Compromising a Backup System by iSCSI Interface During a Routine Penetration Test

Compromising a Backup System by iSCSI Interface During a Routine Penetration Test

How We Identified a Critical Security Situation for Our Client

This is the story of a routine internal network penetration test that led to the identification of a critical security issue. 

As part of the normal process, I was exploring the target IPs to discover services, and I could not find anything interesting. In this type of situation, my second step is to identify adjacent relevant networks, so I checked the DNS servers – that were automatically assigned – and found another network to be scanned based on the DNS IP addresses.

So, I found this server on the network.

This finding definitely caught my attention.

Internet Small Computer System Interface (iSCSI) is a protocol developed by IBM and Cisco that allows SCSI commands through TCP. The iSCSI protocol encapsulates SCSI commands, permitting shared storages to be connected as local devices. They are often utilized in backup solutions.

The iSCSI storage resource unit is named target. As you can imagine, these targets must be protected, but sometimes they are not so we can exploit them in a penetration test.

To handle iSCSI commands in Linux, you must install the iSCSI utility. In Debian-based Linux systems, you can use Advanced Packaging Tool (APT) to install the command-line client.

Executing the Penetration Test

First, we need to discover the targets from the iSCSI resource, which we can do by using the Send Targets method.

Now, we can try to attach the device.

As shown, we could log into the interface without any authentication. You can see if the device is “plugged in” by checking the messages log.

Here are more details about the disk attached.

Then we just need to mount it.

Now we can list it as a regular disk in the system.

Finally, we gained access to the Veeam backup files. In this case, we can use the Veeam utility to extract the VBK files.

The Results

Unauthenticated access to backup systems is a critical situation for the client. These systems are very valuable targets for ransomware infections since they can contain loads of sensitive data, possibly including domain controller backup hashes. If we can write access to the backup disk during a penetration test, it gets even worse, since an attacker can encrypt or even delete the backup files that you might be relying on to recover from a ransomware attack.

Ultimately, this misconfiguration led to a full compromise of backup data. This data could be storing sensitive information capable of bringing serious threats to the company. We recommend enabling authentication on every device in this organization, and if not, do not publish sensitive information, even in the internal environment.

As technology evolves, so are attackers. When you receive an internal penetration test or red team simulation from DirectDefense, our consultants are using the latest attack vectors seen in the field today.

Contact Us Today!

Take stock of how secure your organization is from malicious attackers. Set up a security consultation or call us at 1 888 720 4633.

   By: Bruno Oliveira   10.13.22