TryHackMe Write-Up | OpenVAS Task 7 Practical Vulnerability Management

The OpenVAS reports used are created from rooms on TryHackMe, machines used are credited to their respective owners.

Case 001: MS00-What?

In this scenario, you are assigned to a routine vulnerability management pipeline as a SOC analyst. Your automated pipeline has already pulled a scan on the server, it is up to you to analyze and identify risk in this report.

Answer the questions below

When did the scan start in Case 001?

How to: Download the file for this task, open it to reveal the report. In the report you will see Host Summary, in this section you will see a column marked Start, under this is the answer you can copy and paste it in the answer box of THM. 

Answer: Feb 28, 00:04:46

When did the scan end in Case 001?

How to: This answer is directly to the right of the previous answer. Copy and paste over in the answer box on THM. 

Answer: Feb 28, 00:21:02

How many ports are open in Case 001?

How to: Scroll down to the next section you will see Port Summary, count the number of port numbers you see in this section. Put the number you counted over into the THM answer box. 

Answer: 3

How many total vulnerabilities were found in Case 001?

How to: Right above Port Summary you will see number of results, the number in this row is the answer. Write it over in the THM answer box. 

Answer: 5

What is the highest severity vulnerability found? (MSxx-xxx)

How to: Scroll down to the Security Issues section, in the first vulnerability look into the summary. The answer is at the end of this first summary, copy and paste it over in the THM answer box. 

Answer: MS17-010

What is the first affected OS to this vulnerability?

How to: Staying in the Security Issues Section, scroll down till you see the chart title Affected Software/OS . In this section highlight the first OS up until you reach the next OS (the next OS starts with the same thing as the one you are highlighting). Now copy and paste over in the THM answer box. 

Answer: Microsoft Windows 10 x32/x64 Edition

What is the recommended vulnerability detection method?

How to: Still staying in the Security Issues Section, scroll down till you reach the Vulnerability Detection Method. Now highlight and copy the entire first line, paste it over in THM answer box. 

Answer: Send the crafted SMB transaction request with fid = 0 and check the response to confirm the vulnerability.

TryHackMe Write-up | Intro to ISAC Task 9 Investigation Scenarios

Scenario 1

Your incident response team has quarantined a suspicious bin file. The team thinks it is a ransomware variation. Investigate and create indicators for the file.

You can find the shellcode under C:\Users\Jon\Documents\Scenarios\Scenario 1

Scenario 2

You have been assigned to analyze this week's quarantined files. The file is thought to be an unknown trojan or a new strain of the emotet malware. Investigate and create indicators for the file.

You can find the shellcode under C:\Users\Jon\Documents\Scenarios\Scenario 2

Answer the questions below

Read the above and complete the investigations

How to: So even though this doesn’t require an answer, you need to do investigation on the two scenario files. Open up your favorite text editor, you will use this to document your findings as you check out this two possible malicious files. Going to each folder in turn you can right click on the file and in the drop down menu go to properties, this will give you most of the information you will need. Record in the text editor the following: File Name, File Type, Size, Size on Disk, Date Created, and file path. Now that you have all that info for both files you can now open up the program WinMD5free. Click on the Browse button to the right of the pop-up box, you can copy and paste the file path in or just click on documents, scenarios, scenario 1, and then the file. Copy the MD5 hash over to the text editor, now do the same thing but for the file in the scenario 2 folder. now the last thing to do is run strings. Click on the start icon in the bottom left corner, in the search type cmd and hit enter to open command prompt. Use the command ./strings.exe “C:\Users\Jon\Documents\Scenarios\Scenario 1\29D6161522C7F7F21B35401907C702BDDB05ED47.bin” -accepteula > “C:\Users\Jon\Documents\Scenarios\Scenario 1\output.txt” . This will save the output to a text file in the scenario 1 folder. Now use this command for the second file ./strings.exe “C:\Users\Jon\Documents\Scenarios\Scenario 2\cryptowall.bin” -accepteula > “C:\Users\Jon\Documents\Scenarios\Scenario 2\output.txt” . Now that you have completed you investigation you can answer the question for this task. 

Answer: No Answer Needed.

What is the name of the file from Scenario 1?

How to: Found this answer while doing the investigation. 

Answer: 29D6161522C7F7F21B35401907C702BDDB05ED47.bin

What is the size of the file from Scenario 1 in bytes?

How to: Found this answer while doing the investigation. 

Answer: 96,535

What is the size on disk of the file from Scenario 1 in bytes?

How to: Found this answer while doing the investigation. 

Answer: 98,304

What is the MD5 hash of the file from Scenario 1?

How to: Found this answer while doing the investigation. 

Answer: 8baa9b809b591a11af423824f4d9726a

What is the name of the file from Scenario 2?

How to: Found this answer while doing the investigation. 

Answer: cryptowall.bin

What is the size of the file from Scenario 2 in bytes?

How to: Found this answer while doing the investigation. 

Answer: 246,272

What is the size on disk of the file from Scenario 2 in bytes?

How to: Found this answer while doing the investigation. 

Answer: 249,856

What is the MD5 hash of the file from Scenario 2?

How to: Found this answer while doing the investigation. 

Answer: 47363b94cee907e2b8926c1be61150c7

Create IOCs for both files using IOCe.

How to: No Answer Needed. 

Answer: No Answer Needed.

Welcome to DR's note, your weekly dose of knowledge from Circuit Stitch Blog.

 

This week we take about open source.

    We hear open source all over the place, but do you know what it is?  Open source refers to software that can be modified and shared because its design is publicly accessible.  The simplified version is the source code (the part that makes up the software) can be accessed easily and minimal to no cost, then you can add, remove, or replace any of that code to make it your own.  So if you hear that some software is open source, then it was created by means to be distributed and used free of cost.  They some times will have a donation page asking for donations to help cover the cost of running, maintaining, and updating the software. 

    Is all open source software safe to use?  The short answer is no, but the long answer is nnnnnooooooooooooo.  Basically it is a two-edged sword, on the one side you (or a programmer) have the ability to check the source code for anything malicious, on the other side someone malicious could have put something in that source code you don't know about.  That is one reason why you should only download software directly from the company that created the software.  When you download from third party sites, you run the risk of downloading a tainted file. 

    So what are the advantages and disadvantages of using open source software?  Let us start with the advantages, firstly it is created by people that are very talented and enjoy what they do.  If these people didn't like what they do, then they would not have created it.  Secondly, it tends to be cheaper than commercial versions.  They are either free, ask for a lower cost, or ask for a donation to the project.  Thirdly, the software is reliable, which goes hand in hand with the created by talented people.  Lastly it is flexible, since you are not tied to a proprietary software architecture, it can be used or configured for many platforms.

    Now let us look at the disadvantages, firstly it is more easily editable and could have malicious code hidden in it.  This would go with download it from a reputable site.  Secondly, it might not be as user-friendly as it is a proprietary counterpart.  Thirdly, when it comes to support it is more community based.  You might  not be able to go to the creators website and get a solution to your problems, you'll probably have to check out forums and different post from people that had the same issue as you and how they fixed it.  Sometimes you'll find a solution, sometimes you won't. 

    We all use open source software daily, Thunderbird our email client is open source.  Sometimes you just need to do a little research to vet if the software is good and legitimate.  As always if you have any questions feel free to email me, and if you have any topic you'd like me to talk about.  Have a great week.

If you'd like to read more about open source, this is where I got some of my information
https://connectusfund.org/7-main-advantages-and-disadvantages-of-open-source-software

https://opensource.com/resources/what-open-source