14. Vulnerability Assessment

Cover Letter

Respected Information Security Team, It is with great pleasure that Oman Data Park - Cyber Security Park confirms our ability to deliver the requested red team assessment. The aim of this assessment, as we understand it, is to evaluate the effectiveness of your organization’s security posture through simulated attacks and other testing methods.

We assure you that all penetration testing activities will be conducted in a manner that adheres to industry’s best practices and standards, and that is both professional and ethical. The scope and objectives of the assessment will be clearly defined and agreed upon in advance, and all findings will be promptly reported to you in a comprehensive manner. We are aware that our team will be collaborating closely with your internal security staff and other relevant parties during the duration of the assessment. To minimize any potential disruptions to your business operations, we will cooperate with your team to ensure that all necessary precautions are taken.

We are confident in our ability to provide valuable insights and recommendations based on the results of this assessment. We look forward to working with you and your team to ensure the success of this engagement. Will you have any questions or concerns, please do not hesitate to contact us.

Sincerely, Oman Data Park - Cyber Security Park

Confidentiality Statement This proposal is confidential to “CUSTOMER” (hereinafter referred to as “CUSTOMER”) and Oman Data Park SAOC (hereinafter referred to as “ODP”). This proposal contains the intellectual property of Oman Data Park and other third parties with whom ODP has business relationships. It has been supplied to “CUSTOMER” on condition that it may not be disclosed, in whole or in part, to any party other than those of your employees and professional advisors who need to see it to evaluate the proposal. It may not be used for any other purpose. © Copyright Oman Data Park 2025 All Rights Reserved. Other than the purposes specified above, no part of this document may be reproduced in any form or by any means without the prior written permission of ODP. Whilst every care has been taken to ensure that the contents of this proposal are complete and realistic, ODP reserves the right to change or withdraw this document in the light of further information on “CUSTOMER” specific requirements.

Executive Summary

Oman Data Park- Cyber Security Park (ODP-CSP) is pleased to submit a proposal to “CUSTOMER” for a comprehensive Vulnerability Assessment and Penetration Testing (VAPT) services. The objective of this VAPT is to identify and address potential vulnerabilities and weaknesses in “CUSTOMER”’s IT infrastructure. Our team of experienced professionals will utilize a combination of automated and manual testing techniques to provide a comprehensive evaluation of “CUSTOMER”’s network, systems, and applications.

The testing process will be performed by our highly skilled and certified ODP-CSP offensive security team, who will conduct thorough testing of the IT infrastructure. This will include testing web applications, network infrastructure, and endpoint devices. Our team will work closely with “CUSTOMER”’s relevant department to ensure that the testing process is minimally disruptive to daily operations.

Upon completion of the VAPT, ODP-CSP will provide “CUSTOMER” with a comprehensive report detailing all identified vulnerabilities, showcasing a step-by-step approach to breakdown the team’s approach and methodology, the severity of each identified vulnerability, and recommendations for mitigation. Our team will also provide detailed technical debriefing to “CUSTOMER”’s relevant team(s), including recommendations on how to implement effective security measures to address identified vulnerabilities.

Background

Oman Data Park is a joint venture company owned by Oman Telecommunications and 4-Trust, a part of National Trading Company. The partnership brings an unrivalled combination of network infrastructure and management expertise to ensure unmatched service and reliability to its customers. Oman Data Park has Data Centre’s in Wattaya, Knowledge Oasis Muscat and Duqm. The facilities provide the highest levels of performance, simultaneously providing the most robust, fault-tolerant site infrastructure, redundant capacity systems and multiple distribution paths to serve business critical IT needs of its customers. Oman Data Park operates both

$24 \times 7 \times 365$

Security Operation Centre (SOC) and Network Operation Centre (NOC) which are ISO27001 & ISO 20000 Certified. Oman Data Park is the first the Managed Security Services provider in Oman that provides both practice and detective security services. It operates on

$24 \times 7 \times 365$

basis. The incident response team is available across the clock to provide the assistance needed on site or remotely

Associations

Offensive Security Team

As Oman embarked on its digital transformation journey, Oman Data Park emerged as the pioneer company in driving the cybersecurity pillar of this transformation. An Omani company led by the industry’s top leaders and experts over the last decade.

We are a $100 \%$ Omani team, with a deep understanding of the local business landscape and culture, giving us a unique edge when providing tailored security solutions and assessments for our clients.

Our team members hold multiple top leading industry-level certifications and trainings - from OffSec’s OSCP, OSWE, OSEP, and OSED, to CRTO, CRTP and CRTE, as well as courses from SpecterOps’ Adversary Tactics: Red Team Operations. We have a plethora of experience across multiple industries, from finance, banking, and insurance to oil & gas, aviation, and healthcare amongst others. All members of our team have discovered zero-day vulnerabilities within national and international applications, demonstrating their exceptional skills and abilities to identify and exploit vulnerabilities that may have been missed by other teams. Our team provides customized solutions that fit the unique needs of each client, working closely with them to identify and mitigate potential risks before they are exploited. We prioritize keeping our clients in the loop when conducting engagements, keeping a close communication & collaboration link to ensure that they have a full understanding of their security posture.

Our commitment to excellence is reflected in our track record of successful engagements and longterm relationships with our clients.

Proposal Overview Scope of Work ODP-CSP will provide “CUSTOMER” with the requested security assessment services to assess and measure “CUSTOMER”’s overall security posture. ODP-CSP will provide the knowledge and technical expertise to conduct a comprehensive security assessment service through the services specified in the table below. This is to begin upon an agreed date and last for the duration specified.

Approach

Provided that our proposal is accepted, the project will follow a structured approach, divided into distinct phases to allow for comprehensive analysis and thorough evaluation of “CUSTOMER”’s environment. The schedule will be adjusted as information is discovered in each phase and is dependent on resource availability. Each service will run on a different milestone, which may overlap, but won’t hinder the work. The duration of each phase is exclusive of the final report submission. ODPCSP will not be held to timelines for delays caused by the client.

Table 1 - Penetration Testing Approach

Client Provided Property ODP-CSP requires the following information detailed in the table below, to be able to commence with and successfully complete the specified Scope of Work (SOW). Listed on the table below is the required information/details:

Table 2 - Client Provided Property

ODP-CSP proposes the following testing and penetration testing and deliverable schedule to provide “CUSTOMER” with an overview of the general assessment timelines. It is anticipated that exact timeframes for assessment and consulting activities will be finalized during the planning process.

Table 3 - Deliverables

Penetration Testing Methodology

The Penetration Test provides a comprehensive security evaluation of the network with the goal of identifying and leveraging vulnerabilities in Internet-facing systems. ODP-CSP uses a structured methodology and publicly available information to identify and/or verify the network ranges that comprises “CUSTOMER”’s networks, identify potential vulnerabilities, and, when requested by “CUSTOMER”, attempt to exploit these vulnerabilities to demonstrate their potential business impact. To present a realistic attack scenario, the test will be conducted with no prior knowledge of or access to “CUSTOMER”’s IT environment.

External Penetration Test

Methodology

The External Penetration Test consists of the following stages:

Table 4 - External Penetration Testing Methodology

Stage 1 - Footprinting: ODP-CSP begins the assessment by performing some basic research on publicly available sources to verify the ownership of the provided target ranges and to search for readily available information (Open-Source Intelligence or OSINT) that would be useful to an attacker targeting a network. Such information is often useful in identifying potential usernames and passwords to try in password spraying attacks and in identifying details about the network infrastructure, such as versions of the software in use, and the types of devices on the network.

Tools Used: WHOIS, nslookup, dig, Shodan, search engines. Stage 2 - Host Discovery & Enumeration: The purpose of this stage is to perform an inventory of all the live hosts in the target IP address ranges approved by “CUSTOMER”’s Point of Contact (POC). The primary steps of that constitute this process are:

DNS Mining: The first phase of discrete host discovery is to examine Domain Name Service (DNS) records for the target network. Using reverse and brute-forced forward DNS lookups, ODP-CSP assembles a list of hostnames in the network, along with the associated IP addresses. This list is then manually reviewed to determine likely roles and services provided by the systems based on the hostname(s) assigned. In some cases, geographic or sub-organization structures of the network can also be determined by analysis of the hostnames. Tools Used: Nmap, Recon-NG, Shodan, Custom Scripts, Other scanning tools. Host Discovery: The process of host discovery is initiated with ICMP ping sweeps to determine live hosts. However, this process does not always produce a comprehensive list of Internet-routable hosts. This can be attributed to the rejection of ICMP packets by most perimeter firewalls or other filtering devices. Thus, ODP-CSP augments this process by using TCP and UDP based discovery methods that query commonly available services such as HTTP, SMTP, DNS, VPN services and SNMP, to detect Internet-accessible hosts through positive responses. In addition, ODP-CSP performs source port scans to locate additional hosts that may be protected by elementary router access controls. Tools Used: Nmap, Vulnerability Scanners, and other scanning tools. Port and Service Enumeration: Having amassed a list of live hosts, ODP-CSP proceeds to identify services listening on TCP and UDP ports. This is achieved by executing automated and manual TCP and UDP port scans against the list of known active hosts. The types of scans include, but are not limited to, TCP connect scans, TCP SYN scans, and UDP data packet scans. Due to the time-consuming nature of port scans, the initial scans are targeted to probe only the commonly available services like HTTP,

SMTP, DNS, NetBIOS, etc. Depending on the responses received, the targeted scans are typically followed by comprehensive scans that query all 65536 (0-65535) TCP and UDP ports. In addition to determining the open ports, ODP-CSP also attempts to map these ports to the corresponding service daemons by running automated service fingerprinting tools and evaluating the banners returned by the various service daemons by listening on the host. These banners normally yield definitive clues to the version of the service running. Tools Used: Nmap, Vulnerability Scanners, tcpdump, WireShark, and Custom Scripts. Operating System Identification: To build a comprehensive inventory prior to the attack and penetration phases, it is essential to determine the underlying operating system of the live hosts. ODPCSP uses publicly available tools to accomplish operating system identification. These tools function by observing subtle variances received in response to specially crafted TCP and UDP packets directed at the live hosts. The variations in the responses arise due to the minor differences in the implementation of TCP/IP stacks of different operating systems. In addition to using automated tools for this purpose, ODP-CSP also evaluates the banners returned by the various service daemons listening on the host. These banners normally yield definitive clues to the type of operating system deployed. Tools used: Nmap, vulnerability scanners, netcat, sysinternals tools, and custom scripts Network Topology Mapping: ODP-CSP uses a combination of ICMP, TCP and UDP-based route tracing methods to determine the various paths into Customer’s network. The results of these network probes are collated to create a baseline network map as perceived by an outside observer. This allows ODPCSP to properly evaluate the security of the external facing hosts in the context of the externally visible network.

Many of the tools used concentrate on soliciting information from misconfigured routing devices, allowing an outside attacker to not only determine the network architecture available to the Internet, but also to discover implemented protocols. Tools used: ping, trace route, Nmap netmask and timestamp requests Stage 3 - Vulnerability Identification & Exploitation: After thoroughly mapping out the target space, ODP-CSP consultants conduct testing to identify vulnerabilities and determine if they are exploitable. ODP-CSP tests each running service on each Internet accessible system to identify any security risks that could be exploited by an attacker from the Internet. Automated tools are used to perform an initial check of the environment, but most of the testing is performed using manual techniques to discover vulnerabilities and misconfigurations and to attempt to exploit those issues, where possible, to gain access to systems and/or to sensitive information. Tools used: Nessus, Metasploit framework, Nikto, Nmap, OS commands, and custom scripts and tools Stage 4 - Vulnerability Exploitation: When explicitly approved by “CUSTOMER”, ODP-CSP proceeds to exploit any identified vulnerabilities. The purpose of this exercise may be to emphasize the impact of a potential compromise. This process entails the use of built-in operating system commands and the execution of verified exploit code to gain unauthorized access to any vulnerable machines. Tools used: Tested exploits, native MS Windows and Unix commands, NetCat, Metasploit Framework, SQLmap and custom scripts

Red Team Execution Phases

The goal of the Red Team Assessment is to assess the effectiveness of “CUSTOMER”’s information security detection, prevention and response capabilities by leveraging real-world, objective-based adversarial techniques to attempt to penetrate the external perimeter, establish a foothold on the internal environment, and accomplish specific attack objectives mutually defined by “CUSTOMER” and ODP-CSP. Example objectives may include gaining access to “CUSTOMER”’s data, compromising internal domain administrator credentials, or demonstrating access to email or critical business systems. To present a realistic attack scenario, the test will be conducted with no prior knowledge of or access to Oman Data Park’s IT environment. Additionally, ODP-CSP will utilize techniques specifically designed to evade detection by IT Security teams and controls.

Approach

In the Planning phase, ODP-CSP testers will interact with “CUSTOMER”’s stakeholders, scope the project, develop a project plan and rules of engagement, and coordinate all assessment activities.

Methodology

The specific methodology used during this testing may be customized during the engagement based on results and findings, but will generally follow the following stages:

Stage 1: Identification. The goal of this stage is to identify, assess, and catalogue both human and technical targets that would be most susceptible to compromise by an external adversary. ODP-CSP may leverage both open-source intelligence collection techniques (OSINT) and active scanning tools to locate Internet-accessible systems and applications. Each potential target may be evaluated for further testing based on multiple factors, including exposed ports and services, technical architecture, functionality, potential vulnerabilities, ease of compromise, and value to an attacker.

ODP-CSP may also leverage OSINT to identify potential Oman Data Park employees for targeting using social engineering techniques. This process entails collection and analysis of data derived from publicly accessible sources such as search engines, social media, “CUSTOMER” owned websites, and other online resources that provide the information necessary to create and execute targeted social engineering attacks against specific individuals. The outcome of the Identification stage is a master list of potential targets that will be evaluated and prioritized for exploitation. Tools used: WHOIS, nslookup, dig, search engines Stage 2: Exploitation. During the Exploitation stage, ODP-CSP will leverage the analysis conducted during the Identification stage to select high-potential targets, customize technical and social engineering attacks designed specifically for those targets, and execute the attacks to gain access to internal “CUSTOMER”’s networks. The Exploitation stage may include any of the following: Technical Exploitation - Upon identification of vulnerabilities in Internet-facing systems and applications, ODP-CSP may attempt to exploit those vulnerabilities to compromise sensitive data or gain a foothold within the perimeter. Additionally, ODP-CSP may execute attacks against systems with the goal of gaining further insight into the environment to identify additional targets or gain additional targeting information. Types of attacks typically used during this activity include SQL Injection, upload and execution of web shells, and brute force attacks against login interfaces. Social Engineering - ODP-CSP may also target “CUSTOMER”’s employees using both phone and emailbased techniques. Individuals may be selected from the target list based on job function, presumed access to important internal systems, and perceived susceptibility. ODP-CSP will tailor the phone and email-based attacks to each user in an attempt to perform various potentially harmful actions, including revealing login credentials, visiting unknown websites, or executing malware on the target’s corporate IT asset. The goal of the Exploitation stage is to breach the perimeter and access internal systems. Technical exploitation is often accomplished by compromising Internet-facing systems and leveraging that access to attack adjacent systems within the environment. Social engineering exploitation is often achieved by obtaining valid credentials that can be leveraged to access the environment via remote access solutions (e.g., VPNs) or via installation of malware on the user’s machine that allows ODP-CSP to operate within the internal environment under the context of the user.

Stage 3: Post-Exploitation. Upon gaining access to the internal environment, ODP-CSP will attempt to move laterally throughout the intranet and ultimately gain access to “CUSTOMER” sensitive data and critical business systems. The post-exploitation stage may involve the following: Privilege Escalation - Upon gaining access to a system, ODP-CSP may leverage various attacks to escalate the privileges of the current user to the highest levels. This escalated privilege allows ODP-CSP to perform a variety of malicious activities, including establishing persistence, installing additional malware (e.g., key loggers), and capturing credentials. Internal Exploitation - By leveraging the same techniques used during Identification stage, ODP-CSP may search for internal data repositories, portals, collaboration forums, and other internal sources that provide access to sensitive data and assist in locating high-value targets within the intranet. Additionally, ODP-CSP may identify internal systems that can be compromised via technical exploits to gain further access to the environment or capture additional credentials. Credential Harvesting - Once access to internal systems has been obtained, ODP-CSP may begin collecting account credentials for valid internal users. Specific focus will be given to identifying and extracting privileged domain credentials, as these provide extensive access to the environment. Typical credential harvesting attacks include dumping hashes, Kerberos tickets, and cleartext credentials from local system memory or accessible virtual machine files and identifying accessible scripts and configuration files with hard-coded credentials. In most attacks, post-exploitation is an iterative process that involves multiple cycles of identifying internal targets, compromising those targets, and extracting additional information and credentials for further lateral movement within the intranet. As noted above, the goal of this stage is to accomplish the predefined attack objectives. This is often accomplished by demonstrating full administrative access to critical systems (e.g. financial application servers, key databases, executive email and file shares), the internal authentication and authorization systems (e.g., Active Directory, LDAP, two-factor authentication), or the core network infrastructure (e.g., RADIUS, TACACS). A secondary objective of this assessment is to measure the detection and response capabilities of the information security team, ODP-CSP will utilize testing and attack techniques that are specifically designed to bypass or evade security controls. The team will leverage custom malware that may not be detected by commercial anti-virus products and avoid using any scanning or exploitation techniques that are likely to be observed by system users or detected by network sensors and endpoint controls. If “CUSTOMER” information security team detects the test in progress, the ODP-CSP project manager and “CUSTOMER”’s PM will select an appropriate course of action for the continuation of testing. Testing activities will be discussed and agreed upon by both ODP-CSP and “CUSTOMER” during the project kick-off meeting. This document may include the specific scope of the engagement (e.g., whitelisted targets, blacklisted targets), coordination and approval necessary prior to exploitation of targets, schedules and timeframes, data handling and communications plan, and escalation policy. Stage 4: Exfiltration Testing. During this stage of testing, ODP-CSP will attempt to securely transfer test/sample data out of the Oman Data Park network environment. The purpose of this testing is to determine if network and host-based defences will identify and/or prevent such a transfer. This testing would include the transmission of simulated data created by ODP-CSP.

Offensive Tooling

The team utilizes multiple vetted tools from customized open-source tooling, as well as commercial ones to ensure comprehensive and effective engagement takes place. Tooling will usually be different per engagement as each environment is unique, though the below ones are the most used and fit the current industry standards such as OWASP and PTES.

Please note that the table above includes some of the main tools that we commonly use in our engagements, but it is not an exhaustive list, and we may use additional tools or techniques depending on the specific needs of each engagement.

Sample Penetration Testing Report Network Penetration Test Table of Contents

1. Statement of Proprietary and Confidentiality ….. 4
2. Engagement Contacts ….. 5 2.1 Scope ….. 5 2.2 Client Details ….. 5 2.3 Purple Team Details ….. 5 2.4 Document Control ….. 5
3. Executive Summary ….. 6 3.1 Approach ….. 6 3.2 Assessment Overview ….. 7
4. Technical Overview ….. 8 4.1 Findings Overview ….. 8 4.2 Attack Path Narrative ….. 9 4.2.1 PRINTSRV - Remote Code Execution ….. 9 4.2.2 PDC - Kerberoasting ….. 10
5. Technical Details ….. 12 5.1 ID-001 Reversible Encryption Enabled ….. 12 5.2 ID-002 Insufficient Account/Role Segregation & Tiering ….. 14 5.3 ID-003 Remote Code Execution - Symantec/Veritas Backup Exec ndmp ….. 15 5.4 ID-004 Domain Credential Hardening ….. 17 5.5 ID-005 Insufficient Network Segmentation ….. 18 5.6 ID-006 Weak Password Policy ….. 19 5.7 ID-007 Insufficient Lightweight Directory Access Protocol (LDAP) Security ….. 21 5.8 ID-008 Scanner User with Administrator over all Employee Accounts ….. 23 5.9 ID-009 Outdated Kerberos Ticket Granting Ticket (KRBTGT) Account Password ….. 25 5.10 ID-010 Privileged Accounts outside of Protected Users Group ….. 27 5.11 ID-011 Domain User with Dangerous Permissions ….. 28 5.12 ID-012 Service Account in Domain Admins Group ….. 32 5.13 ID-013 Windows & PowerShell Remoting Enabled ….. 33 5.14 ID-014 NTP Server Out of Sync ….. 35 5.15 ID-015 Misconfigured Password Expiration Policy ….. 36 5.16 ID-016 Outdated EDR Agents ….. 37 5.17 ID-017 Server Message Block (SMB) v1 Protocol Enabled ….. 40 5.18 ID-018 LLMNR NBT-DS Enabled ….. 42
6. Appendix ….. 43

Figure 1 - Network Sample Report

Figure 2 - Sample Network Finding

Table of Contents

1. Statement of Proprietary and Confidentiality ….. 3
2. Engagement Contacts ….. 4 2.1 Scope ….. 4 2.2 Client Details ….. 4 2.3 Penetration Testing Team Details ….. 4 2.4 Document Control ….. 4
3. Executive Summary ….. 5 3.1 Approach ….. 5 3.2 Assessment Overview ….. 6
4. Technical Overview ….. 7 4.1 Findings Summary ….. 7 4.2 Attack Path Narrative ….. 8
5. Evidence ….. 9 5.1 ID-001 Remote Code Execution via Unrestricted File Upload ….. 9 5.2 ID-002 Directory Listing Enabled on Application Path ….. 12 5.3 ID-003 Broken Access Control - Unrestricted Admin Access ….. 13 5.4 ID-004 Reflected Cross Site Scripting (XSS) ….. 16 5.5 ID-005 Stored Cross Site Scripting (XSS) ….. 17 5.6 ID-006 Laravel Debug Mode Enabled ….. 19 5.7 ID-007 Information Disclosure - Internal path ….. 22 5.8 ID-008 Information Disclosure - Verbose Error Messages ….. 24 5.9 ID-009 Username Enumeration via Password Reset Functionality ….. 26 5.10 ID-0010 ASP.NET Version Disclosure ….. 28 5.11 ID-0011 Lack of Rate Limiting ….. 29
6. Appendix ….. 30 6.1 Appendix A - Finding Severities ….. 30 6.2 Appendix B - Changes/Host Cleanup ….. 31 6.3 Appendix C - Compromised Users ….. 31 6.4 Appendix D - Abbreviations ….. 32

Figure 3 - Sample Web Application Report

Figure 4 - Sample Web Application Finding

Table of Contents

STATEMENT OF PROPRIETARY AND CONFIDENTIALITY ….. 1

1. ENGAGEMENT CONTACTS ….. 5 1.1 Scope Details. ….. 5 1.2 Client Details ….. 5 1.3 Red Team Details ….. 5 1.4 Document Control ….. 6
2. EXECUTIVE SUMMARY ….. 7 2.1 Approach ….. 7 2.2 Assessment Overview. ….. 8
3. TECHNICAL OVERVIEW ….. 10 3.1 Findings Summary ….. 10 3.2 Remediation Summary ….. 11 3.2.1 Short Term ….. 11 3.2.2 Medium Term ….. 11 3.2.3 Long Term ….. 12
4. OBJECTIVES ….. 13 4.1 Assess ACME’s network From a Black Box perspective ….. 13 4.2 Assess ACME’s network From a Grey Box perspective ….. 14 4.3 Perform an Active Directory Configuration Review. ….. 15
5. ATTACK PATH NARRATIVE ….. 16 5.1 Attack Path Diagram ….. 16 5.1.1 Black Box Methodology ….. 16 5.1.2 Grey Box Me thodology ….. 18 5.2 Detailed Attack Path Narrative ….. 19
6. TECHNIQUE BREAKDOWN ….. 23 ID-001 Domain Credential Hardening - Critical. ….. 23 ID-002 Domain Privilege Escalation - DFSCoerce - Critical ….. 26 Id-003 Domain Privilege Escalation - Pettipotam - Critical ….. 29 ID-004 Domain Privilege Escalation - NoPAC - Critical ….. 32 ID-005 Lack of Domain Admin Tiering - Critical ….. 34 ID-006 Default Credentials - Cisco Switch - Critical ….. 36 ID-007 LLMNR/NBT-NS Poisoning - Critical. ….. 38 ID-008 Weak Password Policy - Critical ….. 42 ID-009 Broken Access Control - Unrestricted Admin Access & Defaut Credentals - Critical ….. 46 ID-010 Outdated Operating Systems - Critical ….. 50 ID-011 Insufficient Network Segmentation - Critical ….. 51 ID-012 Misconfigured Password Expiration Policy - Critical ….. 52 ID-013 Improper Password Storage Methods - High ….. 53 ID-014 Insufficient Lightweight Directory Access Protocol (LDAP) Security - High ….. 54 ID-015 Insufficient Hardening - Windows & PowerShell Remoting Enabled - High ….. 56 ID-016 Outdated Kerseros Ticket Granting Ticket (KRBTGT) Account Password - High. ….. 59 ID-017 Privileged Accounts outside of Protected Users Group - High ….. 62 ID-018 Insufficient Logging and Monitoring - High ….. 63 ID-019 Lack of Visitor Identification Protocol - High. ….. 64 ID-020 Misconfiguration - Default Machine Account Quota - Medium ….. 65 ID-021 Poor Surveillance Coverage - Medium. ….. 68 ID-022 Server Message Block (SMB) v1 Protocol Enabled - Medium ….. 69
7. APPENDIX ….. 70 7.1 Appendix A - Risk Rating System ….. 70 7.1.1 Impact ….. 71 7.1.2 Exploitability ….. 72 7.1.3 Objective Statuses ….. 73 7.2 Appendix B - Observations ….. 73 7.3 Appendix C - Changes/Host Cleanup ….. 74 7.4 Appendix D - Exploited Hosts ….. 75 7.5 Appendix E - Compromised Users ….. 75 7.6 Appendix F - ACL Anomalies. ….. 76 7.7 Appendix G - Computer Members with High Privileges, ….. 76 7.8 Appendix H - Domain Admins not in Protected Users Group ….. 77 7.9 Appendix I - Dorman Accounts ….. 78 7.10 Appendix J - Ghost Computers ….. 84 7.11 Appendix K - Obsolete Operating Systems. ….. 89 7.12 Appendix L - Passwords Unchanged in 42 + Days ….. 90 7.13 Appendix M - Users that Bypass Password Policy ….. 98 7.14 Appendix N - Users without Password Expiration ….. 99 7.15 Appendix O - SMBv1 Enabled Hosts ….. 109 7.16 Appendix P - Abbreviations. ….. 111 7.17 Appendix Q - MITRE ATTACK Licene ….. 112

Figure 5 - Sample Red Team Report

Figure 6 - Sample Red Team Finding

ODP-CSP follows the Iterative method when it comes to managing penetration testing projects as they follow a linear process of initiating, scoping, testing, revalidating, and delivering the project.

Initiate Project

This phase marks the beginning of the penetration testing engagement, where initial planning and alignment with “CUSTOMER” takes place. The goal is to set clear objectives, define timelines, and establish expectations for the project’s deliverables. Define the project’s objectives, deliverables, and timeline. Engage stakeholders to confirm scope, expectations, and responsibilities. Allocate resources and assign roles within the project team.

Define Scope

In this phase, the project scope is clearly outlined to ensure both ODP-CSP and “CUSTOMER” have a mutual understanding of what will be tested and any constraints. This step is essential to avoid scope creep and align on specific assets or systems that require attention. Identify assets, systems, and networks included in the testing. Clarify boundaries and exclusions for testing activities. Document the testing objectives, limitations, and any special requirements from the client.

Execute Testing

This is the core phase where the actual penetration testing activities are conducted. ODP-CSP leverages a mix of tools, methodologies, and manual techniques to identify vulnerabilities and potential risks within the defined scope. Conduct penetration testing based on the defined scope and methodologies. Identify, analyse, and document vulnerabilities, along with their potential impacts. Use a combination of automated tools and manual testing techniques for comprehensive results.

Deliver Detailed Report

After the testing is completed, the findings are compiled into a detailed report. This report is designed to convey technical findings in a clear, actionable manner for both technical and non-technical audiences, outlining vulnerabilities and providing recommendations. Prepare a comprehensive report with findings, including severity and potential impacts. Provide remediation and mitigation recommendations for identified vulnerabilities.

Present findings to “CUSTOMER”’s, explaining technical issues in a clear format. Revalidated Controls In this final phase, the ODP-CSP retests previously identified vulnerabilities to confirm remediation efforts have been successfully implemented. This step ensures that the environment is secure and that the project objectives are fully met. Retest vulnerabilities to confirm effective remediation. Validate that the implemented controls meet security standards. Close the project upon successful revalidation, ensuring all identified issues are addressed. This structured approach helps to ensure that all aspects of the penetration testing process are handled efficiently and comprehensively, providing clear value to “CUSTOMER”

High Level Timeline ODP-CSP proposes the following penetration testing and deliverables schedule to provide “CUSTOMER” with an overview of the general assessment timelines. It is anticipated that exact timeframes for the assessment and consulting activities will be finalized during the planning process.

Table 5 - High Level Overview Table

Figure 7: Client References

Experience & Qualifications Mohammed Al Balushi - Red Team Manager

Areas of Expertise

Mastery in simulating adversarial techniques on large enterprises. Detailed proficiency with technical report writing. Experience across entities both locally and internationally.

Certifications

Offensive Security Web Expert (OSWE) Offensive Security Experienced Penetration Tester (OSEP) Offensive Security Certified Professional (OSCP) Zero Point Security - Certified Red Team Lead (CRTL) Zero Point Security - Certified Red Team Operator (CRTO) Pentester Academy - Certified Red Team Expert (CRTE) Pentester Academy - Certified Red Team Professional (CRTP) Hackthebox Certified Dante & APT Pro Lab

Achievements

1st Place - Cyber Talents Oman National Cybersecurity Competition 2020 1st Place - Oman HUSN CTF 2021 1st Place - Cyber Talents Oman National Cybersecurity Competition 2021 2nd Place - Oman Cyber Drill 2022 2nd Place - Oman Threat Hunters (Seniors) 2020 Discovered 3 Zero days in leading banks and international applications Conducted Country Level Scoped Red Team Assessments HackTheBox Top 5 Worldwide Haitham Al Siyabi - Red Team Operator

Areas of Expertise

Offensive Security Red Teaming Windows Active Directory Python and Golang Programming Bug Bounty Hunting

Certifications

Offensive Security Web Expert (OSWE) Offensive Security Certified Professional (OSCP) eLearnSecurity - Certified Professional Penetration Tester (eCPPTv2) Pentester Academy - Certified Red Team Professional (CRTP) eLearnSecurity - Junior Penetration Tester (eJPT)

Achievements

1st Place - Cyber Talents Oman National Cybersecurity Competition 2020. 1st Place - Oman HUSN CTF 2021. 1st Place - Cyber Talents Oman National Cybersecurity Competition 2021. 1st Place - Cybersafe Oman Incident Response Competition 2022. 2nd Place - Oman Cyber Drill 2022. Top 1% of participating students in Python Programming Competition. Finalist of 2021/2022 IoT challenge. 65,000+ points with $150+$ training hours/CPE points. Finalist of 2021/2022 IoT challenge. Created custom red team tooling on GitHub: GoMugger Tariq Al Harrasi - Red Team Operator

Areas of Expertise

Red Teaming & Adversary Simulation Windows Active Directory Python, Go & C/C# Programming Offensive Development Infrastructure Automation & Development DevOps & CI/CD Threat Hunting

Certifications

Offensive Security Experienced Penetration Tester (OSEP) Zero Point Security - Certified Red Team Operator (CRTO) Altered Security - Certified Red Team Professional (CRTP) Cyber Warfare Lab - Certified Red Team Infrastructure Developer (CRT-ID) SpecterOps - Adversary Tactics: Red Team Operations (AT:RTO) White Knight Labs - Advanced Red Team Operations (ARTO) White Knight Labs - Offensive Development (OD) EC-Council - Certified Ethical Hacker v12 (Practical)

Achievements

Helped develop and instruct the Advanced Red Team Operations Course by WKL Speaker @ Black Hat Oman 2nd Place - NTG Hacktivate Capture the Flag 2023 Top 50% - Cyber Safe 2021 Taught Cyber Security & Ethical Hacking in a University Capacity Antisyphon Training - Nerd Herder Created Custom Tooling on GitHub (dOtxecute & Lavender-exe) Wrote articles on Computer Science and Red Teaming @ blog.securescape.cc