PRACTICE LAB 1

Threat Landscape & Attack Chain Briefing

Research the historical WannaCry Ransomware campaign, map its sequence to the Cyber Kill Chain and MITRE ATT&CK frameworks, assess the CIA Triad impact, and execute local audit scripts to detect SMBv1 legacy protocols.

Environment

Local PowerShell / Bash Shell

Difficulty

Beginner (Level 1)

Course Module

Foundations & Attack Chains

Deliverables

Threat Briefing Report & Audit Logs

1. System Architecture & Workflow

The diagram below traces the WannaCry attack workflow. The exploit vector relies on external network sweeps targetting Port 445 (SMB) to inject the MS17-010 (EternalBlue) buffer overflow exploit, installing the DoublePulsar backdoor to run cryptographic payload engines on the victim's filesystem.

2. Part 1: Step-by-Step Action Items & Key Execution Steps

STEP 1

Research WannaCry on the MITRE ATT&CK Matrix

Locate the official WannaCry records inside the MITRE database to document tactical adversary techniques.

Open your web browser and navigate to the official MITRE ATT&CK repository: https://attack.mitre.org.
In the top-right search box, type WannaCry and press Enter.
Click on the entry under Software named WannaCry (S0366).
Examine the software dossier page. Scroll down to the Techniques Used table and note at least 5 distinct techniques:
- T1047: Windows Management Instrumentation (execution)
- T1083: File and Directory Discovery (reconnaissance)
- T1210: Exploitation of Remote Services (lateral movement)
- T1486: Data Encrypted for Impact (impact)
- T1571: Non-Standard Port communication (C2)
Note down the associated Threat Groups linked to WannaCry (e.g., Lazarus Group (G0032)). Keep these mappings handy for compilation into your Threat Briefing table.

STEP 2

Deconstruct the Cyber Kill Chain Stages

Map WannaCry execution events to the Lockheed Martin Cyber Kill Chain model to capture the chronological attack progress.

Use the mappings below to write the analysis matrix in your final report:

Kill Chain Phase	WannaCry Implementation Action	Associated Security Control
1. Reconnaissance	Scans target networks (port 445) seeking public-facing SMBv1 services.	Block inbound Port 445 on WAN interfaces.
2. Weaponization	Bundles MS17-010 (EternalBlue) exploit code with DoublePulsar and encryption binaries.	Deploy EDR/Antivirus signature analysis.
3. Delivery	Transmits crafted SMBv1 packets containing exploit payloads directly over raw TCP sockets.	Network Intrusion Prevention Systems (IPS).
4. Exploitation	Triggers buffer overflow in SMB server driver memory (srv.sys), executing remote code.	Apply Microsoft MS17-010 security patch.
5. Installation	Deploys DoublePulsar backdoor to run ring-0 shellcode, writing the encryptor service files.	Restrict kernel driver loading & monitor registry.
6. Command & Control	Connects to hardcoded Tor onion node domains to coordinate key exchange.	DNS filtering / block access to Tor networks.
7. Actions on Objectives	Encrypts local folders using AES + RSA, changing file extensions and displaying ransom notes.	Enforce offline, immutable file backups.

STEP 3

Audit Local Windows Systems for SMBv1 Configuration

Run administrative commands in PowerShell to inspect whether the legacy SMBv1 protocol is enabled on your host system.

On your Windows host computer, click the Start Menu.
Type powershell in the search bar.
Right-click Windows PowerShell and select Run as Administrator. Click Yes on the User Account Control (UAC) prompt.
Enter the command below in the prompt window.

PS> Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

This command queries SMB server configuration flags from the Windows registry, returning True if the legacy SMBv1 protocol is active.

5. If the returned value is True, execute the command below to disable the protocol immediately, mitigating WannaCry exploit compatibility:

PS> Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol-Client -NoRestart

This administrative command calls DISM to uninstall SMBv1 client features from the current Windows kernel without prompting for an immediate reboot.

STEP 4

Audit Local Linux Systems for SMB Services

Execute audit checks in your Linux VM terminal window to detect if Samba daemon shares are running insecure protocol configurations.

Log in to your Kali Linux VM.
Open the terminal window from your application dashboard.
Execute the commands below to check Samba package installations and inspect open ports.

$ ss -tulpn | grep 445

This command lists all listening TCP sockets on port 445, showing whether a Samba server is actively listening for connections.

$ testparm -v | grep "server min protocol"

This command queries active configuration defaults for Samba, checking the minimum protocol version. If set to NT1 (SMBv1), the service is vulnerable to legacy attacks.

Part	What It Does
`-v`	Verbose — shows detailed connection and transfer information including headers
`grep`	Global Regular Expression Print — searches text for lines matching a pattern

3. Automation Architecture

The diagram below highlights the assessment pipeline. Security professionals utilize active port sweeps, map exploit signatures to ATT&CK classifications, inspect local registry protocols, script security hardening remediations, and verify the resulting system states.

4. Part 2: Complete Deliverable Assets & Production Templates

To automate the vulnerability audit across your local infrastructure, you will write a cross-platform configuration scanner script. Below is a step-by-step breakdown of how this script is constructed, followed by the final combined script.

Step-by-Step Script Construction

Step 1

Define Script Metadata and Target Log Directories

Specify the logging configurations and output paths for the scanner.

AUDIT_LOG="./smb_audit.log" echo "=== SMB Configuration Audit Log ===" > "${AUDIT_LOG}"

This block initializes the log file and writes the audit header, ensuring all subsequent check outcomes are logged persistently.

Step 2

Check SMBv1 Port Exposure

Audit local network ports to determine if Port 445 is exposed and listening on the network interfaces.

if ss -tulpn | grep -q ":445 "; then echo "[WARNING] SMB Service port 445 is open and listening!" >> "${AUDIT_LOG}" else echo "[SUCCESS] SMB port 445 is closed." >> "${AUDIT_LOG}" fi

This uses socket statistics command to search for open listening ports, appending warning flags if a network listener exists on port 445.

Part	What It Does
`ss`	Socket Statistics — shows active network connections, listening ports, and socket details (modern replacement for netstat)
`grep`	Global Regular Expression Print — searches text for lines matching a pattern

Step 3

Scan Configuration Files for Legacy SMBv1 Protocols

Parse Samba configuration files to determine if weak protocol versions are allowed.

if [ -f "/etc/samba/smb.conf" ]; then if grep -qi "server min protocol = NT1" /etc/samba/smb.conf; then echo "[CRITICAL] Samba is explicitly configured to support legacy SMBv1 (NT1)!" >> "${AUDIT_LOG}" else echo "[INFO] SMB configuration does not enforce SMBv1." >> "${AUDIT_LOG}" fi fi

This checks for the presence of the samba config file, grep-parses the minimum protocol parameter, and flags instances of NT1 (SMBv1) support.

Combined Automated Script

Save the consolidated script code below inside your Kali Linux VM as /home/student/Scripts/smb_audit.sh, configure execute permissions, and run the audit tool:

$ chmod +x /home/student/Scripts/smb_audit.sh && /home/student/Scripts/smb_audit.sh

This command activates run permissions for the script file and executes the vulnerability scanner checks in your terminal.

Part	What It Does
`+x`	Adds execute permission to the file
`run`	Creates and starts a new container from an image

Code Breakdown — Line by Line

Copy

Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

#!/usr/bin/env bash

Line 2: This is a comment that describes what the code does: "!/usr/bin/env bash". Comments start with # and are ignored by Python.

# smb_audit.sh - Cross-Platform SMB Protocol Vulnerability Auditor

Line 3: This is a comment that describes what the code does: "smb_audit.sh - Cross-Platform SMB Protocol Vulnerability Auditor". Comments start with # and are ignored by Python.

set -euo pipefail

Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

LOG_FILE="./smb_audit.log"

Line 5: Creates a variable called LOG_FILE and assigns a value to it. Variables store data for use later in the program.

echo "========================================" | tee "${LOG_FILE}"

Line 6: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "LOCAL SYSTEM SMB PROTOCOL AUDIT" | tee -a "${LOG_FILE}"

Line 7: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "========================================" | tee -a "${LOG_FILE}"

Line 8: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

# 1. Port Scan Check

Line 9: This is a comment that describes what the code does: "1. Port Scan Check". Comments start with # and are ignored by Python.

echo -n "Auditing socket connections... "

Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

if ss -tulpn 2>/dev/null | grep -q ":445 "; then

Line 11: A conditional check — the code inside this block only runs if the condition evaluates to True.

echo "WARNING [Port 445 is exposed]" | tee -a "${LOG_FILE}"

Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

else

Line 13: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "OK [Port 445 closed]" | tee -a "${LOG_FILE}"

Line 14: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

Line 15: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

# 2. Samba Configuration File Check

Line 16: This is a comment that describes what the code does: "2. Samba Configuration File Check". Comments start with # and are ignored by Python.

echo -n "Auditing Samba configuration parameters... "

Line 17: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

if [ -f "/etc/samba/smb.conf" ]; then

Line 18: A conditional check — the code inside this block only runs if the condition evaluates to True.

if grep -qi "server min protocol = NT1" /etc/samba/smb.conf; then

Line 19: A conditional check — the code inside this block only runs if the condition evaluates to True.

echo "CRITICAL [SMBv1 explicitly enabled in config]" | tee -a "${LOG_FILE}"

Line 20: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.

Copy

#!/usr/bin/env bash
# smb_audit.sh - Cross-Platform SMB Protocol Vulnerability Auditor

set -euo pipefail

LOG_FILE="./smb_audit.log"

echo "========================================" | tee "${LOG_FILE}"
echo "LOCAL SYSTEM SMB PROTOCOL AUDIT" | tee -a "${LOG_FILE}"
echo "========================================" | tee -a "${LOG_FILE}"

# 1. Port Scan Check
echo -n "Auditing socket connections... "
if ss -tulpn 2>/dev/null | grep -q ":445 "; then
  echo "WARNING [Port 445 is exposed]" | tee -a "${LOG_FILE}"
else
  echo "OK [Port 445 closed]" | tee -a "${LOG_FILE}"
fi

# 2. Samba Configuration File Check
echo -n "Auditing Samba configuration parameters... "
if [ -f "/etc/samba/smb.conf" ]; then
  if grep -qi "server min protocol = NT1" /etc/samba/smb.conf; then
    echo "CRITICAL [SMBv1 explicitly enabled in config]" | tee -a "${LOG_FILE}"
  else
    echo "OK [Minimum protocol set securely or default]" | tee -a "${LOG_FILE}"
  fi
else
  echo "OK [No Samba server config found]" | tee -a "${LOG_FILE}"
fi

# 3. Print Report Completion
echo "========================================" | tee -a "${LOG_FILE}"
echo "Audit complete. Log saved to: ${LOG_FILE}"
echo "========================================"

5. Deliverables Summary

Students must compile and submit the following artifacts to verify completion of this training lab.

Created Files / Configs

Threat briefing text document (Markdown format) addressing the WannaCry incident.
/home/student/Scripts/smb_audit.sh - Automated SMB scanner script on Kali VM.
smb_audit.log - Saved audit scan output listing local vulnerability status.

Verification Artifacts / Execution Proof

PowerShell screenshot verifying EnableSMB1Protocol output is False.
Screenshot of the MITRE ATT&CK software dossier page for WannaCry (S0366).
Lockheed Martin Cyber Kill Chain mapping matrix compiled in the report.

6. Closing Explanation: Why We Did This & What It Accomplishes

Architectural Intent & Operational Impact

Why We Did This

Threat modeling framework mappings (like Cyber Kill Chain and MITRE ATT&CK) allow security analysts to decompose attack campaigns into predictable steps, identifying target injection points where controls can disrupt the threat.
Auditing legacy protocols like SMBv1 addresses a critical vector of attack. SMBv1 lacks encrypted packet headers and session validation mechanisms, exposing systems to memory corruption flaws like MS17-010.
Applying the CIA Triad principles to ransomware incidents clarifies that encryption primarily impacts system Availability, while data exfiltration breaches target confidentiality.

What This Accomplishes

Equips students with the analytical skills needed to perform technical threat briefings.
Teaches students how to audit active configurations using administrative scripting terminals in Windows and Linux.
Validates system state hardening through defensive mitigations that block legacy protocols.