Attack Path Analysis

0x00 Definition of Attack Path

Attack path is not a new concept but one that has been defined as two statements in academia at present. The first is that the attack path is composed of all the asset nodes which an attacker passes through in the whole process of penetration test of information system. In another view, the attack path is all the means of attack used by an attacker in the process of of attacking a single asset. As a technician, I side with the latter one.

0x01 Combing of Attack Path

Why should we comb the attack paths?

As early as 2018, the first edition of PTES(Penetration Testing Execution Standard) showed that attack path analysis is indispensable in penetration test. Following are the main stages defined by the standard as the basis for penetration testing execution:

• Pre-engagement Interactions
• Intelligence Gathering
• Threat Modeling
• Vulnerability Analysis
• Exploitation
• Post Exploitation
• Reporting

The description of the stage of vulnerability analysis is as follows:

You need to consider how to obtain access to the target system. At the stage of vulnerability analysis, you should synthesize the information gained from previous stages and analyze which attack paths will be feasible.

It simply means that we could identify vulnerabilities in the target system through collecting information, and then comb the attack paths. The method is to select the appropriate scenario to plan the overall attack path, I just list a few applicable intranet and extranet attack paths in some attack scenarios as follows(For reference only):

0x02 Attack Path Analysis

In the process of penetration testing, we must be prepared to follow the "winding path" because things probably won't go smoothly as expected. To ensure a thorough understanding of the target system, the first thing you need to do is identify the target and scope of this attack through previous intelligence gathering. And then, draw attack paths based on the analysis of vulnerabilities of target system. It's better to attack the target system when you almost sure the particular attack will be succeed. I'll analyze a few specific cases according to some attack scenarios, and the methods of intelligence gathering and threat modeling that need not be detailed here.

Social Engineering—Spear Phishing

Spear phishing is one of the common attack methods used by hackers, it often send targeted emails that trick recipients into clicking on unsafe links or attachments.

Case Description

Jerry is a hacker employed by Company A as a social-engineering attack censor whose task is to try to break into the servers of Company A. The company has some patented processes and a list of suppliers that the rivals want to obtain. However, the chief executive told Jerry that it was almost impossible to break into the servers of his company because he takes his own life to preserve secret materials.

Jerry found the server location, IP address, e-mail address, telephone number, physical address, e-mail server, employee names and more information of Company A through previous intelligence gathering. He also managed to know that the CEO has a family member with cancer so that Jerry began to focus on the research and fund-raising of cancer, and actively involved in it. Meanwhile, it seems quite simple for Jerry to get other personal information about the CEO, such as his favorite restaurant and football team.

After mastering these materials, Jerry called the CEO and pretended to be a fundraiser of a cancer charity where the CEO had been to before. Moreover, he told the CEO that the cancer charity will conduct a lottery draw. In addition to the coupons for several restaurants (including his favorite restaurant), the prizes for donors also includes two tickets for a football match(including his favorite team).

As expected, the CEO agreed to ask Jerry to send him a PDF document with more information about the activity. Jerry even managed to persuade the CEO to use a specific version of Adobe reader on his computer, because he told the CEO, "I want to make sure you can open the PDF file. " Soon after he sent the PDF file, the CEO opened the file and his computer was installed with a malicious Trojan Horse which allowed Jerry to break into his computer.

Case Analysis

This case is applicable for spear phishing scenarios because the target is a specific individual or group, and the target host is in a closed network. Since the attack is for a specific individual or group, typically the attacker will spend time to get information of the employee names and titles, e-mail address, telephone number, server IP address, physical address, mail server and other information in early stage. In order to trick the recipient into clicking on the links with malicious Trojan Horse, the attacker need to obtain the trust of a target individual by impersonating someone. When the recipient clicks on the malicious link on his computer, he will run a Trojan Horse program which allows hackers to break into his host.

Network Layer—Intrusion of Wireless Network

For wireless networking attacks, the most frequently used way is to build fishing WiFi. Once the attacked target automatically connects to Wi-Fi, the attacker will intercept the communication data and steal sensitive data. The enterprise network may be intruded by attacker in the event of providing public Wi-Fi for employees' daily use, and then the attacker could steal the confidential data.

Case Description

The security tester found that there were two wireless networks near the target company. One of the networks was public Wi-Fi and based on Portal Authentication, another is the 802.1x network. After connecting to the public Wi-Fi, the tester jumped to the Portal Authentication page.

Soon an common vulnerability was detected by is that usern ames of this portal system can be viewed due to the information returned from login page. The tester used burp force method to obtained the user names through Burp Suite scanner, and he logged into the portal system after burp force attack on the password of user names. However, it had been found that this network is isolated from office network of the company. Considering that purpose of the penetration test is to break into intranet, hence the network can not be the target. The tester turned eyes to another wireless network in the use of 802.1x authentication.

When companies deploy 802.1x wireless network, PEAP-MSCHAP V2 architecture are generally adopted with consider of compatibility and convenience of domain account. The authentication process of PEAP is divided into two stages as follows:

• First, the client authenticates the server and establishes TLS tunnel between server and client. Then server sends certificate information to client, in order to achieve " Client-to-Server Authentication ".
• Second, after the first stage of TLS tunnel established, multiple authentication methods (usually EAP-TLS or EAP-MSCHAPv2) are shared with PEAP to achieve "Server-to-Client Authentication".

At present, the problem of PEAP mainly lies with clients to certificate validation of server. The validation provides the security of transport layer for authentication through similar SSL mechanism, and also requires companies to purchase certificates from CA, or establish their own PKI system and sign certificates for wireless network. Meanwhile, they need to deploy root certificates to each client. Most companies choose to sign a certificate by themselves because deploying root certificates to each client is so complicated that they prefer to abandon this choice directly.

The method of this attack is to trick users into connecting a pseudo Wi-Fi established by the tester, then getting the hash of the account transmitted during the process of MSCHAP V2 authentication in the second stage, and he can burp force the password in the use of dictionary. Here the tester used hostapd-wpe to build a 802.1x Wi-Fi, and eight hash values were obtained in a few moment. He successfully gained two login passwords by using brute-force programs, which run through passwords guesses at rapid speed until it gets a match.

Through the previous detection, he found that the company adopted PEAP-MSCHAP V2 architecture because the two login accounts were also the the domain accounts, which are able to log into office automation system. Moreover, a Jenkins program was found in the intranet through detection. Jenkins is a continuous integrated tool based on Java for monitoring lastingly reproducible work. When the configuration of Jenkins is not appropriate, there will be a vulnerability of unauthorized command execution, but the administrator had been limited it. Therefore, the tester need to get an account that can execute commands.

Accessing the management page of the Jenkins program, the list of users is obtained in the state of non-login due to insecurity configurations. After grabbing all user names, three passwords are successfully obtained by burp force attack. The tester logged into to Jenkins program and accessed the page like "xxxx.com/script" with one of the three accounts. Although the account could execute commands and had very low privileges, the shell can be rebounded back to the local server for permission elevation. Due to the "wget" command in the environment cannot be used, the rebound script is written on the server by using Groovy grammar. Next, the test gained the root authority from exploiting local privilege promotion vulnerability of Linux Kernel. The next step is to collect information about sensitive files such as configuration files, history, shadow, etc. After decrypting the passwords obtained in shadow, he tried to use "Hydra"—the burp force tool— to log into the intranet host through SSH protocol. Then a private key file was found by logging into a server successfully, and through it, he accessed to another server and detected a Zabbix program. When the server address of the Zabbix program was found in the configuration file, the task turned into finding account passwords for Zabbix program. By collecting information from the history file found in several other severs before, the tester used burp force method to obtain the password of Zabbix's account and finally entered Zabbix. Finally, the tester successfully intruded intranet of the company.

Case Analysis

This case is a typical wireless intrusion scenario in the network layer attack scenario. Firstly, the attacker discovered that the company has opened up the public wireless network. Then the pseudo Wi-Fi is used to obtain employees' login accounts, which are used to intrude the Wi-Fi of the company. Finally relying on the pseudo WiFi to break into the intranet system.

Application Layer—Application Weak Password

PhpMyadmin is a popular database management system. If the password setting is too simple, an attacker could log into the system and further intrude the host.

Case Description

During the penetration testing, We may meet some Web environments built with phpStudy at some time. If PhpMyAdmin has a weak password, we could get the root privilege of MySQL database and write Web Shell to the database by executing database statements. Here's an experiment I've done.

phpStudy is a application integration package in PHP debugging environment. It integrates MySQL, Apache and other environments, also including MySQL management tool named PhpMyAdmin. Here's a little trick. In the root directory of a php Website, there is always an L. PHP probe, and when you encounter a probe that contains all kinds of server and website information. The PHP probe looks like this: