Exploit known backdoor to gain remote root shell.
22/tcp	SSH (OpenSSH 5.3p1)	Brute-force user passwords; Use outdated crypto to downgrade or intercept sessions.
80/tcp	HTTP (Apache 2.2.8)	Enumerate web directories and files.
139/445/tcp	SMB (Windows 7 SP1)	Perform pass-the-hash, SMB relay, or brute-force attacks.

2. Known Vulnerabilities

SERVICE	VERSION	KNOWN VULNERABILITIES
vsftpd	2.3.4	Backdoor (CVE-2011-2523): Sending a smiley face :) as username gives unauthenticated root shell on port 6200. Also DoS and directory traversal.
OpenSSH	5.3p1	User enumeration (CVE-2016-6210, CVE-2018-15473); Weak key exchange algorithms; CVE-2010-4478 (potential remote crash).
Apache	2.2.8	Multiple DoS (CVE-2008-0005, CVE-2011-3192); Directory traversal (CVE-2008-2938).
SMB	Windows 7 SP1	EternalBlue (MS17-010): Remote code execution via SMBv1; Numerous privilege escalation and info disclosure CVEs.

3. Highest Risk Analysis

Highest Risk: Port 21 (vsftpd 2.3.4 backdoor)
Reason: Immediate, unauthenticated root shell. The backdoor requires no credentials. An attacker simply connects to FTP, sends USER :), then connects to port 6200 to get a root shell.

4. Attack Path

• Step 1: Get root shell via FTP backdoor.

5. Remediation

Service	Action
vsftpd 2.3.4	Upgrade to vsftpd ≥ 2.3.5 (or latest stable).
General	If not needed, disable FTP and use SFTP/SCP instead. Ensure FTP is firewalled to only trusted IPs.

---

Question 4: Identify the OS (OS Fingerprinting) - TTL

• : ttl=64
  Answer: Linux / FreeBSD / macOS
• : Time to live: 255
  Answer: Solaris / Cisco / Network devices
• : ttl=128
  Answer: Windows

---

Question 5: Analyse the Nessus file (Ghostcat)

1. Affected Port Number: 8009
2. Affected Protocol: AJP
3. CVSS Score: 9.8
4. Exploit Availability: Exploit-DB: The vulnerability is indexed on Exploit-DB, providing downloadable code that demonstrates how the Arbitrary File Read/Inclusion works.
5. CVE: CVE-2020-1938