I need help with Penetration Testing Homework

Due Friday May 15th @11:59pm

Version 2.1 – April 13th 2020

You have been hired to conduct

a penetration test and security assessment for a fictitious company, 

Pictures, Inc. The goal of this penetration test and security assessment is to

show the executive of ENPM685 Pictures, Inc. that their security posture needs

to be improved.

Background

Pictures, Inc. is a

small movie production studio that specializes in low budget “mockbusters” that

are spoofs of larger budget films produced by larger studios. They have been

successful by extreme cost cutting wherever possible, which shows in their IT

infrastructure and hiring practices. For example, to not have to deal with

employee benefits the company only has 1 employee, the CEO Bob Dobbs. Everyone

else is hired as a contractor. Due to a recent issue with a rogue contractor

stealing several ideas for upcoming films and an aggressive growth plan the CEO

is moving towards hiring actual employees and developing the infrastructure (IT

and otherwise) that supports Picture, Inc’s production efforts.

As part of this expansion I as

a consultant to the CEO has recommended bringing in a IT security firm to

assess the current state of Picture, Inc’s IT security through a

penetration test and recommendations for improvement of the current

environment. You are that IT security firm hired to perform this assessment.

The Virtual Machines

Picture, Inc’s IT

operations are small, only 2 computers, the CEO’s

desktop and a server that hosts

the firm’s website as well as other resources. Both virtual machines are available

from the class Google Drive share in the “Final Project” folder.

Link: https://drive.google.com/drive/folders/1jWbyudFRAC8GHrx_GY5Kr1lP40LTrQf5

Do not change any of the

network settings in VMWare for the VMs, they are set up with the primary

network interface using NAT. There is a secondary network interface for both of

these VMs but you can ignore those. Import these VMs, if you get a popup saying

there were issues select “Retry” and the VMs should import.

The Assignment and

Requirements

•                   

• Conduct a

penetration test of Picture, Inc’s network and report your findings.

•                   

• There are 6

“flags” spread out across the computers in Pictures, Inc’s network. By

finding these you can demonstrate to the CEO the need to make security

improvements. A top grade can only be attained by finding all 6 flags.

o What is a flag? It will be a short phrase or other

interesting information you discover during your penetration test. If the flag

is a file it will be the contents of the file, not just the file name/location.

They are clearly marked, you will know them when you see them.