(https://myslide.es/register.html)
(https://myslide.es/)
HOME (HTTPS://MYSLIDE.ES/) LEADERSHIP (HTTPS://MYSLIDE.ES/CATEGORY/LEADERSHIP-MANAGEMENT.HTML) TECHNOLOGY (HTTPS://MYSLIDE.ES/CATEGORY/TECHNOLOGY.HTML) EDUCATION (HTTPS://MYSLIDE.ES/CATEGORY/EDUCATION.HTML) MORE TOPICS (HTTPS://MYSLIDE.ES/CATEGORY.HTML)
Home (https://myslide.es/) / Documents (https://myslide.es/category/documents.html) / Root Password (https://myslide.es/documents/root-password.html)
Root Password Category
View
Download
Posted on
REPORT (HTTPS://MYSLIDE.ES/REPORT-COPYRIGHT/ROOT-PASSWORD) Documents (https://myslide.es/category/documents.html) 1242 40 26-OCT-2014
RECOMMENDED (https://myslide.es/documents/manual-cambiopassword-root-centos.html)
Manual Cambio Password Root Centos (https://myslide.es/documents/manualcambio-password-root-centos.html) Documents
(https://myslide.es/category/documents.html) (https://myslide.es/technology/solaris-10-forgetroot-password.html)
Solaris 10 forget root password (https://myslide.es/technology/solaris10-forget-root-password.html) Technology
(https://myslide.es/category/technology.html) (https://myslide.es/documents/reset-rootpassword-zfs-boot-file-system.html)
Reset Root Password Zfs Boot File System (https://myslide.es/documents/resetroot-password-zfs-boot-filesystem.html) Documents
(https://myslide.es/category/documents.html) (https://myslide.es/documents/changing-aforgotten-root-password-on-aix.html)
Changing a Forgotten Root Password on Aix (https://myslide.es/documents/changinga-forgotten-root-password-on-aix.html) Documents
(https://myslide.es/category/documents.html) (https://myslide.es/technology/recuperarpassword-de-root-en-linux-centos.html)
Recuperar password de root en linux centos (https://myslide.es/technology/recuperarpassword-de-root-en-linuxcentos.html) Technology
(https://myslide.es/category/technology.html) (https://myslide.es/documents/sudo-user-forresetting-root-password-amits.html)
[
Sudo-User for Resetting Root Password AmitS (https://myslide.es/documents/sudouser-for-resetting-root-passwordamits.html)
]
Documents
(https://myslide.es/category/documents.html) (https://myslide.es/documents/caramengembalikan-password-root-yang-hilang.html)
Cara Mengembalikan Password Root yang Hilang (https://myslide.es/documents/caramengembalikan-password-root-yanghilang.html) Documents
(https://myslide.es/category/documents.html) (https://myslide.es/documents/best-way-toreset-root-password-in-solaris-10.html)
Best Way to reset Root Password in Solaris 10 (https://myslide.es/documents/bestway-to-reset-root-password-in-solaris10.html) Documents
(https://myslide.es/category/documents.html) (https://myslide.es/software/root-user-passwordis-missing-or-forgot-for-linux.html)
Root user password is missing or forgot for linux (https://myslide.es/software/root-userpassword-is-missing-or-forgot-forlinux.html) Software
(https://myslide.es/category/software.html) (https://myslide.es/documents/don-crawleyarticle-how-to-prevent-root-password-guessingattacks.html)
Don Crawley Article--How to Prevent Root Password Guessing Attacks (https://myslide.es/documents/doncrawley-article-how-to-prevent-rootpassword-guessing-attacks.html) Documents
(https://myslide.es/category/documents.html)
(https://myslide.es/documents/root54785bb5b4af9f59058b456e.html
Root (https://myslide.es/documents/root54785bb Documents
(https://myslide.es/category/documents.html)
(https://myslide.es/documents/root544f3d4ab1af9f2f258b4844.html)
Root (https://myslide.es/documents/root544f3d4a Documents
(https://myslide.es/category/documents.html) (https://myslide.es/documents/root.html)
root (https://myslide.es/documents/root.html) Documents
(https://myslide.es/category/documents.html)
(https://myslide.es/documents/root55cf8548550346484b8c54a0.htm
Root (https://myslide.es/documents/root55cf8548 Documents
(https://myslide.es/category/documents.html) (https://myslide.es/healthmedicine/root554b8002b4c90574668b47fd.html)
Root (https://myslide.es/healthmedicine/root554b8002b4c90574668b47fd Health & Medicine
(https://myslide.es/category/healthmedicine.html) (https://myslide.es/healthmedicine/root554b7f1cb4c9056d5f8b499b.html)
Root (https://myslide.es/healthmedicine/root554b7f1cb4c9056d5f8b499b. Health & Medicine
(https://myslide.es/category/healthmedicine.html)
(https://myslide.es/documents/root554b7f5ab4c90561588b4b49.htm
[
]
root (https://myslide.es/documents/root554b7f5a Documents
(https://myslide.es/category/documents.html) View more (https://myslide.es/search?q=Root+Password)
1
of 63
Download (https://myslide.es/download/link/rootpassword)
(https://myslide.es/documents/rootpassword.html)
DESCRIPTION Certified Penetration Tester (CPT) Practical Examination Report Matthew Tiedeman
[email protected] February 21st, 2009 Contents 1. 2. 3. 4. Overview.......................................................................................4…
TRANSCRIPT
Certified Penetration Tester (CPT) Practical Examination Report Matthew Tiedeman
[email protected] February 21st, 2009 Contents 1. 2. 3. 4. Overview.......................................................................................4 Assumptions..................................................................................4 Tools.............................................................................................4 Penetration test details....................................................................5 A. Scanning...................................................................................5 i. Baseline scan of network..........................................................5 ii. Port scanning and OS fingerprinting...........................................5 iii. Service fingerprinting - TCP services.........................................7 iv. Service fingerprinting - Validation of Apache HTTP service............9 v. SNMP enumeration................................................................11 vi. Service fingerprinting - UDP services.......................................13 B. Sites used during the exploit research phase.................................14 C. Remote TOP RELATED exploits........................................................................15 i. Research via anyside.org.........................................................15 ii. Exploits – round 1.................................................................18 iii. Research via secwatch.org.....................................................19 iv. Exploits – round 2.................................................................19 D. User discovery..........................................................................19 i. Abuse of finger......................................................................19 E. Brute force password guessing....................................................21 i. Discovery of password for “user” account..................................21 ii. Discovery of password for “cptvm1” and “cptvm2” accounts........23 F. Research of cptvm1 and cptvm2 hosts..........................................25 i. cptvm1.................................................................................25 ii. … … … cptmv2................................................................................27 G. Penetration of cptvm1...............................................................29 i. Local exploit research via anyside.org.......................................29 ii. Local exploit research via secwatch.org....................................32 iii. Privilege escalation using a Kernel VMA exploit..........................33 iv. Maintaining access via creation of a new “r00t” account.............34 v. Gathering the shadow password file.........................................35 H. Cracking passwords of the cptvm1 host.......................................35 i. Cracking of “user”, “cptvm1” and “cptvm2”................................35 I. Penetration of cptvm2................................................................36 i. Privilege escalation using a Kernel vmsplice exploit.....................36 ii. Maintaining access via creation of a new “r00t” account..............37 iii. Gathering the shadow password file........................................38 J. Cracking passwords of the cptvm2 host........................................39 i. Cracking of ROOT PASSWORD (HTTPS://MYS… RESET ROOT PASSWORD (HTTP… CUCM LINUX ROOT PASSWORD … “cptvm1”, “cptvm2”, “root” and “r00t”.......................39 K. Cracking passwords of the cptvm1 host – round 2.........................40 i. Cracking of “root” and “r00t”...................................................40 L. Ultimate Certified Penetration Tester (CPT) Practical Reset the passwords of the CUCM Page 1 of 4 « goal............................................................................43 i. Cptvm1 and ctpvm2 hosts Examination Report Matthew Tiedeman RIP timer Cisco » Reset the passwords of compromised...................................43 ii. Passwords for root accounts on cptvm1 and cptvm2...................43 M. Lessons learned.......................................................................43 i. Searching exploit
[email protected] February 21st, 2009 the CUCM There are three kinds of CUCM sites............................................................43 ii. Attack vectors.......................................................................44 5. Contents 1. 2. 3. 4.... password : administrator… Appendix.....................................................................................44 A. Source code for the Kernel 2.4 VMA 1038 15 620 0 581 0 exploit...................................44 B. Source code for the Kernel 2.6 vmsplice exploit.............................59 1. Overview The certified pen tester practical examination consists of the compromising of two VMware virtual machines, the recovery of the root passwords for each system and the creation of a penetration report. The penetration report will contain, at a minimum, the details of all of the penetration test findings and a prioritized list of the vulnerabilities discovered. The penetration report should be submitted for review to:
[email protected] The following information was provided as part of the examination documentation: ! Virtual machine 1 (cptvm1) – VM containing a Linux system. " The system has the following static We built a platform for members to share COMPANY CONTACT & LEGAL OPENING HOURS configuration: # IP Address: 192.168.1.200 # Netmask: 255.255.255.0 # Gateway: 192.168.1.254 # DNS: 192.168.1.254 ! documents and knowledge. And we are not Virtual machine 2 (cptvm2) – VM containing a Linux system. " The system has been configured to gain its network information Monday to Saturday 9:00am to 5:00pm About (https://myslide.es/about.html) Terms (https://myslide.es/info/terms.html) related to any other website via DHCP. ! Information gathered from one of the VM's during the penetration test may be required in order to compromise the Sunday: CLOSED other VM. 2. Assumptions ! ! While the penetration testing process consists of 5 phases (reconnaissance, scanning, Contact (https://myslide.es/contacts.html) DMCA (https://myslide.es/info/dmca.html) penetration, maintaining connectivity and covering tracks), the reconnaissance and covering tracks phases will not be covered within this report. Stealthy scanning and penetration techniques will not be used. 3. Tools The following tools were used during the completion of the penetration testing practical examination. ! back|track3 – Collection of penetration tester utilities. ! VMware Fusion – VMware virtual host software for OSX. ! Apple OSX – Host operating system used to execute VMware Fusion. ! nmap – Port scanning, fingerprinting, “swiss army knife” utility. ! httprint – HTTP fingerprinting utility. ! snmpenum.pl STARTUP - SHARE TO SUCCESS – SNMP enumeration utility. ! vi – Text editor. ! emacs – A “swiss army knife” editor (text/source code/etc). ! gcc – C, etc compiler. ! tftp – Trivial File Transfer Protocol client ! ssh – Secure shell client ! ! ! ! ! ! ! ! finger – Finger utility. bash shell (https://facebook.com/d (https://twitter.com (https://goo