Security Assessment Findings Report

Business Confidential

Date: June 26th, 2024

Project: DC-001
Version 1.0

By:
JOUINI Manel
SAIDI Khaoula
JOUINI Anis
Class:
2-SSIR-N
2023/2024

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 1 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
 Table of Contents

Confidentiality Statement ................................................................................................................................... 3

Disclaimer ........................................................................................................................................................... 3
Contact Information ............................................................................................................................................ 3
Assessment Overview ......................................................................................................................................... 4
Assessment Components ................................................................................................................................... 4
Internal Penetration Test ....................................................................................................................... 4
Finding Severity Ratings ..................................................................................................................................... 5
Risk Factors ........................................................................................................................................................ 5
Likelihood ........................................................................................................................................................... 5
Impact ................................................................................................................................................................. 5
Scope .................................................................................................................................................................. 6
Scope Exclusions .................................................................................................................................... 6
Client Allowances .................................................................................................................................... 6
Executive Summary ............................................................................................................................................ 7
Attack Summary...................................................................................................................................... 7
Internal Penetration Test Findings ........................................................................................................ 8
Vulnerabilities Detected ..................................................................................................................................... 8
Vulnerability Summary & Report Card ................................................................................................................ 8
Vulnerabilities Detected ..................................................................................................................................... 9
Technical Findings ............................................................................................................................................ 14
SMB Vulnerabilities Detected ......................................................................................................................... 14
Unrestricted Logon Attempts .......................................................................................................................... 17
Successful Brute-Force Attack and Password Cracking ............................................................................... 19

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 2 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Confidentiality Statement
This document is the exclusive property of the administration of Tek-Up and the Security Team of Tek-
up University. This document contains proprietary and confidential information. Duplication,
redistribution, or use, in whole or in part, in any form, requires consent of Tek-up University.
Tek-up University may share this document with auditors under non-disclosure agreements to
demonstrate penetration test requirement compliance.

Disclaimer
A penetration test is considered a snapshot in time. The findings and recommendations reflect the
information gathered during the assessment and not any changes or modifications made outside of
that period.
Time-limited engagements do not allow for a full evaluation of all security controls. Tek-up prioritized
the assessment to identify the weakest security controls an attacker would exploit. Tek-up
recommends conducting similar assessments on an annual basis by internal or third-party assessors
to ensure the continued success of the controls.

Contact Information
NAME Title Contact Information
Tek-Up Administration
Global Information Security
Oussema Riahi Email: [email protected]
Manager
Tek-up Team Security
Manel Jouini Lead Penetration Tester Email: [email protected]
Khaoula Saidi Penetration Tester Email: [email protected]
Anis Jouini Penetration Tester Email: [email protected]

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 3 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Assessment Overview
From May 30th, 2024 to June 26th, 2024, Tek-up evaluate the security posture of its infrastructure
compared to current industry best practices that included an internal network penetration test. All
testing performed is based on the NIST SP 800-115 Technical Guide to Information Security Testing
and Assessment, OWASP Testing Guide (v4), and customized testing frameworks.
Phases of penetration testing activities include the following:
• Planning – Customer goals are gathered and rules of engagement obtained.
• Discovery – Perform scanning and enumeration to identify potential vulnerabilities, weak
areas, and exploits.
• Attack – Confirm potential vulnerabilities through exploitation and perform additional
discovery upon new access.
• Reporting – Document all found vulnerabilities and exploits, failed attempts, and company
strengths and weaknesses.

Assessment Components
Internal Penetration Test
An internal penetration test emulates the role of an attacker from inside the network. A tek-up
engineer will scan the network to identify potential host vulnerabilities and perform common and
advanced internal network attacks, such as: LLMNR/NBT-NS poisoning and other man- in-the-middle
attacks, token impersonation, kerberoasting, pass-the-hash, golden ticket, and more. The engineer
will seek to gain access to hosts through lateral movement, compromise domain user and admin
accounts, and exfiltrate sensitive data.

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 4 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Finding Severity Ratings
The following table defines levels of severity and corresponding CVSS score range that are used
throughout the document to assess vulnerability and risk impact.

Severity CVSS V3 Definition

Score Range
Exploitation is straightforward and usually results in system-level
Critical 9.0-10.0 compromise. It is advised to form a plan of action and patch
immediately.

Exploitation is more difficult but could cause elevated privileges and

High 7.0-8.9 potentially a loss of data or downtime. It is advised to form a plan of
action and patch as soon as possible.

Vulnerabilities exist but are not exploitable or require extra steps such
Moderate 4.0-6.9 as social engineering. It is advised to form a plan of action and patch
after high-priority issues have been resolved.

Vulnerabilities are non-exploitable but would reduce an organization’s

Low 0.1-3.9 attack surface. It is advised to form a plan of action and patch during
the next maintenance window.

No vulnerability exists. Additional information is provided regarding

Informational N/A items noticed during testing, strong controls, and additional
documentation.

Risk Factors
Risk is measured by two factors: Likelihood and Impact:

Likelihood
Likelihood measures the potential of a vulnerability being exploited. Ratings are given based on the
difficulty of the attack, the available tools, attacker skill level, and client environment.

Impact
Impact measures the potential vulnerability’s effect on operations, including confidentiality,

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 5 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Scope
Assessment Details

Internal Penetration Test 172.25.220.145/32

Scope Exclusions
Per client request, Tek-up did not perform any of the following attacks during testing:
• Denial of Service (DoS)
• Phishing/Social Engineering

All other attacks not specified above were permitted by the Tek-up administration.

Client Allowances
The Tek-up Administration did not provide any allowances to assist the testing:

• Internal access to network via dropbox and port allowances

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 6 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Executive Summary
Tek-up Security Team evaluated Tek-up internal security posture through penetration testing from
May 30th, 2024 to June 26th, 2024. The following sections provide a high-level overview of
vulnerabilities discovered, successful and unsuccessful attempts, and strengths and weaknesses.
Attack Summary
The following table describes how Tek-up Security Team gained internal network access, step by
step:
Step Action Recommendation
➢ Update Systems
➢ Enable SMB Signing
➢ Disable SMBv1
1 SMB Vulnerabilities Detected
➢ Restrict SMB Access
➢ Firewall Rules
➢ Network Segmentation
➢ Implement Account Lockout Mechanisms
➢ Enable Rate Limiting
➢ Use CAPTCHA
2 Unrestricted Logon Attempts ➢ Enforce Strong Password Policies
➢ Multi-Factor Authentication (MFA)
➢ Monitor and Alert
➢ Regular Audits and Penetration Testing

➢ Implement Strong Password Policies

➢ Enable Account Lockout Mechanisms
Successful Brute-Force Attack and
➢ Use Multi-Factor Authentication (MFA)
3 Password Cracking
➢ Hash Passwords Securely
➢ Regularly Monitor and Audit
➢ User Education

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 7 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Internal Penetration Test Findings
Vulnerabilities Detected
Vulnerability Summary & Report Card
The following tables illustrate the vulnerabilities found by impact and recommended remediations:

Internal Penetration Test Findings

Critical High Moderate Informational

3 4 2 1

Finding Severity Recommandation

Internal Penetration Test
IPT-001: MS11-030: Vulnerability Critical Apply the appropriate Microsoft
in DNS Resolution Could Allow patches to remediate the issue.
Remote Code Execution
IPT-002: Unsupported Windows OS Critical Upgrade to a supported service
pack or operating system.
IPT-003: Microsoft Windows Search Critical Apply the appropriate Microsoft
Remote Code Execution patches to remediate the issue.
Vulnerability (CVE-2017-8543)
IPT-004: MS17-010: Security High Apply the appropriate Microsoft
Update for Microsoft Windows SMB patches to remediate the issue.
Server (ETERNALBLUE)
IPT-005: Microsoft Windows SMB High Restrict permissions on each
Shares Unpriviliged Access share.
IPT-006: MS11-048: Vulnerability in High Apply the appropriate Microsoft
SMB Server Could Allow Denial of patches to remediate the issue.
Service
IPT-007: Microsoft Windows SMB High Apply the appropriate Microsoft
Server (2017-10) Multiple patches to remediate the issue.
Vulnerabilities (Uncredential check)
IPT-008: Unencrypted Telnet Server Moderate Disable the Telnet service and
use SSH instead
IPT-009: SMB Signing not required Moderate Enforcing message signing in
the host's configuration
IPT-010: LLMNR detection Information Make sure that use of this
software conforms to your
organization's acceptable and
security policies

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 8 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Vulnerabilities Detected
Internal Penetration Test Findings

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 9 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
 TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 10 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
 TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 11 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
 TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 12 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
 TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 13 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Technical Findings
SMB Vulnerabilities Detected
Description: The scan results indicate the presence of the EternalBlue vulnerability (MS17-010)
on the target machine. EternalBlue is a critical vulnerability in the SMBv1 protocol
that allows remote code execution by exploiting a flaw in Microsoft's
implementation of SMB. This vulnerability was famously used in the WannaCry
ransomware attack.
Impact & Critical - Exploiting this vulnerability allows an attacker to execute arbitrary code on
Likelihood: the target system, potentially leading to complete control over the affected
machine. This can result in data theft, system compromise, and propagation of
malware across the network.
System: 172.25.220.145
References: • Microsoft Security Bulletin MS17-010
• https://cert.be/fr/document/smb

Exploitation Proof of Concept

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 14 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
 TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 15 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Remediation:
Who: IT Team
Vector: Remote
Action: ▪ Update Systems : Immediately update the operating system to the latest
version. Apply all security patches, particularly MS17-010.
▪ Enable SMB Signing : Configure SMB signing to be required on all SMB
servers and clients to prevent man-in-the-middle attacks.
▪ Disable SMBv1 : Disable SMBv1 on all systems, as it is an outdated and
vulnerable protocol.
▪ Restrict SMB Access : Limit SMB access to only trusted networks and
consider using more secure alternatives if SMB is not necessary.
▪ Firewall Rules : Implement strict firewall rules to restrict access to SMB
services, allowing only necessary IP addresses.
▪ Network Segmentation : Segregate networks to limit the spread of potential
malware exploits within the network.

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 16 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Unrestricted Logon Attempts
Description: During the assessment, multiple brute-force attacks were performed against
login forms found on the external network by Tek-ups. The assessment revealed
that the login forms did not have any rate limiting or account lockout mechanisms
in place. This allowed for unlimited login attempts, which eventually led to
successful unauthorized access to the academy web application. The lack of
protective measures against brute-force attacks significantly increases the risk
of unauthorized access to sensitive data and systems.
Impact & Critical - Successful brute-force attacks can lead to unauthorized access to user
Likelihood: accounts, exposing personal information and potentially sensitive data. An
attacker could leverage this access to escalate privileges, deploy malware, or
compromise other parts of the network. This could result in data breaches, loss
of confidentiality, and damage to the organization's reputation.
System: 172.25.220.145
References: https://www.rapid7.com/
Exploitation Proof of Concept

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 17 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Remediation:

Who: IT Team
Vector: Remote
Action: ▪ Implement Account Lockout Mechanisms: Configure the application to lock
accounts after a certain number of failed login attempts. This will prevent
automated brute-force attacks by locking the account after multiple
unsuccessful attempts.

▪ Enable Rate Limiting: Apply rate limiting on login attempts to slow down brute-
force attacks. This can be done by limiting the number of login attempts per
IP address or user within a specific timeframe.

▪ Use CAPTCHA : Implement CAPTCHA on login forms to distinguish between

human users and automated scripts. This adds an additional layer of security
by making it difficult for bots to perform brute-force attacks.
▪ Enforce Strong Password Policies: Ensure that users create strong passwords
by enforcing complexity requirements (e.g., minimum length, use of
uppercase and lowercase letters, numbers, and special characters).
▪ Multi-Factor Authentication (MFA): Enable MFA for all user accounts to add
an additional layer of security. Even if an attacker successfully guesses a
password, they would still need the second factor to gain access.
▪ Monitor and Alert: Continuously monitor login attempts and set up alerts for
suspicious activities, such as a high number of failed login attempts from a
single IP address.
▪ Regular Audits and Penetration Testing: Conduct regular security audits and
penetration tests to identify and mitigate any vulnerabilities in the login
mechanisms.

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 18 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Successful Brute-Force Attack and Password Cracking
Description: During the assessment, multiple brute-force attacks and password-cracking
attempts were conducted using Metasploit and John the Ripper. These attacks
successfully retrieved and cracked several user password hashes from the target
system. The lack of strong password policies and protective measures allowed
easy access to user credentials, demonstrating critical vulnerabilities in the
system's authentication mechanisms.
Impact & Critical - The successful retrieval and cracking of user passwords, including
Likelihood: administrative accounts, expose the system to unauthorized access. This
compromises the confidentiality, integrity, and availability of the system and its
data. Attackers can leverage this access to escalate privileges, install malware,
exfiltrate sensitive information, and disrupt operations.
System: 172.25.220.145
References: • Rapid7 on Password Cracking :
https://www.rapid7.com/db/modules/auxiliary/analyze/crack_databases
• John the Ripper : https://www.openwall.com/john/

Exploitation Proof of Concept

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 19 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
Remediation:
Who: IT Team
Vector: Remote
Action: ▪ Implement Strong Password Policies: Enforce policies that require complex
passwords (e.g., minimum length, mix of upper and lower case letters,
numbers, and special characters) and mandate regular password changes.
▪ Enable Account Lockout Mechanisms: Configure the system to lock accounts
after a certain number of failed login attempts to prevent brute-force attacks.
▪ Use Multi-Factor Authentication (MFA): Implement MFA to add an additional
layer of security, ensuring that even if a password is compromised, a second
factor is required for access.
▪ Hash Passwords Securely: Use strong hashing algorithms like bcrypt, scrypt,
or Argon2 to securely store passwords. Salt and hash passwords before
storing them.
▪ Regularly Monitor and Audit : Continuously monitor authentication logs for
suspicious activities and conduct regular audits to ensure compliance with
security policies.
▪ User Education : Educate users on the importance of strong passwords and
how to recognize phishing attempts and other social engineering tactics.

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 20 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)
 Last Page

TEK-UP UNIVERSITY
BUSINESS CONFIDENTIAL Page 21 of 21
Copyright © TEK-UP UNIVERSITY (tekup-university.com)