TryHackMe | Vulnerabilities 101

Task 1: Introduction

Cybersecurity is big business in the modern-day world. The hacks that we hear about in newspapers are from exploiting vulnerabilities. In this room, we’re going to explain exactly what a vulnerability is, the types of vulnerabilities and how we can exploit these for success in our penetration testing endeavors.

An enormous part of penetration testing is knowing the skills and resources for whatever situation you face. This room is going to introduce you to some resources that are essential when researching vulnerabilities, specifically, you are going to be introduced to:

• What vulnerabilities are
• Why they’re worthy of learning about
• How are vulnerabilities rated
• Databases for vulnerability research
• A showcase of how vulnerability research is used on ACKme’s engagement

Task 2: Introduction to Vulnerabilities

A vulnerability in cybersecurity is defined as a weakness or flaw in the design, implementation or behaviors of a system or application. An attacker can exploit these weaknesses to gain access to unauthorized information or perform unauthorized actions. The term “vulnerability” has many definitions by cybersecurity bodies. However, there is minimal variation between them all.

For example, NIST defines a vulnerability as “weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source”.

Vulnerabilities can originate from many factors, including a poor design of an application or an oversight of the intended actions from a user.

We will come on to discuss the various types of vulnerabilities in a later room. However, for now, we should know that there are arguably five main categories of vulnerabilities:

As a cybersecurity researcher, you will be assessing applications and systems — using vulnerabilities against these targets in day-to-day life, so it is crucial to become familiar with this discovery and exploitation process.

Answer the questions below

Q) An attacker has been able to upgrade the permissions of their system account from “user” to “administrator”. What type of vulnerability is this?

A)

Q) You manage to bypass a login panel using cookies to authenticate. What type of vulnerability is this?

A)

Task 3: Scoring Vulnerabilities (CVSS & VPR)

Vulnerability management is the process of evaluating, categorising and ultimately remediating threats (vulnerabilities) faced by an organisation.

It is arguably impossible to patch and remedy every single vulnerability in a network or computer system and sometimes a waste of resources.

After all, only approximately 2% of vulnerabilities only ever end up being exploited (Kenna security., 2020). Instead, it is all about addressing the most dangerous vulnerabilities and reducing the likelihood of an attack vector being used to exploit a system.

This is where vulnerability scoring comes into play. Vulnerability scoring serves a vital role in vulnerability management and is used to determine the potential risk and impact a vulnerability may have on a network or computer system. For example, the popular Common Vulnerability Scoring System (CVSS) awards points to a vulnerability based upon its features, availability, and reproducibility.

Of course, as always in the world of IT, there is never just one framework or proposed idea. Let’s explore two of the more common frameworks and analyze how they differ.

Common Vulnerability Scoring System (CVSS)

First introduced in 2005, the Common Vulnerability Scoring System (or CVSS) is a very popular framework for vulnerability scoring and has three major iterations. As it stands, the current version is CVSSv3.1 (with version 4.0 currently in draft) a score is essentially determined by some of the following factors (but many more):

1. How easy is it to exploit the vulnerability?

2. Do exploits exist for this?

3. How does this vulnerability interfere with the CIA triad?

In fact, there are so many variables that you have to use a calculator to figure out the score using this framework. A vulnerability is given a classification (out of five) depending on the score that is has been assigned. I have put the Qualitative Severity Rating Scale and their score ranges into the table below.

However, CVSS is not a magic bullet. Let’s analyze some of the advantages and disadvantages of CVSS in the table below:

Vulnerability Priority Rating (VPR)

The VPR framework is a much more modern framework in vulnerability management — developed by Tenable, an industry solutions provider for vulnerability management. This framework is considered to be risk-driven; meaning that vulnerabilities are given a score with a heavy focus on the risk a vulnerability poses to the organization itself, rather than factors such as impact (like with CVSS).

Unlike CVSS, VPR scoring takes into account the relevancy of a vulnerability. For example, no risk is considered regarding a vulnerability if that vulnerability does not apply to the organization (i.e. they do not use the software that is vulnerable). VPR is also considerably dynamic in its scoring, where the risk that a vulnerability may pose can change almost daily as it ages.

VPR uses a similar scoring range as CVSS, which I have also put into the table below. However, two notable differences are that VPR does not have a “None/Informational” category, and because VPR uses a different scoring method, the same vulnerability will have a different score using VPR than when using CVSS.

Let’s recap some of the advantages and disadvantages of using the VPR framework in the table below.

Answer the questions below

Q) What year was the first iteration of CVSS published?

A)

Q) If you wanted to assess vulnerability based on the risk it poses to an organization, what framework would you use?

Note: We are looking for the acronym here.

A)

Q) If you wanted to use a framework that was free and open-source, what framework would that be?

Note: We are looking for the acronym here.

A)

Task 4: Vulnerability Databases

Throughout your journey in cybersecurity, you will often come across a magnitude of different applications and services. For example, a CMS whilst they all have the same purpose, often have very different designs and behaviors (and, in turn, potentially different vulnerabilities).

Thankfully for us, there are resources on the internet that keep track of vulnerabilities for all sorts of software, operating systems and more! This room will showcase two databases that we can use to look up existing vulnerabilities for applications discovered in our infosec journey, specifically the following websites:

1. NVD (National Vulnerability Database)

2. Exploit-DB

Before we dive into these two resources, let’s ensure that our understanding of some fundamental key terms is on the same page:

NVD — National Vulnerability Database

The National Vulnerability Database is a website that lists all publicly categorized vulnerabilities. In cybersecurity, vulnerabilities are classified under “Common Vulnerabilities and Exposures” (Or CVE for short).

These CVEs have the formatting of CVE-YEAR-IDNUMBER. For example, the vulnerability that the famous malware WannaCry used was CVE-2017-0144.

NVD allows you to see all the CVEs that have been confirmed, using filters by category and month of submission. For example, it is three days into August; there have already been 223 new CVEs submitted to this database.

While this website helps keep track of new vulnerabilities, it is not great when searching for vulnerabilities for a specific application or scenario.

Exploit-DB

Exploit-DB is a resource that we, as hackers, will find much more helpful during an assessment. Exploit-DB retains exploits for software and applications stored under the name, author and version of the software or application.

We can use Exploit-DB to look for snippets of code (known as Proof of Concepts) that are used to exploit a specific vulnerability.

Answer the questions below

Q) Using NVD, how many CVEs were published in July 2021?

Question Hint

Change “Search Type” to Advanced, specify the proper Published Date Range, and hit Search.

A)

Q) Who is the author of Exploit-DB?

A)

Task 5: An Example of Finding a Vulnerability

In this task, I’m going to demonstrate the process of finding one minor vulnerability, coupled with some research of the vulnerability databases leading to a much more valuable vulnerability and exploit ultimately.

Throughout an assessment, you will often combine multiple vulnerabilities to get results. For example, in this task, we will leverage the “Version Disclosure” vulnerability to find out the version of an application. With this version, we can then use Exploit-DB to search for any exploits that work with that specific version.

Applications and software usually have a version number. This information is usually left with good intentions; for example, the author can support multiple versions of the software and the likes. Or sometimes, left unintentionally.

For example, in the screenshot below, we can see that the name and version number of this application is “Apache Tomcat 9.0.17”

With this information in hand, let’s use the search filter on Exploit-DB to look for any exploits that may apply to “Apache Tomcat 9.0.17”.

Great! After searching Exploit-DB, there are a total of five exploits that may be useful to us for this specific version of the application.

Answer the questions below

Q) What type of vulnerability did we use to find the name and version of the application in this example?

A)

Task 6: Showcase: Exploiting Ackme’s Application

It is your first week on the job as Jr. Penetration tester at ThePentestingCo. For your first engagement, you are shadowing a Sr. Penetration Tester within the company.

Deploy the site attached to this task and follow the steps that the Sr. Penetration Tester took to exploit a vulnerability against ACKme IT Service’s infrastructure.

Complete the engagement to retrieve a flag.

Scenario

It is your first week at ThePentestingCo as a Jr. Penetration tester. To ease into the role, you are shadowing a Sr. Penetration tester on your first engagement.

The Sr. Penetration tester has managed to find a vulnerability in a web application that the client (ACKme IT Services) uses.

Follow the steps that the Sr. Penetration tester took to ultimately exploit ACKme IT Service’s infrastructure.

1. Information Gathering

At this stage, the Sr. Penetration Tester has used a public service that compiles some details about the target company.

As we can see, ACKme IT Services provide IT services to 800+ clients. This information is useful because we can begin to think of possible software that they are using for us to attack. For example, helpdesk or a support application.

2. Enumeration & Scanning

The Sr. Penetration tester now moves onto the enumeration and scanning stage of the engagement. This stage helps establish services and applications running on ACKme’s infrastructure.

We can use the information gathered from this scan to begin to understand what services may be viable to attack. For example, a webserver hosting a website.

Recall from our Email, we are given one IP address 240.228.189.136. Try scanning this IP address yourself…

3. Application Testing

Using the information gathered from stage two of the penetration engagement. The Jr. Penetration tester has visited the target in their web browser and has been greeted with a login page.

The Sr. Penetration tester guesses some random passwords such as ‘admin’ and ‘admin’ to no avail. They notice a version number of the application 1.5.2 and takes a note of this. This will be useful for the next stage.

4. Vulnerability Research

The Sr. Penetration tester recalls that ACKme IT Services uses an application called ACKme Portal that has a version number of 1.5.2. The Sr. Penetration Tester visits a vulnerability & exploit database called ‘Vulnerability Bank™’.

This website stores details of vulnerabilities and exploits for applications. The Sr. Penetration Tester searches this site for the software that was discovered in stage three. They’re in luck! There is one vulnerability listed for that application & version: Remote Code Execution (RCE).

RCE vulnerability allows commands to be executed on the target’s system. The Sr. Penetration Tester could use this vulnerability to gain access to the console of the target. Try searching Vulnerability Bank™️ for an exploit for ACKMe Portal 1.5.2 and

5. Exploitation

Accumulating the information from all the previous stages, the Sr. Penetration Tester uses the exploit downloaded from Vulnerability Bank™️ against ACKme’s web application on 240.228.189.13.

The exploit is successful and abuses the Remote Code Execution (RCE) vulnerability to launch a reverse shell on ACKme’s infrastructure.

From here, the Sr. Penetration tester can look for files of value such as passwords, backups or application source code.

Flag: clicking the “Show Flag” reveals the flag!

Task 7: Conclusion

Nice work! We’ve made it to the end. This room has served as an introductory to vulnerability research and some skills and resources this requires, where you have practically applied this knowledge.

(Answers are removed due to copyright rules)

Happy Hacking!