Vulnerability Assessment with Nessus — Hack The Box Academy
For this lab, you will need to spawn the target from the academy module and log in to Nessus at https:// < IP >:8834. The Nessus credentials are: htb-student:HTB_@cademy_student!.
- What is the name of one of the accessible SMB shares from the authenticated Windows scan? (One word)
There are several scans performed, so we need to access the Windows_basic_authed scan and click on our target host. Use the search feature in Nessus to find the vulnerability related to SMB share access.
We get several matches back:
Select the Microsoft Windows SMB Shares Access to get more information on it.
The information page that opens up shows us the vulnerability description, recommended solution, and the output. The output shows the shares that can be accessed as administrator; we just have to read its name.
2. What was the target for the authenticated scan?
Go back to scans and select the Windows_basic_authed or the Linux_basic_authed scan.
There is only one target host per scan, so we just need to read the IP address of this host.
3. What is the plugin ID of the highest criticality vulnerability for the Windows authenticated scan?
Get cyb3rloud’s stories in your inbox
Join Medium for free to get updates from this writer.
Access the Windows_basic_authed scan and click on vulnerabilities to get a view of all the vulnerabilities discovered in the scan. You will see Score, among other headers at the top, and the values listed vertically underneath it (10.0, 9.9, 9.8, etc.) represent the severity ratings for each corresponding row. Each row represents a specific vulnerability entry (like “Apache Log4j Unsupported Version Detection”). Click on it to toggle the sort order to display the vulnerability with the highest criticality.
Click on the first vulnerability to get more information on it. Nessus usually displays the vulnerability along with the Plugin ID in the title of the scan on this page, but you can also read the plugin ID from the Plugin Details on the side.
4. What is the name of the vulnerability with plugin ID 26925 from the Windows authenticated scan? (Case sensitive)
Access the Windows_basic_authed scan again and click on the target host. Earlier, we could search for vulnerabilities on the search bar because we knew the vulnerability we were looking for, but in this case, we know the plugin ID(26925).
Use the Filter option to filter using a number of criteria. Nessus allows us to filter for specific CVE’s, Host names, Severity scores, Metasploit Names, Plugin families, Plugin IDs, and more.
Select the plugin ID from the available dropdown and key in the plugin ID we are looking for after selecting the is equal to comparison operator, then apply this filter.
We get one match that shows the vulnerability in question is VNC Server Unauthenticated Access.
5. What port is the VNC server running on in the authenticated Windows scan?
Still on the Windows_basic_authed scan, we have found that our previous vulnerability is the VNC Server Unauthenticated Access. Click on the vulnerability to get more information on it.
A new page with valuable information, including the description and severity of the vulnerability, family, risk factor, and cvss score, shows us the output, which includes the hosts(IP address) and the port in which the service was running.
That’s it! I stream similar walkthroughs live over on my Discord Server. Check it out and join the community if you’re into hacking.
El Psy Kongroo!
