diff --git a/docs/content/features/exploiters/log4shell.md b/docs/content/features/exploiters/log4shell.md index e112647b0c3..c0e8deeafe9 100644 --- a/docs/content/features/exploiters/log4shell.md +++ b/docs/content/features/exploiters/log4shell.md @@ -37,7 +37,7 @@ to propagate to a victim machine. ### Services exploited -Infection Monkey will attempt to exploit the Log4Shell vulnerability in the +Infection Monkey attempts to exploit the Log4Shell vulnerability in the following services: - Apache Solr diff --git a/docs/content/features/exploiters/mssql.md b/docs/content/features/exploiters/mssql.md new file mode 100644 index 00000000000..4176d026bd9 --- /dev/null +++ b/docs/content/features/exploiters/mssql.md @@ -0,0 +1,48 @@ +--- +title: "MSSQL Exploiter" +draft: false +description: "Exploits MSSQL by taking advantage of insecure configuration" +tags: ["exploiter", "mssql", "brute force"] +pre: " " +--- + +## MSSQL + +[MSSQL (Microsoft SQL Server)]( +https://learn.microsoft.com/en-us/sql/sql-server/what-is-sql-server) is a +relational database management system (RDBMS) developed by Microsoft whose +functions include managing, storing, retrieving, manipulating, and analyzing +data efficiently. In addition to manipulating data stored within the database, +the [`xp_cmdshell`]( +https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql) +procedure allows users to manipulate the host server by executing Windows shell +commands from within the SQL Server environment. + +## Exploitation + +Because of the inherent security risks associated with `xp_cmdshell`, it is +disabled by default. If `xp_cmdshell` has been enabled on an MSSQL instance, +attackers who possess valid credentials can leverage MSSQL to run arbitrary commands +on the server. Infection Monkey's MSSQL exploiter uses brute-force to +authenticate with a victim's MSSQL server and uses `xp_cmdshell` to propagate +to the victim server. + +![MSSQL Configuration]( +/images/island/configuration-page/mssql-exploiter-configuration.png +"MSSQL Configuration") + +### Credentials used + +The MSSQL exploiter uses [user-configured credentials]( +/usage/configuration/credentials), as well as credentials collected from other +victims for brute-forcing. All possible combinations of usernames and passwords +are used, prioritizing pairs provided by the user in the configuration. + +## Mitigation + +The best approach to mitigate this attack is to disable the `xp_cmdshell` +feature as described in [Microsoft's documentation]( +https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option?view=sql-server-2017). + +## See also +- [MSSQL exploiter reference documentation](/reference/exploiters/mssql) diff --git a/docs/content/features/exploiters/powershell.md b/docs/content/features/exploiters/powershell.md new file mode 100644 index 00000000000..eac3890305c --- /dev/null +++ b/docs/content/features/exploiters/powershell.md @@ -0,0 +1,83 @@ +--- +title: "PowerShell Exploiter" +draft: false +description: "Exploits PowerShell Remoting" +tags: ["exploiter", "powershell", "brute force"] +pre: " " +--- + +## PowerShell Remoting + +[PowerShell Remoting]( +https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity) +is a PowerShell feature that enables connecting to Windows machines remotely in +order to execute PowerShell commands on them. It is commonly used by +administrators to manage multiple systems in a network. + +## Exploitation + +Attackers that can successfully authenticate via PowerShell Remoting are able +to execute arbitrary commands on the victim machine. Infection Monkey's +PowerShell exploiter uses brute-force to attempt to propagate to a victim +via PowerShell Remoting. + +![PowerShell Configuration]( +/images/island/configuration-page/powershell-exploiter-configuration.png +"PowerShell Configuration") + +### Credentials used + +The PowerShell exploiter can be run from both Linux and Windows attackers. On +Windows attackers, the exploiter has the ability to use the cached username +and/or password from the current user. On both Linux and Windows attackers, the +exploiter uses all combinations of [user-configured credentials]( +/usage/configuration/credentials), as well as credentials collected from other +victims. Different combinations of credentials are attempted in the following +order: + +1. **Cached username and password (Windows attacker only)** - The exploiter + uses the stored credentials of the current user to attempt to log into + the victim machine. + +1. **Brute force usernames with blank passwords** - Windows allows you to + configure a user with a blank/empty password. The exploiter attempts to + log into the victim machine using usernames set in the + [configuration](/usage/configuration/credentials) or stolen from other + victims, and a blank password. + + In order for the attacker to connect with a blank password, the victim must + have enabled basic authentication, http and no encryption. + +1. **Brute force usernames with cached password (Windows attacker only)** - The + exploiter attempts to log into the victim machine using usernames + set in the [configuration](/usage/configuration/credentials) or stolen from + other victims, and the current user's cached password. + +1. **Brute force usernames and passwords** - The exploiter attempts to use + all combinations of usernames and passwords that were set in the + [configuration](/usage/configuration/credentials) or stolen from other + victims. + +1. **Brute force usernames and LM hashes** - The exploiter attempts to use + all combinations of usernames and LM hashes that were set in the + [configuration](/usage/configuration/credentials) or stolen from other + victims. + +1. **Brute force usernames and NT hashes** - The exploiter attempts to use + all combinations of usernames and NT hashes that were set in the + [configuration](/usage/configuration/credentials) or stolen from other + victims. + +## Mitigation + +1. Restrict PowerShell remote command execution. +1. Harden the credentials of relevant users by enforcing strong password + policies. +1. Enable multi-factor authentication. + +More information about how to remediate security concerns related to PowerShell +Remoting can be found [here]( +https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity). + +## See also +- [PowerShell exploiter reference documentation](/reference/exploiters/powershell) diff --git a/docs/content/features/exploiters/rdp.md b/docs/content/features/exploiters/rdp.md new file mode 100644 index 00000000000..0303a619939 --- /dev/null +++ b/docs/content/features/exploiters/rdp.md @@ -0,0 +1,58 @@ +--- +title: "RDP Exploiter" +draft: false +description: "Exploits RDP" +tags: ["exploiter", "rdp", "brute force"] +pre: " " +--- + +## RDP + +[RDP (Remote Desktop Protocol)]( +https://learn.microsoft.com/en-us/windows/win32/termserv/remote-desktop-protocol) +is a network communication protocol by Microsoft which enables users to connect +to another computer over a network, providing a remote display and input +capabilities to the user. It is commonly used for remote administration, remote +technical support, and remote work access. + +## Exploitation + +Machines with RDP enabled may be accessible to attackers if they come across +the correct credentials. Infection Monkey's RDP exploiter uses brute-force to +attempt to propagate to a victim via RDP. + +![RDP Configuration]( +/images/island/configuration-page/rdp-exploiter-configuration.png +"RDP Configuration") + +### Credentials used + +The RDP exploiter uses [user-configured credentials]( +/usage/configuration/credentials) as well as credentials collected from +other victims. Different combinations of credentials are attempted in the +following order: + +1. **Brute force usernames and passwords** - The exploiter attempts to use + all combinations of usernames and passwords that were set in the + [configuration](/usage/configuration/credentials) or stolen from other + victims. + +1. **Brute force usernames and NT hashes** - The exploiter attempts to use + all combinations of usernames and NT hashes that were set in the + [configuration](/usage/configuration/credentials) or stolen from other + victims. + + This only works on Windows 8.1 and Windows Server 2012 R2. You can read more + [here](https://www.kali.org/blog/passing-hash-remote-desktop/). + +## Mitigation + +1. Change user passwords to complex passwords that are not shared with other +computers on the network. + +For information about remediating RDP-related security risks, see +[Microsoft's +guidance](https://www.microsoft.com/en-us/security/blog/2020/04/16/security-guidance-remote-desktop-adoption/) + +## See also +- [RDP exploiter reference documentation](/reference/exploiters/rdp) diff --git a/docs/content/features/exploiters/smb.md b/docs/content/features/exploiters/smb.md new file mode 100644 index 00000000000..1c613eb341c --- /dev/null +++ b/docs/content/features/exploiters/smb.md @@ -0,0 +1,42 @@ +--- +title: "SMB Exploiter" +draft: false +description: "Exploits SMB" +tags: ["exploiter", "smb", "brute force"] +pre: " " +--- + +## SMB + +[SMB (Server Message Block)](https://en.wikipedia.org/wiki/Server_Message_Block) +is a network protocol primarily used in Windows for sharing and communication +between computers on a network. Besides resource sharing, SMB supports remote +procedure calls (RPC), which allows executing arbitrary commands on remote +systems using command line utilities such as `psexec` and `smbexec`. This is +generally used for administrative tasks and remote management. + +## Exploitation + +Machines with SMB enabled may be accessible to attackers if they come across the +correct credentials. Infection Monkey's SMB exploiter uses brute-force to +attempt to propagate to a victim via SMB. + +![SMB Configuration]( +/images/island/configuration-page/smb-exploiter-configuration.png +"SMB Configuration") + +### Credentials used + +The SMB exploiter uses [user-configured credentials]( +/usage/configuration/credentials) as well as credentials collected from other +victims for brute-forcing. All possible combinations of usernames, passwords, +LM hashes, and NT hashes are used, prioritizing pairs provided by the user in +the configuration. + +## Mitigation + +Change user passwords to complex passwords that are not shared with other +computers on the network. + +## See also +- [SMB exploiter reference documentation](/reference/exploiters/smb) diff --git a/docs/content/features/exploiters/ssh.md b/docs/content/features/exploiters/ssh.md new file mode 100644 index 00000000000..7eaf0620f74 --- /dev/null +++ b/docs/content/features/exploiters/ssh.md @@ -0,0 +1,46 @@ +--- +title: "SSH Exploiter" +draft: false +description: "Exploits SSH" +tags: ["exploiter", "ssh", "brute force"] +pre: " " +--- + +## SSH + +[SSH (Secure Shell)](https://en.wikipedia.org/wiki/Secure_Shell) is a network +protocol designed for Unix-like operating systems that provides a secure way to +access a remote computer over an unsecured network. After establishing an +encrypted connection to a remote machine, it can be used to execute arbitrary +commands directly through the SSH terminal or by specifying commands in the SSH +client. This allows for secure remote administration and automation of tasks on +the target system. + +## Exploitation + +Machines with SSH enabled may be accessible to attackers if they come across the +correct credentials. Infection Monkey's SSH exploiter uses brute-force to +attempt to propagate to a victim via SSH. + +![SSH Configuration]( +/images/island/configuration-page/ssh-exploiter-configuration.png +"SSH Configuration") + +### Credentials used + +The SSH exploiter uses [user-configured credentials]( +/usage/configuration/credentials) as well as credentials collected from other +victims for brute-forcing. All possible combinations of usernames, passwords, +and SSH keypairs are used, prioritizing pairs provided by the user in the +configuration. + +## Mitigation + +1. Change user passwords to complex passwords that are not shared with other +computers on the network. + +1. [Store private keys securely.]( +https://www.ssldragon.com/blog/best-practices-to-store-the-private-key/) + +## See also +- [SSH exploiter reference documentation](/reference/exploiters/ssh) diff --git a/docs/content/features/exploiters/wmi.md b/docs/content/features/exploiters/wmi.md new file mode 100644 index 00000000000..483b25f3e91 --- /dev/null +++ b/docs/content/features/exploiters/wmi.md @@ -0,0 +1,43 @@ +--- +title: "WMI Exploiter" +draft: false +description: "Exploits WMI" +tags: ["exploiter", "wmi", "brute force"] +pre: " " +--- + +## WMI + +[WMI (Windows Management Instrumentation)]( +https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page) is a set +of tools and extensions in Windows for managing and querying system information, +configurations, and operations. WMI's command line utilities and scripting +capabilities are used by administrators to run arbitrary commands on local and +remote environments for monitoring system health, automating administrative +functions, managing network resources, etc. + +## Exploitation + +Machines with WMI enabled may be accessible to attackers if they come across the +correct credentials. Infection Monkey's WMI exploiter uses brute-force to +attempt to propagate to a victim via WMI. + +![WMI Configuration]( +/images/island/configuration-page/wmi-exploiter-configuration.png +"WMI Configuration") + +### Credentials used + +The WMI exploiter uses [user-configured credentials]( +/usage/configuration/credentials) as well as credentials collected from other +victims for brute-forcing. All possible combinations of usernames, passwords, +LM hashes, and NT hashes are used, prioritizing pairs provided by the user in +the configuration. + +## Mitigation + +Change user passwords to complex passwords that are not shared with other +computers on the network. + +## See also +- [WMI exploiter reference documentation](/reference/exploiters/wmi) diff --git a/docs/static/images/island/configuration-page/mssql-exploiter-configuration.png b/docs/static/images/island/configuration-page/mssql-exploiter-configuration.png new file mode 100644 index 00000000000..1f444ae2a70 Binary files /dev/null and b/docs/static/images/island/configuration-page/mssql-exploiter-configuration.png differ diff --git a/docs/static/images/island/configuration-page/powershell-exploiter-configuration.png b/docs/static/images/island/configuration-page/powershell-exploiter-configuration.png new file mode 100644 index 00000000000..35d1ce1874b Binary files /dev/null and b/docs/static/images/island/configuration-page/powershell-exploiter-configuration.png differ diff --git a/docs/static/images/island/configuration-page/rdp-exploiter-configuration.png b/docs/static/images/island/configuration-page/rdp-exploiter-configuration.png new file mode 100644 index 00000000000..1fd918a658d Binary files /dev/null and b/docs/static/images/island/configuration-page/rdp-exploiter-configuration.png differ diff --git a/docs/static/images/island/configuration-page/smb-exploiter-configuration.png b/docs/static/images/island/configuration-page/smb-exploiter-configuration.png new file mode 100644 index 00000000000..b5a0763ba4a Binary files /dev/null and b/docs/static/images/island/configuration-page/smb-exploiter-configuration.png differ diff --git a/docs/static/images/island/configuration-page/ssh-exploiter-configuration.png b/docs/static/images/island/configuration-page/ssh-exploiter-configuration.png new file mode 100644 index 00000000000..6755d3ace9c Binary files /dev/null and b/docs/static/images/island/configuration-page/ssh-exploiter-configuration.png differ diff --git a/docs/static/images/island/configuration-page/wmi-exploiter-configuration.png b/docs/static/images/island/configuration-page/wmi-exploiter-configuration.png new file mode 100644 index 00000000000..41a28a961f4 Binary files /dev/null and b/docs/static/images/island/configuration-page/wmi-exploiter-configuration.png differ