Blue Team Bible ① [Vulnerability Chapter]: Defending against vulnerability probing attacks and strengthening target-focused protection strategies

With the acceleration of digital transformation, enterprise information security faces unprecedented challenges. Vulnerability profiling attacks, as an efficient and hidden attack method, seriously threaten the information security of enterprises. In order to help enterprises better cope with this challenge, Cyritex has specially refined a set of detailed protection strategies to help you reinforce your information security defense line.

01 Attack Target Deep Analysis and Strategy Formulation

Target Vulnerability Assessment and Attack Strategy Analysis

When planning an attack campaign, the first task is to identify and focus on the "weak links." By comprehensively reviewing the asset value of potential targets, attackers pay special attention to the following categories of targets with significant vulnerabilities:

1. Key systems directly exposed to the external network: Unprotected core systems become the preferred choice for direct attacks, which are launched quickly by collecting system characteristic information (such as fingerprints, directory structures, etc.).

2. Office networks containing domain environments: Domain environments manage a large number of devices and data, and intrusion can yield substantial gains.

3. Important business systems lacking multi-factor authentication: Systems without secondary authentication implemented are vulnerable to brute force and credential stuffing attacks.

4. Remote nodes in complex network architectures: Utilize security vulnerabilities of remote nodes to perform roundabout penetration.

5. Remote access tools in internal networks: Tools like VPNs and cloud desktops provide shortcuts for entering internal networks.

6. Security risks caused by improper network planning: Failure to effectively isolate the office network from Web system servers, leading to indirect access to the office network.

Target System Deep Dissection and Strategy Planning

The target system is undoubtedly the key to success or failure. For a comprehensive and in-depth study and judgment of the target system, attention should be paid to the following aspects:

1. Target system nature definition: Clarify whether the target system is a Web system or other service types, making it easier to formulate attack strategies quickly.

2. Target system accessibility analysis: Determine whether the system is open to the Internet, directly accessed, or approaching the target by first breaking through external defense lines.

3. Target system deployment environment assessment: Focus on whether the system is deployed in a traditional internal network or a cloud service environment, and flexibly choose attack paths.

IP Information Deep Parsing

When conducting internal network penetration testing, the primary task is to confirm whether the target system is located in an internal network environment. It is crucial to perform validation on whether the target IP range can be queried in authoritative databases such as the Asia-Pacific Network Information Centre (APNIC), which helps to determine whether the IP is an asset directly managed by the target organization. It should be noted that if the target IP belongs to a third-party hosting service, even if access permissions are obtained, direct penetration to its internal network may not be possible due to network architecture restrictions. To analyze IP information efficiently, online tools like http://tool.chinaz.com/ipwhois/ can be used for WHOIS queries to obtain key data including the registrant, time, IP range, etc. This information helps to deeply understand the attribution and purpose of the target IP, supporting the subsequent formulation of internal network penetration strategies, and is an important basis for judging the target's network structure, security policies, and potential penetration paths.

Office Network Environment Dissection

When analyzing the target office network in depth, the primary task is to determine its type, especially whether employee machines mainly use Windows, and whether there is a domain environment in the network. This can be achieved by analyzing publicly exposed services, such as open mail services meaning there is a mail server, and Web system integration with AD domain login indicating the presence of a domain environment.

Remote Office System Current Status Analysis

As an important part of modern enterprises, remote office systems, including OA systems, VPN services, cloud desktop solutions, etc., provide flexible working styles for employees, but also pose security risks. Systems lacking secondary authentication are vulnerable to attacks like brute force, where attackers may use automated tools to try a large number of password combinations to obtain system privileges, thereby accessing or tampering with sensitive data. Even if they fail to crack it directly, attackers may obtain employee login credentials through other channels, using the remote office system as an "invisible door" to enter the internal network. Since the use of such systems is often regarded as normal business operations, attack activities may be difficult to detect in time. Remote office systems are usually placed in corporate internal networks, and once breached, the entire internal network security defense line will face challenges, making them a focus target for attackers.

02 Offensive and Defensive Tactics on Key Assets

Key Asset Definition and Boundary Breakthrough Strategy

In the boundary breakthrough phase, focus attacks on the following categories of assets:

1. Core Web technologies and components: Widely used Web middleware, development frameworks, etc., whose security vulnerabilities are often studied in depth.

2. High-privilege assets accessible remotely within the internal network: Assets accessed remotely via the Internet that possess high privileges directly threaten internal network security.

3. Basic service ports: Ports providing basic network services, such as database services and file transfer services, are common paths for unauthorized access.

4. High-value reward targets: Assets containing sensitive data, core business systems, or advanced administrative privileges are highly attractive to attackers.

Organizational Structure Sorting and Data Interface Integration

Utilize enterprise information query platforms (such as Tianyancha, Qichacha, etc.) to collect relevant enterprise data, sort out organizational structures, and conduct asset discovery. Generate precise search engine query statements to expand the search scope and improve search efficiency.

Organizational Structure Sorting: Company Name Query

After collecting data using group member and equity penetration data interfaces, in order to perform asset discovery in cyberspace more effectively, we will generate search engine query statements according to the following rules:

1. Precise website title query, generating query statements that directly search website titles for each company's full name.

2. Website content keyword combination query, combining company names with ownership and operation-related keywords to generate query statements targeting the body text of websites.

3. Simplified certificate holder name query, after pre-processing company names, generating query rules targeting certificate holders.

4. Geographically restricted query, adding region judgment rules to all query statements to clearly limit the search scope to Mainland China, in order to improve search efficiency and accuracy.

Organizational Structure Sorting: Website Registration Query

After collecting information using website registration data interfaces, to locate and identify assets in cyberspace more effectively, we will follow these rules to generate search engine query statements:

1. Root domain-related searches, extracting root domains and generating query statements to search for subdomains, server host configurations, and associated SSL certificates.

2. Website icon recognition, requesting the "/favicon.ico" path or parsing webpage source code to obtain and calculate the hash value of the ico file, assisting in identifying the website.

3. Excluding common interfering hash values, automatically identifying and excluding hash values of open-source software and general frameworks to reduce false positives, and generating search statements to find websites with the same icon.

4. ICP registration information search, using registration numbers or related information to generate search statements to quickly locate official registration information pages, validating website legality and authenticity.

5. Email domain search, extracting the email domain part to generate search statements, finding websites containing that email domain, and discovering associated enterprises or businesses.

6. Region limitation, adding region judgment rules to all query statements, clearly limiting the search scope to Mainland China, and excluding unrelated results from other regions.

Overview of Key Vulnerable Applications/Vulnerabilities/Risks

Application Overview

Office collaboration, email, remote access, Web middleware and frameworks, database and caching systems, monitoring and management tools are key vulnerable applications. Vulnerabilities include:

• Office applications: such as Seeyon OA, Weaver OA, etc., have RCE vulnerabilities, SQL injection, file upload vulnerabilities, etc.

• Email applications: such as Exchange, Coremail, etc., have remote code execution vulnerabilities, arbitrary user forgery, etc.

• Web middleware and frameworks: such as Apache Solr, Tomcat, etc., have privilege bypass, deserialization vulnerabilities, etc.

• Remote access applications: such as VPNs, bastion hosts, etc., have remote command execution vulnerabilities.

...

Vulnerability Overview

Office, email, Web middleware, and remote access applications widely suffer from security vulnerabilities, such as Weaver OA's RCE and database leakage; Seeyon OA's arbitrary file write and SQL injection; Landray OA's SQL injection and file write; Tongda OA's file operation RCE, etc. Email systems like Exchange and Coremail suffer from vulnerabilities such as remote execution and user forgery. Web middleware like Apache, Tomcat, Weblogic, etc., and remote access types like VPNs and cloud desktops also present many security risks. These vulnerabilities threaten system security, and measures such as patch updates, hardening, and access control must be taken immediately.

Overview of Security Risks in Key Basic Service Ports

In cybersecurity, basic service ports often become targets of attacks. Vulnerabilities such as weak passwords and unauthorized access easily lead to command execution, information leakage, and system control. Key ports such as MSSQL (1433), SMB (445), WMI (135), WinRM (5985), RDP (3389), SSH (22), Oracle (1521), MySQL (3306), Redis (6379), etc., all carry risks of weak passwords and backdoor implants. In addition, ports like SMTP/POP3/IMAP, Exchange, VNC, FTP, Rsync, MongoDB, Telnet, SVN, Java RMI, CouchDB, etc., face similar threats. Strengthening password policies, access control, security auditing, and patch updates are key to protection.

03 Case Studies and Recommendations

During a practical offensive and defensive drill targeting a large high-tech manufacturing enterprise, an asset landscape map was drawn using automated tools. A webshell was implanted using a file upload vulnerability in the Seeyon OA system to gain server control. Further, through brute-forcing the SMB service, a backdoor program was implanted, gradually penetrating the core area of the group's network.

Policy Recommendations for Strengthening Key Asset Security Protection

Protection recommendations against vulnerability attacks on key applications include:

1. Asset Clearing and Risk Warning: Comprehensively sort key assets and focus on the latest vulnerability intelligence.

2. Application Fingerprint Feature Obfuscation: Modify default or identifiable fingerprint features to increase recognition difficulty.

3. Reduce Exposure Surface: Clean up old and unauthorized assets.

4. Network Area Isolation: Ensure that the office network and the Web server network do not communicate directly.

5. Limit PowerShell Usage: Disable or restrict PowerShell to reduce the risk of malicious script execution.

...

Protection recommendations against brute-force attacks on basic service ports include:

1. Regular Security Auditing: Organize internal self-inspection to simulate brute force testing.

2. Strong Password Policy: Use randomly generated login passwords that meet complexity requirements.

3. IP Whitelisting Control: Implement strict IP whitelisting policies to restrict unauthorized access.

...

04 Dealing with Vulnerability Profiling Attacks

Principles of Vulnerability Profiling

When performing vulnerability detection, the following principles should be followed: reduce packet sending and attack signatures to avoid IP banning, use proxy pools to dynamically switch IPs, use distributed scanning to improve efficiency, utilize browser crawlers to simulate real browser behavior, and use fingerprinting to select applications applicable to all versions.

Large-scale Vulnerability Detection and Assessment Process

1. Task Initialization and Crawler Deployment: Start browser crawlers to work in parallel, record all accessed URLs, and utilize dynamic proxy pool technology to change scanner IP addresses.

2. Vulnerability Filtering and Value Assessment: Assess vulnerabilities hierarchically, giving priority to direct privilege acquisition, unauthorized access, and Web application vulnerabilities.

3. Scanning Strategy and False Positive/Negative Control: Ensure scanner rules are broad enough to cover potential vulnerabilities. Resolutely avoid false negatives; false positives are preferable to false negatives.

Large-scale Brute-force Profiling

To implement large-scale login attacks, the target login page address must first be determined, which can be obtained through crawlers, directory scanning tools, or cyberspace search engines. However, facing challenges from Token validation and JS encryption, traditional methods are limited.

Innovative Solution: Use Selenium to simulate real browser behavior, run multiple browser instances, automatically fill out forms and detect login status, and effectively address JS encryption and random Token issues.

Tokens and Their Security Role: As an authentication mechanism, Tokens prevent duplicate form submissions and CSRF attacks, enhancing security. However, vigilance is still required against new threats such as Selenium simulation attacks.

Fingerprint-based Vulnerability Detection Strategy

Since Web port components vary, scanning common ports and fingerprinting are crucial for revealing exposure surfaces and finding specific asset vulnerabilities combined with vulnerability databases. The advantage lies in quickly locating "soft targets," but effectiveness relies on the completeness of asset collection. During asset collection, ensure all root domains are captured. For example, besides the common port 80, other ports such as 8080 and 8090 may be missed, missing attack opportunities. Therefore, it is necessary to combine with vulnerability databases to detect comprehensively, using "vulnerabilities to drive asset identification."

Web Application Fingerprint Recognition Methods: Fingerprint recognition is divided into passive and active: passive collects HTTP response headers, HTML, and other characteristics through normal website visits; active identifies by visiting special directories, files, etc. "Analyze HTTP response headers" and "Analyze HTML" in the figure are passive. Since they do not require specific access and are hard to monitor, their priority is higher than active "URL features" recognition, which requires visiting specific addresses and is easily monitored. In fingerprint construction, passive takes priority.

Selection of Fingerprint Databases and Recognition Tools: When implementing fingerprint recognition, attackers prefer open-source tools and fingerprint databases. Defenders can sort out key assets, study open-source fingerprint characteristics, and modify asset fingerprints to enhance security.

Shiro-550 Deserialization Vulnerability Overview

Shiro is Apache's open-source security framework, providing authentication and other functions. However, Shiro-550 (RememberMe deserialization vulnerability), exposed in 2016, gained attention due to its ability to bypass WAFs. In the 2020 offensive and defensive drills, this vulnerability became a hot spot, using default keys and automated tools to attack efficiently, accounting for a high proportion of Shell access entries. Shiro uses AES to encrypt Cookies; if keys are leaked, encryption fails. The vulnerability stems from hard-coded keys in version 1.2.4 and earlier, and subsequent versions did not change the read process, so the risk remains. Domestically, copying Github code often leads to key leakage, and the encrypted nature of the Payload makes it easy to bypass WAFs, exacerbating the hazard of the vulnerability.

05 Case Studies and Protection Recommendations

Related Case Sharing

In an offensive and defensive drill in the chemical industry, the red team first collected asset information. Subsequently, they detected a Shiro-550 vulnerability in the business system of a secondary unit, exploited it to obtain host privileges, and further implanted a Webshell on the target system. Next, using internal network detection tools, the red team found that the Exchange mail server had an SSRF vulnerability (CVE-2021-26855). Combined with an arbitrary file write vulnerability (CVE-2021-27065), they successfully obtained host privileges of the mail server. After entering the domain environment, the red team obtained the NTLM Hash of the krbtgt account and forged a Golden Ticket to seize domain controller privileges, ultimately achieving full control of the domain environment.

Policy Recommendations for Coping with Vulnerability Profiling

Against large-scale detective vulnerability profiling:

1. Deploy protective equipment: It is recommended to deploy Web application firewalls and other security equipment to effectively block and detect potential malicious detection behaviors.

2. Minimize exposure surface: Comprehensively sort out and identify shadow assets to ensure only necessary services and ports are open externally, thereby reducing the risk of being detected.

3. Regular self-inspection and risk assessment: Establish a regular self-inspection mechanism to conduct comprehensive security testing on systems to detect and handle potential security risks in advance.

Against large-scale brute-force profiling:

1. Implement account locking mechanisms: Add a locking mechanism to system accounts so that when input errors exceed a set threshold, the account is automatically locked for a period of time to resist brute force attacks.

2. Strengthen login password complexity: Require users to use login passwords that comply with complexity specifications to increase the difficulty of password cracking.

3. Adopt advanced CAPTCHA technology: Use obfuscated CAPTCHAs to ensure open-source OCR technology cannot recognize them, thereby improving CAPTCHA effectiveness.

4. Introduce two-factor authentication: Even if users log in successfully, secondary validation is still required, increasing the difficulty for attackers to bypass authentication.

Against fingerprint-based vulnerability profiling:

1. Change key asset fingerprints: Modify the fingerprint information of key systems and perform validation using fingerprint recognition tools to ensure the changed fingerprints cannot be easily identified.

2. Asset and vulnerability correlation analysis: Fully grasp asset conditions from the organizational structure level and correlate assets with vulnerability databases to discover and handle risky assets in advance.

3. Strengthen system monitoring and auditing: Focus on access to dangerous ports, parent-child relationships of newly started processes, and whether there are external network connections to promptly detect and respond to potential security threats.

06 Summary and Review

Analysis of the Root Causes of Security Issues in Defenders

1. Complexity of Organizational Structure and Network Connections: Enterprises have numerous subordinate units, network connections are intricate, and security policies are poorly executed.

2. Poor Web Application Management: Asset sorting is unclear, patch updates are not timely, and network planning is non-standard.

3. Security Risks in Basic Service Ports: Use of weak passwords and default passwords without adding whitelisting policies.

Strategies and Measures to Deal with Vulnerability Profiling Attacks

1. Response Strategies at the Organizational Structure Level: Comprehensively sort assets, strictly control access permissions, and implement the principle of least privilege.

2. Security Hardening at the Web Application Level: Change fingerprint information, focus on file upload directories, apply the principle of least privilege, and monitor sensitive operations of key asset accounts.

3. Security Protection of Basic Service Ports: Ban port scanning, perform regular self-inspections, add whitelisting policies, and analyze security from a business perspective.

Through comprehensive and deep analysis and strategy formulation, enterprises can effectively improve network security defense capabilities and cope with various vulnerability profiling attacks.

Build a Solid Line of Defense to Guard Information Security

In the digital era, only by continuously reinforcing the information security defense line can we effectively cope with vulnerability profiling attacks and guard enterprise information security. Cyritex adopts safe and effective protection strategies to provide strong support for your enterprise's information security journey.