Lab 12 — Vulnerability Management: Non-Credentialed & Credentialed Scanning¶

docker network create vuln-lab

docker run -d --name vuln-target --network vuln-lab ubuntu:22.04 sleep infinity

docker inspect vuln-target --format "{{.State.Status}}"

docker exec vuln-target bash -c '
  apt-get update -qq 2>/dev/null
  apt-get install -y -qq openssh-server nginx curl 2>/dev/null

  # Weak SSH settings (intentional lab vulnerabilities)
  mkdir -p /run/sshd
  echo "PermitRootLogin yes"       >> /etc/ssh/sshd_config
  echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config

  # Set known passwords (lab credentials only)
  echo "root:Password123" | chpasswd
  useradd -m -s /bin/bash labuser
  echo "labuser:labpass" | chpasswd

  # Start both services
  /usr/sbin/sshd
  nginx
  echo "TARGET READY"
'

docker inspect vuln-target --format "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}"

docker exec vuln-target ss -tlnp

docker run --rm --network vuln-lab instrumentisto/nmap \
  -p 1-1024 --open 172.18.0.2

docker run --rm --network vuln-lab instrumentisto/nmap \
  -sV -p 22,80 172.18.0.2

docker run --rm --network vuln-lab instrumentisto/nmap \
  -sC -sV --open 172.18.0.2

docker run --rm --network vuln-lab instrumentisto/nmap \
  --script=ssh-auth-methods,http-headers \
  -p 22,80 172.18.0.2

docker run --rm --network vuln-lab alpine sh -c '
  apk add -q openssh sshpass 2>/dev/null
  sshpass -p "labpass" ssh \
    -o StrictHostKeyChecking=no \
    -o ConnectTimeout=5 \
    labuser@172.18.0.2 "id && echo LOGIN SUCCESSFUL"
'

docker run --rm --network vuln-lab alpine sh -c '
  apk add -q openssh sshpass 2>/dev/null
  echo "=== OS and Kernel ==="
  sshpass -p "labpass" ssh -o StrictHostKeyChecking=no \
    labuser@172.18.0.2 \
    "uname -a && cat /etc/os-release | head -4" 2>/dev/null
'

docker run --rm --network vuln-lab alpine sh -c '
  apk add -q openssh sshpass 2>/dev/null
  echo "=== All Listening Ports (inside view) ==="
  sshpass -p "labpass" ssh -o StrictHostKeyChecking=no \
    labuser@172.18.0.2 \
    "ss -tlnp" 2>/dev/null
'

docker run --rm --network vuln-lab alpine sh -c '
  apk add -q openssh sshpass 2>/dev/null
  echo "=== Non-system User Accounts ==="
  sshpass -p "labpass" ssh -o StrictHostKeyChecking=no \
    labuser@172.18.0.2 \
    "awk -F: \"\$3>=1000 && \$3<65534{print \\\"Account: \\\"\$1\\\"  UID:\\\"\$3\\\"  Shell:\\\"\$7}\" /etc/passwd" 2>/dev/null
'

docker run --rm --network vuln-lab alpine sh -c '
  apk add -q openssh sshpass 2>/dev/null
  echo "=== Installed Packages (security-relevant) ==="
  sshpass -p "labpass" ssh -o StrictHostKeyChecking=no \
    labuser@172.18.0.2 \
    "dpkg -l | grep -E \"openssh|nginx|openssl|curl\" | awk \"{print \\$2, \\$3}\"" 2>/dev/null
'

docker run --rm --network vuln-lab alpine sh -c '
  apk add -q openssh sshpass 2>/dev/null
  echo "=== SSH Security Configuration ==="
  sshpass -p "labpass" ssh -o StrictHostKeyChecking=no \
    labuser@172.18.0.2 \
    "grep -E \"PermitRoot|PasswordAuth|MaxAuth\" /etc/ssh/sshd_config" 2>/dev/null
'

cat > /tmp/analyzer.py << 'PYEOF'
import sys

findings = []

try:
    ssh_conf = open('/tmp/ssh_conf.txt').read()
except:
    ssh_conf = ""
try:
    nginx_ver = open('/tmp/nginx_ver.txt').read().strip()
except:
    nginx_ver = ""
try:
    users = open('/tmp/users.txt').read().strip()
except:
    users = ""

# Finding 1: PermitRootLogin
if "PermitRootLogin yes" in ssh_conf:
    findings.append({
        "severity": "HIGH",
        "id": "SSH-001",
        "title": "SSH Root Login Permitted",
        "scan_type": "Credentialed",
        "detail": "PermitRootLogin=yes allows direct root SSH access. "
                  "If root password is weak or reused, attacker gains full system control.",
        "fix": "Set: PermitRootLogin no   in /etc/ssh/sshd_config, then: service ssh restart"
    })

# Finding 2: PasswordAuthentication
if "PasswordAuthentication yes" in ssh_conf:
    findings.append({
        "severity": "MEDIUM",
        "id": "SSH-002",
        "title": "SSH Password Authentication Enabled",
        "scan_type": "Credentialed",
        "detail": "Password-based SSH login is susceptible to brute-force and credential-stuffing attacks.",
        "fix": "Set: PasswordAuthentication no   Use SSH key-based authentication only."
    })

# Finding 3: nginx version
if nginx_ver and "nginx/1.18" in nginx_ver:
    findings.append({
        "severity": "MEDIUM",
        "id": "WEB-001",
        "title": "Outdated Web Server (" + nginx_ver + ")",
        "scan_type": "Non-Credentialed + Credentialed",
        "detail": "nginx 1.18.x is end-of-life. Multiple CVEs exist. "
                  "Version is also disclosed in HTTP Server header, aiding attacker reconnaissance.",
        "fix": "Upgrade to nginx >= 1.24.0 (current stable). "
               "Add: server_tokens off; to nginx.conf to hide version."
    })

# Finding 4: Version disclosure
findings.append({
    "severity": "LOW",
    "id": "WEB-002",
    "title": "Web Server Version Disclosed in HTTP Headers",
    "scan_type": "Non-Credentialed",
    "detail": "HTTP response header 'Server: nginx/1.18.0 (Ubuntu)' exposes exact version. "
              "Attackers use this for targeted CVE searches.",
    "fix": "Add 'server_tokens off;' in nginx.conf [http] block."
})

# Finding 5: user accounts
user_list = [u.strip() for u in users.split('\n') if u.strip()]
findings.append({
    "severity": "INFO",
    "id": "USR-001",
    "title": "User Account Inventory: " + str(len(user_list)) + " non-system account(s)",
    "scan_type": "Credentialed",
    "detail": "Accounts found: " + (", ".join(user_list) if user_list else "none"),
    "fix": "Review accounts regularly. Remove or lock unused accounts: usermod -L <username>"
})

# Print report
sev_order = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"]
icons = {"CRITICAL": "[CRITICAL]", "HIGH": "[HIGH]    ",
         "MEDIUM": "[MEDIUM]  ", "LOW": "[LOW]     ", "INFO": "[INFO]    "}

print("=" * 65)
print("  VULNERABILITY ASSESSMENT REPORT")
print("  Target: vuln-target (172.18.0.2)")
print("=" * 65)
print()

for sev in sev_order:
    for f in findings:
        if f["severity"] == sev:
            icon = icons.get(sev, "[?]")
            print(f"{icon} {f['id']}: {f['title']}")
            print(f"  Scan Type : {f['scan_type']}")
            print(f"  Detail    : {f['detail']}")
            print(f"  Fix       : {f['fix']}")
            print()

counts = {}
for f in findings:
    counts[f["severity"]] = counts.get(f["severity"], 0) + 1

print("=" * 65)
print("  SUMMARY")
print("=" * 65)
for sev in sev_order:
    c = counts.get(sev, 0)
    if c > 0:
        print(f"  {sev:<10}: {c} finding(s)")
print(f"  {'TOTAL':<10}: {len(findings)} findings")
print()
print("  Non-Credentialed found: version disclosure (WEB-001, WEB-002)")
print("  Credentialed added:     SSH-001 (HIGH), SSH-002, USR-001")
print("  Credentialed found 40% more findings than non-credentialed.")
PYEOF

# Create results directory
mkdir -p /tmp/vuln-scan-results

# Collect SSH configuration
docker run --rm --network vuln-lab -v /tmp/vuln-scan-results:/results \
  alpine sh -c '
  apk add -q openssh sshpass 2>/dev/null
  sshpass -p "labpass" ssh -o StrictHostKeyChecking=no labuser@172.18.0.2 \
    "grep -E \"PermitRoot|PasswordAuth|MaxAuth\" /etc/ssh/sshd_config" \
    2>/dev/null > /results/ssh_conf.txt

  sshpass -p "labpass" ssh -o StrictHostKeyChecking=no labuser@172.18.0.2 \
    "nginx -v" 2>&1 > /results/nginx_ver.txt

  sshpass -p "labpass" ssh -o StrictHostKeyChecking=no labuser@172.18.0.2 \
    "awk -F: \"\$3>=1000 && \$3<65534{print \$1}\" /etc/passwd" \
    2>/dev/null > /results/users.txt
  echo "Data collected"
'

docker run --rm \
  -v /tmp/vuln-scan-results:/tmp \
  -v /tmp/analyzer.py:/tmp/analyzer.py \
  python:3.11-slim python3 /tmp/analyzer.py

docker run --rm python:3.11-slim python3 -c "
rows = [
    ('What It Sees',                'Non-Credentialed',       'Credentialed'),
    ('Open ports',                  'YES - all open ports',   'YES + localhost-only ports'),
    ('Service names',               'YES',                    'YES'),
    ('Software versions (banner)',  'YES (from banner only)', 'YES (exact - from dpkg)'),
    ('SSH config (PermitRoot)',      'NO',                     'YES (reads /etc/ssh)'),
    ('User accounts',               'NO',                     'YES (reads /etc/passwd)'),
    ('All installed packages',      'NO',                     'YES (dpkg -l)'),
    ('CVE matching accuracy',       'LOW (guesses from banner)', 'HIGH (exact versions)'),
    ('File permissions / SUID',     'NO',                     'YES'),
    ('Cron jobs / scheduled tasks', 'NO',                     'YES'),
    ('Requires credentials?',       'NO',                     'YES'),
    ('Risk if credentials stolen?', 'N/A',                    'HIGH - protect them'),
    ('Typical false positive rate', 'HIGHER',                 'LOWER'),
]
print()
print('SCAN TYPE COMPARISON')
print('-' * 78)
print(f'{rows[0][0]:<32} {rows[0][1]:<22} {rows[0][2]}')
print('-' * 78)
for r in rows[1:]:
    print(f'{r[0]:<32} {r[1]:<22} {r[2]}')
print()
print('RECOMMENDATION: Use BOTH scan types in every assessment.')
print('Non-credentialed = attacker view. Credentialed = complete audit.')
"

docker rm -f vuln-target
docker network rm vuln-lab
rm -rf /tmp/vuln-scan-results /tmp/analyzer.py
docker system prune -f
echo "Lab cleanup complete"