pentest_tex_output.tex

%%
% Copyright (c) 2018, Pascal Wagler;  
% Copyright (c) 2014--2018, John MacFarlane
% 
% All rights reserved.
% 
% Redistribution and use in source and binary forms, with or without 
% modification, are permitted provided that the following conditions 
% are met:
% 
% - Redistributions of source code must retain the above copyright 
% notice, this list of conditions and the following disclaimer.
% 
% - Redistributions in binary form must reproduce the above copyright 
% notice, this list of conditions and the following disclaimer in the 
% documentation and/or other materials provided with the distribution.
% 
% - Neither the name of John MacFarlane nor the names of other 
% contributors may be used to endorse or promote products derived 
% from this software without specific prior written permission.
% 
% THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 
% "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 
% LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
% FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 
% COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 
% INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
% BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
% LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 
% CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
% LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 
% ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
% POSSIBILITY OF SUCH DAMAGE.
%%

%%
% For usage information and examples visit the GitHub page of this template:
% https://github.com/Wandmalfarbe/pandoc-latex-template
%%

\PassOptionsToPackage{unicode=true}{hyperref} % options for packages loaded elsewhere
\PassOptionsToPackage{hyphens}{url}
\PassOptionsToPackage{dvipsnames,svgnames*,x11names*,table}{xcolor}
%
\documentclass[a4paper,,tablecaptionabove]{scrartcl}
\usepackage{lmodern}
\usepackage{amssymb,amsmath}
\usepackage{ifxetex,ifluatex}
\usepackage{fixltx2e} % provides \textsubscript
\ifnum 0\ifxetex 1\fi\ifluatex 1\fi=0 % if pdftex
  \usepackage[T1]{fontenc}
  \usepackage[utf8]{inputenc}
  \usepackage{textcomp} % provides euro and other symbols
\else % if luatex or xelatex
  \usepackage{unicode-math}
  \defaultfontfeatures{Ligatures=TeX,Scale=MatchLowercase}
\fi
% use upquote if available, for straight quotes in verbatim environments
\IfFileExists{upquote.sty}{\usepackage{upquote}}{}
% use microtype if available
\IfFileExists{microtype.sty}{%
\usepackage[]{microtype}
\UseMicrotypeSet[protrusion]{basicmath} % disable protrusion for tt fonts
}{}
\IfFileExists{parskip.sty}{%
\usepackage{parskip}
}{% else
\setlength{\parindent}{0pt}
\setlength{\parskip}{6pt plus 2pt minus 1pt}
}
\usepackage{xcolor}
\definecolor{default-citecolor}{HTML}{4077C0}
\definecolor{default-urlcolor}{HTML}{4077C0}
\usepackage{hyperref}
\hypersetup{
            pdftitle={Example Exam Report},
            pdfauthor={David Lassig},
            pdfsubject={Pentesting},
            pdfkeywords={lab},
            colorlinks=true,
            linkcolor=Maroon,
            citecolor=default-citecolor,
            urlcolor=cyan,
            breaklinks=true}
\urlstyle{same}  % don't use monospace font for urls
\usepackage[margin=2.5cm,includehead=true,includefoot=true,centering]{geometry}


\usepackage{longtable,booktabs}
% Fix footnotes in tables (requires footnote package)
\IfFileExists{footnote.sty}{\usepackage{footnote}\makesavenoteenv{longtable}}{}
\setlength{\emergencystretch}{3em}  % prevent overfull lines
\providecommand{\tightlist}{%
  \setlength{\itemsep}{0pt}\setlength{\parskip}{0pt}}
\setcounter{secnumdepth}{0}
% Redefines (sub)paragraphs to behave more like sections
\ifx\paragraph\undefined\else
\let\oldparagraph\paragraph
\renewcommand{\paragraph}[1]{\oldparagraph{#1}\mbox{}}
\fi
\ifx\subparagraph\undefined\else
\let\oldsubparagraph\subparagraph
\renewcommand{\subparagraph}[1]{\oldsubparagraph{#1}\mbox{}}
\fi

% Make use of float-package and set default placement for figures to H
\usepackage{float}
\floatplacement{figure}{H}

\usepackage{minted}
\usepackage{xcolor}
\definecolor{bg}{rgb}{0.95,0.95,0.95}
\definecolor{lin}{rgb}{0.67, 0.88, 0.69}
\definecolor{win}{rgb}{0.6, 0.73, 0.89}
\definecolor{met}{rgb}{0.93,0.79,0.69}
\definecolor{att}{rgb}{0.0,1.0,0.0}
\definecolor{vic}{rgb}{0.8,0.0,0.0}

\title{Example Exam Report}
\providecommand{\subtitle}[1]{}
\subtitle{email:d.lassig@t-online.de}
\author{David Lassig}
\date{2018-05-26}





%%
%% added
%%

%
% No language specified? take American English.
%

\ifnum 0\ifxetex 1\fi\ifluatex 1\fi=0 % if pdftex
  \usepackage[shorthands=off,main=english]{babel}
\else
    % See issue https://github.com/reutenauer/polyglossia/issues/127
  \renewcommand*\familydefault{\sfdefault}
    % load polyglossia as late as possible as it *could* call bidi if RTL lang (e.g. Hebrew or Arabic)
  \usepackage{polyglossia}
  \setmainlanguage[]{english}
\fi


%
% colors
%

%
% listing colors
%

\definecolor{sbase03}{HTML}{002B36}
\definecolor{sbase02}{HTML}{073642}
\definecolor{sbase01}{HTML}{586E75}
\definecolor{sbase00}{HTML}{657B83}
\definecolor{sbase0}{HTML}{839496}
\definecolor{sbase1}{HTML}{93A1A1}
\definecolor{sbase2}{HTML}{EEE8D5}
\definecolor{sbase3}{HTML}{FDF6E3}
\definecolor{syellow}{HTML}{B58900}
\definecolor{sorange}{HTML}{CB4B16}
\definecolor{sred}{HTML}{DC322F}
\definecolor{smagenta}{HTML}{D33682}
\definecolor{sviolet}{HTML}{6C71C4}
\definecolor{sblue}{HTML}{268BD2}
\definecolor{scyan}{HTML}{2AA198}
\definecolor{sgreen}{HTML}{859900}
\definecolor{bash-background}{HTML}{000000}
\definecolor{bash-text-color}{HTML}{FFFFFF}
\definecolor{listing-background}{HTML}{F7F7F7}
\definecolor{listing-rule}{HTML}{B3B2B3}
\definecolor{listing-numbers}{HTML}{B3B2B3}
\definecolor{listing-text-color}{HTML}{000000}
\definecolor{listing-keyword}{HTML}{435489}
\definecolor{listing-identifier}{HTML}{435489}
\definecolor{listing-string}{HTML}{00999A}
\definecolor{listing-comment}{HTML}{8E8E8E}
\definecolor{listing-javadoc-comment}{HTML}{006CA9}



\definecolor{listing-background}{HTML}{F7F7F7}
\definecolor{listing-rule}{HTML}{B3B2B3}
\definecolor{listing-numbers}{HTML}{B3B2B3}
\definecolor{listing-text-color}{HTML}{000000}
\definecolor{listing-keyword}{HTML}{435489}
\definecolor{listing-identifier}{HTML}{435489}
\definecolor{listing-string}{HTML}{00999A}
\definecolor{listing-comment}{HTML}{8E8E8E}
\definecolor{listing-javadoc-comment}{HTML}{006CA9}

%\definecolor{listing-background}{rgb}{0.97,0.97,0.97}
%\definecolor{listing-rule}{HTML}{B3B2B3}
%\definecolor{listing-numbers}{HTML}{B3B2B3}
%\definecolor{listing-text-color}{HTML}{000000}
%\definecolor{listing-keyword}{HTML}{D8006B}
%\definecolor{listing-identifier}{HTML}{000000}
%\definecolor{listing-string}{HTML}{006CA9}
%\definecolor{listing-comment}{rgb}{0.25,0.5,0.35}
%\definecolor{listing-javadoc-comment}{HTML}{006CA9}

%
% for the background color of the title page
%
\usepackage{pagecolor}
\usepackage{afterpage}

%
% TOC depth and 
% section numbering depth
%
\setcounter{tocdepth}{3}

%
% line spacing
%
\usepackage{setspace}
\setstretch{1.2}

%
% break urls
%
\PassOptionsToPackage{hyphens}{url}

%
% When using babel or polyglossia with biblatex, loading csquotes is recommended 
% to ensure that quoted texts are typeset according to the rules of your main language.
%
\usepackage{csquotes}

%
% captions
%
\definecolor{caption-color}{HTML}{777777}
\usepackage[font={stretch=1.2}, textfont={color=caption-color}, position=top, skip=4mm, labelfont=bf, singlelinecheck=false, justification=raggedright]{caption}
\setcapindent{0em}
\captionsetup[longtable]{position=above}

%
% blockquote
%
\definecolor{blockquote-border}{RGB}{221,221,221}
\definecolor{blockquote-text}{RGB}{119,119,119}
\usepackage{mdframed}
\newmdenv[rightline=false,bottomline=false,topline=false,linewidth=3pt,linecolor=blockquote-border,skipabove=\parskip]{customblockquote}
\renewenvironment{quote}{\begin{customblockquote}\list{}{\rightmargin=0em\leftmargin=0em}%
\item\relax\color{blockquote-text}\ignorespaces}{\unskip\unskip\endlist\end{customblockquote}}

%
% Source Sans Pro as the de­fault font fam­ily
% Source Code Pro for monospace text
%
% 'default' option sets the default 
% font family to Source Sans Pro, not \sfdefault.
%
\usepackage[default]{sourcesanspro}
\usepackage{sourcecodepro}

%
% heading color
%
\definecolor{heading-color}{RGB}{40,40,40}
\addtokomafont{section}{\color{heading-color}}
% When using the classes report, scrreprt, book, 
% scrbook or memoir, uncomment the following line.
%\addtokomafont{chapter}{\color{heading-color}}

%
% variables for title and author
%
\usepackage{titling}
\title{Example Exam Report}
\author{David Lassig}

%
% tables
%

\definecolor{table-row-color}{HTML}{F5F5F5}
\definecolor{table-rule-color}{HTML}{999999}

%\arrayrulecolor{black!40}
\arrayrulecolor{table-rule-color}     % color of \toprule, \midrule, \bottomrule
\setlength\heavyrulewidth{0.3ex}      % thickness of \toprule, \bottomrule
\renewcommand{\arraystretch}{1.3}     % spacing (padding)
\rowcolors{3}{}{table-row-color!100}  % row color

% Reset rownum counter so that each table
% starts with the same row colors.
% https://tex.stackexchange.com/questions/170637/restarting-rowcolors
\let\oldlongtable\longtable
\let\endoldlongtable\endlongtable
\renewenvironment{longtable}{\oldlongtable} {
\endoldlongtable
\global\rownum=0\relax}

% Unfortunately the colored cells extend beyond the edge of the 
% table because pandoc uses @-expressions (@{}) like so: 
%
% \begin{longtable}[]{@{}ll@{}}
% \end{longtable}
%
% https://en.wikibooks.org/wiki/LaTeX/Tables#.40-expressions

%
% remove paragraph indention
%
\setlength{\parindent}{0pt}
\setlength{\parskip}{6pt plus 2pt minus 1pt}
\setlength{\emergencystretch}{3em}  % prevent overfull lines

%
%
% Listings
%
%


%
% header and footer
%
\usepackage{fancyhdr}
\pagestyle{fancy}
\fancyhead{}
\fancyfoot{}
\lhead{Example Exam Report}
\chead{}
\rhead{2018-05-26}
%\lfoot{David Lassig}
\cfoot{\leftmark}
\rfoot{\thepage}
\renewcommand{\headrulewidth}{0.4pt}
\renewcommand{\footrulewidth}{0.4pt}

%%
%% end added
%%

\begin{document}

%%
%% begin titlepage
%%

\begin{titlepage}
\newgeometry{left=6cm}
\newcommand{\colorRule}[3][black]{\textcolor[HTML]{#1}{\rule{#2}{#3}}}
\begin{flushleft}
\noindent
\\[-1em]
\color[HTML]{5F5F5F}
\makebox[0pt][l]{\colorRule[435488]{1.3\textwidth}{4pt}}
\par
\noindent

{ \setstretch{1.4}
\vfill
\noindent {\huge \textbf{\textsf{Example Exam Report}}}
\vskip 1em
{\Large \textsf{email:d.lassig@t-online.de}}
\vskip 2em
\noindent
{\Large \textsf{\MakeUppercase{David Lassig}}
\vfill
}

\textsf{2018-05-26}}
\end{flushleft}
\end{titlepage}
\restoregeometry

%%
%% end titlepage
%%


{
\hypersetup{linkcolor=}
\setcounter{tocdepth}{3}
\tableofcontents
}
\hypertarget{introduction}{%
\subsection{Introduction}\label{introduction}}

This reports holds all achievements and findings Pentester David was
able of to find during the assessment for the EvilCorp Network. I was
confronted with the exploit of multiple machines.

\hypertarget{objective}{%
\subsection{Objective}\label{objective}}

The objective of this assessment is to perform an internal penetration
test against the EvilCorp network. The Pentester is tasked with
following methodical approach in obtaining access to the objective
goals.

\begin{minted}[breaklines=true, bgcolor=bg, fontsize=\footnotesize]{text}
A) Target IP: 192.168.100.1
--------------------------------------

Main Objectives:
- Get shell on machine
- Obtain Account of Domain Controller

B) Target IP: 192.168.100.2
--------------------------------------

Main Objectives:
- Get root shell access to machine
- Dump full Database
\end{minted}

\hypertarget{report-high-level-summary}{%
\section{Report: High-Level Summary}\label{report-high-level-summary}}

David Lassig was tasked with performing an internal penetration test
towards EvilCorp Network. An internal penetration test is a dedicated
attack against internally connected systems. The focus of this test is
to perform attacks, similar to those of a hacker and attempt to
infiltrate EvilCorps internal netowrk. My overall objective was to
evaluate the network, identify systems, and exploit flaws while
reporting the findings back to EvilCorp.

When performing the internal penetration test, there were several
alarming vulnerabilities that were identified on EvilCorps network. When
performing the attacks, I was able to gain access to multiple machines,
primarily due to outdated patches and poor security configurations.
During the testing, I had administrative level access to multiple
systems. All systems were successfully exploited and access granted.
These systems as well as a brief description on how access was obtained
are listed below:

\begin{itemize}
\tightlist
\item
  \textbf{Objective A)} - Got into 192.168.100.1 Windows Machine through
  outdated FTP Server.
\item
  \textbf{Objective B)} - Got in 192.168.100.2 through misconfigured
  Apache Web Server.
\end{itemize}

\hypertarget{report-recommendations}{%
\section{Report: Recommendations}\label{report-recommendations}}

I recommend patching the vulnerabilities identified during the testing
to ensure that an attacker cannot exploit these systems in the future.
One thing to remember is that these systems require frequent patching
and once patched, should remain on a regular patch program to protect
additional vulnerabilities that are discovered at a later date.

Especially for the windows machines it should be avoided to use such old
software versions (Windows Server 2003). The effort to patch these
systems are much higher than migrate to newer windows machines.

\hypertarget{report-methodologies}{%
\section{Report: Methodologies}\label{report-methodologies}}

\hypertarget{procedure-of-pentesting}{%
\subsection{Procedure of Pentesting}\label{procedure-of-pentesting}}

I use tmux for getting a organised step-by-step pentesting environment.
I have tmux multiple windows in my session. Every window holds only
panes for specific tasks. Every of this named window hold multiple panes
to do multiple tasks at the same time.

\hypertarget{report-format}{%
\subsubsection{Report Format}\label{report-format}}

I use Pandoc with a Latex template to generate my report. This gives me
great flexibility. For terminal outputs, code and config files I use
several color schemes for giving a quick classification. Hence we're
working on multiple machines the same time this should give the reader a
better understanding.

\hypertarget{attacker-machine-linux-prompt}{%
\paragraph{Attacker Machine Linux
Prompt}\label{attacker-machine-linux-prompt}}

\begin{minted}[bgcolor=lin, breaklines=true, fontsize=\footnotesize, framesep=2mm, frame=single, rulecolor=att]{bash}
root@kali:~#
\end{minted}

\hypertarget{attacker-metasploit-prompt}{%
\paragraph{Attacker Metasploit
Prompt}\label{attacker-metasploit-prompt}}

\begin{minted}[bgcolor=met, breaklines=true, fontsize=\footnotesize, framesep=2mm, frame=single, rulecolor=att]{text}
msf >
\end{minted}

\hypertarget{attacker-machine-windows-prompt}{%
\paragraph{Attacker Machine Windows
Prompt}\label{attacker-machine-windows-prompt}}

\begin{minted}[bgcolor=win, breaklines=true, fontsize=\footnotesize, framesep=2mm, frame=single, rulecolor=att]{text}
C:\Users\ADMINI~1\Desktop\Tools>
\end{minted}

\hypertarget{victim-machine-linux-prompt}{%
\paragraph{Victim Machine Linux
Prompt}\label{victim-machine-linux-prompt}}

\begin{minted}[bgcolor=lin, breaklines=true, fontsize=\footnotesize, framesep=2mm, frame=single, rulecolor=vic]{text}
admin@victimlinux:~$
\end{minted}

\hypertarget{victim-machine-windows-prompt}{%
\paragraph{Victim Machine Windows
Prompt}\label{victim-machine-windows-prompt}}

\begin{minted}[bgcolor=win, breaklines=true, fontsize=\footnotesize, framesep=2mm, frame=single, rulecolor=vic]{text}
C:\Program Files\>
\end{minted}

\hypertarget{report-information-gathering}{%
\section{Report: Information
Gathering}\label{report-information-gathering}}

During this penetration test, I was tasked with exploiting the EvilCorp
network. The specific IP addresses were:

\hypertarget{internal-network}{%
\subsection{Internal Network}\label{internal-network}}

\hypertarget{internal-local-subnet-192.168.100.024}{%
\paragraph{Internal Local Subnet
192.168.100.0/24}\label{internal-local-subnet-192.168.100.024}}

\begin{itemize}
\tightlist
\item
  192.168.100.1
\item
  192.168.100.2
\item
  \ldots{}
\end{itemize}

\hypertarget{report-service-enumeration-summary}{%
\section{Report: Service Enumeration
Summary}\label{report-service-enumeration-summary}}

As it's very repetitive I will step over the first step of enumeration
in the individual machine description. I did on every machine the same:

\begin{minted}[breaklines=true, bgcolor=lin, fontsize=\footnotesize, framesep=6mm, frame=single, rulecolor=att]{text}
root@kali:~/exam# nmap -Pn -p- -vv <objective-ip> | tee nmap_<objective-ip>.txt
root@kali:~/exam# nmap -Pn sU -p- -vv <objective-ip> | tee nmap_<objective-ip>_udp.txt
\end{minted}

I will step into more detailed enumeration by filtering these outputs.

\begin{longtable}[]{@{}lll@{}}
\toprule
Host & Ports & Suspicious\tabularnewline
\midrule
\endhead
192.168.100.1 & 21 & Windows FTP Server 5.0\tabularnewline
& 143 & Netbios\tabularnewline
& 139 &\tabularnewline
& 445 &\tabularnewline
192.168.100.2 & 80 & Apache2 Webserver 2.3\tabularnewline
& 8080 & webdav\tabularnewline
\bottomrule
\end{longtable}

\hypertarget{report-machine-penetration}{%
\section{Report: Machine Penetration}\label{report-machine-penetration}}

\hypertarget{section}{%
\subsection{192.168.28.161}\label{section}}

\begin{longtable}[]{@{}ll@{}}
\toprule
\endhead
OS & Windows Server 2013\tabularnewline
Network Name & dc.evilcorp.local\tabularnewline
Access Exploit & Outdated Windows FTP Server\tabularnewline
\bottomrule
\end{longtable}

\hypertarget{information-gathering}{%
\subsubsection{Information Gathering}\label{information-gathering}}

Lorem Ipsum

\hypertarget{service-enumeration}{%
\subsubsection{Service Enumeration}\label{service-enumeration}}

Lorem Ipsum

\hypertarget{nmap}{%
\paragraph{nmap}\label{nmap}}

Lorem Ipsum

\hypertarget{ftp}{%
\paragraph{FTP}\label{ftp}}

Lorem Ipsum

\hypertarget{exploiting---getting-access}{%
\subsubsection{Exploiting - Getting
Access}\label{exploiting---getting-access}}

Lorem Ipsum

\hypertarget{post-exploitation}{%
\subsubsection{Post Exploitation}\label{post-exploitation}}

Lorem Ipsum

\hypertarget{section-1}{%
\subsection{192.168.100.2}\label{section-1}}

\begin{longtable}[]{@{}ll@{}}
\toprule
\endhead
OS & Linux Debian 5\tabularnewline
Network Name & database.evilcorp.local\tabularnewline
Access Exploit & RCE and LFI on Apache Web Server\tabularnewline
Local Privilege Escalation & DirtyCow Exploit\tabularnewline
\bottomrule
\end{longtable}

\hypertarget{information-gathering-1}{%
\subsubsection{Information Gathering}\label{information-gathering-1}}

Lorem Ipsum

\hypertarget{service-enumeration-1}{%
\subsubsection{Service Enumeration}\label{service-enumeration-1}}

Lorem Ipsum

\hypertarget{nmap-1}{%
\paragraph{nmap}\label{nmap-1}}

Lorem Ipsum

\hypertarget{nikto}{%
\paragraph{nikto}\label{nikto}}

Lorem Ipsum

\hypertarget{exploiting---getting-access-1}{%
\subsubsection{Exploiting - Getting
Access}\label{exploiting---getting-access-1}}

Lorem Ipsum

\hypertarget{internal-information-gathering}{%
\subsubsection{Internal Information
Gathering}\label{internal-information-gathering}}

Lorem Ipsum

\hypertarget{download-interesting-files}{%
\paragraph{Download interesting
files}\label{download-interesting-files}}

Lorem Ipsum

\hypertarget{open-command-shell}{%
\paragraph{Open command shell}\label{open-command-shell}}

Lorem Ipsum

\hypertarget{file-transfer}{%
\paragraph{File Transfer}\label{file-transfer}}

Lorem Ipsum

\hypertarget{network-connections}{%
\paragraph{Network Connections}\label{network-connections}}

Lorem Ipsum

\hypertarget{services}{%
\paragraph{Services}\label{services}}

Lorem Ipsum

\hypertarget{exploiting---local-privilege-escalation}{%
\subsubsection{Exploiting - Local Privilege
Escalation}\label{exploiting---local-privilege-escalation}}

Lorem Ipsum

\hypertarget{post-exploitation-1}{%
\subsubsection{Post Exploitation}\label{post-exploitation-1}}

Lorem Ipsum

\end{document}