Network Security Project: Employee Monitoring and Access

This project details a network security investigation focused on monitoring an employee's computer usage. The project begins with network scanning using NMAP to identify the target system. A Kali Linux virtual machine is created for penetration testing. The project then explores SSH attacks, including brute-force password cracking using tools like HYDRA, Ncrack, and Medusa, to gain initial access. A backdoor is created using Python and the Paramiko library for persistent access. To monitor network traffic, a proxy server is implemented using SquidGuard, allowing the attacker to monitor all web traffic from the target system. The project demonstrates a comprehensive approach to ethical hacking and network security, including identifying vulnerabilities, gaining access, and monitoring activities. The project aims to simulate a white-hat hacking scenario, highlighting methods for securing networks against potential threats. The project concludes by summarizing the steps taken and the tools used, emphasizing the importance of network security measures.

Table of Contents
1. Introduction.......................................................................................................................................2
2. Scanning.............................................................................................................................................2
3. VM Creation......................................................................................................................................3
4. SSH attack........................................................................................................................................10
5. Continued Access.............................................................................................................................12
6. Proxy Implementation.....................................................................................................................16
7. Conclusion........................................................................................................................................17
8. References........................................................................................................................................17
1

1. Introduction
It is suspected that one of the employee "Philip Price" is leaking out the company's details to the
outside world. The investigation will be for monitoring the activities of Price and his usage of the
company's computer system. The entire network will be scanned, the target computer (Philip's
computer) will be identified. Target PC will be accessed by bye-passing the credentials,
attaching the SSH of the system. A proxy will be setup to monitor the traffic of the target system.
Suitable methods will be implemented to access the target system at any time whenever the
target system is in ON state. Entire activity is a part of white hat hacking (Venue, 2012) and the
results of the white hat hacking will be published.
2. Scanning
NMAP (Nmap.org, 2018) is installed in a windows system. It is a security scanner. It scanned all
the network and gave a network map. It displayed all the swathed systems and the open ports in
those systems. Target system found to be "price-pc". NMAP is assigned to scan only the target
system. Nmap sent a special packets to the target system and analyzed the responses. This tool
the following activities.
1. Host discovery
It discovered all the switched on systems in the network
2. Port Scanning
It displayed the open ports in the target system
3. Services identification
NMAP identified the services running in the target system along with the version of the
services
4. Operating system identification
NMAP found the operating system of the target system.
NMAP gave lot of other information as follows
2

Security settings and the devices in the network, open ports of the network, asset details, new
servers in the network, existing vulnerabilities of the network.
The outputs came as a XML file, line oriented tools, normal output
In our task we ran the following command.
nmap 192.168.1.0/24 -p22
3. VM Creation
Created VM with kali linux to access the target system. Kali linux got all the tools to crack the
password of the target system and to create a back door to access the target system whenever we
need.
Installed vmware work station.
3

Downloaded Kali linux ISO from https://www.kali.org/downloads/
4

5

6

7

8

9

4. SSH attack
SSH user name and password of the target machine are obtained by using brute force attack.
Frequently used password sheet is provided and are used in the experiment. Password sheet is
attached.
The passwords from https://packetstormsecurity.com/Crackers/wordlists/ can also be used for
this purpose.
10

HYDRA
Installed Hydra in the Linux system. Kali Linux got this tool pre-installed
NCrack
This tool is already installed in kali Linux
11

Medusa
5. Continued Access
Created back door using python. The attacking system is a kali linux system and hence it got all
the tools for continuous access. The process is followed. Two scripts are prepared. Paramiko
module is downloaded and used for this purpose.
While scanning the network it is found out that the network is fully secured with firewalls,
indows firewalls and anti-virus softwares. Most of the operating systems are fully patched. All
the security devices allowed port number 22. It is the SSH port.
Target machine is a windows 10, fully secured with IDS/IPS, Firewall, security patched, anti-
virus, incoming traffic blocked. Our attacker machine got Kali linux OS with Python.
Paramiko and python are necessary software.
Downloaded the Paramiko Library (Paramiko.org, 2018).
12