# Коллективное решение финального проекта по основам ИБ
```
sudo nmap -O -v 10.10.122.1
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
5357/tcp open wsdapi
5432/tcp open postgresql
MAC Address: 00:50:56:9E:4D:81 (VMware)
Nmap scan report for 10.10.122.2
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
5357/tcp open wsdapi
8080/tcp open http-proxy
MAC Address: 00:50:56:9E:73:93 (VMware)
Nmap scan report for 10.10.122.3
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
5357/tcp open wsdapi
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
49157/tcp open unknown
MAC Address: 00:50:56:9E:9B:5E (VMware)
Nmap scan report for 10.10.122.4
Host is up (0.011s latency).
Not shown: 995 closed tcp ports (reset)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1433/tcp open ms-sql-s
5357/tcp open wsdapi
MAC Address: 00:50:56:9E:65:96 (VMware)
Nmap scan report for 10.10.122.5
PORT STATE SERVICE
139/tcp open netbios-ssn
MAC Address: 00:50:56:9E:01:28 (VMware)
Nmap scan report for 10.10.122.6
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:50:56:9E:D7:E4 (VMware)
Nmap scan report for 10.10.122.7
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
49158/tcp open unknown
MAC Address: 00:50:56:9E:88:94 (VMware)
```
---
делаем скриншот с машины
смотрим файлы
сканируем сеть
10.10.122.7 - worker pc - windows 7 pro (подвержена ethernalBlue) - все наши машины подключены сюда
10.10.122.3 - worker pc - windows 7 pro
10.10.122.2 - computer (Apache tomcat)
10.10.122.4 - computer - windows10
10.10.122.1 - computer (дефо)
10.10.122.5 - hm2
10.10.122.6 - hm3 - windows 10
domain.local - имя домена
10.10.122.240 - cервер - apache tomcat атака
скан портов командой
sudo masscan -v -sS -p80,443,53,389 10.10.0.0/16 --source-ip 10.10.122.12 --source-mac 96:7c:12:ea:25:ea --router-ip 10.10.122.254 --interface tap0
там надо поменять на свой IP и MAC
https://nmap.org/book/man-port-scanning-techniques.html
сканим хосты
10 подсетей:
10.10.21
10.10.122
10.10.113
10.10.121
10.10.54
10.10.20
10.10.50
10.10.112
10.10.51
10.10.53
после фильтрования 29 адресов:
10.10.112.250
10.10.112.254
10.10.113.254
10.10.120.254
10.10.121.10
10.10.121.254
10.10.20.208
10.10.20.240
10.10.20.248
10.10.20.251
10.10.20.254
10.10.21.1
10.10.21.10
10.10.21.11
10.10.21.2
10.10.21.200
10.10.21.254
10.10.21.3
10.10.21.4
10.10.21.5
10.10.21.6
10.10.21.7
10.10.21.8
10.10.21.9
10.10.50.254
10.10.51.254
10.10.52.254
10.10.53.254
10.10.54.254
*DBeaver* - поисковик базы данных
# **Findings**
Имеет дефолтный логин и пароль
10.10.122.1
Login:postgres
Password:
10.10.122.2
Apache tomcat 10.0.12
High level - CVE-2021-42340
входим в систему
Login: tomcat
password: tomcat
10.10.122.3
MS17-010 EthernalBlue
Dos
*подключились по RDP*
Vivaldi - mimikatz
10.10.122.4 p1433
Sql server 2019
httpd2.0
NETBIOS - nbtscan
Вошли на ЕВЕ 10.10.122.240
admin
eve
**Armitage**
**Netdiscover**
**NMAP**
`nmap -sV -A 10.10.122.1-7,239,240`
*Nmap scan report for 10.10.122.1*
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Service Unavailable
|_http-server-header: Microsoft-HTTPAPI/2.0
5432/tcp open postgresql?
MAC Address: 00:50:56:9E:4D:81 (VMware)
*Nmap scan report for 10.10.122.2*
Host is up (0.031s latency).
Not shown: 995 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Service Unavailable
|_http-server-header: Microsoft-HTTPAPI/2.0
8080/tcp open http Apache Tomcat 10.0.12
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Apache Tomcat/10.0.12
|_http-favicon: Apache Tomcat
MAC Address: 00:50:56:9E:73:93 (VMware)
*Nmap scan report for 10.10.122.3*
Host is up (0.031s latency).
Not shown: 991 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49157/tcp open msrpc Microsoft Windows RPC
MAC Address: 00:50:56:9E:9B:5E (VMware)
Host script results:
| smb2-security-mode:
| 2.1:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_nbstat: NetBIOS name: nil, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:9b:5e (VMware)
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: worker-PC
| NetBIOS computer name: WORKER-PC\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2021-12-22T01:40:49-08:00
*Nmap scan report for 10.10.122.4*
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| ms-sql-ntlm-info:
| Target_Name: COMPUTER
| NetBIOS_Domain_Name: COMPUTER
| NetBIOS_Computer_Name: COMPUTER
| DNS_Domain_Name: Computer
| DNS_Computer_Name: Computer
|_ Product_Version: 10.0.17763
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
MAC Address: 00:50:56:9E:65:96 (VMware)
Host script results:
| smb2-security-mode:
| 3.1.1:
NetBIOS MAC: 00:50:56:9e:65:96 (VMware)
| ms-sql-info:
| 10.10.122.4:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
*Nmap scan report for 10.10.122.5*
Host is up (0.031s latency).
Not shown: 997 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
MAC Address: 00:50:56:9E:01:28 (VMware)
Host script results:
|_nbstat: NetBIOS name: HM2, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:01:28 (VMware)
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
*Nmap scan report for 10.10.122.6*
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
MAC Address: 00:50:56:9E:D7:E4 (VMware)
Host script results:
|_clock-skew: 6h56m58s
|_nbstat: NetBIOS name: HM3, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:d7:e4 (VMware)
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
*Nmap scan report for 10.10.122.7*
Not shown: 991 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49157/tcp open msrpc Microsoft Windows RPC
MAC Address: 00:50:56:9E:88:94 (VMware)
Host script results:
| smb2-security-mode:
| 2.1:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: worker-PC
| NetBIOS computer name: WORKER-PC\x00
| Workgroup: WORKGROUP\x00
*Nmap scan report for 10.10.122.239*
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
MAC Address: 00:50:56:9E:46:5F (VMware)
*Nmap scan report for 10.10.122.240*
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
MAC Address: 00:50:56:9E:95:39 (VMware)
Подключились через браузер к 10.10.122.240:80
Вошли в EVE Login:admin password:eve
Получили доступ к лабам
Sign in with Wallet
Connect another wallet