Penetration testing and malware investigations
Black-box pentest + multi-sample malware reverse engineering
Problem
Legacy, end-of-life infrastructure quietly accumulates exploitable risk. The brief: enumerate and validate every weakness on an externally-facing host with no prior knowledge, then, separately, triage a high-confidence malware cluster, prove its persistence and capabilities, and produce actionable detection engineering.
Coursework (CSEC2003D) in an isolated lab with provided targets and samples. Two parts: a black-box penetration test of a simulated legacy banking host (“Besure Bank”, 192.168.50.130), and a malware investigation of four artefacts: three malware samples (a PDF, a service DLL and a downloader) and one vulnerable C program. The service DLL is Practical Malware Analysis Lab 3-2, a standard training sample.
What I did
For the pentest I ran a staged, throttled methodology (Nmap recon, Nessus Essentials vuln scanning, testssl.sh/OpenSSL crypto analysis, and Metasploit exploitation attempts), validating tool output manually. For the malware work I combined static analysis (PDFiD, peepdf, PDFStreamDumper, PE tooling, IDA Pro) with dynamic detonation (ProcMon, Process Explorer, ApateDNS) and debugger-led reverse engineering (GDB/REMnux).
Penetration test: Besure Bank
Nmap revealed an end-of-life stack: OpenSSH 3.1p1 (SSHv1 enabled), Apache 2.0.40 and PHP 4.2.2. Nessus Essentials reported 96 findings: 2 critical, 15 high, 26 medium, 8 low and 45 informational. The report references five CVEs: CVE-2014-3566 (POODLE), CVE-2016-0800 (DROWN), CVE-2003-0253 (Apache 2.0 buffer overflow), CVE-2007-1001 (PHP code injection) and CVE-2008-0599 (PHP variable handling).
- Critical: SSLv2/SSLv3 enabled → POODLE (CVE-2014-3566) and DROWN (CVE-2016-0800)
- Critical: PHP 4.2.2, end of life, with public exploits (CVE-2007-1001, CVE-2008-0599); Metasploit modules attempted
- Weak ciphers (RC4, EXPORT, 3DES/SWEET32), TLS 1.0, expired self-signed cert (2007)
- HTTP TRACE enabled (XST), exposed phpinfo.php, inconsistent login errors → enumeration
- Delivered tactical + strategic remediation and a patch-management lifecycle
Malware: weaponised PDF (sus-file1)
PDFiD flagged embedded /JS, /AA additional-actions and an /EmbeddedFile. PDFStreamDumper exposed obfuscated XFA JavaScript using slice/concat evasion, with a deceptively-named nested document: a classic phishing initial-access vector. VirusTotal consensus aligned with the Exploit.PDF-JS / pdfka family.
Malware: persistence service DLL (sus-file3)
A PE32 service DLL exporting Install/ServiceMain/UninstallService. Imports (OpenSCManagerA, CreateServiceA) and strings revealed svchost/netsvcs persistence, masquerading as “Intranet Network Awareness (INA+)” under service name IPRIP. Dynamic analysis confirmed the DLL loading inside svchost.exe. Its C2 strings point to hxxp://practicalmalwareanalysis[.]com/serve.html, a lab IOC: this is the Practical Malware Analysis Lab 3-2 sample, not a live threat.
Downloader + stack overflow (sus-file4 / sus-file6)
IDA disassembly of the downloader showed the canonical URLDownloadToFileA → WinExec → ExitProcess pattern, with an XOR-0xFF string-decode loop. The advanced task verified a stack-based buffer overflow in check_authentication(): a watchpoint on the auth flag flipped 0 → non-zero after an unbounded strcpy into a 16-byte buffer, proving control-flow influence in GDB.
MITRE ATT&CK & detection engineering
Evidence mapped to T1566.001 (Spearphishing Attachment), T1204 (User Execution), T1218.011 (Rundll32), T1543.003 (Windows Service) and T1112 (Modify Registry). I delivered low-noise/high-signal detections: alert on CreateServiceA where ServiceDll points to a user-writable path, and on rundll32 executing DLLs from user directories.
Evidence
- Nessus findings
- 96
- 2 critical · 15 high · 26 medium · 8 low · 45 info
- Artefacts analysed
- 4
- 3 malware samples (PDF · DLL · EXE) + 1 vulnerable C program
- ATT&CK techniques mapped
- 5
- listed under “MITRE ATT&CK & detection engineering”
- CVEs referenced
- 5
- listed under “Penetration test”
Stack and tools
Result
Two reports with IOC tables (host- and network-based indicators), prioritised remediation and detection logic you could implement, covering the loop from finding a weakness to detecting its use. The IOCs and detections are in the public repo.