Okay, here we are.
We are back, and we are ready to test for network segmentation.
So to do that, you're just going to come back to your Run Monkey tab,
Configure the Monkey, it's going to be under Basic Network,
and you scroll down to Network Analysis,
Network segmentation testing.
So here is where we're going to add the subnets that we
want not to be able to talk to each other.
So I'm going to do my 172.20 subnet and I'm going to do my 172.24.
We're going to submit that, that was saved successfully.
We're going to run the Monkey now on a machine of our choice again.
Both of them, in this case,
are Windows so I've got my RDP connections open already.
So we're just going to open these up in command
prompt, run as administrator, Yes,
go ahead and paste in our payload, we're going to have to
change that IP address one more time to the public‑facing
IP so that the payload works.
Set that one loose, then we're going to come on over to our second RDP session,
do the same thing.
Alright,
so we've got both of our initial hosts on their different
subnets identified so we're going to let it run and then see
what it comes up with in the results.
Okay, we're back.
We've got the results from our network segmentation test, and as you can see,
the Monkey got pretty busy.
We had a lot of interhost exploiting going on. Again, the orange
arrows are where initial host scans were completed, but red arrows
are where exploits were successful.
So here in the log, we've got the most recent failed exploits, however,
there are quite a few up here where the Monkey was
definitely successful using SMB exploiter,
SambaCry, etc.
So again, if you want the full log for everything your monkey did during its run,
you can go ahead and check that out on the left‑hand
side and download the whole thing.
It definitely is pretty exciting.
You can see that even though we only gave the MonkeyIsland one
connection, which was the Windows box running on the subnet,
it went ahead and discovered everything and from different host
was able to discover and exploit other host, it exploited this
host from four different other hosts,
and it got team server communication directly back to three other hosts.
In fact,
we know the segmentation portion of our test was a failure, but what
further speaks to that is the fact that multiple hosts,
besides the initial jump off point, were able to
communicate directly back with the team server,
which is obviously a remote host not originally included on its subnet.
So that's pretty cool.
So let's go ahead and come on over to our Security Report now.
Critical issues were detected. So I did leave my monkey
running a lot longer than the typical time, again, it'll
give you your initial results,
which is indicated by those yellow checkmarks over on the left‑hand side.
If there is a checkmark next to security report,
it's got results to show you, but again,
your monkeys are still running, they have not stopped until you kill them.
So I decided to leave mine running a lot longer and the map actually
grew and the exploits grew and the results changed.
So the longer you can give it to run,
you can even let it run overnight, that's really what I
recommend, and it's got some pretty cool results.
Now what I want to call your attention to is the finding of weak segmentation.
So in this second scenario we were testing network segmentation and it
does confirm for us that machines on different segments of the network
were able to communicate with each other,
which is not what we want.
So our network segmentation test was a fail.
It's got each host that it compromised, the username it compromised it
with. Of the 12 machines, it discovered it was able to successfully
breach 6 of them, so that's a 50% breach rate.
For those of you reporting this to senior management,
they love figures like that.
It does give you a copy of your infection map.
It did go ahead and find my domain controller.
It found my interfaces.
It found my data center evaluation.
So the Monkey got pretty far.
I'm pretty proud of it.
If you scroll down a bit farther,
it does tell you on the breach servers exactly which exploiter was successful.
Here, we see a lot of SSH on my Linux machines and SMB on my windows DCs and my
Windows endpoints. So it goes over the post breach actions,
which means not only was it successful in a proof of concept breach,
it conducted some kind of post breach actions such as a file
deletion or a privilege permissions change,
which is pretty cool, it gives you a list of the running services it detected,
and it's got a lot more that it would like to show you, it'll even show
you the credentials that were successful right here.
So pretty good stuff.
That's your basic vulnerability and security report. If we come on over
to the Attack tab, and I apologize for the adjusted resolution in this
layout of the table, but that's just a visual.
Honestly, if you scroll down,
it'll give you a list of all the techniques and what was successful down here,
too. So we can see it was successful across quite a few
techniques in several different tactic categories.
Mainly,
what we're concerned with is everything in discovery and lateral movement,
which is really what the Monkey is meant for.
So we have remote system discovery, it was detecting other hosts
from initial hosts. Exploitation of remote services, it was able
to exploit SSH, HTTP, and SMB, and also an unknown uncommon
protocol over TCP port.
So you've got that proof in the pudding right there.
Remote file copy, it was definitely running and executing itself on
multiple machines multiple times. And last, but not least,
the remote services that were successfully executed over MSSQL,
SMB, and SSH, it also was successful using WMI,
which is pretty unique.
So feel free to launch and execute your own monkeys and
see what kind of neat results you get.
As you can see,
the Monkey does have a number of other capabilities we didn't
cover such as C2 exfiltration and credential access like brute
force and credential dumping.
We didn't cover these. It also is capable of pass the hash.
My virtual environment wasn't configured for that,
but it will give you the plain text passwords, and
if it is able to recover hashes, you will see those here as well.
So I hope you enjoyed.