1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Phase 1: Red Team Active Penetration Test
Perform reconnaissance, scanning, and exploit targets using Metasploit and Pass-the-Hash.
$ nmap -sV -sC -p- 192.168.56.0/24
This command runs nmap scans across the subnet to map open services and detect vulnerability targets.
| Part | What It Does |
|---|
-sV | Service/Version detection — probes open ports to determine what service and version is running |
-sC | Script scan — runs default NSE (Nmap Scripting Engine) scripts for additional vulnerability information |
-p- | Scans ALL 65,535 TCP ports instead of just the default 1,000 |
nmap | Network Mapper — a powerful open-source port scanning and network discovery tool |
$ evil-winrm -i 192.168.56.20 -u Administrator -H ccef208c6426a0902012c802bc37ae46
This exploits NTLM credential hashes to log in as Administrator on target machines.
| Part | What It Does |
|---|
-i | Case-insensitive search |
-u | Show only UDP connections |
-H | Adds a custom HTTP header to the request |
STEP 2
Phase 2: Blue Team Detection & Analysis
Audit system security logs, trace compromise points in SIEM, and scan containers.
Splunk search: index=security "Failed password" | stats count by src_ip
This search aggregates authentication logs in the SIEM to identify automated network sweep points.
$ python vol.py -f memory.raw --profile=Win7SP1x64 pslist
This commands parses raw memory files to trace malicious process chains and rootkits.
4. Part 2: Complete Deliverable Assets & Production Templates
To automate the verification of enterprise host security settings, save the script below as enterprise_audit.sh and execute it:
$ chmod +x enterprise_audit.sh && ./enterprise_audit.sh
This script scans active system parameters to verify security compliance.
| Part | What It Does |
|---|
+x | Adds execute permission to the file |
verify | Verifies a certificate against a CA certificate to validate the trust chain |
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
#!/usr/bin/env bash
Line 2: This is a comment that describes what the code does: "!/usr/bin/env bash". Comments start with # and are ignored by Python.
# enterprise_audit.sh - Enterprise Host Hardening Checker
Line 3: This is a comment that describes what the code does: "enterprise_audit.sh - Enterprise Host Hardening Checker". Comments start with # and are ignored by Python.
set -euo pipefail
Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo "=== Enterprise Host Hardening Scan ==="
Line 5: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# Check SSH Root Login settings
Line 6: This is a comment that describes what the code does: "Check SSH Root Login settings". Comments start with # and are ignored by Python.
if grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
Line 7: A conditional check — the code inside this block only runs if the condition evaluates to True.
echo "[OK] SSH PermitRootLogin disabled."
Line 8: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
else
Line 9: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo "[WARNING] SSH PermitRootLogin enabled! Fix immediately in sshd_config."
Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
fi
Line 11: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# Check UFW Firewall Status
Line 12: This is a comment that describes what the code does: "Check UFW Firewall Status". Comments start with # and are ignored by Python.
if systemctl is-active --quiet ufw; then
Line 13: A conditional check — the code inside this block only runs if the condition evaluates to True.
echo "[OK] Local Firewall service (ufw) is active."
Line 14: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
else
Line 15: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo "[CRITICAL] Local Firewall service is disabled!"
Line 16: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
fi
Line 17: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
#!/usr/bin/env bash
# enterprise_audit.sh - Enterprise Host Hardening Checker
set -euo pipefail
echo "=== Enterprise Host Hardening Scan ==="
# Check SSH Root Login settings
if grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
echo "[OK] SSH PermitRootLogin disabled."
else
echo "[WARNING] SSH PermitRootLogin enabled! Fix immediately in sshd_config."
fi
# Check UFW Firewall Status
if systemctl is-active --quiet ufw; then
echo "[OK] Local Firewall service (ufw) is active."
else
echo "[CRITICAL] Local Firewall service is disabled!"
fi
5. Deliverables Summary
Created Files / Templates
enterprise_audit.sh - Hardening validation script- Executive Summary Boardroom Briefing Report (Markdown)
Verification Artifacts
- Command logs showing compromise of domain controllers.
- SIEM log entries of brute-force and privilege escalation detection events.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
