SIMULATION A previous penetration test report identified a host with vulnerabilities that was successfully exploited. Management has requested that an internal member of the security team reassess the

SIMULATION A previous penetration test report identified a host with vulnerabilities that was successfully exploited. Management has requested that an internal member of the security team reassess the host to determine if the vulnerability still exists. INSTRUCTIONS Part 1:

Analyze the output and select the command to exploit the vulnerable service. Part 2:

Click on each command to view its output. Select the appropriate set of commands to escalate privileges. Identify which remediation steps should be taken. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. Answer:

Part 1 - Exploiting the Vulnerable Service The nmap scan output shows open services on 192.168.10.2, including:

22/tcp (SSH) 80/tcp (HTTP) 445/tcp (Samba) Additionally, enum4linux results indicate the presence of user accounts, suggesting that brute- force attacks on SSH or Samba could be viable. The most appropriate exploitation command from the given options is: hydra -l lowpriv -P 500-worst-passwords.txt -t 4 ssh://192.168.10.2:22 This command uses hydra to perform a brute-force attack against the SSH service (22/tcp) on the target host. The user "lowpriv" (identified from enum4linux results) is targeted. The password list "500-worst-passwords.txt" is used to attempt login. The -t 4 option specifies the number of parallel tasks to speed up the attack. Part 2 - Privilege Escalation The correct set of commands to escalate privileges is: openssl passwd password echo "root2:$2QYXRHtV07QY:0:0:root:/root:/bin/bash" >> /etc/passwd openssl passwd password generates a hashed password. The echo command modifies /etc/passwd, adding a new root-level user (root2). This effectively grants root privileges to the attacker. Part 2 - Remediation Steps The two most appropriate remediation measures are:

Remove no_root_squash from fstab Make backup script not world-writeable Removing no_root_squash from /etc/fstab prevents root users on NFS-mounted systems from having full root privileges, reducing privilege escalation risks. Making the backup script not world- writeable prevents unauthorized modifications that could be leveraged for privilege escalation.