Implementing Tenable Nessus Vulnerability Scanner
Implementing Tenable Nessus Vulnerability Scanner
This project started by downloading and installing Nessus Scanner on Kali Box from: https://www.tenable.com/products/nessus/nessus-essentials
Running Nessus on Kali Box:
Opening Nessus from https://kali:8834/
Once Tenable Nessus is open and ready to run, the Advanced Scan’ was selected to scan the Metasploitable Box and personal Home Network.
Metasploitable Scan:
The screenshot below illustrates the result of running the ‘Advanced Scan’ on Metasploitable:
Vulnerabilities Details of the Metasploitable Scan:
Vulnerabilities in Metasploitable:
Many Vulnerabilities of varying severity were scanned on Metasploitable using the Advanced Scan. Some of the Critical Vulnerabilities scanned are VNC Server ‘password’ Detection, SSL Version 2 and 3 Protocol Detection, Bash Remote Code Execution (Shellshock), and Weak Debian OpenSSH Keys.
VNC Server ‘password’ Detection:
Get Kiran Limbu Phudong’s stories in your inbox
Join Medium for free to get updates from this writer.
VNC Server ‘password’ Detection is a critical vulnerability with a CVSS score of 10. The VNC server is configured with a weak or default password, making it extremely easy for attackers to gain remote access. Once connected, they will gain full graphical access to the system, enabling them to view and control the desktop, execute commands, install malware or backdoors, exfiltrate data, and use the system as a pivot point for lateral movement.
SSL Version 2 and 3 Protocol Detection:
SSL Version 2 and 3 Protocol Detection is another critical vulnerability with a CVSS score of 9.8. The system supports outdated SSL protocols (v2/v3), which are vulnerable to multiple attacks and lack modern cryptographic protections. Their presence allows man-in-the-middle (MITM) attacks, decryption of sensitive data, session hijacking, and downgrade attacks that force clients to use insecure protocols.
Bash Remote Code Execution (Shellshock):
Bash Remote Code Execution (Shellshock) is another critical vulnerability with a CVSS score of 9.8. This vulnerability allows attackers to execute arbitrary commands via specially crafted environment variables in Bash. This can lead to full remote code execution, privilege escalation, installation of persistent malware, data theft or destruction, and compromise of other systems via pivoting.
Weak Debian OpenSSH Keys:
Weak Debian OpenSSH Keys is another critical vulnerability with a CVSS score of 9.8. Debian systems generated predictable SSH keys due to a bug in OpenSSL, making brute-force attacks feasible. The attacks could include BEAST, DROWN, or Heartbleed. These issues can allow attackers to decrypt encrypted traffic, impersonate trusted services, steal session cookies or credentials, and undermine trust in secure communications.
Home Network Scan:
The Advanced Scan of the Home Network was completed, but did not yield any vulnerabilities or information. This possibly can be a ‘True Negative’ result, which might indicate there are no vulnerabilities. On the other hand, this could also be a ‘False Negative’, meaning the scan was not able to capture the vulnerabilities, which then could be very misleading and lead to dangerous conclusions. Having said this, the Advanced Scan was able to yield results for the Metasploitable Scan, and therefore, the result of the Home Network scan may indeed be a ‘True Negative’ result.
Remediation of Critical Vulnerabilities:
VNC Server ‘password’ Detection:
In order to remediate the VNC Server ‘password’ Detection vulnerability, the default password should be changed immediately to a strong, complex one. VNC, if not required, should be disabled or access should be restricted only to trusted IPs. Use of encrypted VNC connections can reduce or minimize this vulnerability.
SSL Version 2 and 3 Protocol Detection:
In order to remediate the SSL Version 2 and 3 Protocol Detection vulnerability, SSLv2 and SSLv3 should be disabled for all server configurations. Only TLS 1.2 or TLS 1.3 should be enforced, and libraries such as OpenSSL, Apache, and Nginx should be updated to versions that support modern protocols.
Bash Remote Code Execution (Shellshock):
In order to remediate the Bash Remote Code Execution (Shellshock), Bash should be updated to the latest patched version. Only vendor-provided security updates should be applied. Scripts and services that rely on Bash for input parsing should be audited.
Weak Debian OpenSSH Keys:
In order to remediate Weak Debian OpenSSH Keys, all SSH keys using a patched version of OpenSSL should be regenerated. Old keys should be replaced. Systems for any lingering weak keys should be audited and revoked.
The End.
