Skip to content

Commit dd6d7a0

Browse files
mssalvatoremssalvatore
committed
Merge branch '4213-docs-exploiters-feature-pages_brute-force' into develop
Issue #4213 PR #4269
2 parents 2b5a939 + 9d6a9fb commit dd6d7a0

13 files changed

+337
-2
lines changed

‎docs/content/features/exploiters/log4shell.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).
1717
logging framework that is used to log messages within software, including
1818
information like error messages and user inputs in a program. Due to its
1919
widespread adoption, thousands of software packages and applications use
20-
Log4j, making them all vulnerable to Log4Shell.
20+
Log4j, making them all vulnerable to
21+
[Log4Shell](https://en.wikipedia.org/wiki/Log4Shell).
2122

2223
## Exploitation
2324

@@ -37,7 +38,7 @@ to propagate to a victim machine.
3738

3839
### Services exploited
3940

40-
Infection Monkey will attempt to exploit the Log4Shell vulnerability in the
41+
Infection Monkey attempts to exploit the Log4Shell vulnerability in the
4142
following services:
4243

4344
- Apache Solr

‎docs/content/features/exploiters/mssql.md

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
title: "MSSQL Exploiter"
3+
draft: false
4+
description: "Exploits MSSQL by taking advantage of insecure configuration"
5+
tags: ["exploiter", "mssql", "brute force"]
6+
pre: "<i class='fa fa-database'></i> "
7+
---
8+
9+
## MSSQL
10+
11+
[MSSQL (Microsoft SQL Server)](
12+
https://learn.microsoft.com/en-us/sql/sql-server/what-is-sql-server) is a
13+
relational database management system (RDBMS) developed by Microsoft whose
14+
functions include managing, storing, retrieving, manipulating, and analyzing
15+
data efficiently. In addition to manipulating data stored within the database,
16+
the [`xp_cmdshell`](
17+
https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql)
18+
procedure allows users to manipulate the host server by executing Windows shell
19+
commands from within the SQL Server environment.
20+
21+
## Exploitation
22+
23+
Because of the inherent security risks associated with `xp_cmdshell`, it is
24+
disabled by default. If `xp_cmdshell` has been enabled on an MSSQL instance,
25+
attackers who possess valid credentials can leverage MSSQL to run arbitrary commands
26+
on the server. Infection Monkey's MSSQL exploiter uses brute-force to
27+
authenticate with a victim's MSSQL server and uses `xp_cmdshell` to propagate
28+
to the victim server.
29+
30+
![MSSQL Configuration](
31+
/images/island/configuration-page/mssql-exploiter-configuration.png
32+
"MSSQL Configuration")
33+
34+
### Credentials used
35+
36+
The MSSQL exploiter uses [user-configured credentials](
37+
/usage/configuration/credentials), as well as credentials collected from other
38+
victims for brute-forcing. All possible combinations of usernames and passwords
39+
are used, prioritizing pairs provided by the user in the configuration.
40+
41+
## Mitigation
42+
43+
The best approach to mitigate this attack is to disable the `xp_cmdshell`
44+
feature as described in [Microsoft's documentation](
45+
https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option?view=sql-server-2017).
46+
47+
## See also
48+
- [MSSQL exploiter reference documentation](/reference/exploiters/mssql)

‎docs/content/features/exploiters/powershell.md

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
---
2+
title: "PowerShell Exploiter"
3+
draft: false
4+
description: "Exploits PowerShell Remoting"
5+
tags: ["exploiter", "powershell", "brute force"]
6+
pre: "<i class='fa fa-terminal'></i> "
7+
---
8+
9+
## PowerShell Remoting
10+
11+
[PowerShell Remoting](
12+
https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity)
13+
is a PowerShell feature that enables connecting to Windows machines remotely in
14+
order to execute PowerShell commands on them. It is commonly used by
15+
administrators to manage multiple systems in a network.
16+
17+
## Exploitation
18+
19+
Attackers that can successfully authenticate via PowerShell Remoting are able
20+
to execute arbitrary commands on the victim machine. Infection Monkey's
21+
PowerShell exploiter uses brute-force to attempt to propagate to a victim
22+
via PowerShell Remoting.
23+
24+
![PowerShell Configuration](
25+
/images/island/configuration-page/powershell-exploiter-configuration.png
26+
"PowerShell Configuration")
27+
28+
### Credentials used
29+
30+
The PowerShell exploiter can be run from both Linux and Windows attackers. On
31+
Windows attackers, the exploiter has the ability to use the cached username
32+
and/or password from the current user. When attacking from Linux or Windows,
33+
the exploiter uses all combinations of [user-configured credentials](
34+
/usage/configuration/credentials), as well as credentials collected from other
35+
victims. Different combinations of credentials are attempted in the following
36+
order:
37+
38+
1. **Cached username and password (Windows attacker only)** - The exploiter
39+
uses the stored credentials of the current user to attempt to log into
40+
the victim machine.
41+
42+
1. **Brute force usernames with blank passwords** - Windows allows you to
43+
configure a user with a blank/empty password. The exploiter attempts to
44+
log into the victim machine using usernames set in the
45+
[configuration](/usage/configuration/credentials) or stolen from other
46+
victims, and a blank password.
47+
48+
In order for the attacker to connect with a blank password, the victim must
49+
have enabled basic authentication, http and no encryption.
50+
51+
1. **Brute force usernames with cached password (Windows attacker only)** - The
52+
exploiter attempts to log into the victim machine using usernames
53+
set in the [configuration](/usage/configuration/credentials) or stolen from
54+
other victims, and the current user's cached password.
55+
56+
1. **Brute force usernames and passwords** - The exploiter attempts to use
57+
all combinations of usernames and passwords that were set in the
58+
[configuration](/usage/configuration/credentials) or stolen from other
59+
victims.
60+
61+
1. **Brute force usernames and LM hashes** - The exploiter attempts to use
62+
all combinations of usernames and LM hashes that were set in the
63+
[configuration](/usage/configuration/credentials) or stolen from other
64+
victims.
65+
66+
1. **Brute force usernames and NT hashes** - The exploiter attempts to use
67+
all combinations of usernames and NT hashes that were set in the
68+
[configuration](/usage/configuration/credentials) or stolen from other
69+
victims.
70+
71+
Note that techniques that use cached credentials, are only possible from
72+
Windows attackers.
73+
74+
## Mitigation
75+
76+
1. Restrict PowerShell remote command execution.
77+
1. Harden the credentials of relevant users by enforcing strong password
78+
policies.
79+
1. Enable multi-factor authentication.
80+
81+
More information about how to remediate security concerns related to PowerShell
82+
Remoting can be found [here](
83+
https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity).
84+
85+
## See also
86+
- [PowerShell exploiter reference documentation](/reference/exploiters/powershell)

‎docs/content/features/exploiters/rdp.md

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: "RDP Exploiter"
3+
draft: false
4+
description: "Exploits RDP"
5+
tags: ["exploiter", "rdp", "brute force"]
6+
pre: "<i class='fa fa-desktop'></i> "
7+
---
8+
9+
## RDP
10+
11+
[RDP (Remote Desktop Protocol)](
12+
https://learn.microsoft.com/en-us/windows/win32/termserv/remote-desktop-protocol)
13+
is a network communication protocol by Microsoft that enables users to connect
14+
to remote computers over a network, providing a remote display and input
15+
capabilities to the user. It is commonly used for remote administration, remote
16+
technical support, and remote work access.
17+
18+
## Exploitation
19+
20+
Attackers that can successfully authenticate to a machine via RDP can run
21+
arbitrary commands on the victim machine. This allows the attacker to perform
22+
actions such as installing malware, exfiltrating data, or pivoting and moving
23+
laterally through the network. Infection Monkey's RDP exploiter uses
24+
brute-force to attempt to propagate to a victim via RDP.
25+
26+
![RDP Configuration](
27+
/images/island/configuration-page/rdp-exploiter-configuration.png
28+
"RDP Configuration")
29+
30+
### Credentials used
31+
32+
The RDP exploiter uses [user-configured credentials](
33+
/usage/configuration/credentials) as well as credentials collected from
34+
other victims. Different combinations of credentials are attempted in the
35+
following order:
36+
37+
1. **Brute force usernames and passwords** - The exploiter attempts to use
38+
all combinations of usernames and passwords that were set in the
39+
[configuration](/usage/configuration/credentials) or stolen from other
40+
victims.
41+
42+
1. **Brute force usernames and NT hashes** - The exploiter attempts to use
43+
all combinations of usernames and NT hashes that were set in the
44+
[configuration](/usage/configuration/credentials) or stolen from other
45+
victims.
46+
47+
This only works on Windows 8.1 and Windows Server 2012 R2. You can read more
48+
about this limitation
49+
[here](https://www.kali.org/blog/passing-hash-remote-desktop/).
50+
51+
## Mitigation
52+
53+
1. Change user passwords to complex passwords that are not shared with other
54+
computers on the network.
55+
2. [Enable multi-factor authentication for
56+
RDP](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-plan-mfa).
57+
58+
For information about remediating RDP-related security risks, see
59+
[Microsoft's
60+
guidance](https://www.microsoft.com/en-us/security/blog/2020/04/16/security-guidance-remote-desktop-adoption/)
61+
62+
## See also
63+
- [RDP exploiter reference documentation](/reference/exploiters/rdp)

‎docs/content/features/exploiters/smb.md

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: "SMB Exploiter"
3+
draft: false
4+
description: "Exploits SMB"
5+
tags: ["exploiter", "smb", "brute force"]
6+
pre: "<i class='fa fa-folder-open'></i> "
7+
---
8+
9+
## SMB
10+
11+
[SMB (Server Message Block)](https://en.wikipedia.org/wiki/Server_Message_Block)
12+
is a network protocol primarily used in Windows for sharing and communication
13+
between computers on a network. Besides resource sharing, SMB supports remote
14+
procedure calls (RPC), which allows executing arbitrary commands on remote
15+
systems using command line utilities such as `psexec` and `smbexec`. This is
16+
generally used for administrative tasks and remote management.
17+
18+
## Exploitation
19+
20+
Attackers that can successfully authenticate to a machine via the SMB service
21+
can run arbitrary commands on the victim machine. This allows the attacker to
22+
perform actions such as installing malware, exfiltrating data, or pivoting and
23+
moving laterally through the network. Infection Monkey's SMB exploiter uses
24+
brute-force to attempt to propagate to a victim via SMB.
25+
26+
![SMB Configuration](
27+
/images/island/configuration-page/smb-exploiter-configuration.png
28+
"SMB Configuration")
29+
30+
### Credentials used
31+
32+
The SMB exploiter uses [user-configured credentials](
33+
/usage/configuration/credentials) as well as credentials collected from other
34+
victims for brute-forcing. All possible combinations of usernames, passwords,
35+
LM hashes, and NT hashes are used, prioritizing pairs provided by the user in
36+
the configuration.
37+
38+
## Mitigation
39+
40+
1. Change user passwords to complex passwords that are not shared with other
41+
computers on the network.
42+
43+
## See also
44+
- [SMB exploiter reference documentation](/reference/exploiters/smb)

‎docs/content/features/exploiters/ssh.md

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
title: "SSH Exploiter"
3+
draft: false
4+
description: "Exploits SSH"
5+
tags: ["exploiter", "ssh", "brute force"]
6+
pre: "<i class='fa fa-terminal'></i> "
7+
---
8+
9+
## SSH
10+
11+
[SSH (Secure Shell)](https://en.wikipedia.org/wiki/Secure_Shell) is a network
12+
protocol designed for Unix-like operating systems that provides a secure way to
13+
access a remote computer over an unsecured network. After establishing an
14+
encrypted connection to a remote machine, it can be used to execute arbitrary
15+
commands directly through the SSH terminal or by specifying commands in the SSH
16+
client. This allows for secure remote administration and automation of tasks on
17+
the target system.
18+
19+
## Exploitation
20+
21+
Attackers that can successfully authenticate to a machine via SSH can run
22+
arbitrary commands on the victim machine. This allows the attacker to perform
23+
actions such as installing malware, exfiltrating data, or pivoting and moving
24+
laterally through the network. Infection Monkey's SSH exploiter uses
25+
brute-force to attempt to propagate to a victim via SSH.
26+
27+
![SSH Configuration](
28+
/images/island/configuration-page/ssh-exploiter-configuration.png
29+
"SSH Configuration")
30+
31+
### Credentials used
32+
33+
The SSH exploiter uses [user-configured credentials](
34+
/usage/configuration/credentials) as well as credentials collected from other
35+
victims for brute-forcing. All possible combinations of usernames, passwords,
36+
and SSH keypairs are used, prioritizing pairs provided by the user in the
37+
configuration.
38+
39+
## Mitigation
40+
41+
1. Change user passwords to complex passwords that are not shared with other
42+
computers on the network.
43+
44+
1. [Store private keys securely.](
45+
https://www.ssldragon.com/blog/best-practices-to-store-the-private-key/)
46+
47+
## See also
48+
- [SSH exploiter reference documentation](/reference/exploiters/ssh)

‎docs/content/features/exploiters/wmi.md

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
title: "WMI Exploiter"
3+
draft: false
4+
description: "Exploits WMI"
5+
tags: ["exploiter", "wmi", "brute force"]
6+
pre: "<i class='fa fa-toolbox'></i> "
7+
---
8+
9+
## WMI
10+
11+
[WMI (Windows Management Instrumentation)](
12+
https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page) is a set
13+
of tools and extensions in Windows for managing and querying system information,
14+
configurations, and operations. WMI's command line utilities and scripting
15+
capabilities are used by administrators to run arbitrary commands on local and
16+
remote environments for monitoring system health, automating administrative
17+
functions, managing network resources, etc.
18+
19+
## Exploitation
20+
21+
Attackers that can successfully authenticate to a machine via WMI can run
22+
arbitrary commands on the victim machine. This allows the attacker to perform
23+
actions such as installing malware, exfiltrating data, or pivoting and moving
24+
laterally through the network. Infection Monkey's WMI exploiter uses
25+
brute-force to attempt to propagate to a victim via WMI.
26+
27+
![WMI Configuration](
28+
/images/island/configuration-page/wmi-exploiter-configuration.png
29+
"WMI Configuration")
30+
31+
### Credentials used
32+
33+
The WMI exploiter uses [user-configured credentials](
34+
/usage/configuration/credentials) as well as credentials collected from other
35+
victims for brute-forcing. All possible combinations of usernames, passwords,
36+
LM hashes, and NT hashes are used, prioritizing pairs provided by the user in
37+
the configuration.
38+
39+
## Mitigation
40+
41+
Change user passwords to complex passwords that are not shared with other
42+
computers on the network.
43+
44+
## See also
45+
- [WMI exploiter reference documentation](/reference/exploiters/wmi)

‎docs/static/images/island/configuration-page/mssql-exploiter-configuration.png

314 KB
Loading

‎docs/static/images/island/configuration-page/powershell-exploiter-configuration.png

272 KB
Loading

‎docs/static/images/island/configuration-page/rdp-exploiter-configuration.png

289 KB
Loading

‎docs/static/images/island/configuration-page/smb-exploiter-configuration.png

280 KB
Loading

‎docs/static/images/island/configuration-page/ssh-exploiter-configuration.png

278 KB
Loading

‎docs/static/images/island/configuration-page/wmi-exploiter-configuration.png

279 KB
Loading

0 commit comments

Comments
 (0)