Narrator: Scan outputs. 2 2
In this lesson, I'm going to show you 3 3
how to assess scan outputs. 4 4
And so instead of using Nessus, 5 5
we're going to go ahead and use OpenVAS 6 6
to see how that one looks a little bit different. 7 7
Now in this one, I'm going to go a little bit more in depth 8 8
than I did last time because I'm going to show you everything 9 9
from creating the scan account, 10 10
configuring its permissions, setting up OpenVAS, 11 11
and then looking at the results that come from that scan. 12 12
Let's jump into the environment and get started. 13 13
First, we need to go ahead and configure our scan accounts, 14 14
so I'm going to open up DC1 15 15
and then use my Active Directory users and computers area. 16 16
And from here, I'm going to right-click on users 17 17
and select New and then Group. 18 18
When I do this, I'm going to enter my name for my group. 19 19
I'm going to call it sec-glo-scan 20 20
and this is the group name we're going to use 21 21
for our auditors who are going to perform our scans. 22 22
Now, when we look at the scope of this, it should be global 23 23
and the type should be selected as security. 24 24
Once that's done, go ahead and hit OK. 25 25
Next, we're going to right-click on users 26 26
and select New and then User. 27 27
Here, we're going to enter in the full name 28 28
and username as scan, 29 29
then I'm going to click Next and I'm going to enter a password. 30 30
Now, I'm going to uncheck the user must change password 31 31
and check the password never expires 32 32
and then click None and then Finish. 33 33
This is a common setting 34 34
when you're setting up a scan account. 35 35
Now, when you do this, 36 36
make sure you're using a good strong password because again, 37 37
we're not requiring people to change their password here 38 38
and the password will never expire, 39 39
so something long and strong and complicated 40 40
would be a great use case here. 41 41
Next, we're going to right-click the scan object 42 42
that we just created, that user, 43 43
and we're going to select Add to Group. 44 44
Here, we're going to type in sec-glo-scan 45 45
and then click Check Name. 46 46
Once that's underlined, click OK 47 47
and then we'll be able to hit OK again. 48 48
Now we can close the Active Directory 49 49
users and computers console. 50 50
Next, we're going to go into the Server Manager 51 51
and select Tools, Group Policy Management. 52 52
This will allow us to go and manage our group policies. 53 53
Once we're in here, 54 54
then right-click the computer's OU container 55 55
and select Create a GPO in this Domain and link it here. 56 56
When we get to the box, 57 57
we're going to go ahead and call it something. 58 58
In this case, 515 Support Scanning Policy. 59 59
If you remember, 60 60
515 Support is going to be our fictional company 61 61
that we're using in most of our examples here. 62 62
Now we're going to expand the computer configuration 63 63
and then policies, and then window settings, 64 64
then security settings, then local policies, 65 65
and then user rights assignment. 66 66
Once you do that, double click the deny log on locally. 67 67
This is going to make sure 68 68
that we're not going to allow people to log on 69 69
to the local machines as an administrator. 70 70
We can only do it remotely by using our scanning engine. 71 71
We're going to check the define these policy settings box 72 72
and then click Add Users or Groups. 73 73
Again, we're going to type in our group, 74 74
which is sec-glo-scan, and click OK, 75 75
and then OK to confirm the main dialog. 76 76
At this point, we can double click 77 77
the deny log on through Remote Desktop services 78 78
because again, we don't want people 79 79
logging onto these machines, 80 80
and we're going to check the define these policy settings box 81 81
and click Add User or Group. 82 82
Again, we're going to put in our group, sec-glo-scan, 83 83
and click OK and then OK once more. 84 84
Under security settings, 85 85
we're going to select the registry node. 86 86
We're going to right-click in the empty pane 87 87
and select Add Key. 88 88
From here, we're going to select Users and click OK. 89 89
Then we'll click Advanced and click Add. 90 90
Then we can select a principal. 91 91
Again, we're going to type in sec-glo-scan and click OK. 92 92
From the type box, we're going to select Deny. 93 93
From the applies to list box, 94 94
we're going to ensure this object 95 95
and child object is selected. 96 96
Now at this point, 97 97
we can select the Show Advanced Permissions 98 98
and we're going to check the following boxes: 99 99
set value, create subkey, create link, delete, 100 100
change permissions, and take ownership, 101 101
and then we'll confirm all the dialog boxes. 102 102
This allows us to create those keys 103 103
that we need inside the registry 104 104
to give us the right permissions for our scanner. 105 105
Next, we're going to right-click in the empty pane 106 106
and again select Add Key. 107 107
From here, we're going to select Machine and click OK. 108 108
Then click Advanced and Add and select a principal. 109 109
Once more, we're going to type in sec-glo-scan and click OK. 110 110
From the type box, we're going to select Deny. 111 111
And for the applies to list box, 112 112
we're going to select this object and child objects. 113 113
Then we're going to click the Show Advanced Permissions 114 114
and make sure we check the following boxes: 115 115
set value, create subkey, create link, delete, change, 116 116
and take ownership. 117 117
Once more, confirm all the dialog boxes 118 118
and now we have set the right permissions. 119 119
So at this point, we have now created a user 120 120
and a group with the right permissions 121 121
that we can use for our scanners. 122 122
Anytime we want to do credentialed scans now, 123 123
we're going to use the user account sec-glo-scan 124 124
inside the group sec-glo-scan 125 125
because that is our scanning account 126 126
so any host on the network will allow us to connect 127 127
using administrative credentials 128 128
when we're using the scan account. 129 129
And it gives us local administrative rights 130 130
to the registry across all the computers in this domain. 131 131
Now that we've finished creating the scan account, 132 132
we need to go into OpenVAS and start using it. 133 133
So we're going to go over to my OpenVAS scanning machine 134 134
and we're going to go to the webpage 10.1.0.243, 135 135
which is my local account. 136 136
When you're using OpenVAS, 137 137
you're going to do it through a webpage 138 138
that then interacts with the server 139 139
and the program on that local machine. 140 140
Once we're there, 141 141
I'm going to log in with my admin user and my password. 142 142
Now, once I'm in the system, you can see the dashboard 143 143
and there isn't much information here 144 144
because I haven't done any scans yet. 145 145
First, I want to go to configuration under the menu 146 146
and then select Credentials. 147 147
From here, I want to select New Credential. 148 148
And then in that dialog box, 149 149
I'm going to add a new account known as sec-glo-scan, 150 150
that user account we just created. 151 151
Now, from the allow insecure use options, 152 152
I'm going to select yes 153 153
because I want to find every vulnerability in my systems, 154 154
not just the ones that might not cause problems. 155 155
Then in the username box, I'm going to type 515 Support, 156 156
which is my domain, /scan. 157 157
And in the password box, I'm going to type my password. 158 158
Now notice the /scan is that user account we created. 159 159
After we do this, click Save. 160 160
Now that we have our credentials saved, 161 161
we can now go and configure a scan scope and sensitivity. 162 162
When we do this, we're going to decide 163 163
what group of targets we want to go after 164 164
with our vulnerability scanning, 165 165
so we're going to click on Configuration 166 166
and then select Targets. 167 167
Here, I'm going to click New Target. 168 168
Then in that web dialog, 169 169
I'm going to type in the name 515support-host-windows 170 170
because I'm going to do a scan across all my hosts 171 171
inside my network that are Windows based. 172 172
Next to the host, I'm going to select manual 173 173
and type in the IP address that I want to scan. 174 174
In this case, 10.1.0.0/24, 175 175
which is my subnet that contains all my Windows hosts. 176 176
Next, I can click to exclude some hosts 177 177
so I'm going to select manual 178 178
and type in 10.1.0.254, 179 179
10.1.0.243. 180 180
Now, the .243 machine is the box I'm actually scanning with 181 181
so I don't want to actually scan this as part of my host 182 182
because it's actually an excluded area. 183 183
It is my vulnerability scanner. 184 184
Then under Credentials, I'm going to select sec-glo-scan 185 185
because that is one that we have authorized 186 186
as that administrative scanning account 187 187
and then I'm going to click on Save. 188 188
Now next, I'm going to go into the configuration menu 189 189
and click Scan Configs. 190 190
Here, we're going to take a few minutes 191 191
to just browse the default scan configurations, 192 192
but we're not going to make any changes here. 193 193
From the scans, I can select tasks. 194 194
And from the task, 195 195
there's going to be a wizard prompt that appears. 196 196
If it does, just close it. 197 197
Next, click on New Task and then select New Task. 198 198
In the new task dialog box, 199 199
we're going to type in the name that we want to call this. 200 200
In this case, 515support-host-windows-full. 201 201
Then from the scan targets box, 202 202
we're going to select the group we just set up, 203 203
515support-host-windows. 204 204
From the scan configuration box, 205 205
we're going to ensure that we select full and fast 206 206
which is the type of vulnerability scan we want to conduct 207 207
and then we'll click Save, 208 208
and finally, we'll click Play which will start our scan. 209 209
Now, because I'm using the Community edition here, 210 210
I don't have the ability to schedule tasks. 211 211
That's a feature of the Pro version of this tool. 212 212
So if you're going to be using this on your own home network, 213 213
you're going to have to actually remember 214 214
to start up the scan yourself at designated intervals 215 215
instead of having it do it for you automatically. 216 216
Now, it'll usually take a couple of minutes 217 217
or even longer to perform these scans 218 218
because it's connecting to each machine inside my scope 219 219
and being able to test them for those vulnerabilities. 220 220
So I'm going to speed this up here 221 221
so you don't have to wait as long. 222 222
Once you're done, you're going to get back the results 223 223
by going ahead and looking at the scan report. 224 224
Click on Scan and then Results. 225 225
Once you do that, 226 226
you'll see a dashboard with four key areas. 227 227
The top left is all the results by severity class. 228 228
So in this case, 229 229
you could see I had 163 total vulnerabilities. 230 230
I had seven high, 26 medium, five low, 231 231
and the rest of these were log or informational content. 232 232
Then in the middle, we have a word cluster. 233 233
These are words that are coming to us 234 234
based on all those vulnerabilities that were found 235 235
and so I could see for instance that Windows occurred a lot 236 236
because these were Windows scans 237 237
so that was a very large word. 238 238
So it's a very quick visual way to say, 239 239
"Oh, I have an issue with SSL, TLS, 240 240
or I have an issue with SSH," 241 241
or whatever that vulnerability is that's really taking up 242 242
most of your cluster there inside the words. 243 243
Then on the top right side, you have the results shown 244 244
based on the severity inside of CVSS 245 245
so it goes from non-applicable, low, 246 246
and then one through 10, 247 247
and so you can see very quickly 248 248
how dangerous things are on your network. 249 249
Now, what I really find useful is that bottom part. 250 250
Now in the bottom part, 251 251
we're seeing the results 10 at a time. 252 252
And in those results, we are going to see, 253 253
in this case 10 out of 163. 254 254
You'll have the name of the vulnerability, 255 255
you'll have the severity, 256 256
you'll have the quality of detection, 257 257
you'll have the host IP, 258 258
the name which is the DNS name of your server, 259 259
and then the location and when that was created. 260 260
This is information again at the top level, 261 261
but you can drill down and see additional detail 262 262
by clicking on the names of those vulnerabilities. 263 263
So now that we've done a quick look at our results, 264 264
let's go ahead and take a look by filtering 265 265
to find out anything associated with a particular host. 266 266
For example, if I wanted to find all the vulnerabilities 267 267
for the host at 10.1.0.1, 268 268
I could go into the filter box type host equals 10.1.0.1 269 269
and click Update Filter. 270 270
This is all the vulnerabilities 271 271
associated with my domain controller. 272 272
Now, you'll see there's not many here. 273 273
Why is that? 274 274
Well, because we really only did an uncredentialed scan 275 275
against the domain controller. 276 276
We gave ourself permissions with that scan account 277 277
to have administrative rights on everything in the network 278 278
except the domain controller. 279 279
So the domain controller is getting an uncredentialed scan 280 280
while everything else is getting a credentialed scan. 281 281
Now, let's take a look for instance 282 282
at the null session vulnerability. 283 283
When we click on that, 284 284
we can see that because the guest account is enabled, 285 285
there is a serious configuration here. 286 286
And because this is a domain controller, 287 287
this is quite alarming. 288 288
This is something that definitely should not be there 289 289
on a domain controller, which is why there's a high severity 290 290
and it's something we should fix quite quickly. 291 291
Now, the next thing we want to do is we want to filter out 292 292
and adjust our string here. 293 293
So instead of looking at the domain controller at 10.1.0.1, 294 294
let's go ahead and make that 10.1.0.2. 295 295
When we do that, you're going to see a lot more severe results. 296 296
This is because we had administrative credentials 297 297
and we did a credentialed scan. 298 298
Now, when we did this on a host, 299 299
we're going to see a lot more vulnerabilities 300 300
because we have administrative rights. 301 301
In this case, we see a lot of them that have high severity 302 302
in the 10 range or the nine range. 303 303
Now, we can go in and look at these 304 304
by clicking on those reports. 305 305
And if you have internet access connected to this, 306 306
you can actually go and research those different CVEs 307 307
to figure out what you should do. 308 308
For example, if we look at the vulnerability in the filter 309 309
and we want to find everything that's affected 310 310
by a particular vulnerability, 311 311
instead of looking at it by host, 312 312
we can type in vulnerability tilde quote 313 313
and then the name of the vulnerability. 314 314
In my case, I'm going to use 4013389 and then end quote. 315 315
Once I do that, I click the Update Filter button 316 316
and you'll see that I have a hit for PC2, 317 317
which is running Windows 7. 318 318
And this is bad news because this is the same vulnerability 319 319
that was used by WannaCry, which is known as EternalBlue. 320 320
This is a big bad vulnerability 321 321
that allows remote code execution on a system. 322 322
So this is one that if you find in your network, 323 323
you want to make sure you get it patched up pretty quickly. 324 324
Now, additionally, we can look at the same results 325 325
by instead of looking at the vulnerability number 326 326
based on the knowledge base that Microsoft uses, 327 327
we can instead look at it based on a CVE. 328 328
For example, I know that the WannaCry Vulnerability 329 329
is CVE -017-0144 330 330
so I can go into the filter box type tilde quote 331 331
CVE-2017-0144 quote and hit Update Filter. 332 332
Now, I'm going to find any machines that match that CVE. 333 333
This is really useful 334 334
if there's some new big bad vulnerability that comes out 335 335
and you want to test all your systems 336 336
for that particular vulnerability. 337 337
For example, I was working in a large organization 338 338
when the Apache Struts vulnerability 339 339
came out a couple of years ago. 340 340
We wanted to identify across our millions of endpoints 341 341
which ones were vulnerable to this attack. 342 342
So we were able to do a search 343 343
looking just for that one CVE 344 344
as we looked across our network and scanned 345 345
and that way we can find those and patch those quickly. 346 346
So hopefully you've enjoyed this short lesson 347 347
on learning how to configure your scanner 348 348
and use a scanner using OpenVAS 349 349
and the Greenbone Community Edition. 350 350
As I said in our lesson, 351 351
I recommend you download this program 352 352
and scan your own network, play with it, 353 353
get comfortable reading these different results 354 354
and reading these reports because it would be totally fair 355 355
for the exam to give you an output from one of these results 356 356
and then ask you what you would do to fix it.