This case study provides an overview of the operations carried out by our penetration testing red berets for one of our customers.

Our client, a Fortune 500 financial services company, needed to conduct a rigorous penetration test of its network before launching a slew of new services.

Our penetration team members have these advantages:

The initial steps in penetration testing involve numerous scans and a careful study of the network. This reveals important information about the network and allows the team to obtain relevant details of objects in the path, including router, firewall and switch.

The Internet provided an unlimited pool of resources that we used to narrow the range of activities and provide some insight as to the type and amount of information publicly available about the organization.

Network enumeration is a technique that identifies the domain names and associated networks related to a particular organization. We queried the 'whois' databases to assist us in finding a wealth of information about the network. There are many different tools to query various whois databases.

The following query types provided the majority of the information that was used:

Our information collection phase becomes easy if a system administrator configures the DNS server incorrectly, by allowing a distrusted Internet user to perform a DNS zone transfer. A zone transfer allows a second master server to update its zone database from the primary master server.

Many DNS servers, however, are mis-configured, and provide a copy of the zone to anyone who asks. This isn't necessarily bad if the information provided relates only to the systems that are connected to the Internet, and have valid hostnames, although it makes it that much easier for attackers to find potential targets. This DNS server of our target network did not have the zone transfers enabled.

We now attempted to determine their network topology, as well as potential access path into the network. To accomplish this, we used the 'traceroute' program that comes with most Unix systems and is provided in Windows NT.

Traceroute is a diagnostic tool that lets you view the routes that an IP packet follows from one host to the next. It uses the time-to-live (TTL) option in the IP packet to obtain an 'ICMP time exceeded' message from each router. Each router that handles the packet is required to decrement the TTL field. The TTL field is known as a hop count. When the TTL field decrements to zero, the packet is discarded.

With accurate information about the network, the focus was now on getting access at the operating system level on the target machines. Port scanning is the act of systematically scanning a computer's ports. Since a port is a place where information goes into and out of a computer, port scanning identifies open doors to a computer.

With accurate information about the network, the focus was now on getting access at the operating system level on the target machines. Port scanning is the act of systematically scanning a computer's ports. Since a port is a place where information goes into and out of a computer, port scanning identifies open doors to a computer.

The following shows the output of a port scan on the two identified target systems, called here as system A and the mail server called here as B.

Port scan on A
(The 65,526 ports scanned but not shown below are in state: filtered.)
Port State Service
80/tcp open http
The telnet on to port 80 to this server revealed that it was running a version of Apache. The server running was Solaris 2.7.

Port scan on B
(The 65,526 ports scanned but not shown below are in state: filtered.)
Port State Service
25/tcp open smtp
79/tcp open finger
110/tcp open pop-3

A telnet on to port 25 sent back a default banner, which revealed that it was a vulnerable version of sendmail server running on Linux.

At this point we had a fair idea about the two machines on the network and the operating systems running on them. The findings about the operating systems were further confirmed by doing extensive manual tests on the packets received from the target system (using passive OS fingerprinting techniques).

Next came a complete vulnerability scan of the two systems, and a listing down of all the known vulnerabilities that were associated with the services running on the two systems. We found more than one vulnerability associated with the sendmail and also on the version of Apache running on the web server.

The team now brainstormed on strategies to exploit one or more of the vulnerabilities, and doing so without creating an alarm. It was critical at this stage to get full control of the system, but covertly. Often, if care is not taken at this stage, you run the risk of crashing the operating system and bringing the target administrator's attention to the covert operation.

After analyzing the above information, these were the attack approaches decided on by the penetration testing team.