Practical Summary for Task 1(a):

1. Testbed Setup:

o Create a safe environment using virtual machines and sandbox tools like Cuckoo
Sandbox.

o Isolate the testbed from production networks to prevent malware spread.

2. Static Malware Analysis:

o File Identification: Determine the file type and extract metadata using tools like TrID or
ExifTool.

o Disassembly & Decompilation: Analyze the malware code using IDA Pro or Ghidra for
insights into its behavior.

o String & Code Analysis: Use strings or PEStudio to extract readable content and look for
suspicious functions.

o Entropy Calculation & Packer Detection: Detect packed or encrypted sections using
PEiD.

o Hash Calculation: Compute checksums (MD5, SHA-256) and compare with known
malware databases.

3. Dynamic Malware Analysis:

o Execution Environment: Run malware in an isolated VM or sandbox (Cuckoo) and

monitor behavior in real-time.

o Process & File System Monitoring: Use tools like Process Monitor and Sysinternals to
observe process creation and file modifications.

o API Call & Network Traffic Analysis: Monitor system API calls (API Monitor) and network
traffic (Wireshark) for malicious connections.

o Memory Analysis: Examine memory using Volatility to detect hidden processes and
injected code.

4. Conclusion:

o Combine static and dynamic analysis to understand malware structure and behavior
comprehensively.
Practical Gist of Task 2(a): Exploiting CVE-2019-20183

1. Malicious SMB Packet Crafting:

o Create malicious SMBv3 packets exploiting the compression flaw to trigger a buffer
overflow and execute arbitrary code.

2. File Extension Manipulation:

o Use disguised executable files (e.g., file.pdf.exe) to exploit the vulnerability by bypassing
file validation checks.

3. SMBv3 Network Traffic Manipulation:

o Perform Man-in-the-Middle (MITM) attacks to intercept and inject malicious packets

into legitimate SMBv3 traffic.

4. Reverse Shell Execution:

o Create and inject a payload to establish a reverse shell, giving the attacker remote
control over the system.

5. Memory Corruption Exploitation:

o Use memory corruption techniques to manipulate system memory and execute

arbitrary code through the buffer overflow.

6. Advanced Memory Corruption:

o Employ advanced techniques to bypass security defenses like DEP and ASLR, ensuring
reliable code execution.

Key Techniques:

• Buffer overflow exploitation, reverse shell payloads

• File extension manipulation, network traffic injection

• Memory corruption techniques, bypassing security defenses

Practical Gist of Task 2(b): Enumerating SNMP Service on Port 161

1. Initial Network Scanning:

o ICMP and TCP probes target port 161 to find devices running SNMP.

o Follow-up packet analysis identifies device types and services.

2. Port Scanning and SNMP Version Identification:

o Determine SNMP version (v1, v2c, v3) via crafted queries.

o Exploit weak community strings in v1 and v2c, while v3 requires sophisticated methods.

3. OID (Object Identifier) Querying:

o Query OIDs like sysDescr to gather system details (e.g., OS, device specs).

o Combine with MIB entries for deeper device information.

4. Community String Enumeration:

o Use brute-force or dictionary attacks to guess weak community strings like "public" or
"private."

o Combine with social engineering for better success.

5. Advanced SNMP Enumeration Techniques:

o OID fuzzing and packet injection uncover hidden data or bypass restrictions.

o Combine with packet sniffing for sensitive information like system configurations.

Key Information Gathered:

• Device configuration (interfaces, IPs)

• System details (OS version, hardware)

• Network traffic data

• Community strings enabling unauthorized system access

Practical Gist for Task 3(a): Identifying the FTP Server's Operating System

1. Banner Grabbing:

o Tool: Netcat, Telnet, FTP Clients (FileZilla, WinSCP)

o Method: Connect to the FTP server and capture the banner, which may contain OS
details (e.g., UNIX/Linux, Windows).

o Combination: Use FTP clients alongside Telnet connections for multiple layers of
information.

2. Nmap OS Detection:

o Tool: Nmap

o Method: Perform an OS scan using TCP/IP packets to trigger OS-specific response

signatures.

o Combination: Cross-reference Nmap results with banner details to improve accuracy.

3. Passive OS Fingerprinting:

o Tool: p0f, Xprobe2

o Method: Passively monitor network traffic and analyze packet metrics (e.g., TTL, TCP
window size) to deduce the OS.

o Combination: Use after active scanning to confirm findings stealthily.

4. Manual Inspection:

o Tool: FTP commands (e.g., SYST)

o Method: Review FTP responses and error messages to identify the OS.

o Combination: Verify findings from scans with manual analysis of system-specific

responses.

5. Service Enumeration:

o Tool: Nmap, service detection scripts

o Method: Identify other services (e.g., Apache, OpenSSH) running on the FTP server to
infer the OS.

o Combination: Cross-reference service information with common OS distributions.

6. Exploiting Vulnerabilities:

o Tool: Metasploit, custom exploits

o Method: Exploit known vulnerabilities in the FTP service to gain access and confirm the
OS.
 o Combination: Use after reconnaissance to verify findings through system-level access.

This layered approach combines active scans, passive fingerprinting, and manual verification for
comprehensive OS identification.

Practical Gist of Task 3(b): Packet Sniffing Penetration Testing on an FTP Server Using Wireshark

1. Preparing the Environment:

o Install Wireshark and enable promiscuous mode to capture all network packets.

2. Identifying the Target FTP Server:

o Use Nmap for network scanning and identifying the FTP server's IP address.

3. Capturing FTP Traffic:

o Apply a capture filter for port 21 in Wireshark and capture FTP traffic, focusing on login
attempts.

4. Analyzing Captured Traffic:

o Use Wireshark's "Follow TCP Stream" to inspect FTP login attempts and data transfers
for vulnerabilities.

5. Extracting and Reporting Findings:

o Extract plaintext credentials, sensitive data, and report the findings, recommending
protocols like SFTP for security.

6. Complementary Tools:

o Use tcpdump for packet capture, Ettercap for ARP poisoning, and dsniff for sniffing
credentials.

7. Identifying Vulnerabilities:

o Look for unencrypted credentials and misconfigurations, including default login.

Tools Used:

• Wireshark (main tool)

• Nmap (network scanning)

• tcpdump, Ettercap, dsniff (complementary tools)

Practical Gist of Task 4(a): Exploiting DLL Hijacking Vulnerability for Privilege Escalation on Windows 10

1. Identify Vulnerable DLL Loading Behavior:

o Use Process Monitor to detect DLLs loaded by "Patient App Service" and check for
administrative privileges.

2. Craft a Malicious DLL:

o Write a malicious DLL mimicking the legitimate one, embedding privilege escalation
commands or a reverse shell.

3. Replace Legitimate DLL:

o Place the malicious DLL in the app's directory, ensuring it has the same name and
properties to avoid detection.

4. Trigger the Vulnerability:

o Restart the app or use Task Scheduler to load the malicious DLL and execute the
embedded payload.

5. Exploit Elevated Privileges:

o Execute privilege escalation commands via the DLL, gaining admin rights, and
performing further attacks like disabling security.

6. Advanced Post-Exploitation:

o Maintain persistence and monitor network traffic for further attacks across the system
or network.

Key Tools and Techniques:

• Process Monitor, Task Scheduler

• DLL creation, reverse shell payloads

• Path manipulation, privilege escalation