In this lesson,
I'm going to show you how to assess scan outputs.
And so instead of using Nessus,
we're going to go ahead and use OpenVAS
to see how that one looks a little bit different.
Now, in this one, I'm going to go a little bit more in-depth
than I did last time,
because I'm going to show you everything
from creating the scan account, configuring its permissions,
setting up OpenVAS,
and then looking at the results that come from that scan.
Let's jump into the environment and get started.
First, we need to go ahead and configure our scan accounts.
So I'm going to open up DC1,
and then use my Active Directory Users and Computers Area.
And from here, I'm going to right click on Users
and select New, and then Group.
When I do this, I'm going to enter my name for my group.
I'm going to call it sec-glo-scan.
And this is the group name
we're going to use for our auditors
who are going to perform our scans.
Now, when we look at the scope of this, it should be Global
and the type should be selected as Security.
Once that's done, go ahead and hit OK.
Next, we're going to right click on Users
and select New, and then User.
Here, we're going to enter in the full name
and username as scan.
Then I'm going to click Next,
and I'm going to enter a password.
Now, I'm going to uncheck the 'user must change password'
and check the 'password never expires,'
and then click none, and then Finish.
This is a common setting
when you're setting up a scan account.
Now, when you do this,
make sure you're using a good, strong password
because again, we're not requiring people
to change their password here
and the password will never expire.
So something long and strong
and complicated would be a great use case here.
Next, we're going to right click the scan object
that we just created that user.
And we're going to select add to a group.
Here, we're going to type in sec-glo-scan,
and then click Check Name.
Once that's underlined, click OK,
and then we'll be able to hit OK again.
Now, we can close the active directory users
and computers console.
Next we're going to go into the Server Manager
and select tools, Group Policy Management.
This will allow us to go and manage our group policies.
Once we're in here,
then right click the Computer's OU container
and select Create a GPO in this domain and link it here.
When we get to the box, we're going to go ahead
and call it something,
in this case, 515support Scanning Policy.
515support is going to be our fictional company
that we're using in examples here.
Now we're going to expand the Computer Configuration,
and then Policies,
and then Window Settings, then Security Settings,
then Local Policies, and then User Rights Assignment.
Once you do that, double click the Deny log on locally.
This is going to make sure that
we're not going to allow people
to log onto the local machines as an administrator.
We can only do it remotely by using our scanning engine.
We're going to check the 'Define these policy settings' box,
and then click Add User or group.
Again, we're going to type in our group,
which is sec-glo-scan, and click OK,
and then OK to confirm the main dialogue.
At this point, we can double click the Deny log on
through Remote Desktop Services, because again,
we don't want people logging onto these machines.
And we're going to check the
'Define these policy settings' box
and click Add User or group.
Again, we're going to put in our group, sec-glo-scan,
and click OK, and then OK once more.
Under Security Settings,
we're going to select the Registry node.
We're going to right click in the empty pane
and select Add Key.
From here, we're going to select USERS and click OK.
Then we'll click Advanced and click Add.
Then we can select a principle.
Again, we're going to type in sec-glo-scan, and click OK.
From the Type box, we're going to select Deny.
From the Applies to list box, we're going to
ensure 'This object and child objects' is selected.
Now at this point,
we can select the 'Show advanced permissions,'
and we're going to check the following boxes: Set Value,
Create Subkey, Create Link, Delete,
Change permissions, and Take ownership,
and then we'll confirm all the dialogue boxes.
This allows us to create those keys
that we need inside the registry
to give us the right permissions for our scanner.
Next, we're going to right click in the empty pane
and again select Add Key.
From here, we're going to select 'MACHINE' and click OK.
Then click advanced, and Add, and Select a principle.
Once more, we're going to type in sec-glo-scan,
and click OK.
From the Type box, we're going to select Deny.
And for the applies to list box,
we're going to select 'This object and child objects.'
Then we're going to click the 'Show advanced permissions,'
and make sure we check the following boxes:
Set Value, Create Subkey, Create Link, Delete,
Change, and Take Ownership.
Once more, confirm all the dialogue boxes,
and now we have set the right permissions.
So at this point we have now created a user
and a group with the right permissions
that we can use for our scanners.
Anytime we want to do credentialed scans now,
we're going to use the user account, sec-glo-scan,
inside the group, sec-glo-scan,
because that is our scanning account.
So any host in the network will allow us
to connect using administrative credentials
when we're using the scan account,
and it gives us local administrative rights to the registry
across all the computers in this domain.
Now that we've finish creating the scan account,
we need to go into OpenVAS and start using it.
So we're going to go over to my OpenVAS scanning machine,
and we're going to go to the webpage 10.1.0.243,
which is my local account.
When you're using OpenVAS, you're going to do it
through a webpage that then interacts with the server
and the program on that local machine.
Once we're there, I'm going to log in
with my admin user and my password.
Now, once I'm in the system, you can see the dashboard,
and there isn't much information here,
because I haven't done any scans yet.
First, I want to go to configuration under the menu
and then select credentials.
From here, I want to select New Credential,
and then in that dialogue box,
I'm going to add a new account known as sec-glo-scan,
that user account we just created.
Now, from the Allow insecure use options,
I'm going to select Yes,
because I want to find every vulnerability in my systems,
not just the ones that might not cause problems.
Then in the Username box, I'm going to type 515support,
which is my domain /scan,
and in the password box, I'm going to type my password.
Now notice the /scan is that user account we created.
After we do this, click Save.
Now that we have our credentials saved, we can now go
and configure a scan/scope, and sensitivity.
When we do this, we're going to decide what group
of targets we want to go after
with our vulnerability scanning.
So we're going to click on Configuration
and then select Targets.
Here, I'm going to click New Target.
Then in that web dialogue,
I'm going to type in the name, 515support-Hosts-Windows,
because I'm going to do a scan across all my hosts
inside my network that are Windows based.
Next to the Hosts, I'm going to select Manual
and type in the IP address that I want to scan.
In this case 10.1.0.0/24, which is my subnet
that contains all my Windows hosts.
Next, I can click to exclude some hosts,
so I'm going to select Manual
and type in 10.1.0.254,
10.1.0.243.
Now, the .243 machine is the box I'm actually scanning with,
so I don't want to actually scan this as part of my host,
because it's actually an excluded area.
It is my vulnerability scanner.
Then under Credentials, I'm going to select sec-glo-scan,
because that is one that we have authorized
as that administrative scanning account,
and then I'm going to click on Save.
Now, next I'm going to go into the Configuration menu
and click Scan Configs.
Here, we're going to take a few minutes
to just browse the default scan configurations,
but we're not going to make any changes here.
From the Scans, I can select Tasks.
And from the task,
there's going to be a wizard prompt that appears.
If it does, just close it.
Next, click on New Task and then select New Task.
In the New Task dialogue box, we're
going to type in the name
that we want to call this,
in this case, 515support-Hosts-Windows-Full.
Then from the Scan Targets box,
we're going to select the group we just set up,
515support-Hosts-Windows.
From the Scan Configuration box,
we're going to ensure that we select 'Full and fast,'
which is the type of vulnerability scan we want to conduct.
And then we'll click Save,
and finally we'll click Play, which will start our scan.
Now, because I'm using the community edition here,
I don't have the ability to schedule tasks.
That's a feature of the pro version of this tool.
So if you're going to be using
this on your own home network,
you're going to have to actually remember
to start up the scan yourself at designated intervals
instead of having it do it for you automatically.
Now, it'll usually take a couple of minutes
or even longer to perform these scans,
because it's connecting to each machine inside my scope
and being able to test them for those vulnerabilities.
So I'm going to speed this up here,
so you don't have to wait as long.
Once you're done, you're going to get back the results
by going ahead and looking at the scan report.
Click on Scans, and then Results.
Once you do that,
you'll see a dashboard with four key areas.
The top left is all the results by severity class,
so in this case,
you could see I had 163 total vulnerabilities,
I had 7 high, 26 medium, 5 low,
and the rest of these were log or informational content.
Then in the middle, we have a word cluster.
These are words that are coming to us
based on all those vulnerabilities that were found,
and so I could see for instance that Windows occurred a lot,
because these were Windows scans,
so that was a very large word.
So it's a very quick visual way to say, "Oh,
I have an issue with SSL/TLS",
or "I have an issue with SSH,"
or whatever that vulnerability is
that's really taking up most
of your cluster there inside the words.
Then on the top right side, you have the results shown
based on the severity inside of CVSS.
So it goes from non applicable login, and 1 through 10.
And so you could see very quickly how dangerous things are
in your network.
Now, what I really find useful is that bottom part.
Now, in the bottom part,
we're seeing the results 10 at a time.
And in those results,
we're going to see, in this case, 10 out of 163.
You'll have the name of the vulnerability,
you'll have the severity, you'll have the quality
of detection, you'll have the host IP, the name,
which is the DNS name of your server,
and then the location, and when that was created.
This is information, again, at the top level,
but you can drill down and see additional detail
by clicking on the names of those vulnerabilities.
So now that we've done a quick look at our results,
let's go ahead and take a look by filtering
to find out anything associated with a particular host.
For example, if I wanted to find all the vulnerabilities
for the host at 10.1.0.1,
I could go into the Filter box,
type host=10.1.0.1,
and click Update Filter.
This is all the vulnerabilities
associated with my domain controller.
Now you'll see there's not many here. Why is that?
Well, because we really only did an uncredentialed scan
against the domain controller.
We gave ourself permissions with that scan account
to have administrative rights on everything in the network
except the domain controller.
So the domain controller is getting an uncredentialed scan
while everything else is getting a credentialed scan.
Now, let's take a look for instance,
at the null session vulnerability.
When we click on that, we can see
that because the guest account is enabled,
there is a serious configuration here,
and because this is a domain controller,
this is quite alarming.
This is something that definitely should not be there
on a domain controller, which is why there's a high severity
and it's something we should fix quite quickly.
Now, the next thing we want to do is
we want to filter out and adjust our string here.
So instead of looking at the domain controller at 10.1.0.1,
let's go ahead and make that 10.1.0.2.
When we do that, you're going
to see a lot more severe results.
This is because we had administrative credentials
and we did a credentialed scan.
Now, when we did this on a host,
we're going to see a lot more vulnerabilities
because we have administrative rights.
In this case, we see a lot of them
that have high severity in the 10 range or the 9 range.
Now, we can go in and look at these
by clicking on those reports,
and if you have Internet access connected to this,
you can actually go
and research those different CVEs
to figure out what you should do.
For example, if we look at the vulnerability in the filter
and we want to find everything
that's affected by a particular vulnerability,
instead of looking at it by host,
we can type in:
vulnerability~"
and then the name of the vulnerability.
In my case, I'm going to use 4013389, and then end quote.
Once I do that, I click the Update Filter button
and you'll see that I have a hit for PC2,
which is running Windows 7.
And this is bad news, because this is the same vulnerability
that was used by WannaCry, which is known as Eternal Blue.
This is a big bad vulnerability
that allows remote code execution on a system.
So this is one, that if you're finding your network,
you want to make sure you get it patched up pretty quickly.
Now, additionally, we can look at the same results
by instead of looking at the vulnerability number
based on the knowledge base that Microsoft uses,
we can instead look at it based on a CVE.
For example, I know
that the WannaCry vulnerability is CVE-2017-0144,
so I can go into the Filter box, type
~"CVE-2017-0144"
and hit Update Filter.
Now, I'm going to find any machines that match that CVE.
This is really useful
if there's some new big, bad vulnerability that comes out
and you want to test all your systems
for that particular vulnerability.
For example, I was working in a large organization
when the Apache Struts vulnerability
came out a couple of years ago.
We wanted to identify, across our millions of endpoints
which ones were vulnerable to this attack.
So we were able to do a search looking just for that one CVE
as we looked across our network and scanned,
and that way we can find those and patch those quickly.
So hopefully you've enjoyed this short lesson
on learning how to configure your scanner
and use a scanner using OpenVAS
and the Greenbone Community edition.
As I said in our lesson,
I recommend you download this program
and scan your own network. Play with it,
get comfortable reading these different results
and reading these reports
because it would be totally fair for the exam
to give you an output from one of these results,
and then ask you what you would do to fix it as a defender
or how you would exploit it as an attacker.