Assignment 2 Task 2 V3

VUT2-Task 2 v3

Eric Peterson | Western Governors University

Foreword

Due to a plain text file being found on a workstation in the root of the C: drive saying “hacked by KDC”, a small police department’s IT department has been asked to identify three potential penetration testing tools, and contrast them for possible purchase and implementation. The following information is intended to persuade the Police Chief to sign off and implement one of the three tools. The key capabilities and benefits of each are listed, along with some disadvantages or limitations, and penetration tool usage.

A1.

The three network penetration tools chosen for testing and consideration are 1) Core Impact, 2) Immunity’s Canvas, and 3) Metasploit

It has since been purchased by Rapid 7 and consists of a large programmer and subscriber base who create and make custom testing modules for assessing weaknesses in operating systems, networks, and applications. Metasploit Pro will allow the police department to do vulnerability and penetration scans, automate the process, and output reports on the environment. According to SecTools (n.d.), due to Metasploit’s extensible model through which payloads, encoders, no-op generators, and exploits can be integrated, it can also be used in performing innovative exploitation research. Understanding how the KYD was able to access the computer and plant the text file is only the beginning. They will want to plug any security holes, continue to patch the systems, and research new exploits. Metasploit’s exploit modules allow for privilege escalation (obtaining root or admin access) and SMB related attacks. For example, when testing client-side exploits at the Police Department, the exploits may fail due to their having limited user rights, requiring a tweak to the exploit module or payload. Another key feature of Metasploit is its meterpreter script, ‘getsystem‘, that will use a number of different techniques to attempt to gain SYSTEM level privileges on the target. This will assist the Police Department in closing privilege escalation attacks, which appear to have occurred in the

The biggest detractor is the cost, Core Impact is expensive, the most expensive of the three tools compared. Justifying the cost may be difficult, however, the point-and-attack simplicity may outweigh the initial costs. A 10 seat license for Core Impact costs $40,000 annually, including updates. Other negatives, according to Sidel (n.d.), include Core Impact’s frequent misidentification of operating systems for hosts being attacked (para. 21). It also can lack the ability (at times) to suggest recommended exploits for issues encountered in certain scenarios (para. 21). Other issues, such as conflicting or arbitrary information retrieved from the vulnerability database may also be perceived negatively by inexperienced IT Administrators at the Police Department. Also, when importing external vulnerability data for use in forming an attack, Core Impact can be slow and buggy according to various forum users. Core Impacts GUI, or console, depending on the amount of data loaded can become unstable, which is a detractor. Another concern may be the amount of guess work necessary when using Core Impact, as it won’t tell you everything that can be exploited on a host. It is designed to quickly perform an exploit (point-and-attack) and is intent on obtaining root or admin level access. If there are other ways the testing environment