# data[].attributes.body
Not overtly on the NC, CS specs.

# data[].attributes.headline
Resources that a wide range of students can access.

# data[].attributes.subject
Resources that a wide range of students can access.

# data[].attributes.headline
Department are always less interested/supportive as it is not included as part of curriculum

# data[].attributes.subject
Department are always less interested/supportive as it is not included as part of curriculum

# data[].attributes.headline
Digital footprints - how meta data, content of social media posts/images can be analysed to build up a picture for cyber criminals to exploit.

# data[].attributes.subject
Digital footprints - how meta data, content of social media posts/images can be analysed to build up a picture for cyber criminals to exploit.

# data[].attributes.headline
how to secure a standalone network against cyber crime

# data[].attributes.subject
how to secure a standalone network against cyber crime

# data[].attributes.headline
Ideas for interesting resources to engage students.

# data[].attributes.subject
Ideas for interesting resources to engage students.

# data[].attributes.headline
About careers in cybersecurity to inspire students and possibly having speakers to school. Skills required to Cyber Security specialist.

# data[].attributes.subject
About careers in cybersecurity to inspire students and possibly having speakers to school. Skills required to Cyber Security specialist.

# data[].attributes.body
Jobs in Cyber with child friendly descriptions and career paths/qualifications needed

# data[].attributes.headline
our server has 20 students attached but it is not connected to the main network, so we are not limited in anyway and can break it and then fix.....:) and that's the sort of things I am hoping to get.

# data[].attributes.subject
our server has 20 students attached but it is not connected to the main network, so we are not limited in anyway and can break it and then fix.....:) and that's the sort of things I am hoping to get.

# data[].attributes.headline
Virtual activities (hacking), activities to show vulnerabilities in software

# data[].attributes.subject
Virtual activities (hacking), activities to show vulnerabilities in software

# data[].attributes.headline
Interactive resources for all key stages.

# data[].attributes.subject
Interactive resources for all key stages.

# data[].attributes.headline
Pulling together the best resources to teach ocr computer science GCSE cyber security section

# data[].attributes.subject
Pulling together the best resources to teach ocr computer science GCSE cyber security section

# data[].attributes.headline
Could you try showing us some of the activities your students find engaging to see if we could create "watered down" versions for our own students.

# data[].attributes.subject
Could you try showing us some of the activities your students find engaging to see if we could create "watered down" versions for our own students.

# data[].attributes.body
Educators teach based on theoretical knowledge acquired through courses and books and present to students in form of power points. No hands on experience to share.

# data[].attributes.body
Can uni students drop in to share their experience and conduct regular sessions for GCSE students to promote the subject.

# data[].attributes.body
It's so hard for students to understand the concept. How can you engage them while teaching this topic?

# data[].attributes.body
If an online platform can be set up for students to explore the tools, many would understand the subject and choose at GCSE level.

# data[].attributes.body
SQL injection another session that we do as well , may be with live query.

# data[].attributes.headline
BOOLEAN ALGEBRA-ANY IDEAS ON PRACTICAL SESSIONS-ELECTRONICS?

# data[].attributes.subject
BOOLEAN ALGEBRA-ANY IDEAS ON PRACTICAL SESSIONS-ELECTRONICS?

# data[].attributes.headline
Assembly language- we use software called Assemulator.  Any websites, (not LMC) to show memory manipulation in data

# data[].attributes.subject
Assembly language- we use software called Assemulator.  Any websites, (not LMC) to show memory manipulation in data

# data[].attributes.body
Metasploitable guide:

https://akvilekiskis.com/work/metasploitable/index.html

# data[].attributes.attachment_link.readable_text
Updated On: 07/06/2018

Introduction

As I began working with the Metasploitable virtual machine and testing out different exploits, I grew curious on how to protect against them. Unfortunately, I have not seen a guide like this anywhere on the Internet, which is why I decided to create one. The source code for this site is available on GitHub here so feel free to clone the repository and add on your own findings as well.

I'm structuring the guide so you see the exploit first, and then how to patch it afterwards; I also have screenshots included for your reference. Let's begin!

Network Scan

Depending on your experience or comfort with Kali Linux, you can start with either Zenmap or use an nmap command directly on the command line to scan the Metasploitable machine for any open ports. I started off with Zenmap because of the GUI, but nmap is more robust and I would recommend getting into the habit of using that instead. After a port scan of the Metasploitables IP, the first glaring open port is 23 for Telnet. There are a couple exploits utilizing Telnet so I will outline how to do those below before disabling Telnet on the Metasploitable machine.

Zenmap Output

Ports 23 and 25 - Telnet and SMTP

With Telnet, we can start with something simple; power up Wireshark on your Kali machine. You need to pick a network that you want to capture the network traffic on so pick the one that the Metasploitable machine is running. With Wireshark running, Telnet to the Metasploitable machine from your Kali root command line. I linked the YouTube tutorial I used for your reference.

The next exploit that uses Telnet involves port 25 for SMTP. I linked the tutorial I used for that here.

There is a reason why no one uses Telnet anymore and the exploits above are just a few examples why - the best way to mitigate this is to disable Telnet on the Metasploitable machine (if it was a real server, just use SSH instead). This will be done by going into /etc/inetd.conf and commenting out the Telnet line, and then restarting the machine.

/etc/inetd.conf with Telnet commented out

Side note: While running through this entire guide, I've gotten into the habit of restarting the machine and running another scan to confirm that the port is closed or run the exploit again and ensure that it failed. Obviously this isn't required, but it is a good habit to get into when you're working on something like this.

Zenmap scan with no Telnet

Port 21 - FTP

This exploit is pretty simple; you go into the metasploitable framework, choose the vsftpd_234 backdoor exploit, set the target IP, and run the exploit. This backdoor gives us root access to the Metasploitable machine. Here is the YouTube tutorial I used for this.

Besides the fact that vsftpd is on version 3.0.3 now and the obvious patch would be to update it, I wanted to know how to patch it just for the version we had because in real life, the patches won't always be this simple. For this patch, you need to go into the vsftpd config file located in /etc/vsftpd.conf and disable anonymous upload for the FTP service.

/etc/vsftpd.conf with anonymous upload removed

This alone is not enough for the exploit to not work; the reason being is that if you read the write up on the backdoor here, you notice that the attacker is able to log in as ":)" for the username and listen on port 6200. A hardening technique for this particular case is to set up iptables to drop listening on unused ports. For the sake of this, I only did it for port 6200 since that's what the backdoor uses to get in.

iptables commands to drop traffic at port 6200

what happens when you try the exploit after using iptables

Ports 139 and 145 - Samba

This is another Metasploitable exploit so you just use exploit/multi/samba/usermap_script and run it to gain access to the victims machine. Samba released a patch here, but another alternative is to comment out the userman script line in the samba config file. This can be found in /etc/samba/smb.conf on the Metasploitable machine.

Commented out the userman script

What happens with the exploit after you comment out the userman script

Port 1524 - Ingreslock Backdoor

Port 1524 has the xinetd super server daemon running on it. This exploit is as simple as using a netcat command to get root access of the machine.

Netcat exploit

This works due to the Ingreslock backdoor placed on the machine. If you go to /etc/inetd.conf, you can see the last line has this.

Ingreslock backdoor code

All that needs to be done here is delete that entire line, and then reboot the machine. Note that if you did find a line like this in your config in the wild, you would have to do some more digging to make sure the backdoor didn't spread elsewhere.

Exploit attempt post removal

Port 2049 - NFS

Note that for this exploit, you need to first install nfs-common with apt-get-install nfs-common on your Kali Linux machine. Here is the tutorial for the exploit. There are many steps you can take to harden the NFS service, however for this particular machine I just added iptables commands to block the Kali machines IP from attempting to mount the Metasploitable machine. The article I referenced is linked here.

IP tables commands

Failed mount

Now when you try to mount the Metasploitable machine, the root terminal gets frozen and stuck.

Port 5432 - PostGresSQL

This is another easy Metasploit exploit that allows the attacker direct access into the meterpreter shell.

PostGres Exploit

This worked because PostGres is set up to write to the default directory which means that the fix is to change the directory from the default so that the payload won't work. The config file can be found in /etc/postgresql/8.3/main/postgresql.conf. The default directory is /var/lib/postgresql/8.3/main so you can change it to whatever you like. Just know that you actually need to go out and create the new directory because writing it in the config file alone is not enough. Also, make sure you reboot the Metasploitable machine after changing this.

changed to new directory called datadir

exploit attempt after directory change

What Can't Be Patched

I also wanted to note the exploits that have no "patches"; I put this in quotes because there are other ways to mitigate these vulnerabilities.

Port 22 - SSH

Good old SSH, Telnet's updated replacement. The biggest issue (and an issue with the Metasploitable machine) is the use of passwords (or lack thereof). Obviously, this was set up for testing purposes, but if you are actually using SSH, it would be way smarter to utilize public/private key pairs for authentication instead of passwords. This is because if we have the victim's SSH login credentials, we can easily log into their machines. They key pairs make for a much more secure connection and here is a YouTube tutorial for how to set that up.

Port 3306 - MySQL

This can be exploited by using auxiliary modules on Metasploit to scan and find usernames and passwords. The YouTube tutorial here outlines how to do so. This was another exploit that demonstrated how passwords are not a strong protection mechanism against attackers. I linked a tutorial on how to create RSA keys on MySQL here as a mitigation technique.

Port 5900 - VNC

This also uses an auxiliary module exploit on Metasploit. Here is the YouTube tutorial on how to do so. For this particular case, since the password was "password", it would be wise to change that to something stronger or even better, use public/private keys for this as well. Instructions are linked here.

Port 6667 - UnrealIRCd

Hooray for another backdoor! Here is the YouTube tutorial I used to test this out. This one actually can't be patched from the Metasploitable machines side (as far as I know). I'm only saying this because after I read this statement released by Unreal, I understood that there was nothing else I can do except the steps outlined in the screenshot below.

Screenshot solution from Unreal

Port 8180 - Apache Tomcat

This is yet another auxiliary module exploit where the attacker can find the victim's login credentials. Here is the tutorial I used to do so. Similar to VNC, the user had weak credentials so the best mitigation would be to have stronger passwords or as I've reiterated multiple times througout this guide, use public/private key pairs instead. Here is a tutorial on how to do so on Apache Tomcat 9.0.

Port 2121 - vsftpd

This exploit also involves weak passwords (shocker, I know). Details on the exploit are here. After some research, I learned that FTP isn't considered secure anymore and that it would be beneficial to switch to SFTP; details on that are here.

The Two Problem Children

I categorized these separately because these two were unique (and frustrating) to me due to the fact that I couldn't make heads or tails of how to patch this without waiting for the developers of the service to release a patch on their own. This knowledge from the dev side would be a strong addition to the guide, especially since I can't bring myself to look at PHP or Ruby code anymore.

Port 80 - Apache

This vulnerability is PHP based (hence my earlier comment). I would post an actual video of how to do this, but I imagine at this point you've figured out how to read through the exploits on rapid7 anyways. Here's the rapid7 link for the php injection exploit.The furthest I got was looking into this webpage detailing how the exploit works codewise.

Port 1099 - Java RMI Registry

The final exploits tutorial is here for your reference. This payload was written in Ruby, which I unfortunately am unfamiliar with. Here is the source code for the exploit; the only thing that stood out to me was that this doesn't work against JMX ports since they do not support class loading so that could be a possibility. I did some research on JMX and how to set it up, but couldn't make much sense of it.

Conclusion

This concludes the guide, sorry that it ended on a defeated note, it would sadden you if I told you how long I spent looking at those last two ports in particular. I hope that this was all useful information and is helpful to whoever reads it; please feel free to add on to it (especially for those last two that stumped me).

# data[].attributes.attachment_link.title
Metasploitable Exploits and Hardening Guide

# data[].attributes.attachment_link.description
As I began working with the Metasploitable virtual machine and testing out different exploits, I grew curious on how to protect against them. Unfortunately, I have not seen a guide like this anywhere on the Internet, which is why I decided to create one.

# data[].attributes.body
https://tryhackme.com/room/rpmetasploit

# data[].attributes.attachment_link.description
Learn to use Metasploit, a tool to probe and exploit vulnerabilities on networks and servers.

# data[].attributes.headline
Cyber Kill Chain (blog post explaination)

# data[].attributes.subject
Cyber Kill Chain (blog post explaination)

# data[].attributes.body
https://heimdalsecurity.com/blog/cyber-kill-chain-model/

# data[].attributes.attachment_link.readable_text
The cyber kill chain model offers a detailed perspective and the appropriate methods to recognize incidents surrounding an attack against an organization. This model allows security teams to impede the assault during a certain stage and consequently design stronger security and enhance their incident response and analysis capabilities.

Throughout the past couple of decades, cyber threats have grown drastically in size and complexity. The increasing popularity of the cloud, the development of advanced social engineering techniques, or the rise of Business Email Compromise (BEC) are some of today's cyber dangers that have rendered traditional security defenses insufficient. For this reason, cybersecurity prevention and mitigation methods were compelled to keep pace with these ever-growing threats.

Although all security strategies should be based on a prevention-first mindset, this approach alone will not suffice. Instead, monitoring and remediation should also be included, especially when it comes to mitigating targeted, high-profile attacks. It's not only about ensuring absolute prevention - but it's also about understanding how to respond should an incident occur and achieving a state of cyber resilience.

A means of defending your sensitive network is through the cyber kill chain model. This is a framework used to detect and prevent cyber intrusions, defining what the opponents may do in order to reach their target.

What follows is a complete explanation of what the cyber kill chain is, how it works, and why you should apply it in your organization.

What is the Cyber Kill Chain Model?

"Kill Chain" is a concept that was first adopted by the military to describe the actions used by an adversary to attack and destroy a target. In essence, it relates to what an assault would look like from a military perspective and describes all stages that attackers go through. Recognizing the kill chain phases will help the line of defense correctly identify the intruders and stop them faster. The earlier you find the bad actors, the more likely it is that you will catch them.

Using this military model originally created to find, fight, and defeat the enemy, Lockheed Martin developed the cyber kill chain model. The framework has evolved since its beginning to help predict and detect various cyber threats, such as insider attacks, social engineering, sophisticated malware, APTs, data breaches, etc.

The cyber kill chain is a blueprint for operating in a chained way, that incident response teams, forensics experts, and malware researchers can follow. Fundamentally, the cybersecurity kill chain is the visualization and study of an attacker's offensive behavior. Thus, it is of paramount importance that security analysts fully understand it so they can strike back.

The 7 steps of the Cyber Kill Chain

The cybersecurity kill chain comprises seven key steps, spanning from to lateral movement to data exfiltration, aiming to ensure good visibility and helping security teams better grasp the adversary's strategies, operations, and procedures. It offers a mechanism of breaking down a dynamic attack into generic steps so that they can be better examined. This layered tactic would allow observers to fix smaller and simpler challenges, while also helping defenders thwart each stage by designing protection and mitigation methods.

The cyber kill chain consists primarily of 7 stages.

Regardless of what vectors of attack we're looking at and no matter if they're coming from the inside or outside the organization, they can be successfully identified thanks to this model.

1. Reconnaissance - The attackers pick a target and perform a detailed analysis, start collecting information (email addresses, conferences information, etc.) and evaluate the victim's vulnerabilities to determine how to exploit them.

2. Weaponization - During this stage, malicious actors develop a malware weapon and aim to exploit the discovered vulnerabilities.

3. Delivery - This phase involves delivering the weapon. Here, the intruder will use various tactics, such as phishing, infected USB drives, etc.

4. Exploitation - The stage where intruders start leveraging vulnerabilities to executed code on the victim's system.

5. Installation - The malware weapon is installed.

6. Command & Control - A C&C server is used for the remote manipulation of the victim.

7. Actions on Objectives - In the final stage, attackers complete their goals.

If security experts manage to break any link in this chain, the attack will be stopped.
Phases of cyber kill chain - Source: Technical Aspects of the Cyber Kill Chain
How does the Cyber Kill Chain Work?

Next, I will break down each of the kill chain stages, as per the analysis shown in the Technical Aspects of the Cyber Kill Chain research paper, authored by Tarun Yadav.

1. Reconnaissance

This stage involves collecting data about the future target (a person or an organization).

It is further necessary to break down reconnaissance to target identification, selection, and profiling.

Cyberspace identification primarily means crawling the World Wide Web (e.g. websites, conferences, blogs, social relationships, mailing lists, and network tracing software) to obtain information about the target. In later phases of the cyber kill chain, data collected from reconnaissance is used to plan and distribute the payload.

The reconnaissance stage is classified into two types:

1. Passive recognition: This move is achieved by collecting target information without him/her being aware of it.

2. Active recognition: This stage requires much thorough analysis of the target.

Reconnaissance offers information about potential targets, which will allow the intruder to determine the type of weapon necessary to infiltrate the target, potential types of delivery methods, issues with malware installation, and the protection measures that need to be circumvented.

Next, you will see how advanced malware is created using the knowledge obtained in the reconnaissance stage.

2. Weaponization

The cyber kill chain's Weaponization stage deals with the creation of a backdoor and a penetration strategy using the knowledge gathered from reconnaissance to enable the backdoor to be delivered successfully. In this instance, a Remote Access Tool (RAT) will be used.

Weaponization entails the creation and development of two components:

Typically considered the payload of a cyber-weapon, RAT is a piece of software that executes on the machine of the victim and allows the intruder remote, secret, and unobserved entry. It can provide "system exploration, file upload or download, remote file execution, keystroke monitor, screen capture, webcam or system power on/off with limited or user-level privileges", Yadav notes.

This is the part of the weapon which allows the RAT to run, acting as a carrier for the RAT and leveraging system or software vulnerabilities. The key aim of using exploits is to evade user detection by using the RAT to construct a silent backdoor entry. There can be several kinds of infection sources, such as MS Office files, PDFs, audio/video, or web pages. More vulnerabilities such as privilege escalation exploits can be used on the target after having a RAT installed to get elevated privileges, and then further disseminate the RAT, ensure permanent access or even break the entire system.

In my colleague's article, you can find the following Case study: Bank Security's Excel weaponization via the Metasploit SMB delivery module, so please go through it as well.

3. Delivery

Delivery is a crucial component of the cyber kill chain and is responsible for an efficient and powerful cyber-attack. Any type of user activity, such as uploading and executing infected files or accessing malicious web pages will be necessary for most attacks.

For an intruder, delivery is a high-risk assignment because it leaves traces. Many of the attacks are thus carried out anonymously using online payment providers, hacked websites, and compromised email addresses.
Delivery mechanisms include:
4. Exploitation

After the cyber weapon is shipped, the next step is executing the exploit with the aim of silently installing the payload and executing it.

The exploit will only work on outdated systems and most probably will not be picked up by traditional security tools, like Antivirus or Firewalls.

Essentially, exploitation is the most critical stage within the cyber kill chain. We often bring up the importance of patch management and keeping up with the latest software updates to close security holes in your organization. So, on a side note, I suggest you check out our Patch & Asset Management solution, which enables you to achieve compliance, mitigate exploits, close vulnerabilities, deploy updates, and install software remotely and according to your schedule. Our tool covers both Microsoft and 3rd party application management and comes with customizable set-and-forget settings for automatic deployment of software and updates.

5. Installation

Traditionally, an infection vector such as corrupted disposable media will infect a device, which in turn would leave a malware executable that will operate every time the computer boots up. Consequently, users would report this executable to their security provider, who would evaluate it and come up with a signature to detect it and a removal tool. Modern malware no longer works in such a simple manner, now relying heavily on droppers and downloaders to distribute the malware modules in a far more advanced way.

6. Command & Control

The C&C server, used to send remote hidden instructions to compromised computers, is an essential part of any cyber-attacks. It also functions as the location where the data is exfiltrated. Throughout the years, due to the exponential growth of defense mechanisms, including antiviruses, firewalls, IDSs, etc, the design of C&C networks has greatly developed.

C&C server connections can be prevented with DNS filtering tools. For instance, Heimdal Threat Prevention stops threats at the DNS, HTTP, and HTTPS-level, detecting and stopping DNS hijacking, exploits, ransomware, data leaks, and more.

7. Act on Objectives

In the final stage, the intruder executes the commands after the connection with the target device is established. The command used by the attacker depends on the attack's purpose.

Mass Attack

Mass attacks are aimed towards reaching as many targets as possible - multiple systems combined are of concern in mass attacks, rather than a single system. Many of these assaults have the objective of harvesting the victim's credentials. Botnets, which are mostly used for DDoS attacks and virtual coin mining, are some examples of mass attacks. I've also written an article on how to prevent a botnet attack from compromising your business, so I suggest you check it out as well.

Targeted Attacks

Targeted attacks are more sophisticated and more carefully conducted and are aimed towards a single entity, with the purpose of exfiltrating data such as login credentials. For example, when the target is a single enterprise, moving laterally inside the network becomes a primary goal.

Bottom Line

The rise of sophisticated attacks carried out by threat actors, who now can gain access to advanced resources and technologies that help them achieve a pervasive and undetected presence, is one of the main challenges faced by organizations. The cyber kill chain examines the cyber-attack flow, with each stage being of critical importance.

Studying the cybersecurity kill chain at every stage of the assault can help security teams detect and minimize threats. The sooner the identification is completed, the better the damage can be mitigated.

# data[].attributes.attachment_link.title
The Cyber Kill Chain Model: A Comprehensive Guide

# data[].attributes.attachment_link.description
The cyber kill chain model offers a detailed perspective and the appropriate methods to recognize incidents surrounding an attack against an organization. This model allows security teams to impede the assault during a certain stage and consequently design stronger security and enhance their incident response and analysis capabilities.

# data[].attributes.body
https://www.cyberexplorers.co.uk/

# data[].attributes.attachment_link.title
TryHackMe | Assign Students Cyber Security Exercises & Labs

# data[].attributes.attachment_link.description
Teach Cyber Security by assigning students hands-on cyber security exercises and labs to complete and view their progress.