CSCI 632
LAB ASSIGNMENT INSTRUCTIONS
INSTRUCTIONS
You will complete labs associated with the course material. Each lab will have specific
instructions for tasks, along with deliverables, to be completed in the virtual lab environment.
Introduction
Welcome to the Scanning and Enumeration Lab!
Preparing to strike at a target involves careful investigation. The hacker first learns all he or she
can from open sources before actually touching the target system. That process is called passive
reconnaissance. Eventually, the hacker exhausts the available resources and has to actually probe
the target system, thus initiating scanning and enumeration.
The final step before the actual exploit, scanning and enumeration involves learning about a
target system from the system itself. The hacker sets about probing a target system to see what
services might be open and running, what vulnerabilities might exist, and which weaknesses
might be exploitable. Due to the nature of scanning and enumeration, the hacker runs the risk of
his or her activities being discovered and stopped by the target. For this reason, the black-hat
hacker will want to gather as much information as he or she can as quickly as possible. Because
a white-hat, or ethical, hacker has a written directive from the target itself, he or she may be less
concerned with timing.
In this lab, you will explore several scanning and enumeration tools, including some you may
already know. You will use Nmap and its graphical user counterpart, Zenmap, to gather data
about the network, and you will capture that traffic using Wireshark. You will use OpenVAS, a
popular open source vulnerability scanner, to further explore a vulnerable system. You will
create and run a customized scan and examine the results. Finally, you will start two penetration
tools, Metasploit and Armitage, import the Nmap report, and further explore the system. This lab
has four parts, which should be completed in the order specified:
In the first part of the lab, you will use Zenmap and Nmap, the original command-line version, to
actively probe your local area network and export the scan results to a file.
In the second part of the lab, you will use the OpenVAS vulnerability scanner to run an in-depth
vulnerability scan of the target machine and generate a report showing the identified and
prioritized system weaknesses.
In the third part of the lab, you will use Metasploit, a common penetration testing tool, and
Armitage, the graphical user interface (GUI) for Metasploit, to further explore the target system.
CSCI 632
Finally, if assigned by your instructor, you will explore the virtual environment on your own to
answer a set of challenge questions that allow you to use the skills you learned in the lab to
conduct independent, unguided work, similar to what you will encounter in a real-world
situation.
Learning Objectives
Upon completing this lab, you will be able to:
Understand the benefits of and tactics for conducting scanning and enumeration.
Perform network and system scans and export the results.
Capture network traffic and investigate packet-level data.
Understand how to start and configure Metasploit and its supporting services.
Perform and customize vulnerability scans and interpret the results.
Tools and Software
The following software and/or utilities are required to complete this lab. Students are encouraged
to explore the Internet to learn more about the products and tools used in this lab:
Armitage
Metasploit
OpenVAS
Nmap
Wireshark
Zenmap
Please Note: You must click the “Submit” button in the bottom right section of the ‘Lab
Instructions’ pane in order to submit your lab for grading. Graded lab submissions are based on
performance of tasks completed in the lab. When you submit your lab for grading, you might see
a message stating, “Sorry, you did not pass.” This is due to the way the Lab Scoring Technology
converts your score and passes it to the Liberty Learning Platform and is NOT necessarily
indicative of your final score on the lab. The final calculation of your score will be converted
from successful completion of lab exercise tasks and then re-calculated & recorded into Liberty's
Grading Book, based on the total number of points the assignment is worth.
CSCI 632
Before submitting your lab, you can review your current Lab Score based on a possible max
score of 10 representing how many tasks were completed. Click the ‘Check Score’ link located
on your Desktop to see your Lab Score at any time while working on the lab and check your
gradebook for your final score, when complete.
Part 1: Performing Initial Scans with Zenmap and Nmap
Login to the Kali virtual machine
Log in to the Kali virtual machine with the credentials root:toor
Perform initial scans with Zenmap
After logging in, open a new terminal window by clicking the Termincal icon from the sidebar.
At the prompt, type zenmap
and press ENTER to start the Zenmap process.
In the Zenmap target box, type 10.0.0.0/24 to identify the target network to be scanned.
In the initial network probe, you want to find out how many machines are on that network
segment as well as the operating systems and version of those systems. You want to start with a
broad but minimal scan.
From the Profile drop-down menu, select Quick scan plus and click the Scan button to begin the
scan.
The scan will identify each host it discovers and determine which ports are open on that host.
The scan is completed when the message “Nmap done” appears in the Nmap Output tab.
Once the scan has finished, click each host in the left-hand pane and review the scan results for
that host in the Nmap Output tab:
CSCI 632
Ports/Hosts
Host Details
In the target box, change your targets to correspond with the hosts that you found during your
initial scan, and change the Profile to Intense scan, and click Scan to begin the scan.
You can specify multiple targets in different ways in nmap/zenmap with examples including:
Subnet notation in CIDR format ex. 10.0.0.0/24
Range notation, ex. 10.0.0.1-10
Individual target notation, ex. 10.0.0.1,5,10
More information can be found in the nmap documentation found here.
Compare the results from the scan in Step 5, and the scan in Step 7.
Create a new Zenmap profile and continue scanning
From the Zenmap topbar menu, click Profile and select New Profile or Command to open the
Profile Editor dialog box.
Delete the existed scan parameters that are highlighed in blue in the screen shot in order to
configure a new profile.
In the Profile name box, type Custom Scan to rename your scan.
CSCI 632
In the next steps, you will configure a new profile in the Profile Editor that will direct Zenmap to
scan the target machine for SYN traffic, the beginning of a TCP handshake.
Click the Scan tab, and select TCP SYN scan (-sS) from the TCP Scan: dropdown.
Click the Scripting tab and click all of the smb-vuln- checkboxes (ex. smb-vuln-ms08-067), and
the smb-enum-shares checkbox in the lefthand pane. You can ignore the smb2 scripts.
Click the name of the script (for example, smb-check-vulns) to display the purpose of the scan in
the center top pane. Review the descriptions of both of these scripts.
Click the Other tab, and click the radio button next to Extra options defined by user and add the
option --script-args=unsafe=1 to specify that unsafe checks can be enabled.
CSCI 632
Click the Save Changes button to save your new profile.
In the Target box, type 10.0.0.103 to specify a single machine as the target for your custom scan.
From the Profile drop-down menu, select Custom Scan.
Click the Scan button to begin your custom scan.
The scan results appear in the Nmap Output tab. The Nmap Scripting Engine, or NSE, is an
extension to Nmap and provides much more than just basic port scanning. Features include
advanced network discovery, sophisticated version detection, vulnerability detection, and even
vulnerability exploitation.
Without exiting Zenmap, opeb a bew terminal window and type wireshark and press ENTER to
start Wireshark.
Click OK to dismiss the warnings about Wireshark being run as the root user
CSCI 632
In the main Wireshark window, ensure that eth0 is highlighed, and then click the blue sharkfin
on the tool bar to begin capturing traffic on the eth0 interface. You can resize Wireshark's top
frame (the frame summary) if necessary to make each section more visible as necessary.
Restore the Zenmap window containing your custom SYN scan profile.
Click the Scan button again to reinitiate the SYN scan, and then immediately restore the
Wireshark window.
Monitor the captured packets as they scroll in the frame summary pane. As the scan is running,
you’ll see the packets come in rapidly. When the packets slow, the scan is finished.
Once the scan has finished, click the red square icon in Wireshark to stop the packet capture.
The Wireshark display will include information about the scan. The Info column at the right will
show additional information, including TCP flags. You should be able to identify the [SYN]
packets signaling the probes sent by Zenmap. You will also be able to identify the corresponding
reset [RST] and acknowledgement [ACK] packets sent by the probed machine to the requesting
machine.
CSCI 632
In the Wireshark display filter box, type tcp.flags.syn == 1 and press ENTER to show only the
SYN traffic.
Even in the lab environment on a simple scan, the number of captured packets can be
overwhelming. The filter option enables you to sort and display only desired packets.
Click any SYN packet frame to display additional information about it in the middle frame detail
pane. Resize the frame detail pane (middle pane) to make the contents more visible.
In the frame detail pane, navigate to the TCP flags data (Transmission Control Protocol > Flags)
to determine which TCP flags were set.
CSCI 632
A zero (0) denotes not set, while a one (1) denotes the TCP flag was set. Note that your frame
numbers will not match the frame numbers in the following figure. You can see that the SYN
flag is set, but both the ACK or RST flags are not set.
Repeat steps 25-27 and filter the data to show only the RST packets with tcp.flags.reset == 1
From the Wireshark menu, select File > Quit and select Quit without Saving.
From the Zenmap menu, select Scan > Quit and select Close anyway.
Repeat Intense scan using the Nmap command-line tool.
In the next steps, you will repeat the Intense scan using the Nmap command-line tool. Zenmap is
a graphical version of the Nmap tool, so the output should be the same. You will use the
command-line syntax that you explored earlier to run the scan. You will compare the results of
this scan with those of the Zenmap scan. Next, you will repeat the scan and save the results to a
file that can be used by other reconnaissance tools.
At the terminal window, type nmap -T4 -A -v 10.0.0.103,108,112 and press ENTER to begin the
scan.
Remember, this scan is a moderately aggressive scan with verbose output, probing the IP
addresses 10.0.0.103, 10.0.0.108, and 10.0.0.112.
CSCI 632
Using the terminal's scrollbar, review the results of the scan once it has completed.
The results should be the same as the screen capture you recorded in Step 6. While Zenmap and
Nmap produce the same results, Nmap does so more quickly.
At the terminal, type the following command and press ENTER:
nmap -T4 -A -v -oX /root/nmapscan_yourname 10.0.0.103,108,112
This command will repeat the scan and save the output as an XML file (-oX) named
nmapscan_yourname. You will use this file later in the lab.
Once the scan has complete, ensure that your XML file was created.
Part 2: Run a Vulnerability Scan with OpenVAS
When it comes to scanning and enumeration, vulnerability scanning is a means of
actively probing systems to identify vulnerabilities. OpenVAS, a popular open source
vulnerability scanner, will enable you to scan a system with as much (or as little)
foreknowledge as you grant the tool. OpenVAS will scan the target system to search for
vulnerabilities that might exist, but its power comes from its ability to confirm the
vulnerability can be exploited.
In the next steps, you will create a custom OpenVAS scan profile and run the scan
against the IP address 10.0.0.103, a Windows 2003 Server.
1. In your terminal window, type/openvas-start/and press/ENTER. One the
startup process has completed, a Firefox window will open automatically to
the OpenVAS homepage.
CSCI 632
2. Add Exception
oWhen Firefox launches you may see an error like this:
oPlease click/Advanced/and then/Add Exception
oIn the/Add Security Exception/popup, click/Confirm Security
Exception/in the bottom left.
CSCI 632
oYou should land on the page in the following screenshot.
3. Log in to the OpenVAS appliance with the credentials/admin:admin
4. Once logged in and presented with the Greenbone Security Assistant
dashboard, navigate to/Scans/from the topbar, and click/Tasks.
5. Click the/X/on the popup that comes up, and then click the purple wand icon
at the top left, and select/Advanced Task Wizard.
CSCI 632
6. In the/Task Name/box, enter/yourname_Policy/where/yourname/is your
own name.
7. Ensure the/Scan Config/drop-down is set to/Full and fast
8. Change the/Target Hosts(s)/box to/10.0.0.103, and leave all other fields
on their defaults.
The Advanced Task Wizard allows for further configuration, such credentials
for various services such as SSH, SMB, and ESXi, as well as email reporting.
9. Because you are leaving the/Start time/as/Start immediately, once you
click the/Create/button, the scan will begin. After you have ensured your
parameters are correct, press the/Create/button.
10. After beginning your scan, you wil be brought to the Scans dashboard, and
you will see your scan with a status of/Requested. As the scan progresses,
the page will auto-refresh. You can also manually refresh the page to see the
current progress. Additionally, you can click the name of the scan from here
to see a more detailed view of your scan.
CSCI 632
11. Once your scan has completed, you can view the report and the results by
clicking the respective hyperlink numbers next to each field:
12. Click the/Results/page to be brought to the results summary page for the
scan you just conducted:
13. Towards the bottom of the page, click the single green right arrow to browse
to the next page of results:
CSCI 632
On the results dashboard, you can also view results by their categories and
severity class by sorting the columns, or by clicking each area in the pie
chart or bar graph windows.
14. Click the result for/Vulnerabilities in SMB Could Allow Remote Code
Execution (958687) - Remote/to view the details. This finding details the
system's vulnerability to MS09-001, as well as details about said
vulnerability, the CVE page for the vulnerability, and other resources.
15. Click/Back/in your browser, and repeat step 13 for the other high severity
vulnerabilities.
16. In the top of the Greenbone Security Assistant appliance page, click/Scans >
Reports/to be brought to the reports dashboard.
17. Click the date hyperlink for the report that you just ran, ensuring that the
Task Name aligns to what you named your task in earlier steps.
18. In the top left of the page is where the report export function is located. Click
the drop-down box (defaults to Anonymous XML), scroll down and
select/PDF, and click the green down arrow next to the box to download
your report as PDF.
19. Open your report to ensure that everything exported correctly, and close
your Firefox window.
Part 3: Exploire Metasploit and Armitage
1. Return to a terminal window.
2. At the terminal, type/msfdb start/or/service postgresql start/and
press/ENTER/to start the PostgreSQL service.
The Metasploit database has already been initialized for you in this lab. After
a fresh install of Kali Linux, or the Metasploit Framework, you will need to
initialize the database for first time use using/msfdb init/and/msfdb start. If
CSCI 632
you ever have problems with the Metasploit database and need to revert to
its initial state, you can use/msfdb reinit/to reinitialize the database.
3. Type/msfconsole/and press/ENTER/to launch the Metasploit command line
interface.
4. At the/msf >/prompt, type/db_status/and press/ENTER/to verify that
Metasploit and the database service are running properly. A success
message will yield/[*] postgresql connected to msf
From the Metasploit console, you can perform any penetration testing
attacks available within the tool, but it does take some time to become
acquainted with the syntax. Tools like Armitage, the GUI for Metasploit, make
using Metasploit more user-friendly for the novice. CobaltStrike, Armitage’s
Enterprise offering, adds a suite of post-exploitation tools and professional-
looking reporting. These tools require significant time to learn, but tutorials
are available online for both tools.
In the next steps, you will use Armitage to conduct penetration testing on the
LAN.
5. At the/msf >/prompt, type/armitage/and press/ENTER/to open the Armitage
connection dialog box.
6. The default connection parameters should be configured properly by default,
but ensure they match the following:
oHost: 127.0.0.1
oPort: 55553
oUser: msf
CSCI 632
oPass: test
7. Click the/Connect/button to connect to the Armitage console, and when
prompted, click/Yes/to start the Metasploit RPC server.
8. If you receive a prompt regarding the attack computer IP, please
enter/10.0.0.10, which is the IPv4 address of the eth0 interface for the Kali
machine.
9. You will notice that there are no hosts the host pane (top window) because
we haven't conducted any scans yet, nor have we imported any scan data
from other scans.
10. In the top bar, select the/Hosts/drop down, and select/Import Hosts.
11. Select your exported nmap scan in XML format from Part 1 that you exported
to the /root directory, and click/Open. Armitage will parse your XML scan data
and import the findings into Armitage, as seen below:
12. Feel free to explore the Armitage options related to each imported host.
Once you are finished, quit Armitage by selecting/Armitage > Close , and then
pressing the/End/button at the bottom of these instructions.
