Getting Started in Penetration Testing

I have a page written specifically to answer this question at:
http://www.pentester.tips/

Have a look at the community section, specifically Getting Started In Pen Testing

I would love any feedback from the community on how to make it even better. This question comes up a lot and we need to provide a path for talented, passionate security people to increase their skills.

Segmentation Checking for PCI Requirement 11.3.4

PCI 3.0 introduced Requirement 11.3.4: “If segmentation is used to isolate the CDE from other networks, perform penetration tests at least annually and after any changes to segmentation controls/methods to verify that the segmentation methods are operational and effective, and isolate all out-of-scope systems from in-scope systems.” The PCI DSS v3.0 Requirements and Security Assessment Procedures Testing Procedures specified for Requirement 11.3.4.a also states “Examine segmentation controls and review penetration-testing methodology to verify that penetration-testing procedures are defined to test all segmentation methods to confirm they are operational and effective, and isolate all out-of-scope systems from in-scope systems.” 

This requirement is intended to verify that network segments documented as out-of-scope are truly out-of-scope and that this has been verified by someone with a degree of technical expertise. The scary parts of this standard are the “All segmentation methods” and "all out-of-scope systems from in-scope systems.” That could be quite a task depending on the number of methods used to provide segmentation and the number of out-of-scope systems.

Fortunately, the Special Interest Group on Penetration Testing, of which I was honored to be the co-proposer and a lead contributor,  was in the midst of finalizing its guidance. Recognizing that, as written, this requirement could place an unrealistic burden on Merchants and Service Providers, we were able to work with the Council to provide the option for sampling. This excerpt from the guidance addresses 11.3.4:

Segmentation Checks

"PCI DSS Requirement 11.3.4 requires penetration testing to validate that segmentation controls and methods are operational, effective, and isolate all out-of-scope systems from systems in the CDE. Therefore, a robust approach to penetration testing is recommended to satisfy this requirement by actively attempting to identify routes and paths from networks outside the CDE into the CDE. All segmentation methods need to be specifically tested. In very large networks, with numerous internal LAN segments, it may be infeasible for the penetration tester to conduct specific tests from every individual LAN segment. In this case, the testing needs to be planned to examine each type of segmentation methodology in use (i.e., firewall, VLAN ACL, etc.) in order to validate the effectiveness of the segmentation controls. The level of testing for each segmentation methodology should provide assurance that the methodology is effective in all instances of use. In order to effectively validate the segmentation methodologies, it is expected that the penetration tester has worked with the organization (or the organization’s QSA) to clearly understand all methodologies in use in order to provide complete coverage when testing."

As long as the testing provides assurances that the segmentation methodology is effective, testing from every individual LAN segment is not necessary. My recommended approach is to perform testing from network segments where privileged users securely access the CDE and sample a reasonable number of all other segments for each type of segmentation methodology in use. This will meet the requirement without putting undue burden on the client while providing the assessor  or auditor with sufficient information on which to base a determination of segmentation effectiveness.

Do you need to do an internal pen test when the CDE is in the Cloud?

Client: 
We have a Cloud based, virtual data center that we access and manage using a 2-factor, on-demand VPN to a remote jump-box from anywhere in the world. As a result, our corporate network and admin machines are considered out-of-scope for PCI. Do we still need to do an internal penetration test?


Answer: 
Our experience is that these tests are limited and quick, however they must be done.  While it’s true that in this case the in-scope systems could just as easily be administered from a Starbucks, the administrator’s workstation in a Starbucks cannot easily be compromised by exploiting other systems in the coffee shop, whereas in the corporate network the administrator's system is often joined to a domain and can be affected by other systems in the domain. The environment where users routinely access in scope systems will present an attacker with a unique opportunity to steal those credentials or manipulate that traffic.  Such an opportunity would not be afforded to an attacker in a Starbucks. The interrelationship of systems inside the corporate network creates a unique set a threat vectors that must be tested.


So for PCI Pen Testing, a corporate network is defined as having a common network connect AND localized common resources such as file shares and authentication mechanisms.

SharePoint Resource Monitoring

Testing a SharePoint application? Worried that your tests could knock the server over? (Want to knock the server over? This applies to you too.)

One of the new features of SharePoint 2010+ is resource throttling when the system is a bit busy handling requests. This can be tuned on at Web Application level in Central Admin. That throttling uses the health score value. If the value becomes 10 or above it will go into throttling mode. At that point it will give GET requests a lower priority than other types like POST. So people can finish the form they are filling in, but new request will be denied.

Enter the X-SharePointHealthScore HTTP Header.

It's a header that returns the systems health based on 3 performance counters:

Memory - Available MBytes

ASP.NET - Requests Queued

ASP.NET - Request Wait Time

Monitoring the headers of the SharePoint application can tell you if you're hammering the server too much or if it needs that little push more to go dark. http://yuriburger.net/2012/04/03/get-sharepoint-health-score-using-powershell/

Discuss:

Just seem like a really bad idea for an Internet facing app. 

Random Example:

HTTP/1.1 401 Unauthorized

Content-Length: 16

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

SPRequestGuid: 6dcb9a95-61a8-4817-bfd8-65ad55b5d1fa

X-SharePointHealthScore: 4

WWW-Authenticate: Negotiate

WWW-Authenticate: NTLM

X-Powered-By: ASP.NET

MicrosoftSharePointTeamServices: 14.0.0.6120

X-MS-InvokeApp: 1; RequireReadOnly

Date: Sun, 19 Jan 2014 18:40:11 GMT

Example of SharePoint application used by the PCI Council:

curl -k https://committees.pcisecuritystandards.org -I

HTTP/1.1 403 FORBIDDEN

Content-Length: 13

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

SPRequestGuid: 1569c27d-f2cd-4c58-a299-07116dff3154

X-SharePointHealthScore: 0

X-Forms_Based_Auth_Required: https://committees.pcisecuritystandards.org/_layouts/CustomLogin.Application/Pages/Login.aspx?ReturnUrl=/_layouts/Error.aspx

X-Forms_Based_Auth_Return_Url: https://committees.pcisecuritystandards.org/_layouts/Error.aspx

X-MSDAVEXT_Error: 917656; Access denied. Before opening files in this location, you must first browse to the web site and select the option to login automatically.

X-Powered-By: ASP.NET

MicrosoftSharePointTeamServices: 14.0.0.6029

Shodan search:

http://www.shodanhq.com/search?q=X-SharePointHealthScore%3A+

Further details:

http://msdn.microsoft.com/en-us/library/jj162162(v=office.12).aspx

Secure the Headers:

http://www.marc-lognoul.me/itblog-en/sharepoint-removing-http-headers-for-security-reasons/

http://sharepoint.stackexchange.com/questions/87927/what-is-the-correct-way-to-block-all-http-headers-asp-net-and-sharepoint-from

http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html

Update to the NMAP Pass the Hash script

I've had a lot of questions about this, so let's see if this helps. When I score a password or a hash, I use an nmap script to quickly determine if this gives me local admin rights to the workstations and servers:

nmap --script=smb-enum-shares.nse --script-args=smbuser=[ADMIN],smbpass=[PASSWORD],smbdomain=[DOMAIN],smbbasic=1,smbtype=v1  -p445 --open -vv -Pn [IP RANGE TO TEST] -oA [FILENAME].txt 

smbuser=[ADMIN] = Shared administrator account name

smbpass=[PASSWORD] = The shared account password

Alternatively you can Pass-the-Hash using:

smbhash=LMLMLMLMLMLMLMLMLM:NTLMNTLMNTLMNTLMNTLM

smbdomain=[DOMAIN] = WORKGROUP or AD

[FILENAME] = The filename for the results output

[IP RANGE TO TEST] = The IP ranges in CIDR notation. 

Alternatively, you could make a list of all IPs and IP ranges and pass them to the scan using:

 "–iL [INPUT LIST TO SCAN].txt" 

smbbasic=1

Forces the authentication to use basic security, as opposed to "extended security". 

--          Against most modern systems, extended security should work, but there may be cases

--          where you want to force basic. There's a chance that you'll get better results for 

--          enumerating users if you turn on basic authentication.

smbtype=v1

The type of SMB authentication to use. These are the possible options:

-- * <code>v1</code>:     Sends LMv1 and NTLMv1.

-- * <code>LMv1</code>:   Sends LMv1 only.

-- * <code>NTLMv1</code>: Sends NTLMv1 only (default).

-- * <code>v2</code>:     Sends LMv2 and NTLMv2.

-- * <code>LMv2</code>:   Sends LMv2 only.

-- * <code>NTLMv2</code>: Doesn't exist; the protocol doesn't support NTLMv2 alone.

If you have local administrator rights, the scan will show READ/WRITE access to the SMB shares:

Starting Nmap 5.51 ( http://nmap.org ) at 2012-12-22 15:41 PDT

Nmap scan report for 172.0.0.1

Host is up (0.00069s latency).

PORT    STATE SERVICE

445/tcp open  microsoft-ds

Host script results:

| smb-enum-shares: 

|   ADMIN$

|     Type: STYPE_DISKTREE_HIDDEN

|     Comment: Remote Admin

|     Users: 0, Max: <unlimited>

|     Path: C:\Windows

|     Anonymous access: <none>

|     Current user ('admin') access: READ/WRITE

|   C$

|     Type: STYPE_DISKTREE_HIDDEN

|     Comment: Default share

|     Users: 0, Max: <unlimited>

|     Path: C:\

|     Anonymous access: <none>

|     Current user ('admin') access: READ/WRITE

|   D$

|     Type: STYPE_DISKTREE_HIDDEN

|     Comment: Default share

|     Users: 0, Max: <unlimited>

|     Path: D:\

|     Anonymous access: <none>

|     Current user ('admin') access: READ/WRITE

|   IPC$

|     Type: STYPE_IPC_HIDDEN

|     Comment: Remote IPC

|     Users: 2, Max: <unlimited>

|     Path: 

|     Anonymous access: READ <not a file share>

|     Current user ('sysadmin') access: READ <not a file share>

|   SQLBACKUP

|     Type: STYPE_DISKTREE

|     Comment: 

|     Users: 1, Max: <unlimited>

|     Path: D:\SQLBACKUP

|     Anonymous access: <none>

|_    Current user ('admin') access: READ/WRITE

Hacking Microsoft SQL Dedicated Admin Connection (DAC)

Microsoft SQL Dedicated Admin Connection (DAC)

DESCRIPTION:
Microsoft SQL Server 2005/2008/2012 provides a dedicated administrator connection (DAC). The DAC lets an administrator access a running server to execute diagnostic functions or Transact-SQL statements, or to troubleshoot problems on the server, even when the server is locked or running in an abnormal state and not responding to a SQL Server Database Engine connection. This feature requires pre-allocating dedicated resources during server startup like additional memory ~3.5 megs.  Because of this extra resource, in SQL Express scenarios the DAC feature is disabled. You can enable it by starting SQL Server service with a trace flag. By default, the DAC is only available from a client on the server. To enable client applications on remote computers to use the DAC, use the remote admin connections option of sp_configure.

SQL Server listens for the DAC on TCP port 1434 if available or a TCP port dynamically assigned upon Database Engine startup. The error log contains the port number the DAC is listening on. By default the DAC listener accepts connection on only the local port. To activate remote administration connections, see the remote admin connections Server Configuration Option below.

The following example enables the DAC from a remote computer.

sp_configure 'remote admin connections', 1;
GO
RECONFIGURE;
GO

EXAMPLE:
In this example, an administrator notices that server 172.16.x.x is not responding and wants to diagnose the problem. To do this, the user activates the sqlcmd command prompt utility and connects to server 172.16.x.x using -A to indicate the DAC.

C:\Users\Win7>sqlcmd -A -S 172.16.x.x -U sa -P Bob$yourUncl3

RISK:
DAC with remote admin connections permitted may allow an attacker to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.

RECOMMENDATION:
Ensure DAC is configured per your Microsoft SQL Server Build and Hardening Documentation and Policies.

To determine the state of the DAC:

sp_configure 'remote admin connections'

0: Indicates only local connections are allowed by using the DAC.
1: Indicates remote connections are allowed by using the DAC.

DETERMINE IF DAC IS ENABLED AND AVAILABLE ON THE NETWORK:
Detecting DAC using NMap:

bash-3.2$ nmap 172.16.1-3.1-254 -p1434 -vv --open -Pn -n

Starting Nmap 5.51 ( http://nmap.org ) at 2012-06-28 09:56 PDT
Initiating Connect Scan at 09:56
Scanning 762 hosts [1 port/host]
Discovered open port 1434/tcp on 172.16.x.1
Discovered open port 1434/tcp on 172.16.x.2

MONITORING FOR ATTACKS AGAINST DAC:
Failed Logons will appear in the Windows Application Event Log:

Windows Event Log:

Event Type:    Failure Audit
Event Source:    MSSQLSERVER
Event Category:    (4)
Event ID:    18456
Date:        6/28/2012
Time:        10:08:18 AM
User:        N/A
Computer:    SQL01PRD
Description:
Login failed for user 'sa'. [CLIENT: 10.16.x.x]



Additional DAC related messages to monitor for:

17199

Dedicated administrator connection support was not started because it is disabled on this edition of SQL Server. If you want to use a dedicated administrator connection, restart SQL Server using the trace flag %d. This is an informational message only. No user action is required.

17200

Changing the remote access settings for the Dedicated Admin Connection failed with error 0x%lx, status code 0x%lx.

17202

Dedicated admin connection support was established for listening remotely on port %d.

17810

Could not connect because the maximum number of '%ld' dedicated administrator connections already exists. Before a new connection can be made, the existing dedicated administrator connection must be dropped, either by logging off or ending the process.%.*ls

SQL Server Management Studio Tips

How do I indicate a different port number when connecting to the server using SQL management Studio?

127.0.0.1,6283 add a comma between the ip and port

How do I Connect To A Database Using Windows Authentication With Different Credentials Using SQL Server Management Studio?

runas /netonly /user:domain\name "C:\Program Files\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\Ssms.exe"