1 1 00:00:00,060 --> 00:00:01,950 Scan outputs. 2 2 00:00:01,950 --> 00:00:03,570 In this lesson, I'm going to show you 3 3 00:00:03,570 --> 00:00:05,100 how to assess scan outputs. 4 4 00:00:05,100 --> 00:00:06,900 And so instead of using Nessus, 5 5 00:00:06,900 --> 00:00:08,580 we're going to go ahead and use OpenVAS 6 6 00:00:08,580 --> 00:00:10,710 to see how that one looks a little bit different. 7 7 00:00:10,710 --> 00:00:12,570 Now in this one, I'm going to go a little bit more in depth 8 8 00:00:12,570 --> 00:00:14,970 than I did last time because I'm going to show you everything 9 9 00:00:14,970 --> 00:00:16,560 from creating the scan account, 10 10 00:00:16,560 --> 00:00:19,200 configuring its permissions, setting up OpenVAS, 11 11 00:00:19,200 --> 00:00:21,960 and then looking at the results that come from that scan. 12 12 00:00:21,960 --> 00:00:24,210 Let's jump into the environment and get started. 13 13 00:00:24,210 --> 00:00:27,540 First, we need to go ahead and configure our scan accounts, 14 14 00:00:27,540 --> 00:00:29,520 so I'm going to open up DC1 15 15 00:00:29,520 --> 00:00:33,060 and then use my Active Directory users and computers area. 16 16 00:00:33,060 --> 00:00:35,100 And from here, I'm going to right-click on users 17 17 00:00:35,100 --> 00:00:37,590 and select New and then Group. 18 18 00:00:37,590 --> 00:00:39,720 When I do this, I'm going to enter my name for my group. 19 19 00:00:39,720 --> 00:00:43,440 I'm going to call it sec-glo-scan 20 20 00:00:43,440 --> 00:00:44,790 and this is the group name we're going to use 21 21 00:00:44,790 --> 00:00:47,430 for our auditors who are going to perform our scans. 22 22 00:00:47,430 --> 00:00:50,100 Now, when we look at the scope of this, it should be global 23 23 00:00:50,100 --> 00:00:52,530 and the type should be selected as security. 24 24 00:00:52,530 --> 00:00:55,140 Once that's done, go ahead and hit OK. 25 25 00:00:55,140 --> 00:00:56,880 Next, we're going to right-click on users 26 26 00:00:56,880 --> 00:00:59,310 and select New and then User. 27 27 00:00:59,310 --> 00:01:01,050 Here, we're going to enter in the full name 28 28 00:01:01,050 --> 00:01:03,450 and username as scan, 29 29 00:01:03,450 --> 00:01:06,840 then I'm going to click Next and I'm going to enter a password. 30 30 00:01:06,840 --> 00:01:09,480 Now, I'm going to uncheck the user must change password 31 31 00:01:09,480 --> 00:01:11,370 and check the password never expires 32 32 00:01:11,370 --> 00:01:13,800 and then click None and then Finish. 33 33 00:01:13,800 --> 00:01:14,790 This is a common setting 34 34 00:01:14,790 --> 00:01:16,680 when you're setting up a scan account. 35 35 00:01:16,680 --> 00:01:18,000 Now, when you do this, 36 36 00:01:18,000 --> 00:01:21,120 make sure you're using a good strong password because again, 37 37 00:01:21,120 --> 00:01:23,220 we're not requiring people to change their password here 38 38 00:01:23,220 --> 00:01:24,960 and the password will never expire, 39 39 00:01:24,960 --> 00:01:27,420 so something long and strong and complicated 40 40 00:01:27,420 --> 00:01:29,460 would be a great use case here. 41 41 00:01:29,460 --> 00:01:31,530 Next, we're going to right-click the scan object 42 42 00:01:31,530 --> 00:01:33,060 that we just created, that user, 43 43 00:01:33,060 --> 00:01:34,710 and we're going to select Add to Group. 44 44 00:01:34,710 --> 00:01:38,640 Here, we're going to type in sec-glo-scan 45 45 00:01:38,640 --> 00:01:40,140 and then click Check Name. 46 46 00:01:40,140 --> 00:01:42,060 Once that's underlined, click OK 47 47 00:01:42,060 --> 00:01:44,220 and then we'll be able to hit OK again. 48 48 00:01:44,220 --> 00:01:45,900 Now we can close the Active Directory 49 49 00:01:45,900 --> 00:01:47,880 users and computers console. 50 50 00:01:47,880 --> 00:01:49,860 Next, we're going to go into the Server Manager 51 51 00:01:49,860 --> 00:01:52,560 and select Tools, Group Policy Management. 52 52 00:01:52,560 --> 00:01:55,380 This will allow us to go and manage our group policies. 53 53 00:01:55,380 --> 00:01:56,340 Once we're in here, 54 54 00:01:56,340 --> 00:01:58,230 then right-click the computer's OU container 55 55 00:01:58,230 --> 00:02:01,740 and select Create a GPO in this Domain and link it here. 56 56 00:02:01,740 --> 00:02:02,670 When we get to the box, 57 57 00:02:02,670 --> 00:02:04,650 we're going to go ahead and call it something. 58 58 00:02:04,650 --> 00:02:07,860 In this case, 515 Support Scanning Policy. 59 59 00:02:07,860 --> 00:02:08,693 If you remember, 60 60 00:02:08,693 --> 00:02:10,920 515 Support is going to be our fictional company 61 61 00:02:10,920 --> 00:02:13,380 that we're using in most of our examples here. 62 62 00:02:13,380 --> 00:02:15,810 Now we're going to expand the computer configuration 63 63 00:02:15,810 --> 00:02:18,480 and then policies, and then window settings, 64 64 00:02:18,480 --> 00:02:21,180 then security settings, then local policies, 65 65 00:02:21,180 --> 00:02:23,040 and then user rights assignment. 66 66 00:02:23,040 --> 00:02:26,820 Once you do that, double click the deny log on locally. 67 67 00:02:26,820 --> 00:02:27,930 This is going to make sure 68 68 00:02:27,930 --> 00:02:29,910 that we're not going to allow people to log on 69 69 00:02:29,910 --> 00:02:31,980 to the local machines as an administrator. 70 70 00:02:31,980 --> 00:02:35,550 We can only do it remotely by using our scanning engine. 71 71 00:02:35,550 --> 00:02:37,920 We're going to check the define these policy settings box 72 72 00:02:37,920 --> 00:02:40,290 and then click Add Users or Groups. 73 73 00:02:40,290 --> 00:02:41,940 Again, we're going to type in our group, 74 74 00:02:41,940 --> 00:02:45,660 which is sec-glo-scan, and click OK, 75 75 00:02:45,660 --> 00:02:48,330 and then OK to confirm the main dialog. 76 76 00:02:48,330 --> 00:02:49,740 At this point, we can double click 77 77 00:02:49,740 --> 00:02:52,290 the deny log on through Remote Desktop services 78 78 00:02:52,290 --> 00:02:53,730 because again, we don't want people 79 79 00:02:53,730 --> 00:02:55,530 logging onto these machines, 80 80 00:02:55,530 --> 00:02:58,380 and we're going to check the define these policy settings box 81 81 00:02:58,380 --> 00:03:00,570 and click Add User or Group. 82 82 00:03:00,570 --> 00:03:04,440 Again, we're going to put in our group, sec-glo-scan, 83 83 00:03:04,440 --> 00:03:07,170 and click OK and then OK once more. 84 84 00:03:07,170 --> 00:03:08,340 Under security settings, 85 85 00:03:08,340 --> 00:03:10,260 we're going to select the registry node. 86 86 00:03:10,260 --> 00:03:11,910 We're going to right-click in the empty pane 87 87 00:03:11,910 --> 00:03:13,860 and select Add Key. 88 88 00:03:13,860 --> 00:03:17,100 From here, we're going to select Users and click OK. 89 89 00:03:17,100 --> 00:03:19,740 Then we'll click Advanced and click Add. 90 90 00:03:19,740 --> 00:03:22,110 Then we can select a principal. 91 91 00:03:22,110 --> 00:03:27,110 Again, we're going to type in sec-glo-scan and click OK. 92 92 00:03:27,420 --> 00:03:30,210 From the type box, we're going to select Deny. 93 93 00:03:30,210 --> 00:03:31,860 From the applies to list box, 94 94 00:03:31,860 --> 00:03:33,510 we're going to ensure this object 95 95 00:03:33,510 --> 00:03:35,700 and child object is selected. 96 96 00:03:35,700 --> 00:03:36,780 Now at this point, 97 97 00:03:36,780 --> 00:03:39,360 we can select the Show Advanced Permissions 98 98 00:03:39,360 --> 00:03:41,640 and we're going to check the following boxes: 99 99 00:03:41,640 --> 00:03:45,360 set value, create subkey, create link, delete, 100 100 00:03:45,360 --> 00:03:47,370 change permissions, and take ownership, 101 101 00:03:47,370 --> 00:03:49,830 and then we'll confirm all the dialog boxes. 102 102 00:03:49,830 --> 00:03:51,630 This allows us to create those keys 103 103 00:03:51,630 --> 00:03:53,250 that we need inside the registry 104 104 00:03:53,250 --> 00:03:55,650 to give us the right permissions for our scanner. 105 105 00:03:55,650 --> 00:03:57,690 Next, we're going to right-click in the empty pane 106 106 00:03:57,690 --> 00:03:59,790 and again select Add Key. 107 107 00:03:59,790 --> 00:04:03,030 From here, we're going to select Machine and click OK. 108 108 00:04:03,030 --> 00:04:06,510 Then click Advanced and Add and select a principal. 109 109 00:04:06,510 --> 00:04:10,920 Once more, we're going to type in sec-glo-scan and click OK. 110 110 00:04:10,920 --> 00:04:13,200 From the type box, we're going to select Deny. 111 111 00:04:13,200 --> 00:04:14,850 And for the applies to list box, 112 112 00:04:14,850 --> 00:04:17,940 we're going to select this object and child objects. 113 113 00:04:17,940 --> 00:04:20,250 Then we're going to click the Show Advanced Permissions 114 114 00:04:20,250 --> 00:04:22,650 and make sure we check the following boxes: 115 115 00:04:22,650 --> 00:04:26,790 set value, create subkey, create link, delete, change, 116 116 00:04:26,790 --> 00:04:28,260 and take ownership. 117 117 00:04:28,260 --> 00:04:30,930 Once more, confirm all the dialog boxes 118 118 00:04:30,930 --> 00:04:33,330 and now we have set the right permissions. 119 119 00:04:33,330 --> 00:04:35,580 So at this point, we have now created a user 120 120 00:04:35,580 --> 00:04:37,200 and a group with the right permissions 121 121 00:04:37,200 --> 00:04:38,940 that we can use for our scanners. 122 122 00:04:38,940 --> 00:04:40,980 Anytime we want to do credentialed scans now, 123 123 00:04:40,980 --> 00:04:45,120 we're going to use the user account sec-glo-scan 124 124 00:04:45,120 --> 00:04:48,060 inside the group sec-glo-scan 125 125 00:04:48,060 --> 00:04:49,530 because that is our scanning account 126 126 00:04:49,530 --> 00:04:51,750 so any host on the network will allow us to connect 127 127 00:04:51,750 --> 00:04:53,310 using administrative credentials 128 128 00:04:53,310 --> 00:04:54,870 when we're using the scan account. 129 129 00:04:54,870 --> 00:04:56,490 And it gives us local administrative rights 130 130 00:04:56,490 --> 00:05:00,060 to the registry across all the computers in this domain. 131 131 00:05:00,060 --> 00:05:02,160 Now that we've finished creating the scan account, 132 132 00:05:02,160 --> 00:05:04,830 we need to go into OpenVAS and start using it. 133 133 00:05:04,830 --> 00:05:06,930 So we're going to go over to my OpenVAS scanning machine 134 134 00:05:06,930 --> 00:05:10,770 and we're going to go to the webpage 10.1.0.243, 135 135 00:05:10,770 --> 00:05:12,420 which is my local account. 136 136 00:05:12,420 --> 00:05:13,560 When you're using OpenVAS, 137 137 00:05:13,560 --> 00:05:15,180 you're going to do it through a webpage 138 138 00:05:15,180 --> 00:05:16,560 that then interacts with the server 139 139 00:05:16,560 --> 00:05:18,780 and the program on that local machine. 140 140 00:05:18,780 --> 00:05:19,613 Once we're there, 141 141 00:05:19,613 --> 00:05:22,440 I'm going to log in with my admin user and my password. 142 142 00:05:22,440 --> 00:05:24,960 Now, once I'm in the system, you can see the dashboard 143 143 00:05:24,960 --> 00:05:26,370 and there isn't much information here 144 144 00:05:26,370 --> 00:05:28,470 because I haven't done any scans yet. 145 145 00:05:28,470 --> 00:05:30,900 First, I want to go to configuration under the menu 146 146 00:05:30,900 --> 00:05:32,940 and then select Credentials. 147 147 00:05:32,940 --> 00:05:35,310 From here, I want to select New Credential. 148 148 00:05:35,310 --> 00:05:36,930 And then in that dialog box, 149 149 00:05:36,930 --> 00:05:41,490 I'm going to add a new account known as sec-glo-scan, 150 150 00:05:41,490 --> 00:05:43,680 that user account we just created. 151 151 00:05:43,680 --> 00:05:45,840 Now, from the allow insecure use options, 152 152 00:05:45,840 --> 00:05:46,950 I'm going to select yes 153 153 00:05:46,950 --> 00:05:49,500 because I want to find every vulnerability in my systems, 154 154 00:05:49,500 --> 00:05:51,960 not just the ones that might not cause problems. 155 155 00:05:51,960 --> 00:05:54,900 Then in the username box, I'm going to type 515 Support, 156 156 00:05:54,900 --> 00:05:57,147 which is my domain, /scan. 157 157 00:05:57,147 --> 00:06:00,540 And in the password box, I'm going to type my password. 158 158 00:06:00,540 --> 00:06:03,720 Now notice the /scan is that user account we created. 159 159 00:06:03,720 --> 00:06:05,433 After we do this, click Save. 160 160 00:06:06,330 --> 00:06:08,040 Now that we have our credentials saved, 161 161 00:06:08,040 --> 00:06:11,700 we can now go and configure a scan scope and sensitivity. 162 162 00:06:11,700 --> 00:06:13,260 When we do this, we're going to decide 163 163 00:06:13,260 --> 00:06:15,240 what group of targets we want to go after 164 164 00:06:15,240 --> 00:06:17,100 with our vulnerability scanning, 165 165 00:06:17,100 --> 00:06:18,720 so we're going to click on Configuration 166 166 00:06:18,720 --> 00:06:20,220 and then select Targets. 167 167 00:06:20,220 --> 00:06:22,560 Here, I'm going to click New Target. 168 168 00:06:22,560 --> 00:06:24,120 Then in that web dialog, 169 169 00:06:24,120 --> 00:06:28,380 I'm going to type in the name 515support-host-windows 170 170 00:06:28,380 --> 00:06:30,570 because I'm going to do a scan across all my hosts 171 171 00:06:30,570 --> 00:06:33,120 inside my network that are Windows based. 172 172 00:06:33,120 --> 00:06:35,040 Next to the host, I'm going to select manual 173 173 00:06:35,040 --> 00:06:37,410 and type in the IP address that I want to scan. 174 174 00:06:37,410 --> 00:06:41,220 In this case, 10.1.0.0/24, 175 175 00:06:41,220 --> 00:06:44,250 which is my subnet that contains all my Windows hosts. 176 176 00:06:44,250 --> 00:06:46,380 Next, I can click to exclude some hosts 177 177 00:06:46,380 --> 00:06:48,090 so I'm going to select manual 178 178 00:06:48,090 --> 00:06:51,930 and type in 10.1.0.254, 179 179 00:06:51,930 --> 00:06:54,360 10.1.0.243. 180 180 00:06:54,360 --> 00:06:57,780 Now, the .243 machine is the box I'm actually scanning with 181 181 00:06:57,780 --> 00:07:00,330 so I don't want to actually scan this as part of my host 182 182 00:07:00,330 --> 00:07:01,950 because it's actually an excluded area. 183 183 00:07:01,950 --> 00:07:03,990 It is my vulnerability scanner. 184 184 00:07:03,990 --> 00:07:08,220 Then under Credentials, I'm going to select sec-glo-scan 185 185 00:07:08,220 --> 00:07:10,410 because that is one that we have authorized 186 186 00:07:10,410 --> 00:07:12,450 as that administrative scanning account 187 187 00:07:12,450 --> 00:07:14,970 and then I'm going to click on Save. 188 188 00:07:14,970 --> 00:07:17,400 Now next, I'm going to go into the configuration menu 189 189 00:07:17,400 --> 00:07:19,500 and click Scan Configs. 190 190 00:07:19,500 --> 00:07:20,910 Here, we're going to take a few minutes 191 191 00:07:20,910 --> 00:07:23,670 to just browse the default scan configurations, 192 192 00:07:23,670 --> 00:07:26,130 but we're not going to make any changes here. 193 193 00:07:26,130 --> 00:07:28,530 From the scans, I can select tasks. 194 194 00:07:28,530 --> 00:07:29,460 And from the task, 195 195 00:07:29,460 --> 00:07:31,350 there's going to be a wizard prompt that appears. 196 196 00:07:31,350 --> 00:07:33,360 If it does, just close it. 197 197 00:07:33,360 --> 00:07:36,960 Next, click on New Task and then select New Task. 198 198 00:07:36,960 --> 00:07:38,550 In the new task dialog box, 199 199 00:07:38,550 --> 00:07:40,380 we're going to type in the name that we want to call this. 200 200 00:07:40,380 --> 00:07:45,380 In this case, 515support-host-windows-full. 201 201 00:07:45,480 --> 00:07:47,190 Then from the scan targets box, 202 202 00:07:47,190 --> 00:07:49,441 we're going to select the group we just set up, 203 203 00:07:49,441 --> 00:07:52,380 515support-host-windows. 204 204 00:07:52,380 --> 00:07:53,940 From the scan configuration box, 205 205 00:07:53,940 --> 00:07:56,730 we're going to ensure that we select full and fast 206 206 00:07:56,730 --> 00:07:59,190 which is the type of vulnerability scan we want to conduct 207 207 00:07:59,190 --> 00:08:00,720 and then we'll click Save, 208 208 00:08:00,720 --> 00:08:04,140 and finally, we'll click Play which will start our scan. 209 209 00:08:04,140 --> 00:08:06,300 Now, because I'm using the Community edition here, 210 210 00:08:06,300 --> 00:08:08,580 I don't have the ability to schedule tasks. 211 211 00:08:08,580 --> 00:08:11,220 That's a feature of the Pro version of this tool. 212 212 00:08:11,220 --> 00:08:13,380 So if you're going to be using this on your own home network, 213 213 00:08:13,380 --> 00:08:14,820 you're going to have to actually remember 214 214 00:08:14,820 --> 00:08:17,400 to start up the scan yourself at designated intervals 215 215 00:08:17,400 --> 00:08:19,470 instead of having it do it for you automatically. 216 216 00:08:19,470 --> 00:08:21,330 Now, it'll usually take a couple of minutes 217 217 00:08:21,330 --> 00:08:23,310 or even longer to perform these scans 218 218 00:08:23,310 --> 00:08:26,310 because it's connecting to each machine inside my scope 219 219 00:08:26,310 --> 00:08:28,440 and being able to test them for those vulnerabilities. 220 220 00:08:28,440 --> 00:08:29,670 So I'm going to speed this up here 221 221 00:08:29,670 --> 00:08:31,260 so you don't have to wait as long. 222 222 00:08:31,260 --> 00:08:33,690 Once you're done, you're going to get back the results 223 223 00:08:33,690 --> 00:08:36,180 by going ahead and looking at the scan report. 224 224 00:08:36,180 --> 00:08:38,670 Click on Scan and then Results. 225 225 00:08:38,670 --> 00:08:39,503 Once you do that, 226 226 00:08:39,503 --> 00:08:41,640 you'll see a dashboard with four key areas. 227 227 00:08:41,640 --> 00:08:44,640 The top left is all the results by severity class. 228 228 00:08:44,640 --> 00:08:45,473 So in this case, 229 229 00:08:45,473 --> 00:08:48,090 you could see I had 163 total vulnerabilities. 230 230 00:08:48,090 --> 00:08:51,030 I had seven high, 26 medium, five low, 231 231 00:08:51,030 --> 00:08:54,120 and the rest of these were log or informational content. 232 232 00:08:54,120 --> 00:08:56,100 Then in the middle, we have a word cluster. 233 233 00:08:56,100 --> 00:08:57,570 These are words that are coming to us 234 234 00:08:57,570 --> 00:08:59,850 based on all those vulnerabilities that were found 235 235 00:08:59,850 --> 00:09:02,370 and so I could see for instance that Windows occurred a lot 236 236 00:09:02,370 --> 00:09:03,780 because these were Windows scans 237 237 00:09:03,780 --> 00:09:05,340 so that was a very large word. 238 238 00:09:05,340 --> 00:09:06,817 So it's a very quick visual way to say, 239 239 00:09:06,817 --> 00:09:09,300 "Oh, I have an issue with SSL, TLS, 240 240 00:09:09,300 --> 00:09:11,220 or I have an issue with SSH," 241 241 00:09:11,220 --> 00:09:13,470 or whatever that vulnerability is that's really taking up 242 242 00:09:13,470 --> 00:09:15,570 most of your cluster there inside the words. 243 243 00:09:15,570 --> 00:09:18,420 Then on the top right side, you have the results shown 244 244 00:09:18,420 --> 00:09:21,180 based on the severity inside of CVSS 245 245 00:09:21,180 --> 00:09:23,340 so it goes from non-applicable, low, 246 246 00:09:23,340 --> 00:09:24,417 and then one through 10, 247 247 00:09:24,417 --> 00:09:25,860 and so you can see very quickly 248 248 00:09:25,860 --> 00:09:27,810 how dangerous things are on your network. 249 249 00:09:27,810 --> 00:09:30,420 Now, what I really find useful is that bottom part. 250 250 00:09:30,420 --> 00:09:31,350 Now in the bottom part, 251 251 00:09:31,350 --> 00:09:33,570 we're seeing the results 10 at a time. 252 252 00:09:33,570 --> 00:09:35,340 And in those results, we are going to see, 253 253 00:09:35,340 --> 00:09:38,280 in this case 10 out of 163. 254 254 00:09:38,280 --> 00:09:40,110 You'll have the name of the vulnerability, 255 255 00:09:40,110 --> 00:09:41,640 you'll have the severity, 256 256 00:09:41,640 --> 00:09:43,350 you'll have the quality of detection, 257 257 00:09:43,350 --> 00:09:44,850 you'll have the host IP, 258 258 00:09:44,850 --> 00:09:47,490 the name which is the DNS name of your server, 259 259 00:09:47,490 --> 00:09:50,490 and then the location and when that was created. 260 260 00:09:50,490 --> 00:09:52,980 This is information again at the top level, 261 261 00:09:52,980 --> 00:09:54,870 but you can drill down and see additional detail 262 262 00:09:54,870 --> 00:09:57,270 by clicking on the names of those vulnerabilities. 263 263 00:09:57,270 --> 00:09:59,520 So now that we've done a quick look at our results, 264 264 00:09:59,520 --> 00:10:02,310 let's go ahead and take a look by filtering 265 265 00:10:02,310 --> 00:10:05,190 to find out anything associated with a particular host. 266 266 00:10:05,190 --> 00:10:07,680 For example, if I wanted to find all the vulnerabilities 267 267 00:10:07,680 --> 00:10:10,470 for the host at 10.1.0.1, 268 268 00:10:10,470 --> 00:10:14,880 I could go into the filter box type host equals 10.1.0.1 269 269 00:10:14,880 --> 00:10:16,410 and click Update Filter. 270 270 00:10:16,410 --> 00:10:17,820 This is all the vulnerabilities 271 271 00:10:17,820 --> 00:10:19,710 associated with my domain controller. 272 272 00:10:19,710 --> 00:10:21,150 Now, you'll see there's not many here. 273 273 00:10:21,150 --> 00:10:22,170 Why is that? 274 274 00:10:22,170 --> 00:10:24,750 Well, because we really only did an uncredentialed scan 275 275 00:10:24,750 --> 00:10:26,280 against the domain controller. 276 276 00:10:26,280 --> 00:10:28,470 We gave ourself permissions with that scan account 277 277 00:10:28,470 --> 00:10:31,050 to have administrative rights on everything in the network 278 278 00:10:31,050 --> 00:10:32,850 except the domain controller. 279 279 00:10:32,850 --> 00:10:35,700 So the domain controller is getting an uncredentialed scan 280 280 00:10:35,700 --> 00:10:38,460 while everything else is getting a credentialed scan. 281 281 00:10:38,460 --> 00:10:39,810 Now, let's take a look for instance 282 282 00:10:39,810 --> 00:10:41,940 at the null session vulnerability. 283 283 00:10:41,940 --> 00:10:43,170 When we click on that, 284 284 00:10:43,170 --> 00:10:45,600 we can see that because the guest account is enabled, 285 285 00:10:45,600 --> 00:10:47,610 there is a serious configuration here. 286 286 00:10:47,610 --> 00:10:49,230 And because this is a domain controller, 287 287 00:10:49,230 --> 00:10:50,580 this is quite alarming. 288 288 00:10:50,580 --> 00:10:52,860 This is something that definitely should not be there 289 289 00:10:52,860 --> 00:10:55,380 on a domain controller, which is why there's a high severity 290 290 00:10:55,380 --> 00:10:57,420 and it's something we should fix quite quickly. 291 291 00:10:57,420 --> 00:10:59,460 Now, the next thing we want to do is we want to filter out 292 292 00:10:59,460 --> 00:11:00,540 and adjust our string here. 293 293 00:11:00,540 --> 00:11:04,050 So instead of looking at the domain controller at 10.1.0.1, 294 294 00:11:04,050 --> 00:11:07,020 let's go ahead and make that 10.1.0.2. 295 295 00:11:07,020 --> 00:11:10,500 When we do that, you're going to see a lot more severe results. 296 296 00:11:10,500 --> 00:11:12,570 This is because we had administrative credentials 297 297 00:11:12,570 --> 00:11:14,370 and we did a credentialed scan. 298 298 00:11:14,370 --> 00:11:15,900 Now, when we did this on a host, 299 299 00:11:15,900 --> 00:11:17,670 we're going to see a lot more vulnerabilities 300 300 00:11:17,670 --> 00:11:19,560 because we have administrative rights. 301 301 00:11:19,560 --> 00:11:22,620 In this case, we see a lot of them that have high severity 302 302 00:11:22,620 --> 00:11:24,990 in the 10 range or the nine range. 303 303 00:11:24,990 --> 00:11:26,850 Now, we can go in and look at these 304 304 00:11:26,850 --> 00:11:28,530 by clicking on those reports. 305 305 00:11:28,530 --> 00:11:30,990 And if you have internet access connected to this, 306 306 00:11:30,990 --> 00:11:33,810 you can actually go and research those different CVEs 307 307 00:11:33,810 --> 00:11:35,610 to figure out what you should do. 308 308 00:11:35,610 --> 00:11:38,280 For example, if we look at the vulnerability in the filter 309 309 00:11:38,280 --> 00:11:39,840 and we want to find everything that's affected 310 310 00:11:39,840 --> 00:11:41,490 by a particular vulnerability, 311 311 00:11:41,490 --> 00:11:43,050 instead of looking at it by host, 312 312 00:11:43,050 --> 00:11:46,260 we can type in vulnerability tilde quote 313 313 00:11:46,260 --> 00:11:47,790 and then the name of the vulnerability. 314 314 00:11:47,790 --> 00:11:52,770 In my case, I'm going to use 4013389 and then end quote. 315 315 00:11:52,770 --> 00:11:55,290 Once I do that, I click the Update Filter button 316 316 00:11:55,290 --> 00:11:57,450 and you'll see that I have a hit for PC2, 317 317 00:11:57,450 --> 00:11:58,980 which is running Windows 7. 318 318 00:11:58,980 --> 00:12:01,290 And this is bad news because this is the same vulnerability 319 319 00:12:01,290 --> 00:12:04,650 that was used by WannaCry, which is known as EternalBlue. 320 320 00:12:04,650 --> 00:12:06,480 This is a big bad vulnerability 321 321 00:12:06,480 --> 00:12:09,030 that allows remote code execution on a system. 322 322 00:12:09,030 --> 00:12:10,830 So this is one that if you find in your network, 323 323 00:12:10,830 --> 00:12:13,440 you want to make sure you get it patched up pretty quickly. 324 324 00:12:13,440 --> 00:12:16,200 Now, additionally, we can look at the same results 325 325 00:12:16,200 --> 00:12:18,480 by instead of looking at the vulnerability number 326 326 00:12:18,480 --> 00:12:20,850 based on the knowledge base that Microsoft uses, 327 327 00:12:20,850 --> 00:12:23,280 we can instead look at it based on a CVE. 328 328 00:12:23,280 --> 00:12:26,130 For example, I know that the WannaCry Vulnerability 329 329 00:12:26,130 --> 00:12:30,060 is CVE -017-0144 330 330 00:12:30,060 --> 00:12:34,099 so I can go into the filter box type tilde quote 331 331 00:12:34,099 --> 00:12:39,099 CVE-2017-0144 quote and hit Update Filter. 332 332 00:12:39,810 --> 00:12:43,860 Now, I'm going to find any machines that match that CVE. 333 333 00:12:43,860 --> 00:12:44,820 This is really useful 334 334 00:12:44,820 --> 00:12:47,640 if there's some new big bad vulnerability that comes out 335 335 00:12:47,640 --> 00:12:49,020 and you want to test all your systems 336 336 00:12:49,020 --> 00:12:51,330 for that particular vulnerability. 337 337 00:12:51,330 --> 00:12:54,060 For example, I was working in a large organization 338 338 00:12:54,060 --> 00:12:55,560 when the Apache Struts vulnerability 339 339 00:12:55,560 --> 00:12:57,240 came out a couple of years ago. 340 340 00:12:57,240 --> 00:13:00,150 We wanted to identify across our millions of endpoints 341 341 00:13:00,150 --> 00:13:02,190 which ones were vulnerable to this attack. 342 342 00:13:02,190 --> 00:13:03,840 So we were able to do a search 343 343 00:13:03,840 --> 00:13:06,210 looking just for that one CVE 344 344 00:13:06,210 --> 00:13:08,160 as we looked across our network and scanned 345 345 00:13:08,160 --> 00:13:10,800 and that way we can find those and patch those quickly. 346 346 00:13:10,800 --> 00:13:12,690 So hopefully you've enjoyed this short lesson 347 347 00:13:12,690 --> 00:13:14,430 on learning how to configure your scanner 348 348 00:13:14,430 --> 00:13:16,830 and use a scanner using OpenVAS 349 349 00:13:16,830 --> 00:13:19,110 and the Greenbone Community Edition. 350 350 00:13:19,110 --> 00:13:20,280 As I said in our lesson, 351 351 00:13:20,280 --> 00:13:22,170 I recommend you download this program 352 352 00:13:22,170 --> 00:13:24,270 and scan your own network, play with it, 353 353 00:13:24,270 --> 00:13:26,340 get comfortable reading these different results 354 354 00:13:26,340 --> 00:13:29,280 and reading these reports because it would be totally fair 355 355 00:13:29,280 --> 00:13:32,400 for the exam to give you an output from one of these results 356 356 00:13:32,400 --> 00:13:34,650 and then ask you what you would do to fix it.