Blog 12: Lab 14

In this I am going to use a software application used in website security testing/teaching called Damn Vulnerable Web App (DVWA) which I read it is a dynamic website (the content of each page is pulled out of a MySQL database using the server side scripting language PHP) with deliberately open vulnerabilities to teach web developers/students about the threats to web applications.

Exercise 1: Installing XAMPP

I am going to install the local web server XAMPP on my server VM. But before I do that I  removed the network adapter of the client VM and added a new network adapter making sure that it used the VMXNET3 adapter type. However after creating this new network adapter (and starting up then logging into the Server VM) I could not log into my client with the CLASSROOM\Administrator account. I tried restarting the VMs and reverting all my VMs to the ‘Final snapshot’ snapshot. However I still could not log into the client with this account. So I decided to log into the client VM using the local admin account CLIENT\Admin and re-adding the client VM to the classroom.local domain.

To do this on the client I went to  File Explorer-‘Computer’ tab-System Properties

Then I selected “Change” button in the dialog window that appeared. And then ticked on the Workgroup radio button and wrote in the name “workgroup” clicked “OK” and a window appears asking for the client to be restarted which I did.

Then when I logged back into the client VM with the CLIENT\Administrator account I went back to the Computer Name/Domain Changes window and selected the ‘Domain’ radiobutton and wrote in the name ‘classroom.local’ (as you can see in the below screenshot) and then clicked “ok”.

When the restart window appeared I selected to restart the Client VM and I found I could then log in with the account CLASSROOM\Administrator account. So now I have set up my client VM so I can log in with the classroom.local account I can install XAMPP on the server VM. I am familiar with using XAMPP from my WEB601 class.

I logged into the server VM with the account CLASSROOM\Administrator and then in  Server Manager I went to Tools->Services.

Then I right clicked on World Wide Web Publishing Service and selected ‘Properties’

In the resulting dialog box I disabled World Wide Web Publishing Service (by selecting Disabled from the drop-down box for Startup type) and stopped the service (by selecting the ‘Stop’ button. Then clicked ‘Ok’

Then I went to the Change User Account Control settings from the start menu. I then changed the UAC setting so I am never notified about changes to my server.

Then in the c:\GTSLABS folder I clicked on the xampp installer file.

A warning dialog box about the User Account Control appeared and I clicked “ok”.

 

 

I then went through the installation process and unticked the XAMPP components FileZilla FTP Server, Mercury Mail Server, Tomcat.

I then went through the rest of the installation process (keeping the default installation folder), and then when the XAMPP Control Panel appeared I started the Apache and MySQL servers and I know these services are now running because Apache and MySQL are highlighted green.

I could see that Apache uses port 80, and 443 whereas MySQL uses port 3306

 

Exercise 2: Installing DVWA

I will now PHP and MySQL files of the DVWA on the XAMPP server so I can access the DVWA from the client.

I will then configure the Windows Firewall allowing the hosts in my virtual network access the XAMPP server.

I extracted all the contents of the DVWA-1.0.8 folder from inside my c:\GTSLABS folder to the selected of c:\xampp\htdocs.

Then in the c:\xampp\htdocs folder I renamed the ‘DVWA-1.0.8’ folder to be named ‘DVWA’.

Then I opened the config.inc.php file inside the c:\xamp\htdocs\dvwa\config folder.

When a message appeared asking me to choose a app to open this file I selected Notepad.

And I found the line setting the default password of the DVWA to p@ssw0rd.

And I deleted the password so there is now no password in order to access the DVWA.

I now have to create a new firewall inbound rule to allow hosts in the network to access the DVWA.

To do this I went to Windows Firewall with Advanced Security->Inbound Rules and clicked to add a new rule. I specified to set the rule on a port (as the below screenshot shows)

The port numbers I am going to let through the Windows Firewall are the Apache and MySQL ports 80, 443, and 3306. This will allow the client VM to be able to access the web files stored in the htdocs folder (the folder which by default contains the web folders in xampp) in xampp, which in this case is the DVWS files.

To ensure that these ports were allowing inbound traffic to the DVWS I made sure that ‘Allow the connection’ was set

I also made sure that this firewall inbound rule was applied to the domain (all computers connected to the classroom.local domain), private, and public networks because the DVWS is supposed to simulate a vulnerable website, but even so it must still be open to hosts outside of the classroom.local network and so I must open these ports to the public network as well.

I gave the firewall rule the name XAMPP.

So now I have a new inbound firewall rule called XAMPP

I opened up a Run dialog and wrote in the URL ‘http://server/dvwa’

The login page of the DVWA appeared except no database has been set up. To set the MySQL database up I clicked on the ‘here’ link.

I then had to add the http://server website to my list of trusted websites in Internet Explorer.

After doing so I was able to create a database by clicking on the ‘Create/Reset Database’ button, and as you can see in the below screenshot a MySQL database with users, and guestbook table has been created and filled.

I then logged into the DVWA website with the username ‘admin’ and the password ‘password’

In the DVWA Security webpage I changed the vulnerability of the DVWA to ‘low’ which I submitted. This will make it easier for me to simulate an attack on the DVWA web application.

Exercise 3: Exploiting a command execution vulnerability

I will now use the DVWA command execution vulnerability to make the server hosting the DVWA to perform a random command.

I clicked on the ‘Command Execution’ button in the DVWA website.

Then I typed in the name ‘server’ to the IP address box and submitted this in order to get the DVWA command execution to ping the server VM it is running on. I noted that the approximate size of the packets is 32 bytes.

Then I wrote ‘-l 800 server’ into the IP address box and submitted this command and I noticed that the packets were substantially larger than when I just typed ‘server’ into the IP address box. The packets for the ‘-l 800 server’ command were 800 bytes.

I then typed in ‘/?’ and this displayed a list of possible commands I can enter into the IP address box in the DVWS command execution page. These commands are also commands I can perform in the Command Processor. Many of the commands were regarding the ping syntax extensions for example ping -t which will not just ping four times but will continue to to ping the host until you stop it by typing Cntrl+C buttons.

Then I entered the command ‘server | dir’ this showed the contents of the exec directory inside the c:\XAMPP\htdocs\dvwa\vulnerabilities folder. The reason why these files were shown is because the command execution page I am working on currently is the index.php file of the c:\XAMPP\htdics\dvwa\vulnerabilites folder of the server and so when I write in dir it shows the folders of the in the server around this web file.

 

Exercise 4: Exploiting a SQL injection vulnerability

Having worked with PHP and MySQL in WEB602 this will be an interesting task to see how at risk web applications are to SQL injection.

I clicked on the ‘SQL Injection’ button in DVWS.

Into the UserID text input box I submitted the number ‘2’, and a single user record from the user MySQL database appeared that of the user Gordon Brown who has the UserID of 2.

When I submitted the word ‘hello’ into the UserID textbox no data from the database was returned, as the below screenshot shows.

When I submitted a single quote symbol a error message appeared stating “You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ””’ at line 1″. This tells us that the DVWS application is working by submitting a SELECT database query and the value entered into the UserID box is the condition that SQL is searching for a match for in the database.

When I submitted ” 1′ or ‘1’=’1″ into the UserID all of the users in the user table (including the admin account) were displayed with their first and last names visible.

Exercise 5: Exploiting a Cross site scripting vulnerability

I will now make the DVWS website perform a script that is not part of the PHP script it was originally built with.

I clicked on the ‘XSS Reflected’ button

I then typed my name into the ‘What is your name’ text input box and submitted my name. The test displayed was ‘Hello alex’; I am now making the DVWM application do something it was not created to do, display hello message to me when I am not even listed in the users table.

Then I submitted the following text:

alert(‘Hello World!’)

And a Message from the webpage popped up, again I am adding this code to the DVWS application which is causing this web application to perform an action it was not built to do, in this case display a hello world message box.

I have now finished this lab. I have found it an interesting lab, especially seeing what a SQL injection can do to a website and how you can also use Cross Site Scripting Vulnerability to make a website do something it was not built to do in its original code.

I will now revert my VMs.

Blog 11: Lab 13 HTTP and HTTPS

In this lab I will be looking at HTTP and HTTPS transfers, this will be interesting for several reasons. Firstly when logging into a website I always look to see if the website using HTTPS (this is visible in the website URL) which means it encrypting my data using the SSL/TLS cryptography protocols before it is sent to the web server to check my credentials against the database to authenticate me.

All websites where logging in or sensitive data is displayed should use HTTPS however I always check just in case, and after Mark showed us how to view the encryption certificate especially on online banking websites I must admit I have viewed this several times when banking recently.

The second reason I am going to find this an interesting lab is because in class we have talked about how easy it is for website administrators to get open source encryption certificates for their site so it uses SSL/TLS encryption which although still vulnerable to attack at least the data transfers are not in plain text or encoded very simply.

An example of an open source organization distributing free encryption certificates is Lets Encrypt.com (https://letsencrypt.org/).

So it will be interesting to see just how vulnerable HTTP is compared to HTTPS.

Exercise 1: Sniffing HTTP

In this exercise I will use the packet capture tool Wireshark to capture packets sent between the client and server VM during a HTTP session.

I logged into my SERVER VM with the CLASSROOM\Administrator account. I then started Server Manager and selected Tools->Internet Information Services (IIS) Manager

I clicked on the SERVER  (CLASSROOM\Administrator) option and selected “no” to the Microsoft Web Platform dialog box.

I double clicked on the Authentication icon and right clicked on Anonymous Authentication and disabled it.

Then I right clicked on Basic Authentication and enabled it.

So now I have set authentication so the user must write in their username and password.

Then I logged into the client with the local administrator account, CLIENT\Admin.

I started up Wireshark and started capturing.

Then I started up a Run dialog and I wrote in the address “http://server.classroom.local”.

After pressing “Enter” all I got was Internet Explorer appearing with the message “This page can’t be displayed”

So I decided to restart both the client and the server VM. However when I tried writing in the address http://server.classroom.local into the client VM run dialog I just kept getting the same error message.

So I wanted to see if it was because the CLIENT\Admin account is using the network (limited) network so I logged into the client VM with the CLASSROOM\Administrator account and used the run dialog writing in ‘http://server.classroom.local’. But as the below screenshot shows I still got the same error.

I looked at the network connection of the client and even though I logged in with the CLASSROOM\Administrator account and it showed that the client VM was only connected to the ‘Network (limited)’ network. So I decided to revert my client to the ‘Final Snapshot’ snapshot I had used in previous labs rather than use the ‘connected client snapshot’ I had started this lab with.

So in the VSphere client I right clicked on the client VM and powered it off, and then I selected Snapshot Manager and selected the ‘Final Snapshot’ (as you can see in the below screenshot) and then I reverted by clicking ‘Go to’.

Then I right clicked on the client and selected ‘Edit settings” and I removed the network adapter with the adapter type E1000E and added a new network adapter selecting VMXNET3 as the adapter type.

After adding this new network adapter I powered up the client VM and logged in with the account CLASSROOM\Administrator and I checked the network connections icon in the task bar and saw that the client was connected to the classroom.local network. I then opened the run dialog and entered ‘http://server.classroom.local’ and the authentication window appeared just as specified in the lab guide.

The below screenshot shows how the client VM is connected to the classroom.local network and when the url http://server.classroom.local is entered the authentication window appears rather than a ‘This page can’t be displayed’ error message as I had previously.

I then signed out of the CLASSROOM\Administrator account and signed back into the client VM as the local administrator CLIENT\Admin.

Then after opening the run command and entering in ‘http://server.classroom.local’ authentication window appeared as it had when I was logged in as domain administrator and so I can now continue with the rest of this lab now that the page is loading correctly.

I went ahead and started Wireshark again and tried to click to Start capture but the button was greyed out.

But after restarting the client VM Wireshark showed the Ethernet0 3 interface and the Start Capture button was no longer greyed out.

After starting the capture I opened the run command and wrote in ‘http://server.classroom.local. Into the authentication dialog I wrote the username ‘Administrator’ and the password specified in the lab guide. I made sure the “remember my credentials” checkbox was not ticked.

The Internet Information Services webpage appeared.

I then closed the browser, and stopped the Wireshark capture. I observed the three way TCP handshake SYN, ACK, SYN

Then the host (my client VM) sends a HTTP GET request to request the http://server.classroom.local webpage.

Then the server responds with a 401 Unauthorised because I have disabled anonymous authentication in the Internet Information Services (IIS) Manager in my Server VM.

Then further down below several server ARP requests I saw the GET /HTTP /1.1  packet which contains the user credentials (circled in red in the below screenshot) in plaintext 9they are displayed in plaintext because Wireshark has decoded them from a encoding method called Base64) form for anyone using Wireshark to read.

Exercise 2: Securing HTTP

I am now going to secure this authentication by implementing a server side certificate so the login credentials are encrypted between the client and the server.

The certificate will be available for the client to inspect and so determine if it is trustworthy.

In the IIS Manager of the server VM I clicked on the SERVER (CLASSROOM\Administrator). Then I double clicked on the Server Certificates icon.

I selected the ‘Create Self-Signed certificate’ link.

Then I entered the friendly name of the certificate to be ‘server.classroom.local’. The friendly name is the file name of the certificate request.

After creating this self signed certificate I navigated to Sites->Default web site. Under the Actions panel I selected ‘Bindings’.

In the bindings window I selected ‘Add’ and I added a a site binding specifying the type to be ‘https’ and the SSL certificate to be ‘server.classroom.local’ (i.e. the self signed certificate I just created.

So now there is two site bindings; http and a https.

I closed the site bindings window, however I need to ensure that the user will use the https connection because at the moment they can choose to log in using the un-encrypted http.

So to enforce the use of https connection I go to SSL settings in the IIS Manager

I checked the ‘Require SSL’ box and then selected the Apply button in the Actions pane.

I can see that this enforcement of the use of https has been successfully implemented because a message appeared after I applied the SSL Setting stating ‘The changes have been successfully saved’.

Then I returned to the client and I started a new capture in Wireshark discarding the previous captured packets.

Then I started up a run dialog and wrote in ‘http://server.classroom.local’

The Internet Information Services page appeared without me having to authenticate first.

I then pressed F5 to refresh the page. Now the error ‘403-Forbidden:Access is denied’ is displayed. In normal circumstances a redirect to the https page would be performed rather than just displaying a forbidden message.

I then wrote into the address bar ‘https://server.classroom.local’ however unlike the lab guide I did not get a warning about the certificate instead I recieved the same error 403 I had before when I loaded the http://server.classroom.local webpage.

I tried writing in this https link multiple times but continued to get the same error. However after a few minutes the certificate warning did appear.

I selected the ‘Continue to this website (not recommended)’ a authentication window appeared and I wrote in the username ‘Administrator’ and the password ‘Pa$$w0rd’, and after submitting these credentials the Internet Information Services webpage appeared.

Interestingly I noticed that there was a warning icon in the address bar so I clicked on it and it showed that the client did not trust the certificate used in the SSL encryption.

I then stopped the Wireshark capture and scrolled through the captured packets, I found where the SSL/TLS session was established which was the TLSv1.2 which was a client key exchange (highlighted in the below screenshot).

I couldn’t see any HTTP packets all there was was a TJS application data packet which had encrypted contents (circled in the below screenshot) and so it is not readable, compared to the http packets which contained the decoded username and password of the authenticating user.

Therefore I have found using Wireshark that https is far more secure than http because the SSL/TLS cryptographic protocols make the packet data encrypted and therefore not displayed as plaintext to the wireshark user.

I have now finished the lab and will revert all of my VMs.

 

Blog 10: Lab 12 Data leakage prevention

I have had a read about what Data Leakage Prevention is on the Tech Target website, effectively it is the implementation of software to control what users inside a network can do with data. For example the network administrator can deny permission for a user to print, or send sensitive data which if the data got into the wrong hands could put the organization at risk.

The way sensitive data is identified as requiring data leakage prevention is through business rules, and this backs up what Mark has taught us that security is people, policy and procedure as well as the actual technology to implement the security. This is because procedural controls have to be put on the data ensuring least privilege to the people as security threats to a network can come from outside or inside an organization.

In this lab I will be installing and playing around with data leakage prevention systems.

Exercise 1: Installing rights management services

I logged into my server VM with the CLASSROOM\Administrator account. I started up Server Manager and went to Active Directory Users and Computers.

I then created a new user by expanding the classroom.local option and right clicking on the Users folder and selecting New->User.

I created a user with the username, first name and full name of ADRMS

I then gave this user the password provided in the lab guide. I have also made the setting that they don’t have to change their password on the next login.

After creating the user “ADRMS” with the provided password, I right clicked on this user in the Users folder of Active Directory Users and Computers and added this user to the Domain Admins group, as the below screenshot shows.

I clicked ‘OK’ to confirm this addition of ADRMS to the group.

Then back in Server Manager I clicked Manage->Add role and features link.

In the installation wizard I kept the default options, and on the select destination server I made sure the SERVER.classroom.local server was selected (which it was by default).

In the ‘Select Server roles’ page I selected the Active Directory Rights Management Services checkbox. An ‘Add roles and features’ wizard appeared for Active Directory Rights Management Services and I made sure the Include management tools (if applicable) checkbox was selected before clicking the “Add features” button.

Then I just clicked ‘Next’ through the rest of the installation wizard until confirming the installation and Active Directory Rights Management Services service being installed.

After the installation was finished I clicked on the AD RMS node on the Server Manager. A message was displayed saying ‘Configuration required for Active Directory Rights Management Services at SERVER’ I clicked on the ‘More’ link beside this message.

In the ‘All servers task details’ window that appeared I clicked on the action link ‘Perform additional configuration’

In the resulting configuration wizard I selected the default options for the first two pages. When it came to selecting a Configuration database I selected the ‘Use Windows Internal Database on this server’ radio-button.

On the Service Account page I specified the service account to be that of the ADRMS user, by writing in the username ADRMS and the associated password.

I kept the default Cryptographic mode and cluster key storage option. Whilst in the Cluster key password I wrote in the password ‘Pa$$w0rd’. I am only using this password because it specifies to do so in the lab guide in a real world scenario a easily predictable password like this would not be used and I would instead use a pass phrase as we have discussed in class.

For the cluster address I selected ‘Use an unencrypted connection (http://)’ and wrote in the fully qualified domain name of ‘server.classroom.local’.

I didn’t have to enter ‘SERVER’ as the server license name as it was already written by default, then all I had to do was click the ‘Next’ button through the remaining pages of the wizard before checking the installation selections (see the below screenshot) and finally installing the Active Directory Rights Management Services configuration on this server .

After seeing that the AD RMS configuration has been successfully installed I restarted the server VM.

Exercise 2: Exploring DLP Options

I will now configure a typical policy template controlling what users are able to do with data.

I logged into the restarted server with the CLASSROOM\Administrator account, then I went to Tools->Active Directory Rights Management Services.

I then expanded the ‘server.classroom.local’ option, in the Rights Policy Templates I selected the ‘Create distributed rights policy template’ option.

I gave my distributed rights policy template the name of ‘classroom’ and description ‘Default policy’

Then I specified the user group entitled to access data protected using this template to be editors@classroom.local and I gave this user group all permissions except full control.

Then I added another user group by clicking on the ‘Add’ button. I wrote the email address of the user group ‘reviewers@classroom.local’ and only gave them permissions to view and print.

So now I have set up a template (which can be applied to data) giving permissions on the data to one group to view, edit, save, print and export the content whilst the other group can only view and print the content. Determining which group specific users would be in would come down to policies and procedures based on business rules so that the user gets least privileges to perform their job.

I set the content expiration to expire after 1 year.

Then I clicked ‘Next’ and then ‘Finish’ this created the template. So I have now created a distributed rights policy template with the name classroom.

I have now finished the lab and will revert all my VMs.

Before starting this lab I created a new snapshot of the client VM which I named ‘connected client snapshot’. The reason I created a new snapshot which I will now revert to is when I used to revert to the ‘Final snapshot’ snapshot in the client VM the network adapter was set to adapter type=E1000E, however I need it to have the adapter type=VMXNET3 for the client to be able to connect to the classroom.local network which in turn will let me log into the client with the CLASSROOM\Administrator account and will make the server and rogue pingable from the client.

So to save myself time from having to remove and then add a new network adapter at the end of each lab I have made a new snapshot with the client having the adapter type=VMXNET 3.

So I will revert to the ‘connected client snapshot’ in my client VM, and the ‘final snapshot’ snapshot in the rogue and server VMs.

I found this an interesting lab from the point of view of how organizations can protect their data from threats from inside the organization, and how the concept of least privilege is implemented with Data leakage prevention services like Active Directory Rights Management Services.

 

 

 

 

Blog 9: Lab 10 Attacks against DHCP and DNS

In this lab I will be performing an attack against the server services DNS and DHCP. I will create a rogue DHCP server so I can reconfigure the DNS settings on the clients.

 

Exercise 1: Setting up the scenario

In this exercise I will create the situation where the server VM is a busy network server providing the DNS, DHCP, and web host services. Due to the server being on a busy network all the clients will receive dynamic IP addresses with short lease times.

I logged into the server VM with the account CLASSROOM\Administrator and went to Tools->DHCP

I then expanded the server.classroom.local option and went to IPv4. I right clicked and went to the properties of Scope [10.1.0.1] Classroom scope node.

I set the lease duration for DHCP clients to 0 days and 1 hour as you can see in the below screenshot.

Then in the Advanced tab I set the subnet delay to 100.

Then I copied the wwwroot folder from c:\GTSLABS to c:inetpub folder.

 

Exercise 2: Preparing the attack

Now I have recreated the scenario that my server VM is a busy network server having to give out dynamic IP addresses every hour due to the demand for IP addresses from clients, I will now connect to the website make a copy of it and use a rogue DHCP and DNS server to direct network traffic to this new copied site.

I started up my Rogue and logged in with the local Admin account.

I created a new folder inside the c:\GTSLABS directory in the rogue VM and I named this new folder ‘website’

Then I went to the website hosted by my server, to do this I wrote into the search bar of Internet Explorer http://server.classroom.local

I then saved this webpage by going to the tools button on Internet Explorer and clicking “Save As”. I saved the webpage as file type ‘Webpage, complete (*.htm;*.html)’, with the file name “default.htm” and I saved this file into c:\GTSLABS\website. As the below screenshot shows.

Then in the File Explorer I went to c:\GTSLABS\website and I opened the default.htm file in notepad.

The below screenshot shows the header 1 (underlined) of the webpage before I changed it

And now I have changed the header 1 of the webpage to “The fake Book Company website”. Obviously I would not write this if I was trying to direct traffic to a fake copy of a real life website however I wanted to make it clearly visible for this lab that this is the modified site.

Then I saved the default.htm file.

I opened Network and Sharing Center. I clicked on the ethernet connector link and selected the “Properties” button.

I changed the IPv4 settings. I gave the rogue VM a static IP address of 10.1.0.10, subnet mask of 255.255.255.0, preferred DNS server of 10.1.0.10 and unticked “Validate settings upon exit” checkbox.

Then I clicked “OK” to implement these changes. Then I clicked “OK” in the Ethernet properties as well.

Then I typed into the start menu Windows Features and opened “Turn Windows features on and off”, I ticked the Internet Information Services checkbox which resulted in a square dot rather than a tick.

After clicking the “Ok” button the Internet Information Services was installed.

Then I typed ‘iis’ into the start menu and selected the Internet Information Services (IIS) Manager icon. In the IIS Manager I navigated to ROGUE (ROGUE\Admin)->Sites->Default web site

I then browsed the physical path to ‘c:\GTSLABS\website’ then clicked “ok” to confirm the location of my modified website.

Then in the File Explorer I navigated to c:\GTSLABS and ran the DualServerInstallerV7.12

In the User Account Control dialog box that appeared I clicked the “Yes” option.

I completed the rest of the Dual Server Installer keeping the default settings. Then after was installed I used the File Explorer to find the DualServer configuration file in c:\GTSLABS

And copy it int the c:\DualServer folder. A DualServer configuration file  already existed in the c:\DualServer however I choose to replace that file with this new DualServer configuration file by clicking “Replace the file in the destination” in the Replace or skip files dialog box.

I read in the lab guide that the DualServer.ini file in this c:\DualServer directory contains the settings used for the exploit I will be performing later in this lab.

I then went to the Start menu and typed in ‘Services’ and selected the View local services icon. I scrolled down to the Dual DHCP DNS Service and rick clicked on it and clicked “Start”

So I can now see that the Dual DHCP DNS Service is running.

 

Exercise 3: Falling for the attack

I am now going to log into the client VM and see if after setting up a short IP address lease time it has been caught by the exploit. If the client has maintained its previously used IP address I will have to force the client to forget its previous IP address.

I logged into the client VM with the account CLASSROOM\Administrator.

I then opened up the Network and Sharing Center. I clicked on the Ethernet link and viewed the details of this Ethernet connection.

I identified that the final octet of the IPv4 address was less than 128 (in my case it was 64) so the Dual DHCP DNS Service on the rogue has handed the client VM a IP address.

I know this because the DHCP service on my Server VM was configured to hand out dynamic IP addresses starting at 10.1.0.128 therefore as my clients IPv4 address is less than 10.1.0.128 its IP address is not from the networks authorized DHCP server but from the rogue DHCP server on my rogue VM.

I now opened Internet Explorer and wrote in the address http://server.classroom.local.  I could see the heading 1 I wrote “The fake Book Company website”. Thus the modified site I created on the rogue VM appeared.

The reason this modified site appeared is because the Dual DHCP DNS service on the Rogue VM handed my client VM a new dynamic IP address 10.1.0.64. So the client VM goes the rogue for doman name resolution. So when I write in the URL http://server.classsroom.local the rogue can direct me to its default site which I set the physical address to be c:\GTSLABS\website, and so the default.htm file inside this c:\GTSLABS\website folder will be loaded.

I have now finished this lab. It was an interesting lab to see how website redirection can occur inside a network and shows the level of risk places with public wifi networks are at for example libraries where someone could set up a dualserver DNS SHCP service on their computer and a web host server and direct the traffic to their copied version of a genuine website.

I will now revert my VMs.

 

Blog 8 Lab 9: Telnet and FTP

In this lab I will be looking at two unsecure protocols Telnet and FTP.

I logged into the server with the account CLASSROOM\Administrator. I went to Server Manager and selected to Add a new role or feature. I ensured theSERVER.classroom.local was selected to install the role or feature onto.

The role or feature I choose to install was FTP Server in the Web Server (IIS) server role.

For the feature I selected Telnet Server to install (as the below screenshot shows).

After finishing the installation I closed the wizard.

Then I went to Tools->Services and then I scrolled down until I found Telnet and then I right clicked on it and selected Properties.

I set the startup type of Telnet to manual (as the below screenshot shows).

I then right clicked on Telnet again and selected “Start”.

I then copied and pasted the ftproot folder in c:\GTSLABS to c:\inetpub

Then in the Server Manager I went to Tools->Internet Information Services (IIS) Manager. I enabled basic authentication for FTS Authentication.

I then added a new FTP site with FTS site name: server.classroom.local and the physical path of C:\inetpub\ftproot

I selected “no SSL”

In the Authentication and Authorization window I selected Authorization access to all users, and gave all users read and write permissions.

I then opened Windows Firewall with Advanced Security, opened up Windows Firewall with Advanced Security on Local Computer and I allowed inbound connections.

Exercise 2: Examining Telnet traffic

 

I signed into the client VM with the CLASSROOM\Administrator account, and turned on the Telnet client in the “Turn windows features on or off”.

I then started up Wireshark but I found that it would not start capturing because there was no interface for it to start capturing on (the start capture button was greyed out). This was strange because it was on the classroom.local network. Then I came to the conclusion this was the same issue I had with the previous lab on the one occasion I could get the client CM to connect to the VPN that Wireshark would stop capturing because it stated (even when I refreshed the interfaces) that there was no interface to capture on.

So I decided to experiment; I restarted the client and then noticing the client was still on the classroom.local network I started up Wireshark and this time I was able to start capturing. So it seems I must restart the client VM between if I have made a change on the server because I had allowed permissions for basic authentication for FTP Authentication on the server but had not restarted the client before trying to scan the classroom.local network.

So I must remember to restart the client after changes made to the server.

Back to this exercise I opened up the command prompt and wrote in:

telnet server.classroom.local

A welcome message appeared and I note that the escape character sequence is ‘ctrl+]’

To the continue message I typed ‘n’. After a long wait Then a  login prompt appeared and I wrote in administrator, and the password specified in the lab guide.

I then wrote in the command ‘dir’ and I could see all the folders of C:\Users\Administrator in the server. This shows I can execute commands and connect to the server.

I then typed in ctrl+] to escape and then quit to quit Microsoft Telnet client.

Then I stopped the capture of packets in Wireshark and entered in the filter of “telnet” a long list of Telnet data packets appeared and I scrolled through them. I had to scrolled through and click on the packets reading the contents, until I found the packet ending with the text ‘login:’ (as the below screenshot shows).

I then went through and noted the final text character in the packet data pane of the next 26 packets.

The final characters of these next 26 packets spelt out:

.a.d.m.i.n.i.s.t.r.a.t.o.r..

In other words through going through and reading the final characters of these 26 packets after the packet containing the text ‘login’ I have learnt the users username “administrator’.

Now lets see if the password is as easily readable. In the packet number 930 (which was immediately after the packet containing  the last character I wrote down above) the text ‘password:’ was written. See the below screenshot.

Then from the packet containing the text ‘password:’ I wrote down the last character in the next 8 packets which spelt out:

Pa$$w0rd

I found it interesting there were no packets containing full stops as the final character like there was for the packets containing the username ‘administrator’.

All the remaining  packets had the final character in the packet data pane being a full stop except two packets which had significantly longer contents.

packet 960 had a content length of 610 compared to all the other surrounding packets which had a length of around 60.

Whilst packet 994 had a length of 1205 and it is this packet which is of particular interest because it shows the contents of the server displayed after I wrote in the command prompt command dir.

As the below screenshot shows the ‘download’, ‘Favourites’, and ‘Pictures’ folders are visible.

So from examining telnet traffic I have learnt both the username and password are visible and readeable to someone packet capturing on the network just by reading the last character of packets.

As well as command responses such as the folders from the dir command.

 

Exercise 3: Examining FTP traffic

I am very interested to see how secure FTP traffic is because in our web classes we have used the FTP programs WinSCP, and in my personal web design work I have used the FTP program FileZilla. These two programs are used to transfer HTML, CSS, and PHP files from my local machine to the web server. Therefore after having used FTP extensively it will be interesting to see what level of risk my web work was at.

In wireshark on the client VM I started capturing packets again and didn’t save the previous capture as that is no longer necessary.

I then opened a run command and typed in ftp://server

A Internet Explorer login window appeared except it showed the error message “This page can’t be displayed” as the below screenshot shows.

But then I went back to my server VM and I noticed that I never clicked the “OK” button on the Windows Firewall with Advanced Security on Local Computer window. So the changes I made allowing inbound connections were not implemented, so I clicked the “ok” button and then tried writing into the Internet Explorer “ftp://server”

This time the login box appeared. I entered the same username and password I used when logging in the Telnet.

The FTP root of the server appeared and I clicked on the Contact.rtf link.

I opened this Contact.rtf file and I could read the contents.

I then stopped Wireshark from capturing packets and I wrote in the filter “ftp”. I went through the captured packets and looked for packets where the info field started with “Request:USER”. The first two Request:USER packets were anonymous where Internet Explorer has tried to authenticate.

The first packet with the info field “Request:USER Administrator” had the username Administrator both in the info field and in the data packet pane (underlined in the below screenshot)

The packet immediately after this Request: USER Administrator packet had the info field Response: 331 Password required.

Whilst the packet after that had the info field “Request: PASS Pa$$w0rd” and in data packet pane I saw the password was also written.

So I noticed that using FTP the packet info field starts lists the password so the password is even more easily visible than with Telnet where I had to at least click on the packet the see the contents in the data packet pane; and the username and password were not displayed in a single packet but instead one character in each packet. So FTP looks to be even more unsecure than telnet, from a security by obscurity point of view.

I then entered in ‘ftp-data’ into the filter box of wireshark and now only two packets are displayed.

Clicking on the first if these two packets I saw it contained the contents of the FTP root of the server which I had viewed by authenticating on the ftp://server. I know that this is the contents of the FTP root of the server because I could see the Dish_Of_Food.jpg file which is underlined in the below screenshot.

Whilst the second packet seemed to contain information to be displayed as I could make out the message “Getting in touch with us couldn’t be easier, you can contact us using any of the methods listed below” (which is pointed out in the below screenshot).

I have now finished this lab, I was very surprised at how unsecure telnet and FTP are and so I found this a very interesting lab. I will now revert my VMs.

 

 

 

 

Blog 7: Lab 8 Configuring a VPN

A VPN (Virtual Private Network) allows devices in two different physical locations to be networked together. For example a laptop in one physical location such as Nelson can communicate with a desktop in a network in a different physical location such as Sydney as though they were all part of the same network. A VPN is like a tunnel through the internet because the data transmitted is encrypted and so if the data is intercepted it is unintelligible.

In this lab I will be using a VPN software. I am already using the Sophos VPN to perform this lab from home.

Exercise 1: Installing a network adapter

Because the lab guide outlines how to add a second network adapter to your VMs using the Hyper-V Manager which we are no using in the SEC601 class I had to follow a different method for adding a second network adapter.

So I went to VSphere client and I right clicked on the Server VM and I went to “Edit settings” and I added another Ethernet adapter making sure to select the VMXNET 3 adapter type (which is the adapter type that the existing server, rogue and client VMs are using)

So now I have two network adapters on the server VM.

 

Exercise 2: Examining Unsecured Traffic

This exercise is going to look at how unsecured traffic (traffic in plaintext form) is at risk.

After logging into the server VM, I went to the Network and Sharing Center. I was interested to see if the second network adapter was visible. I saw that I am connected to the classroom.local domain (which is because I logged in as the CLASSROOM\Administrator) but the interesting thing is I can see I have two connections Ethernet0 and Ethernet1 (this is because the server VM has two network adapters).

So now I can continue with the rest of this exercise. I navigated to the c:\GTSLABS and created a new folder named SECRET and into this new folder I made a text file named CONFIDENTIAL.

Into the CONFIDENTIAL text file I wrote in “The password is CONFIDENTIAL!”. Then I went to share this file, so I started up Server Manager and clicked on File and Storage Services in the dashboard. I then selected Shares option, and I created a new share.

I selected the file to share as c:\GTSLABS\secret

I specified the name of the share as secret$

I unticked the ‘allow the caching of share’ checkbox to make sure the shared folder was not cached. And kept the default settings for the rest of the New Share wizard. So now I have a new share named secret$

I then logged into my client VM using the CLASSROOM\Administrator account. And then I started capture in Wireshark.

I then opened the Run dialog  and I wrote in command \\SERVER but I noticed that the secret$ share did not appear, only the netlogon and sysvol shares appeared (as you can see in the below screenshot)

However when I wrote into the search bar of the File Explorer \\SERVER\secret$ this share opened up and I could see the confidential text file, which I was able to read.

After closing this text file and the file explorer, I stopped the capture of the Wireshark and looked through all the packets I had captured and after some scrolling up the packet list I found the NetShareEnumAll Response packet. This packet is how the server communicates it share list to the client VMs.

I then double clicked on this NetShareEnumAll Response and scrolled down through the packet data frame and noticed that the secret$ share did appear (it is underlined in the below screenshot).

I right clicked on this packet however there was no Expand All option to view all fields.

I then looked for the Create Response File: ; Find Response; packet. The only matching packet I could find was named slightly differently, it was named:

Create Response File: Find Response;Find Response. I scrolled down in the packet data frame and I saw that as mentioned by the lab guide I could see the Confidential.txt file in the data (this is circled in blue in the screenshot below). This Create Response File:Find Response is what the server uses to communicate the list of files in a shared folder to the client.

I then searched for 2 packets a Read Request and the Read Response sent immediately afterwards. The Read Request was requesting confidential.txt file and the Read Response was sending the contents of the confidential.txt file to the client. In the below screenshot I can see the Read Request packet is explicitly listed as asking for the File: CONFIDENTIAL.txt (highlighted in red below). Whilst the Read Response packet is directly below.

I had a look at the packet data frame of the Read Response packet sending the contents of the Confidential.txt file back to the client; and I noticed the contents of this file are visible on Wireframe (circled in red in the below screenshot). So in unsecured traffic such as the  transfer of the shared file to the client  from the server the data contained in the shared file is visible and readable on a readily available protocol analyzer like Wireshark.

 Exercise 3: Configuring a VPN

I am going to configure my server VM to acts as VPN gateway.

In the Server VM I went to Server Manager->Add Role and Features

And then in the Add role and features window I kept the Role based or feature based installation option selected, and in the Server selection window I ensured that the SERVER.classroom.local was selected.

In the Server Roles I selected Remote Access before clicking “next”

And in the Role Services screen I selected the “DirectAcess and VPN (RAS)?” option, I  ensured the “Include management tolls (if applicable)” was selected, before clicking “Add Features”

After the installation I went to Tools->Routing and Remote Access

And in the Routing and Remote Access tool I right clicked on SERVER(local) and selected Configure ad Enable Routing and Remote Access

I ensured in the Remote Access window I selected VPN, this is setting my Server VM as the VPN gateway (VPN Server). In the VPN Connection I selected the Ethernet adapter configured with the IP address 10.1.0.1(which is highlighted in the below screenshot)).

I set the VPN to use a specified range of IP addresses from a pool of addresses between 172.16.0.1 to 172.16.0.10

After ensuring the option “No, use Routing and Remote Access to authenticate connection requests” before finishing the configuration of the VPN. A warning appeared stating the Remote Access Service cannot enable the Routing and Remote Access as the Windows Firewall is blocking the routing and remote access port.

I closed this warning and went to Windows Firewall with Advanced Security, I clicked on Inbound Rules and scrolled down until I found the Routing and Remote Access (GRE-In), (L2TP-In), (PPTP-In) rules.

And then I right clicked on each and  selected “Enable Rule”, so now all three of these rules are enabled as you can see below.

Now I have enabled the rules allowing the routing and remote access port to be opened in the firewall I have to set permissions allowing the users to join the VPN. To do this I went back to Server Manager->Tools->Active Directory Users and Computers.

I double clicked on Administrator and in the Dial-in tab I selected “Allow access” for the Network Access Permission.

 Exercise 4: Joining a VPN

I will connect to the VPN from the client VM.

I signed into my client with the CLASSROOM\Administrator account. I right clicked on Network icon and opened the Network and Sharing Center. I selected “Set up a new connection or network” link and clicked to connected to a workplace.

I selected “Use my Internet Connection (VPN)” and choose to set up a internet connection later. Then I entered the internet address of 10.1.0.1 (which is the IP address of my server (which is now acting as the VPN gateway/server)).

After creating this connection to the workplace the Networks available bar appeared and I can see I can now connect to either the Network (limited) connection or the VPN connection.

I tried to connect twice writing in the username and password supplied in the lab guide, however on both occasions I got the following error after a long wait trying to connect to 10.1.0.1

I tried logging back into the server VM but this made no difference. So I tried restarting both the client and the server VMs. However this still threw the same error.

So I came to the conclusion I must have somehow misconfigured the VPN connection even though I felt that I had followed the lab guide exactly. So I started the lab again, I reverted all my VMs (even the rogue which I haven’t used in this lab yet) just to be safe.

I went through and removed and then re-added the network adapter of the client VM because in the snapshot “Final snapshot” which was taken immediately after Mark rebuilt my VMs successfully the network adapter is not set as VMXNET 3.

After that I added another network adapter to the server VM (so now it has two network adapters). And then I went through the lab until I needed to log into the client as CLASSROOM\Administrator in order to set up the VPN connection however when I logged in with this account I found that the error thrown was “There are currently no logon servers available to service this logon request”. So the troubleshooting I went through to try to fix this problem was:

1. Log into the client VM as local admin and set a static IP address of 10.1.0.132 with subnet mask 255.255.255.0 and default gateway of 10.1.0.1. Then I restarted the client VM and tried to log in with the CLASSROOM\Administrator account however I got the same error.
2. Set the client VM back to having automatically assigned IP address (dynamic IP address) then restarting. I had heard from other students that setting the VM to have static IP address then making it automatic again had worked for them. However I still got the same error.
3. Turn the client VM off and remove and then add the network adapter again before trying to log in with the CLASSROOM\Administrator account and again I got the same error

 

Then finally I reverted all my VMs to the “final snapshot” and removed and added the network adapter of the client VM and logged into the server and then started up the client. I thought that perhaps having two network adapters on the server VM was causing the problem of the client not being able to log in with the classroom.local network. This seemed to be the last possibility from my troubleshooting process of elimination. So I logged into the client VM with the account CLASSROOM\Administrator and I found that I was able to log in with this account.

So I could now join the client VM to the VPN. When going to the Network and Sharing Center I noticed that my client is now connected to the ‘classroom.local’ network rather than the ‘network’ network I had previously.

After going through the “Set up a new connection or network” wizard I clicked on the VPN connection and signed in with the username CLASSROOM\Administrator, and this time I was able to successfully connect to the VPN (as the circled connection in the below screenshot shows)

After connecting, I had to follow the guides steps and disconnect from the VPN again.

 

Exercise 5: Examining VPN Traffic

In this exercise I will connect to the server through the VPN and use Wireshark to see if I can see what information is visible when it is accessed via a VPN.

I started up Wireshark in the client VM but the Start capture button was greyed out which means there is no interface for Wireshark to scan. However I found that this was because the server had locked so after logging back into the server, I got the Wireshark to start capturing.

I then went to the VPN Connection and connected to it. However as the below screenshot shows I got an error message from the Wireshark saying the network adapter the cpature was being done on is no longer running because I am changing to connecting to the VPN.

I also found that I got the same VPN error I thought that I had solved earlier.

So I went through and started the lab again twice, but I got error 868 each time (see the below screenshot). I tried troubleshooting by doing all the steps I had completed earlier to connect to the VPN but again I could not connect to the VPN.

I continued trying to restart or revert all my VMs and follow through the lab, however I still got either error 868 or error 800. I heard from Scott he got around the problem by reconnecting to the VPN from the client after the error 800 was displayed however I tried this three times and I could not get it to work.

So I will move onto the next lab and come back to this one at the end to see if I can get around this problem.

I have gone through and reverted my VMs so I can start work on lab 9.

After working on and completing labs 9, 10, 12, and 13 I came back to lab 8 and decided to go through it again except this time I decided to add the second Ethernet adapter to the server on a different switch, this is what I read Aaron had done in his blog which worked for him. Every other time I had attempted this lab I made sure the second Ethernet adapter was using the same switch as the first network adapter of the server which was switch 2762.

This time I made the second network adapter use switch 2763 (as you can see in the below screenshot).

Then I went through the lab again and tried to connect to the VPN from the client, and this time after authenticating I was successfully connected, rather than receiving the error 800 or error 868.

Therefore the problem was that I had always created the second network adapter to use the same switch as the first network adapter. I am now able to continue the lab. I started Wireshark now I am connected to the VPN. Then I opened the run dialog and wrote in \\172.16.0.1

Then in the resulting File Explorer I wrote in \\172.16.0.1\secret$

The configuration file appeared

I was able to read this file through the share I had created.

Then I went to Wireshark and stopped the capture. To filter all of the packets in Wireshark I wrote in pptp or ppp or gre and clicked “apply”. I browsed through the PPTP, PPP and GRE packets and as the below screenshot shows the contents of them is unreadable.

I then cleared this packet filter I applied, and scrolled down through the packets and I did not notice any SMB packets, which were the packets used when I scanned accessing the CONFIDENTIAL file before implementing the VPN, and it was the SMB packets which had the contents of the shared file displayed in plaintext.

And as stated above the PPP and GRE packets only contained unintelligible data in the packet data pane. Below is a PPP packet with the packet data pane showing encrypted data.

Whilst below is a GRE packet again unintelligible data in the packet data pane.

This has been an interesting lab from a troubleshooting point of view, and I will now revert my VMs ready to complete my final lab which is lab 14.

Blog 6 Lab 7: Password Sniffing

A password sniffing application captures packets containing passwords and then tries to determine what they are. This is opposed to a packet sniffing application such as Wireshark which will capture all packets being transmitted.

Exercise 1: Keyloggers

Keylogging software is software that records the keys that the user has typed into their computer. This can be useful for determining their password as  it removes the necessity of using a password sniffing application and having to use dictionary or Brute Force attacks to decrypt the users password.

I started up my client VM, signing in with the username CLASSROOM/Administrator. At first I got the error message saying “No logon services available” I had had this error before because the Server VM was not on and signed into, however in this instance the server is on and logged into. So I logged in as CLIENT\local and then tried pinging the server (10.1.0.1) and the rogue (10.1.0.131) and I noticed that both gave the “Destination host not avaliable” response.

I then thought I would have a look at what is in the arp cache so I wrote in the command: arp -a

This showed the servers IP address: 10.1.0.1

So I found it interesting that the servers IP address was in the ARP cache but was not available, this will most likely be because the servers IP address was found through ARP requests when the client had been connected to the classroom.local network in the past and had been stored in the ARP cache. But now the client cannot connect to the server.

To fix this problem I shut down my Rogue and reset it to the “Final snapshot” snapshot this was taken in the final reset Mark did of all my VMs when there was connectivity existing between all of them. I then started up the client and logged in but again no connectivity.

So then I tried adding the Ethernet adapter again making sure it uses the VMXNET3 adapter type.

I then started up and logged into the client and I was able to log in with the CLASSROOM\Administrator account therefore my client was part of the classroom/local network and so was able to ping the server and rogue successfully.

I was now able to start this lab. I browsed to c:\GTSLABS and ran ActualSpy application.

I selected the default settings and installed ActualSpy. I then double clicked on the desktop icon to start the ActualSpy application, however Windows Defender prevented me from running the application by throwing an error message. I then clicked on the “Windows Defender detected malware” message in the top right hand side of my screen and this brought up Windows Defender, because I have to run this software to perform this lab I unticked “Turn on real time protection (recommended)” checkbox.

I then had to reinstall ActualSpy because when I double clicked on the desktop icon it said this shortcut has been deleted. After reinstalling it I was able to run it.

I went to Settings and noted that the hotkey combination for opening ActualSpy is Ctr+shift+Alt+F8. I then checked the “Start at system loading” checkbox and all the checkboxes under the “Hiding” title.

In the Logs tab I noticed that keystrokes, screenshots, run/closed applications, clipboard, documents sent to private, file and directory changes, startup/shutdown are all PC activities that are saved by ActualSpy when run.

I then clicked the “Apply” button and started the ActualSpy monitoring hiding the ActualSpy application so no users would realize they are being monitored (it was not visible in the taskbar as a running application(as you can see in the below screenshot)).

I then signed out and back in as CLIENT\Admin account. I could not see ActualSpy running in the taskbar but I had idenitified that when I started hiding it when I was logged in as CLASSROOM\Administrator.

So I then stared Task Manager, ActualSpy was not shown in the running apps (which is shown by default if a user does not click on the “More details” link of the Task manager. However I clicked on this link and I could see the suspicious activity of the ActualSpy icon (a silhouette of a man wearing a hat) shown but the name ActualSpy was not beside the icon instead the name System (32 bit) was displayed. So unless you recognized the icon you would not realize you are being monitored.

I then opened a Run dialog and wrote in:

\\server.classroom.local

This threw a credential window for me to enter in my credentials, because I am not logged in as a domain user but instead as the local machines admin.

I entered in the username Administrator and the appropriate password.

I then created a text document in the client VM naming it Test and writing some content into this file (as you can see below). The creating extra files is to see if I can identify the username and password that I used when I logged in as Administrator from the other keystroke events recorded by ActualSpy.

I then signed out of the client VM as the CLIENT\local account and signed back in with the CLASSROOM\Administrator account.

I wrote in the shortcut: ctrl+ shift+alt+F8 and this brought up ActualSpy. Looking at the keystroke tab I could see all of the keystrokes I used to sign in as domain user to access the classroom.local server (see the screenshot below); The username is underlined in blue “Administrator” whilst the password is underlined in red (Note: between the first 2 characters and the next 4 characters there is a shift key where I used the shift key to make a $ symbol).

Below is a close up of the username and password identified by ActualSpy.

I then had a look at the other tabs in ActualSpy I noticed that in the Applications tab it showed that I had accessed the “Notepad” application on a file named “Untitled” and then I opened up the task manager after hiding the ActualSpy application  to see if I could see it was visible.

Whilst in the Screenshots tab I saw that I had taken 9 screenshots whilst ActualSpy was monitoring the client. I also noticed that in the Application and Screenshots the records each showed the username I was using at the time I performed the action.

So for example when I ran the Task Manager I was logged in with the local machines Admin. Whereas when I viewed the GTSLABS folder I was logged in as the CLASSROOM/Administrator. As the below screenshot shows the Admin and Administrator usernames are defined.

I then closed ActualSpy and signed out of the client VM.

Exercise 2: Cain and Abel

Cain and Abel is a password sniffing program created by Windows.

I signed into the Server VM. I went to Tools->Internet Information Services (IIS) Manager. I then expanded Server (CLASSROOM\Administrator)->Sites and selected Default Web sites.

I double clicked on Authentication and disabled the Anonymous Authentication option and enabled Basic Authentication.

 

I then logged into my Client VM with the CLASSROOM/Administrator username and after going to the Network and Sharing Center I changed the IPv4 Settings of the Ethernet adapter making it have a static IPv4 address of 10.1.0.10, with subnet mask of 255.255.255.0 and default gateway+ Preferred DNS Server of 10.1.0.1

The reason why I set the Client to have a static IP address is because Cain the sniffer feature of Cain and Abel application requires a static IP address on the ethernet adapter of the device it is sniffing.

I installed Cain and Abel application by going to c:\GTSLABS folder. and running ca_setup

I did not click to install the WinPcap Packet sniffing. After installing Cain and Abel I started it, when I clicked on the desktop shortcut a Windows Firewall warning appeared (as you can see below)

I went to Start->Windows Firewall->Turn Windows Firewall on or off link, and I selected all three Turn off Windows Firewall (not recommended) radiobuttons.

And then clicked “OK” this has disabled the Firewall, so now Cain and Abel will be able to run.

Now I ran Cain again and I noticed that there was no Windows Firewall warning now the application opened straight away. I clicked on the “Start sniffer” button and I noticed that there was no adapter listed in the adapter box. And then I thought  that I had not restarted the client since setting a static IP address and that is probably why there is no adapter showing to Cain. So I restarted the client and then started Cain and this time the adapter was visible (as you can see in the below screenshot).

I checked the Adapter and IP address all of which were correct (below is a close up of the IP addresses identified by Cain)

I had a look at the tabs showing what Cain can do. I was interested looking at the ARP (Arp Poison Routing) tab as you can select to use a real IP address and MAC address or spoofed Ip and MAC address. As we had learned about ARP Poisoning in class recently it was interesting to see Cain could do this.

I then closed this Configuration Dialog  window and then I clicked on the “Start sniffing” button and clicked the “OK” button on the Warning window that appeared.

I then opened up Internet Explorer and wrote in the URL http://server.classroom.local and then I logged in with the account CLASSROOM\Administrator making sure I did not log in saving credentials.

I then went to the Internet options dialog and selected the “Delete Browsing history on Exit” checkbox and clicked “Delete” and then in the window that appeared I ticked all of the option boxes then clicked “Delete”

Exercise 3: Cracking Windows Passwords

I switched back to my Server VM and in the Internet Information Services (IIS) Manager tool I went to the Authentication options of the default site in the SERVER (CLASSROOM\Administrator) and I disabled the Basic Authentication and enabled Windows Authentication (as the below screenshot shows).

 

I then switched back to my client and opened Internet Explorer and wrote in the URL http://server.classroom.local and I wrote in the username CLASSROOM\Administrator. I initially forgot and tried writing in the NMIT Moodle credentials, but realized and wrote in the classroom.local credentials.

Then I closed the browser and went back to Cain and went to the Sniffer tab and then the password option down the bottom of the Cain window. I then went to the HTTP option and I saw 3 entries.

All of these three passwords are decoded and reable because these passwords were written in when Basic Authentication was enabled on the server VM.

I then went to the MSKerb5-PreAuth option and saw 2 credential records (show in the below screenshot) which are from the two login occurrences I did when Windows Authentication was enabled and Basic Authentication was disabled.

I then right clicked on one of the MSKerb5-PreAuth records and selected the “Send to Cracker” option. Then I went to the Cracker tab and selected kerb5 PreAuth Hashes option in the left hand box. I could see the record I sent to the cracker.

I then right clicked on this Administrator account record and selected the Brute Force Attack option.

After starting the Brute Force Attack I noted that the attacks time remaining value was around 1.1854e+012 years

Because the time for a plain Brute force attack is so long, I stopped this brute force attack. I then I ticked the Custom radiobutton and wrote in “pPaAsSwWoOrRD05$@” and I set the min and max password length to 8. Then I started this custom brute force attack and I noticed the time remaining is now around 8.5-9 hours (the time remaining value constantly changed) which is far less than it was with a plain predefined brute force attack as I had attempted before.

I then stopped this custom brute force attack and exited. Then I clicked on the LM & NTLM Hashes option in the cracker tab. Clicking the “Add to List” button I imported hashes from the local system.

The hashes from the local system includes the Admin account.

I then right clicked on the Admin account and selected Brute-Force attack->NTLM Hashes

I noted that when I started the brute force attack on this NTLM hash the time remaining is now 3.3876e+010 years, so this is slightly shorter than the time it takes to perform a brute force attack with predefined charset on  a Kerb5 PreAuth Hash.

After a few minutes I stopped the brute force attack. And then I right clicked on the Admin account again and this time I selected Cryptanalysis Attack->NTLM Hahes->via RainbowTables (RainbowCrack). I had a look at the cryptanalysis window. Cryptanalysis attack uses a database of hashes called a Rainbow table to see if there’s a match with the hash; if there is a match then the password is decodedable.

This lab does not require us to run the cryptanalysis attack on the NTLM hash, so I just exited it. I have now completed this lab 7, so I will now revert my VMs.

 

 

 

 

 

 

Blog 5: Lab 6 Configuring Certificate Services

In this lab I installed certificate services in the server.

Exercise 1: Installing certificate services

I logged into my server VM and started up the Server manager. Then I clicked on the “Add roles and features” link .

I clicked Next for the Before you begin window. I kept the default selected option Role based or feature based installation for the “Select installation” type window.

I kept the default server selected (which was the option) as the SERVER.classroom.local in the server pool box.

Then in a list of services to add appeared I ticked the checkbox for the Active Directory Certificate Services checkbox in the Add roles and features window that appeared I ensured that the “Include management tools (if applicable)” checkbox was ticked, then I ticked the “Add features” button.

I clicked “next” in the next three windows then in the “Select row services” I kept the checkbox ticked “Certification authority” and also ticked the “Certification Authority Web Enrollment”. This caused a “Add roles and services” window to appear; I ensured that the “Include management tools (if applicable)” was ticked before ticking the “Add features” button.

Then I started the installation.

After the installation finished I opened the AD CS node, I saw there was a “more” link in a window showing “Confirmation required for Active Directory Certificate Services at SERVER”

So I clicked on the “More” link. In the “All servers task details” window I clicked to Configure Active Directory Certificate Services link.

I then went through the process of completing the AD CS Configuration by ticking the Certification Authority and Certification Authority Web Enrollment check boxes in the Role Services window.

I clicked “Next” to the next two windows, and in the “Private Key” page I ensured that the “Create a new private key” is selected before selecting the “Next” button. I also made sure that the Cryptography for CA page had the default options kept selected.

I noted that the cryptographic storage providers was: RSA# Microsoft Software Key Storage Provider with the key length:2048

I also noted the hash algorithm used is SHA1

I then clicked “Next” continued to click the default options the wizard displayed until clicking the “Configure” button to configure the Active Directory Certificate Service.

After the configuration finished I saw that the Certificate Service is online on my Server VM.

Exercise 2: Exploring the certificate server

In Server Manager I clicked Tools->Certification Authority

I checked and saw that the folders for revoked and issued certificates were empty, I also saw in the Certificate Templates folder there were subfolders; for example Domain Controller Authentication which is used for user (client) and server authentication.

I then right clicked on the classroom-SERVER-CA in the left hand box and I saw that the certificate proving that my Server VM was a root certification authority was from the classroom.server itself. In other words this certificate assigned to my server was from my server itself.

To find out more information about the certificate I clicked “View details”. I saw that the certificate was valid from 21/08/2016-21/08/2021 (in other words 5 years).

I also checked what the purpose of this certificate was: it turned out that as shown in the lab guide the certificates purpose is digital signature, certificate signing, offline CRL signing, CRL signing (86)

I then looked at the Extensions tab of the classroom-SERVER-CA properties window I wanted to see where the CRL (Certificate Revocation Lists) were located. I saw that they are actually stored in four locations:

c:\Windows\system32\CertSrv\CertEnroll\<CaName>

Idap:///CN=<CaTruncatedName><CRLNameSuffix>

http://<ServerDNSName>/CertEnrol/<CaName><CRLNameSuffix&gt;

file://<ServerDNSName>/CertEnroll/<CaName><CRLNameSuffix>

 

Exercise 3: Configuring an EFS Recovery Agent

A problem with encrypting data that scares a lot of people is the thought of the data becoming unrecoverable if they forget their password (or in this case their private key which only they own). However using a tool called a EFS Recovery Agent it is possible to restore the data but it must be configured first.

I navigated to Active Directory Users and Computers, I selected the classroom.local, then right clicked on User and selected New->User

I gave my new user the name Bob as the full name and user logon name. And then I confirmed the password and unticked the “User must change password at next logon” before clicking “Next” button.

I then double clicked on the Domain Admins group in the User tab, selected the Members tab, and clicked “Add” button

I then added the user Bob by entering the name and then clicking the “Check names” button which showed the domain name of the user Bob.

Bob@classroom.local

So now Bob is a member of the Domain Admins group

I then returned to the Certification Authority and I right clicked on the Certificate Templates folder and selected “Manage”. I right clicked on Key recovery Agent and selected Properties.

I added the user Bob who I just created and gave him enroll permissions on the Key recovery agent service.  I did this by clicking on the “add” button and writing in the name Bob I then clicked check name and this displayed the domain name of Bob (Bob@classroom.local) and then I clicked the “OK” button.

Then I clicked on the name Bob in the Group or User names box and ticked the Enrol checkbox.

I then went back to the Certification Authority window, right clicked on the classroom-SERVER-CA server and clicked on Properties.

I went to the Security tab and clicked the Add button I then went through the same procedure of adding the user Bob, the only difference being instead of giving Bob enrol permissions this time I gave him Issue and Manage certificates permissions.

This means the user Bob can now issue certificates.

Exercise 4: Configuring a Certificate Enrollment Website

In this exercise I am configuring a CA Web Enrollment site which is a site where users can manually request a certificate. Most computer and user certificates are not required to be manually requested but certain types of certificates are required to be manually requested.

In Server Manager I went to Tools-> Internet Information Services (IIS) Manager.

I clicked on the + button for Server (classroom administrator) and I clicked on the Server Certificates icon.

I entered in the name of the Domain Certificate as server .classrooom.local and wrote in the organization of NMIT, location of Nelson, state of Nelson Tasman. Then I clicked the “Next” button.

In the Online Certification Authority I selected the classroom-SERVER-CA

I also entered the friendly name of the Online Certification Authority to be server.classroom.local.

I then clicked to expand the Sites link and I clicked on the Bindings link in the action pane of the Default Web Site node.

Then in the resulting Site Bindings window I selected the type of HTTPS and selected the SSL certificate server.classroom.local then I clicked the “OK” button.

Now I can see that there are two certificates: one for HTTP and one for HTTPS.

Exercise 5: Obtaining a key recovery certificate

I will now request a certificate as the user Bob as I have given bob the permissions to request a certificate. To do this I signed into the Client VM with the username: CLASSROOM\Bob and the password specified in the lab guide.

I then went to Internet Explorer and searched for:

http://SERVER.classroom.local/certsrv

A authentication popup appeared and I entered the username Bob and the same password I used to log into the Client VM.

I then selected Request a certificate-> Advanced Certificate Request-> Create and submit a request to this CA. But the following warning message appeared:

Then I realized I had entered in the wrong URL, I had entered http://SERVER.classroom.local/certsrv

So I now restarted Internet Explorer and I wrote in: https://SERVER.classroom.local/certsrv

I was now able to select the certificate template EFS Recovery Agent, keep all the default settings and click the Submit button.

I clicked “Yes” to the Web access confirmation window, and then clicked to install this certificate. A message box appeared stating that the Certificate had already been installed I just clicked the OK button and then the Certificate Installed screen appeared (below) so now I know that my certificate is installed.

Exercise 6: Configuring Domain EFS Recovery

The certificate I have created for Bob lets all the encrypted files in the domain be recoverable; but to achieve this Group Policy must be used. I will use Group Policy in this exercise to make all encrypted files in the domain recoverable using this certificate.

In my client I started up mmc

In the mmc window I selected File->Add/Remove Snap-in. I clicked on Certificates and then selected “Add” in the window that appeared, then I clicked Finish.

I then navigated to Certificates-Current User->Personal->Certificates. This showed one certificate which was named Bob. I right clicked on this certificate and selected All Tasks->Export.

In the resulting Export Wizard I clicked Next to the first window then interestingly there was a Export Private Key window where I kept the default “No, do not export the private key” option. I found it interesting that this option was available because the whole purpose of private-public key cryptography is that the public key is exported and the private key is kept private. So to give the option of exporting the private key seemed strange.

In the next window I kept the default settings of Export File Format, and for the File to Export window I wrote in: \\server\netlogon\bobcert.cer.

Then I clicked the “Next” and I can now see all the certificate export settings. i am exporting bobcert (Bobs certificate) in the file format DER Encoded Binary.DER stands for Distinguished Encoding Rules this is a binary format, whereas another popular certificate export option Base64 changes binary data to ASCII text. SO effectively DER uses binary , whilst Base64 uses ascii.

I then clicked Finish->Ok (which appeared in a message window stating the export was successful) and then signed out of the client.

I signed into my Server started Server Manager and went to Tools->Group Policy Management. I expanded the hierarchical tree on the left and right clicked on classroom Domain Policy and selected Edit

In the Editor window that appeared I then clicked:

Computer configuration->Policies->Windows Settings->Security Settings-> Public Key Policies->Encrypting File System.

I then right clicked on Encrypting File system and selected “Add data recovery agent”

In the Add Data Recovery Agent I had to select the Recovery Agent (this is Bobs certificate which I have moved) so I clicked Browse folders and wrote in the file path:

\\server\netlogon\bobcert.cer then I clicked Open

When I clicked Open a message box appeared saying the File could not be found however I saw the bobcert in the server directory so I clicked on this certificate and then clicked Open.

Then I clicked Next->Finish.

Then I switched back to my Client VM and signed in with the CLASSROOM\Administrator account.

I started up my command prompt and wrote in

gpupdate /force

I then restarted the client VM.

In my Server VM I went to Active Directory Users and Computers (the guide mistakenly said go to Domain Users and Computers)

I created a new user with the name of Sue, she had the same password that Bob has and I unticked the checkbox User must change password.

After clicking Next then Finish the new user Sue was created. But now I need to add her into the Remote Desktop Users group so I can sign in as her with the client.

So I right clicked on the User Sue selected Add to Group. Wrote in the object name Remote desktop users checked the name which underlined it as it is a valid existing group and then I clicked OK.

Then a message appeared telling me the add to group was successful.

Exercise 7: Using encryption

In this exercise I will see the user Sue encrypt some documents and see the sorts of difficult situations that can occur with encryption.

I signed into the Client with the username: Sue. I  browsed in the File Explorer c:\GTSLABS

I then created a new folder named SECRETS

Into this SECRETS folder I created two text documents and a bitmap image (as you can see below).

Into the practice.txt I wrote: “Hello World this is a practise.” and into the test.txt I wrote “Hello this is a text”. I then right clicked on the SECRETS folder and selected Properties. I then selected the Advanced button and selected “Encrypt content to secure data”  (as you can see below) , then I clicked OK.

A popup window appeared asking if I wanted to apply this change just to the SECRETS folder or to subfolders, I selected to apply it to subfolders (the below screenshot shows the changes being applied) as this should not make any difference because there are no subfolders in the SECRETS folder, just two txt files and a bitmap image.

I can now see that the SECRETS folder itself and the files within it have their names colored green to show they are encrypted. As the below screenshot shows.

I then checked that the files in the SECRETS folder were still readable so I opened the practise.txt and I saw that I could still read this file (as shown in the below screenshot).

I then signed out of the Sue account. I then signed in with the account CLIENT\Admin (this is the local computers admin account). I wanted to see if I as the local computer admin could read the files in the SECRETS folder that Sue has encrypted.

When I clicked on the Practise.txt file to open it a blank Notepad file appeared and a message box stating “Access is denied”

When I tried to remove the encryption property from the practise.txt file by right clicking on the file and selecting properties. Then in the properties window selecting the Advanced button and unticking the “Encrypt contents to secure data” checkbox when I did this then tried to click “Ok” a error messaeg appeared (as shown below) saying an error occurred applying attributes to the file and Access is denied.

 

This shows that the local computer admin cannot read or un-encrypt a encrypted file as they do not possess the appropriate key. I then signed out of the client as the local admin.

Then signed back in as CLASSROOM\Sue.

I went to mmc and selected File->Add/Remove Snap-in.

I then clicked on the certificates snap-in and selected Add then clicked “OK”

I then navigated to Certificates->Personal->Certificates then right clicked in the certificate named Sue and selected All Tasks->Export

In this certificate export I did select “Yes, export the private key” and then selected “Next” then in the Export File Format window I selected “Delete the private key if the export is successful”. What this does is the private key is not kept in the user profile instead it is exported to a USB stick which is kept in a secure location.

I then wrote in and confirmed Sue’s password, and entered in the filepath to Sue’s certificate which is c:\GTSLABS\suecert.

Then I just clicked “Next” keeping the default settings in the next window, and at the end of the export I got a message telling me the export was successful.

I then clicked “Ok” and deleted Sues certificate, clicking “Yes” to the confirmation message.

I then signed out and then signed back in as Sue and tried to access the encrypted documents. When Sue tries to access her encrypted files she will get a “Access is denied” message, I also note as with when the CLASSROOM\Administrator when you click on a txt file which you don’t have private key to decrypt then a blank notepad file appears.

I then signed out of the client.

Exercise 8: Performing data recovery

The private key was exported to a USB stick which Sue owns (in the previous exercise) this means that only when the USB stick is inserted can Sue access her encrypted files. This is opposed to the previous situation where the private key was stored in her user profile.

Having a private key stored in your user profile may not be considered secure because if your account password was compromised then all your encrypted computer files are available to the hacker, whereas by having the private key on a USB stick which is stored in a secure location then this adds another layer of security protecting Sue’s encrypted files.

However this method is only effective if the USB stick in the secure place does not get lost, in this exercise I can assume Sue has lost her USB stick she now needs technical support to access her encrypted files without a private key.

I signed into the client VM with the account CLASSROOM\Bob

I went to c:\GTSLABS and right clicked on the SECRETS folder I selected properties and then after clicking the Advanced button I un-ticked the “Encrypt contents to secure data” checkbox (as you can see in the below screenshot) and then clicked “OK”

I then made sure this change applied to this folder, subfolders and files.

After clicking the “OK” button I noticed that the SECRETS folder and the files stored within were no longer colored green.

I then signed out, and signed back in as Sue. I saw that the files were now de-crypted and Sue can now read and edit them.

This is the end of this lab, I now reverted my VMs removing the changes made in this lab.

 

Blog 4: Lab 5 Steganography

Steganography is the process of hiding (concealing) information inside another file which is often a image or audio file. To ensure that the image/ audio/video file is not visible altered a common process is to encode the information you want to keep secret in the least significant bit of the image/audio/video file.

To start this lab working with tools used for steganography I logged into my client with the account CLIENT\Admin, then after navigating to c:\GTSLabs folder I ran the silenteye-0.4.1-win32 installing this application with the default settings.

Then after installing the SilentEye application I right clicked on the gtslearning.jpg file and noted:

Date created: 26 July 2016

Date modified: 28 September 2015

Date accessed: 26 July 2016

File size: 683Kb (or 684Kb on disk)

Then I double clicked on the WinMD5 application file and I dragged the gtslearning.jpg file into the Select a file box which caused the program to generate a file checksum (this is the message digest the result of hashing the gtslearning.jpg file. It is a fixed length output from the hashing of the variable length image file input.).

I pasted the message digest (file checksum) which is in the Current file MD5 checksum value textbox into the Original file MD5 checksum value textbox.

I then selected File->Open and selected the gtslearning.jpg file in c:\GTSLabs folder of the client.

After clicking the “OK” button to open this gtslearning.jpg file in SilentEye I then selected the “Encode” button and into the message box I wrote a hidden message: “This is a hidden message using steganography” and I chose the quality of 100%.

Then I clicked the Encode button. After Silenteye had encoded the image I went to File Explorer and wrote in %homepath% however this just took me to the root directory of the user account in the client which did not show the gtslearning.jpg output of the Silenteye encoding so I went back to Silenteye and clicked File->Open and saw that the gtslearning.jpg output was in the root Admin folder. So now I could navigate to the C:\Users\Admin and then I right clicked on the gtslearning.jpg and selected properties.

The screenshot below shows the encoded image outputs properties: I noticed that the dates had altered so now the created, modified and accessed dates were now 20 August 2016 (todays date).

But the most surprising thing I noticed was that the file size had changed; the file is now significantly smaller only 45.4Kb (or 48.0Kb on disk) as opposed to 683Kb previsouly before encoding the image.

I then dragged this new gtslearning.jpg file into the WinMD5 select a file box. This automatically created a new file checksum for the new gtsleaning.jpg file which was different to the message digest (checksum) of the old gtslearning.jpg file (the image before encoded with a hidden message) as the below screenshot shows the old files checksum is in the bottom textbox whilst the new files checksum is in the textbox above it. They are clearly different values.

Exercise 2: Detecting steganography

I was interested to see if there was any difference visually between the two image files so I compared them. The image on the left is the original gtslearning.jpg whilst the imae on the right is the encoded gtslearning.jpg.

I noticed that the background of the encoded image is lighter and has faint white dots.

I went to the c:\GTSLABSand extracted the contents of the stegdetect-0.4 zipped folder. I then clicked to run the xsteg application.

I then clicked File->Open and I selected the gtslearning.jpg file in the Admin root directory.

I noticed that after clicking the “OK” button there was a negative value for detection inside this file. In other words xsteg did not identify there was a hidden message inside this file.

Exercise 3: Alternative data streams

NOTE: Describe ADS…………………….

I created a rich text document inside the c:\GTSLABS folder. This text file was named MEMO and I added some text to it.

I then saved and closed the text document. In the c:\GTSLABS folder I right clicked on the newly created MEMO file and selected properties I noted that the size was 197 bytes ( or 0 bytes on disk) and the date created, modified and accessed were all 20 August 2016 (todays date)

I then closed the properties window, returned to the WinMD5 application and dragged the MEMO.rtf file into the Select a file textbox. This returned a new checksum value which I pasted into the Original file MD5 checksum box.

I then started a elevated command prompt selecting the “yes” button to the Iser Account control dialog box.

And into this elevated command prompt I wrote

cd  \GTSLABS
type setup.exe>memo.rtf:odysseus.exe

erase setup.exe

I then went back to the File Explorer and checked the properties of the MEMO file. I noticed the MEMO file was bigger; the size was still 197 bytes however the size on disk was now 380Kb rather than 0 bytes.  Whilst the dates were all the same (just a different time).

I then hashed this new MEMO file to see if the checksum is the same. When I dragged the MEMO file into the Select a file textbox of the WinMD5 application the current checksum value did not change as you can see in the below screenshot. I found this interesting because the size of this file had changed but not the checksum (message digest).

I moved the MEMO file to my Documents folder and then double clicked on it I noticed the text appeared in Wordpad rather than the setup.exe file being run which is what I hid inside this text file earlier using the elevated command prompt.

So to see if I could get the setup.exe file to run I went back to the elevated command prompt and write in:

After running the memo.lnk command the Odysseus setup.exe started.

I cancelled the setup. I then navigated to c:\GTSLABS\adsspy which will identify what might have been concealed in the ADS.

I selected Full Scan (all NTFS drives” and selected the Scan the system for “alternative data streams”

This scan identified the memo.rtf and memo.lnk. I checked the boxes to remove these two files.

And then I tried to execute the memo.lnk shortcut again in the command prompt. This gave the result “File not found” error

This is the end of the lab, I can now revert the changes.

 

 

 

Blog 3 Lab 4 Baseline Security analyzer

It is important to check if a operating system (OS) conforms to basic recommended security configurations to do this we use the Microsoft Security Compliance Manager which allows you to test OS and other applications against templates of these installs illustrating  basic security measures.

In this lab I will be using Baseline Security analyzer as Security Compliance Manager is complex to install.

I started up my server and client, since doing the previous lab (last night) I have checked and the connectivity between the rogue to the client and server is still present as I was able to successfully ping the server and the client, and so at present the issue of the rogue not being able to communicate with my other two VMs seems to be fixed.

I logged in as CLASSROOM/Administrator in the client.

Then after navigating to c:\GTSLABS I started the install of he MBSASetup-x64-EN and kept all the default installer options.

I then started the Baseline Security Analyzer after it had finished installing. I selected to Scan multiple computers and I entered the domain to scan being CLASSROOM, I also unticked the Check for security updates box.

Then started the scan. After the scan I saw that the server and client had been scanned and I noticed that the server had had a incomplete scan, whilst the client was found to be at severe risk.

I checked my server and saw that it had logged off due to non-activity so I logged back into it and performed the scan again. I found that Baseline Security Analyzer still only executed a incomplete scan of the server.

I decided to read through both reports so I then clicked to on the server and client.

Below is the server report.

Scrolling down in the server report I noticed the components of the server OS that were not scanned causing the server to have a incomplete scan were IIS status. IIS (Internet Information Service) is a web server service that supports web protocols such as HTTP.

Below is the client report. The client obviously didn’t have IIS service to scan because it is not a web server and so the client scan completed.

A similarity in both the server and client reports I noticed was both the server and the client have a severe risk score for the Automatic  Updates because that service is not running as both VMs are not connected to the internet.

This is the end of the lab so I now reverted to my ‘Final snapshot’ snapshot.