+ {/* TODO: Replace 01/02/2017 21:45, 23:12 with data */} + The monkey run was started on 01/02/2017 21:45. After 23:12 minutes, all monkeys finished propagation attempts. +
++ From the attacker's point of view, the network looks like this: +
++ A full report of the Monkeys activities follows. +
++ {/* TODO: Replace 6,2 with data */} + During the current run, the Monkey discovered 6 machines and successfully breached 2 of them. + In addition, it attempted to exploit the rest, any security software installed in the network should have picked up the attack attempts and logged them. +
+ +
+ The machine Monkey-SMB with the following IP addresses 192.168.0.1 10.0.0.18 was vulnerable to a SMB attack.
+
+ The attack succeeded by authenticating over SMB protocol with user Administrator and its password.
+
+ The machine Monkey-SMB2 with the following IP address 192.168.0.2 was vulnerable to a SMB attack.
+
+ The attack succeeded by using a pass-the-hash attack over SMB protocol with user temp.
+
+ The machine Monkey-WMI with the following IP address 192.168.0.3 was vulnerable to a WMI attack.
+
+ The attack succeeded by authenticating over WMI protocol with user Administrator and its password.
+
+ The machine Monkey-WMI2 with the following IP address 192.168.0.4 was vulnerable to a WMI attack.
+
+ The attack succeeded by using a pass-the-hash attack over WMI protocol with user Administrator.
+
+ The machine Monkey-SSH with the following IP address 192.168.0.5 was vulnerable to a SSH attack.
+
+ The attack succeeded by authenticating over SSH protocol with user user and its password.
+
+ The machine Monkey-RDP with the following IP address 192.168.0.6 was vulnerable to a RDP attack.
+
+ The attack succeeded by authenticating over RDP protocol with user Administrator and its password.
+
+ The machine Monkey-SambaCry with the following IP address 192.168.0.7 was vulnerable to a SambaCry attack.
+
+ The attack succeeded by authenticating over SMB protocol with user user and its password, and by using the SambaCry vulnerability.
+
+ The machine Monkey-Elastic with the following IP address 192.168.0.8 was vulnerable to an Elastic Groovy attack.
+
+ The attack succeeded because the Elastic Search server was not parched against the CVE-2015-1427 bug.
+
+ The machine Monkey-Shellshock with the following IP address 192.168.0.9 was vulnerable to a ShellShock attack.
+
+ The attack succeeded because the HTTP server running on port 8080 was vulnerable to a shell injection attack on the paths: /cgi/backserver.cgi /cgi/login.cgi.
+
+ The machine Monkey-Conficker with the following IP address 192.168.0.10 was vulnerable to a Conficker attack.
+
+ The attack succeeded because the target machine uses an outdated and unpatched operating system.
+
+ The network can probably be segmented. A monkey instance on Monkey-SMB in the 192.168.0.0/24 network could directly access the Monkey Island C&C server in the 172.168.0.0/24 network. +
++ The network can probably be segmented. A monkey instance on Monkey-SSH in the 192.168.0.0/24 network could directly access the Monkey Island C&C server in the 172.168.0.0/24 network. +
++ Machines are not locked down at port level. Network tunnel was set up from Monkey-SSH to Monkey-SambaCry. +
+- {/* TODO: Replace 01/02/2017 21:45, 23:12 with data */} - The monkey run was started on 01/02/2017 21:45. After 23:12 minutes, all monkeys finished propagation attempts. -
-- From the attacker's point of view, the network looks like this: -
-- A full report of the Monkeys activities follows. -
-- {/* TODO: Replace 6,2 with data */} - During the current run, the Monkey discovered 6 machines and successfully breached 2 of them. - In addition, it attempted to exploit the rest, any security software installed in the network should have picked up the attack attempts and logged them. -
- -- The machine Monkey-SMB with the following IP addresses 192.168.0.1 10.0.0.18 was vulnerable to a SmbExploiter attack. - The attack succeeded because weak/stolen password was used over SMB protocol. -
-- The network can probably be segmented. A monkey instance on Monkey-SMB in the 192.168.0.0/24 network could directly access the Monkey Island C&C server in the 172.168.0.0/24 network. -
-