Lab 1

Scenario Overview

The industrial control system (ICS) used in this scenario simulates an environment that might be used to cool industrial equipment. The ICS is made up of five systems. The first system contains a tank, tank level sensor and a water pump. The second system is a programmable logic controller (PLC) which controls the water pump based on the level of water found in the attached tank. The third system is an Open Platform Communications (OPC) server which accesses and modifies data found on the PLC. The fourth system is running Human Machine Interface (HMI) software which communicates with the OPC server to provide a human system operator with system statistics and control. The final system in the ICS is a security appliance that provides routing and firewall services for all systems. This scenario also makes use of a system running Kali Linux. In this lab the virtual network switch is configured so that the Kail system receives all data transmitted. (Network diagram)

In this lab you are going to configure the HMI system to provide remote access services. You are then going to use a Kali Linux system to perform a remote network scan on unprotected ICS systems. After the scan you are going to demonstrate how the lack of a firewall can allow a remote hacker to compromise passwords and file system security. You will see that Wireshark can be used to capture and decode unencrypted remote communication sessions. You will then configure a firewall, VPN server and a VPN client and observe that this prevents the attacks carried out in the first part of the lab.

Part 1
Install Systems

In this part of the lab you are going to install and configure the systems needed to complete the lab.

1. If necessary, install the free Oracle VirtualBox Manager software on your system.
2. Download, and if necessary extract, the lab image ICS-VirtualBox.ova.
3. Start the Oracle VM VirtualBox program.
4. Import the ICS-VirtualBox.ova lab image.
5. After the import has completed access the Settings for the Security Appliance virtual machine and change its configuration so that it is bridged to the network device in your host computer.
6. Power on the systems in the following order:
   • Security Appliance
   • Sensor
   • PLC
   • OPC
   • HMI
   • Kali

Part 2
Setup remote access

In this part of the lab you are going to configure the HMI system to support remote access.

1. Access the HMI system.
2. Open File Explorer by right clicking the Start button then choose the Explore option ( Example ).
3. Access System Properties by right clicking My Computer inside the File Explorer program then choosing the Properties option ( Example ).
4. Click the Remote tab within System Properties.
5. Select the check box labeled Allow users to connect remotely to this computer.
6. Click the OK button.
7. Access the Computer Management program by right clicking My Computer inside the File Explorer program then choosing the Manage option ( Example ).
8. In Computer Management expand the Local Users and Groups category, select the Users folder right click the Administrator user then choose the Set Password... option ( Example ).
9. Click the Proceed button.
10. Type the new password batman into both the New password: and the Confirm password: fields.
    • This is NOT a secure password and is only being used so cracking it later will be less time consuming.
11. Click the OK button.
12. Click OK a second time when you are informed that the password has been set.
13. Close the Computer Management and File Explorer windows.

Part 3
Use the nmap scanner program to remotely probe unprotected systems

In this part of the lab you are going to move the Kali system to a different network segment then the ICS and use the nmap scanner program to probe for running services.

1. Access the Kali system.
2. At the login screen enter student into the Enter your username field and Password01 into the Enter your password field.
3. Click the Log In button.
4. Open a terminal (command prompt) window by clicking the Terminal Emulator button found at the upper left hand corner of the window (Example).
5. Type the command nmcli connection to view the available network connections.
6. Notice that the Cell-Area Zone configuration is associated with a device but the Manufacturing Zone configuration is not.
7. Type the letter q to stop viewing the network configurations.
8. Switch the zone (network segment) that the Kali system is connected to by typing the command ./change_network.sh then providing the student user's password, Password01 when prompted.
   • To prevent people from looking over your shoulder and writing down the password it is not displayed on the screen as you are typing.
9. View the available network configurations by typing the command nmcli connection.
10. Notice that now the Manufacturing Zone configuration is associated with a device but the Cell-Area Zone configuration is not.
11. Type the letter q to stop viewing the network configurations.
12. Use the command nmap 10.0.255.0/24 to remotely scan the network segment containing the ICS systems.
13. When the scan is complete, notice that the HMI system, having the address 10.0.255.101, has the Microsoft RDP port 3389 and the Microsoft SMB file sharing ports 139/445 open.
14. Take a screen shot showing the entire Kali window, and the open ports on the HMI system (Example) then paste it into the VPN Lab Form found here.

Part 4
Use the ncrack program to crack the administrator password on the unprotected HMI system

In this part of the lab you are going to use ncrack program to crack the administrator password of the HMI system.

1. Access a terminal window on the Kali system.
2. Type the command ncrack --connection-limit 1 -f --user administrator -P rockyou.txt rdp://10.0.255.101 to crack the administrator's password on the HMI system ( Example ).
   • The --connection-limit 1 switch tells the program to only try password at a time.
   • The -f switch tells the program to quit once a single password has been cracked.
   • The --user administrator switch tells the program what username to attack.
   • The -P rockyou.txt switch tells the program the name and location of the password dictionary it should use.
   • The rdp://10.0.255.101 argument indicates the IP address of the system to attack and that the RDP protocol should be used.
   • You can press the <ENTER> key while the attack is in progress to view program statistics.

Part 5
Exfiltrate data from an unprotected system

In this part of the lab, you will exfiltrate data from the unprotected HMI system

1. Access a terminal window on the Kali system.
2. Use the command smbclient //10.0.255.101/c$ -U administrator to start an SMB (file share) connection with the HMI system ( Example ).
3. When prompted enter the administrator password which you previously cracked using the ncrack program.
4. Type the command ls to view the files available on the C: drive of the HMI system ( Example ).
5. Type the command cd vpn to change your current working directory to the vpn directory.
6. Type the command ls to view the files located in the vpn directory ( Example ).
7. Type the command get krabby_patty.txt to copy the file krabby_patty.txt from the HMI system to the Kali system.
8. Type the command exit to close the SMB session.
9. Use the command cat krabby_patty.txt to view the secret recipe for a Krabby Patty.
10. Take a screen shot showing the secret recipe (Example) and paste it into the VPN Lab Form found here.

Part 6
Use Wireshark to decode an unencrypted remote session

In this part of the lab, you will use Wireshark's follow stream functionality to demonstrate how an unencrypted remote session can be easily decoded.

1. Access a terminal window on the Kali system.
2. Start the Wireshark program by typing the command wireshark
3. After the Wireshark program starts, select the manufact-zone network device to indicate that you wish to capture data on that device ( Example ).
4. Click the Start Capturing packets button to begin capturing network data ( Example ).
5. Open a new terminal (command prompt) window by clicking the Terminal Emulator button found at the upper left hand quadrant of the Kali desktop.
6. Connect to the PLC by typing the command nc 10.0.255.102 23
   • The nc command starts the netcat program which is useful network utility that allows a quick connection to network services. In this case netcat is connecting to the telnet service running on the PLC.
7. Type the command exit to end the terminal session.
8. Return to the Wireshark window.
9. Stop capturing network traffic by clicking on the Stop Capturing packets button ( Example ).
10. Click in the display filter field, type ip.addr==10.0.255.102 then click the Apply display filter button or press <ENTER> to activate the filter ( Example ).
11. Right click any packet in the packet list pane which is using the TELNET protocol.
12. From the pop up menu choose the option Follow -> TCP Stream ( Example ).
13. Take a screen shot that shows the entire Kali window ( Example ) and paste it into the VPN Lab Form found here.
14. Click the Close button.
15. Close the Wireshark program clicking the Quit without Saving button when prompted.

Part 7
Protect the HMI system with a Firewall and VPN

In this part of the lab, you will turn on the VPN server and Firewall on the Security Appliance.

1. Start a web browser on the Kali system by clicking the Application menu button at the top left of the screen, scrolling down the list of application folders then clicking the Usual Applications folder, expanding the Internet category and finally clicking on the Web Browser option ( Example ).
2. Type the address 10.0.255.1 into the Web Browser's address bar then click the Go to the address in the Location bar button ( Example ).
3. If necessary, click the Advanced... button when you see the Warning: Potential Security Risk Ahead web page, read the explanation for the security warning then click the Accept the Risk and Continue button.
4. Type the username admin into the Username field.
5. Type the password Password01 into the Password field.
6. Click the SIGN IN button.
7. If you are asked if you would like Firefox to save the login data, click the Don't Save button.
8. Expand the VPN category at the top of the administrative console page then choose the L2TP option ( Example ).
9. Start the L2TP VPN server by checking the box labeled Enable L2TP server then scrolling down the page and click the Save button.
10. After being informed that the changes were successfully applied, expand the Firewall category at the top of the administrative console page then choose the Rules option.
11. Select the MANUFACTURINGZONE interface ( Example ).
12. Click the Disable button associated with the IPv4 rule shown in the MANUFACTURINGZONE interface ( Example ).
13. Click the Apply Changes button.
14. Close the Web Browser.
15. Begin the configuration of the client VPN connection by clicking the network connection icon found directly to the right of the current time at the top of the Kali desktop ( Example ).
16. Expand the VPN Connections category then click the Add a VPN connection... option ( Example ).
17. Choose the Layer 2 Tunneling Protocol (L2TP) VPN from the pull down menu ( Example ).
18. Click the Create... button.
19. Type the IP address 10.0.105.1 into the Gateway: field ( Example ).
20. Type the username remote into the User name: field ( Example ).
21. Click the IPSec Settings... button.
22. Check the box labeled Enable IPSec tunnel to L2TP host ( Example ).
23. Type Password01 into the Pre-shared key: field ( Example ).
24. Check the box labeled Show password and verify that the password entered is Password01.
25. Click the OK button.
26. Click the Save button.

Part 8
Attempt to exfiltrate data from a system protected by a firewall

In this part of the lab you are going to an exploit systems protected by a firewall.

1. Access a terminal window on the Kali system.
2. Use the command nmap 10.0.255.0/24 to remotely scan the network segment containing the ICS systems.
3. When the command completes, notice that the firewall now blocks the network scan.
4. Use the command smbclient //10.0.255.101/c$ -U administrator to attempt and start an SMB (file share) connection with the HMI system.
5. Take a screen shot showing the entire Kali window and the output from the smbclient command ( Example ) then paste it into the VPN Lab Form found here.

Part 9
Attempt to use Wireshark to decode an encrypted remote session

In this part of the lab, you will use Wireshark's follow stream functionality to demonstrate that an encrypted remote session cannot be easily decoded.

1. Start the VPN connection by clicking the network connection icon found directly to the right of the current time at the top of the Kali desktop, expanding the VPN Connections category then clicking the VPN connection 1 option.
2. Type in the password Password01 then click the OK button.
3. Start the Wireshark program by typing the command wireshark
4. After the Wireshark program starts select the manufact-zone network device to indicate that you wish to capture data on that device ( Example ).
5. Click the Start Capturing packets button to begin capturing network data ( Example ).
6. Open a new terminal (command prompt) window by clicking the Terminal Emulator button found at the upper left hand corner of the window.
7. Connect to the PLC by typing the command nc 10.0.255.102 23
   • The nc command starts the netcat program which is useful network utility that allows a quick connection to network services. In this case netcat is connecting to the telnet service running on the PLC.
8. End the terminal session by typing the command exit
9. Return to the Wireshark window.
10. Stop capturing network traffic by clicking on the Stop Capturing packets button ( Example ).
11. Click in the display filter field, type ip.addr==10.0.255.102 then click the Apply display filter button or press <ENTER> to activate the filter (Example).
12. Note that no packets are displayed even though the nc program showed that a connection to the PLC was successful.
13. Answer the remaining questions in the VPN Lab Form found here.
14. To end the lab, power off the virtual machines.