Workshop 3- Session 2: Boot to Rooting - Attacking Vulnerable VMs
No ratings
Presented at bsideslondon 2016 by
The workshop aims to provide a methodology which can be used when attacking vulnerable machines. Participants will hopefully leave with an improved understanding on how to tackle these sorts of challenges. Additionally it is our hope that anyone attending will walk away with additional skills and new techniques which can be applied to CTFs and real world penetration testing. The workshop will be based around a black-box assessment of a purposely vulnerable virtual machine. A Linux based operating will be used for the target, and will be vulnerable to web and infrastructure based attacks. We will start by going through the information gathering stage, all the way to gaining shell access on the box, with the highest level of privilege on the system. Our plan is to be walk through the entire challenge with the class, breaking each stage down, showing how each obstacle can be tackled, and allowing for the participants to see what is required at each step. Each section will have a practical example based on the vulnerable machine we will be attacking. We will be using commonly used tools to perform manual testing (will not be using any “mass vulnerability” scanners). This is a highly interactive and hands-on session so participants are required to bring their own laptops (learn by doing!), as this will be a custom made target for BSidesLondon (which will be made public on VulnHub’s website before the start of the conference, along with the additional resources). Various members of the VulnHub community will be attending to help out. These will include @g0tmi1k, @NullMode and @rasta_mouse. REQUIREMENTS: Laptop (which must be able to run two virtual machines at once). Kali Linux (other operating systems can be used, but support for these is limited) VMware Player/Fusion/Workstation (VirtualBox may be used but the VulnHub team do not actively use it so support will be limited). The Virtual Machine to be used in the workshop - this will be made public ahead of time. (We may have it on USB sticks and DVDs during the workshop).