> For the complete documentation index, see [llms.txt](https://robertos-notebook.gitbook.io/vuldarcourses/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://robertos-notebook.gitbook.io/vuldarcourses/ceh-content/practical-engagement-i.md). # Practical Engagement I Those are the steps that I took to complete the flag-hunting session, in the current module of the CEH v12 Practical Course. ### Flag 1 Perform vulnerability scanning for the webserver hosting movies.cehorg.com using OpenVAS and identify the severity level of RPC vulnerability. Pentesting > Vulnerability Analysis > Openvas – Greenbone > Start Greenbone Vulnerability Manager Service

You can see that the RPC vulnerability has a score of 5 A: 5 ### Flag 2 Perform vulnerability scanning for the Linux host in the 172.16.0.0/24 network using OpenVAS and find the number of vulnerabilities with severity level as medium. Linux IP: 172.16.0.11

A: 0 ### Flag 3 You are performing reconnaissance for CEHORG and has been assigned a task to find out the physical location of one of their webservers hosting [www.certifiedhacker.com](http://www.certifiedhacker.com). What are the GEO Coordinates of the webserver? Note: Provide answer as Latitude, Longitude. Go to: A: 37.751, -97.822 ### Flag 4 Identify if the website [www.certifiedhacker.com](http://www.certifiedhacker.com) allows DNS zone transfer. (Yes/No) {% code title="Parrot Terminal" %} ```bash cd dnsrecon chmod +x ./dnsrecon.py ./dnsrecon.py -d {target} ``` {% endcode %}

From module 02, Lab 7, Task 2. dnsrecon.py

A: No ### Flag 5 Identify the number of live machines in 172.16.0.0/24 subnet. {% code title="Parrot Terminal" %} ```bash nmap -sP 172.16.0.0/24 ``` {% endcode %} Try: nmap -sP 172.16.0.0/24

Here you are scanning even nodes, so to avoid “additional hosts” let’s try another scan option. {% code title="Parrot Terminal" %} ```bash nmap -sP -PS22 172.16.0.0/24 ``` {% endcode %}

{% code title="Parrot Terminal" %} ```bash nmap -PU 172.16.0.0/24 ``` {% endcode %} A: 3 ### Flag 6 While performing a security assessment against the CEHORG network, you came to know that one machine in the network is running OpenSSH and is vulnerable. Identify the version of the OpenSSH running on the machine. Note: Target network 192.168.0.0/24. {% code title="Parrot Terminal" %} ```bash nmap -sV -p 22 --script vuln 192.168.0.0/24 ``` {% endcode %}

You can add **–open** at the end of the command

A: 8.9p1 ### Flag 7 During a security assessment, it was found that a server was hosting a website that was susceptible to blind SQL injection attacks. Further investigation revealed that the underlying database management system of the site was MySQL. Determine the machine OS that hosted the database. {% code title="Parrot Terminal" %} ```bash nmap -T4 -A cehorg.com ``` {% endcode %}

Port 22 shows the detail, you can use -O too

A: Ubuntu ### Flag 8 Find the IP address of the Domain Controller machine. INFO: Domain controllers will show port 389 running the Microsoft Windows AD LDAP service {% code title="Parrot Terminal" %} ```bash nmap -T4 -A movies.cehorg.com ``` {% endcode %}

Just to get some information, now let’s scan another batch of IPs {% code title="Parrot Terminal" %} ```bash nmap -p389 -sV 10.10.10.0/24 --open ``` {% endcode %}

A 10.10.10.25 ### Flag 9 Perform a host discovery scanning and identify the NetBIOS name of the host at 10.10.10.25. {% code title="Parrot Terminal" %} ```bash nmap -sV --script nbstat.nse 10.10.10.25 nmap -T4 -A 10.10.10.25 ``` {% endcode %}

A: ADMINDEPT ### Flag 10 Find the IP address of the machine which has port 21 open. Note: Target network 172.16.0.0/24 {% code title="Parrot Terminal" %} ```bash nmap -p21 -sV 172.16.0.0/24 ``` {% endcode %}

You can try: **nmap -p21 -sV 172.16.0.0/24 --open** A: 172.16.0.12 ### Flag 11 Perform an intense scan on 10.10.10.25 and find out the FQDN of the machine in the network. {% code title="Parrot Terminal" %} ```bash nmap -T4 -A 10.10.10.25 ``` {% endcode %}

A: AdminDept.CEHORG.com ### Flag 12 What is the DNS Computer Name of the Domain Controller?

Google search, are the same from the previous question

A: AdminDept.CEHORG.com ### Flag 13 Perform LDAP enumeration on the target network and find out how many user accounts are associated with the domain. For LDAP Enumeration I suggest to use [ldapsearch](https://vk9-sec.com/enumerating-ad-users-with-ldap/), is a lot more comfortable than the search through nmap or the python script suggested by the documentation. {% code title="Parrot Terminal" %} ```bash nmap -p 389 --script ldap-brute --script-args ldap.base=’”cn=AdminDept,dc=CEHORG,dc=com”’ 10.10.10.25 ``` {% endcode %}

{% code title="Parrot Terminal" %} ```bash ldapsearch -x -h 10.10.10.25 -b “dc=CEHORG,dc=com” “objectclass=user” ``` {% endcode %}

ldapsearch’s output, does not show users

{% code title="Parrot Terminal" %} ```bash ldapsearch -x -h 10.10.10.25 -b “dc=CEHORG,dc=com” “objectclass=user” cn=user ``` {% endcode %} A: 8 ### Flag 14 Perform an LDAP Search on the Domain Controller machine and find out the version of the LDAP protocol. The following command **ldapsearch -x -h 10.10.10.25 -b “dc=CEHORG,dc=com” “objectclass=user”** shows the LDAP’s protocol version too, but in this flag I will shows the step by using the Python Script {% code title="Parrot Terminal" %} ```bash python3 ``` {% endcode %} {% code title="Python" %} ```python import ldap3 server=ldap3.Server('10.10.10.25', get_info=ldap3.ALL, port=389 connection=ldap3.Connection(server) connection.bind() server.info ``` {% endcode %}

server.info’s output, always use the highest supported version

{% code title="Python" %} ```python connection.search(search_base=’DC=CEHORG,DC=com’,search_filter='(&(objectclass=*))’,search_scope=’SUBTREE’, attributes=’*’) connection.entries connection.search(search_base=’DC=CEHORG,DC=com’,search_filter='(&(objectclass=person))’,search_scope=’SUBTREE’, attributes=’userpassword’) connection.entries ``` {% endcode %}

A: LDAPv3 ### Flag 15 What is the IP address of the machine that has NFS service enabled? Note: Target network 192.168.0.0/24. Remember: NFS Service port = 2049 {% code title="Parrot Terminal" %} ```bash nmap -p 2049 192.168.0.0/24 ``` {% endcode %}

{% code title="Parrot Terminal" %} ```bash nmap -p 2049 192.168.0.0/24 --open ``` {% endcode %}

A: 192.168.0.51 ### Flag 16 Perform a DNS enumeration on [www.certifiedhacker.com](http://www.certifiedhacker.com) and find out the name servers used by the domain. {% code title="Parrot Terminal" %} ```bash nmap --script=broadcast-dns-service-discovery www.certifiedhacker.com ``` {% endcode %}

First I tried to use nmap, but it was now precise and did not shows the answer, so I decided to use another command. {% code title="Parrot Terminal" %} ```bash dig ns www.certifiedhacker.com ``` {% endcode %} * Try: dig ns [www.certifiedhacker.com](http://www.certifiedhacker.com/)

dig ns’s output, check on ANSWER SECTION

A: ns1.bluehost.com, ns2.bluehost.com ### Flag 17 Find the IP address of the machine running SMTP service on the 192.168.0.0/24 network. Remember: SMTP Service port is 25 {% code title="Parrot Terminal" %} ```bash nmap -p 25 --script=smtp-enum-users 192.168.0.0/24 --open ``` {% endcode %}

{% code title="Parrot Terminal" %} ```bash nmap -p 25 192.168.0.0/24 --open ``` {% endcode %}

A: 192.168.0.51 ### Flag 18 Perform an SMB Enumeration on 192.168.0.51 and check whether the Message signing feature is enabled or disabled. Give your response as Yes/No. SMB Port: 445 {% code title="Parrot Terminal" %} ```bash nmap -p 445 -A 192.168.0.51 ``` {% endcode %}

A: Yes ### Flag 19 Perform vulnerability scanning for the domain controller using OpenVAS and identify the number of vulnerabilities with severity level as “medium”. Using Greenbone, scan the IP 10.10.10.25 and watch the result

A: 2 ### Flag 20 Perform a vulnerability research on CVE-2022-30171 and find out the base score and impact of the vulnerability. Google: CVE-2022-30171 {% embed url="" %} A: 5.5 Medium