.. include:: global.rst


====================================================    
Lab 01: Identifying and Exploiting Vulnerabilities
====================================================

Lab Overview
------------

This lab walked through the vulnerability management lifecycle in an
isolated training environment: identifying a target system's OS version,
researching a known CVE, using an exploitation framework against a
deliberately vulnerable lab machine, and reviewing the security lapses
that made the exploit possible.

What Was Covered
-----------------

.. rubric:: Guided Exercises

- Identified the OS version and build of the ``TargetWindows01`` lab
  system via the About Windows dialog.
- Researched **CVE-2017-0143** (SMBv1 remote code execution) on the
  NVD, including its CVSS Base Score.
- Located the corresponding **MS17-010**
  EternalRomance/EternalSynergy/EternalChampion module in the Rapid7
  Vulnerability and Exploit Database.
- Used the Metasploit Framework in the Kali lab VM to exploit the
  vulnerability and obtain a SYSTEM-level session.
- Created a proof-of-access artifact (``yourname_was_here`` folder) on
  the target desktop.
- Retrieved sensitive files left in cleartext on the target, including
  a password list and a stored payment-card note.

.. rubric:: Challenge Exercises

- Used anonymous FTP access to pull an additional sensitive file from
  the internal network.
- Answered reflection questions on root causes.

Root Cause Analysis
--------------------

**Storing personal information in clear text files**
   Plain-text files are fast and require no password or special setup,
   making them a convenient — but insecure — place to jot down
   sensitive information.

**Using an FTP service on the internal network**
   Legacy services often persist under an "if it ain't broke, don't
   fix it" mentality; resistance to change makes organizations slow to
   retire outdated protocols.

**Anonymous login enabled on the FTP service**
   Often a leftover default configuration or a convenience trade-off.
   Security and convenience are frequently in tension, and gaps like
   this can go unnoticed — especially when the person responsible for
   security lacks a strong security background.

Key Takeaway
------------

.. epigraph::

   The exercise illustrates how an unpatched, decade-old SMB
   vulnerability combined with poor data-handling practices (cleartext
   credentials, legacy FTP, anonymous login) can lead to a full
   compromise of a system — reinforcing why patch management and basic
   data-hygiene controls matter.

Original Lab Report
--------------------

The full, unedited lab report is attached below for reference.

:download:`Download the original lab report (PDF) <../../_static/cybercrime_govlabone.pdf>`

.. figure:: ../../_static/lab01_page-1.jpg
   :width: 100%
   :align: center

   Page 1 — Guided Exercises, Parts 1 & 2

.. figure:: ../../_static/lab01_page-2.jpg
   :width: 100%
   :align: center

   Page 2 — Guided Exercises, Parts 3 & 4

.. figure:: ../../_static/lab01_page-3.jpg
   :width: 100%
   :align: center

   Page 3 — Guided Exercises, Part 4 & Challenge Exercises, Part 1

.. figure:: ../../_static/lab01_page-4.jpg
   :width: 100%
   :align: center

   Page 4 — Challenge Exercises, Parts 1 & 2