Failed a Pentest...Stake in the Ground

I've been with the company a little over a month and a half.  I've run numerous gap analysis, and I know where we are deficient.  And some of it is  not good.  I've compared ourselves to the SANS Top 20, and again, it's not good.  Management wanted an internal pentest, to get a feel for the security posture.  We in IT wanted a good boutique pentesting company, but we were told to use the company that already audits the finance department.  Fortunately, these guys were good.

We failed the pentest, miserable.  Most of my guesses as to how it would happen came to pass.  And I'm ok with that.  Heck, they had domain admin in about a day.  There were some good surprises, and there were some good wins.  I'm good with it; as it confirmed most of what I have been raising to management for the past year.  The hope is that management will open their eyes and start making changes.

So mentally, I've put a stake in the ground.  I want to see how long it takes for any real change to take place.  I'm waiting to see when management starts mandating change in the form of implementation of controls in order to raise the security posture of the company.  Or, is management just checking a box that an audit was performed.

I'll update as controls start being implemented.

P.S.: I have to say, as a former auditor, it was interesting to experience the audit from the other side of the fence.  I was able to understand what the auditors were looking for and better able to answer their questions since I had been in their shoes.

Finding Inactive Accounts

The SANS Top 20 Controls has a control named Account Monitoring and Control.  Within that control is a Quick Win:  Ensure that systems automatically create a report on a daily basis that includes a list of locked-out accounts, disabled accounts, accounts with passwords that exceed the maximum password age, and accounts with passwords that never expire. This list should be sent to the associated system administrator in a secure fashion.

We don't have an automated report of those types of accounts, and quite frankly, we have very poor visibility into account control.  Coming from a DoD environment, I'm not used to having such lax controls.  Slowly, I'm starting to push the company forward, but it is taking time.

My first thought was to look at the inactive accounts.  I figured that these accounts would be low enough of the low-hanging fruit to start with, and here's how I have gone about finding them.

(Note: that I have created a master script that will do more than what this post details...I'm only describing inactive accounts at this time.)

1.  This command is in a batch file:  dsquery user -inactive 4 -limit 3000 > accountout.txt

Call the output file what you like.  The -inactive 4 parameter tells dsquery to look for accounts that have been inactive for at least four weeks.  I picked four to start with, as I realize that we have users that travel extensively.  My hope is that once we manage the output, I'll be able to lower that number.

2.  I took the output of the file, and copied it to Excel.  From there, I went to Data>Text-to-Columns in order to break up the data nicely.

3.  Column 2 seemed to be where I could differentiate between user and non-user accounts.  I filtered on just user accounts and copied that to a new sheet.

My results were staggering.  There are way too many accounts.  My next step is to find or create a process to validate that these accounts are a) legitimate, and b) truly inactive.  Spot checking a bunch of these users revealed users that are contractors.  And, if I have to guess, they are no longer with the company.  Prime targets to attack - which is why they should be disabled or deleted.

Once that's done, I'll need to automate the process and schedule it to run weekly or so.  As for locked-out, disabled, and password length checking...those will be added in time.

Scripting the retrieval of the warning banner (legal notice) when pushed by Group Policy

As an auditor, one of the controls I constantly come up against is ECWM-1, which states:

All users are warned that they are entering a Government information system, and are
provided with appropriate privacy and security notices to include statements informing
them that they are subject to monitoring, recording and auditing.

All workstations, servers, applications, networking gear, and other hosts must have a specific banner.  (I'm aware of exceptions, but I'm discussing that first-line of defense to an asset, the warning banner.)  Gold Disk, in its latest incarnation does not appear to actively check for the banner; in the tests that I have run, it marks the check as NR and must be manually reviewed.  Doing this for a machine or two is not bad.  However, many times I am working an enterprise system where there man be many servers and hundreds of workstations.  To solve that issue I wrap up many tools (including Gold Disk and Oval) in a a script in order to deploy the script and collect the results automagically.  Usually, I'll set up a share on a server where all servers and workstations can automatically dump their results.

So, there is the question of how to look at all of those warning banners.  Or, at least, how to look at a representational sample.  There are many references on how to set a warning banner on a local host.  The text you want to display as a banner gets added to the following key:
hklm\software\microsoft\windows nt\current version\winlogon and the key is LegalNoticeText

However, in these enterprise systems and enclaves, the warning banner is almost always pushed down to the workstation by Group Policy.  That key is:  hklm\software\microsoft\Windows\CurrentVersion\Policies\system and the key is LegalNoticeText.

To script this out, I do:
objShell.Run "cmd /c reg query ""hklm\software\microsoft\Windows\CurrentVersion\Policies\system"" /v LegalNoticeText >" legalnotice.txt

Now, I have a copy of the warning banner which I can inspect for compliance later on.

Enabling Retina to connect to a target remediated by Gold Disk

This past week, I worked with a large team to audit a very large and complex system.  The Information Assurance Manager at the site explained to us how he audited the system.  He would run Gold Disk on the machine, remediate, open a few holes, then run Retina against the target.  He then closed the holes so Gold Disk would not report the errors.  However, this presented a problem for my team and I as we could not get Retina to connect properly and report on any findings.  Here's what we did in order to open up the machines such that Retina could connect and properly scan the target:

• Navigate to HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
• add a key:  autoshareservices, REG_DWORD, and make the value 1.
• Go to Start, Run, and type Services.msc
• Restart the Server service
• Start, or restart the Remote Registry service

Going through these simple steps enabled Retina to connect to the target and run a proper scan.

If there is a more simple solution, I would love to hear it.  Or, if I've botched this somehow, please correct me.

Auditing IIS 7

I want to thank the anonymous commenter on my previous post regarding IIS 7.  I was out testing this past week on a very long engagement when our team came across two IIS 7 servers.  After learning of the servers existence, I went to the Center for Internet Security's benchmark tools, and downloaded their IIS 7 Benchmark, which is at version 1.0.  (I would hard link to it, but you need to fill out a form first - and the link is wonky after filling out the form.)

I used the guide to go through the IIS servers, and I have to say it's pretty easy and straightforward.  Of course, the guide is not as in-depth as a typical DISA STIG/Checklist, but it covered much of the low hanging fruit.  The guide was easy to read, easy to follow, and even gave remediation advice.  I wholeheartedly recommend the guide for auditing IIS 7 servers until DISA puts out an official checklist.

Finding MS SQL servers that are listening

I learned a new trick today to find potentially listening MS SQL servers in a networked environment.  Currently, I have a process where I go through netstat results, gathered from the audited servers, looking for servers that have a MS SQL server listening.  However, a co-worker taught me a neat trick.  From a sql server, issue the following command from a command prompt:

osql -l

This will return a list of servers that are listening.  I know that you still have to check out the servers, but it is a good quick and dirty method of finding other SQL servers.  This has already proven helpful when the client is not the most forthcoming about how many SQL servers they have, or does not know all of the SQL servers on their network.

Auditing IIS 7 web servers - I'm looking for suggestions

DISA has said, via their FAQ, that the TIM for the IIS 7 STIG is not scheduled until March 1, 2011.  My question is, how do you audit IIS 7 installations?  I have seen that there are differences between IIS 6 and IIS 7 that preclude using the IIS 6 STIG on an IIS 7 server.  Any suggestions?

The circle is complete

"Army...Navy...Air Force...Marines.  What a great place, it's a greaaaat place, To Start!"

A funny scene from Stripes.

My first auditing trip was to a Marine installation.  After that, I worked on two large Army assignments.  When those projects finished I moved to a very long Air Force project encompassing many accreditations.  This week I travel to perform my first Navy audit.

I do not really have a favorite, or a branch that I do not like to work for.  Each branch has their own unique nuance and idiosyncrasies that make it a little different.

Auditing Exchange Server for vulnerabilities?

I have an engagement coming up where we'll have to audit some Exchange servers. Currently, the DISA Exchange checklist is in draft. Yes, we'll be running Gold Disk on the servers, and we'll be running Oval to check the patches. However, is there any other guidance for auditing Exchange?

As I find other options, I'll post them here. And of course, I'll write up our methodology after the trip.

Edit: NSA Exchange guide

Unfortunately, CIS doesn't have a tool for Exchange.