# Nessus Skills Assessment

You have been contracted by the company `Inlanefreight` to perform an internal vulnerability assessment against one of their servers. They have asked for a cursory assessment to be performed to identify any significant vulnerabilities as they do not have the budget for a full-scale penetration test this year. The results of this vulnerability assessment may enable the CISO to push for additional funding from the Board of Directors to perform more in-depth security testing.

The target server is a Windows Server host used as a development server.

## Connecting to the remote Nessus Server

Nessus can be accessed at `https:// < IP >:8834`. The Nessus credentials are: `htb-student`:`HTB_@cademy_student!`. You may also use these credentials to SSH into the target VM to configure Nessus.

<figure><img src="https://3367244783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK3YP1U2Fck03eUZ2XijJ%2Fuploads%2F71fhl1tvXVY272Pzduct%2Fimage.png?alt=media&#x26;token=948ecce3-83c1-4d91-a33b-0d2c762e2795" alt=""><figcaption></figcaption></figure>

1. First step is to create a Basic Scan

<figure><img src="https://3367244783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK3YP1U2Fck03eUZ2XijJ%2Fuploads%2F5Uh0sBn8Kc4Rr5yUCVQy%2Fimage.png?alt=media&#x26;token=9fd30546-e5cb-44fd-9ec6-f6fcde2ea385" alt=""><figcaption></figcaption></figure>

2. Then setup the scan to be authenticated using the provided credentials

```
administrator:Academy_VA_adm1!
```

3. Once that is complete, simply run the scan, it will take about 60 minutes

## Questions&#x20;

<details>

<summary>Question 1: What is the name of one of the accessible SMB shares from the authenticated Windows scan? (One word)</summary>

1. Click on "Windows\_Basic\_authed"
2. Go to the Vulnerabilities tab and search for "SMB Shares"

![](https://3367244783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK3YP1U2Fck03eUZ2XijJ%2Fuploads%2FvGAQCZLGM5WmYXfBDJQk%2Fimage.png?alt=media\&token=6eca353c-1212-4fa6-a504-39811257bf2f)

3. Click on the vulnerability and in the output you will see a list of accessible shares when logged in as Administrator

![](https://3367244783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK3YP1U2Fck03eUZ2XijJ%2Fuploads%2FysECAX4yXpiRlYojpYb5%2Fimage.png?alt=media\&token=df342fae-156f-4b2d-80ca-3474c05b99be)

</details>

<details>

<summary>Question 2: What was the target for the authenticated scan?</summary>

The target is the what the scanned was performed against&#x20;

![](https://3367244783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK3YP1U2Fck03eUZ2XijJ%2Fuploads%2F9EUC5JqS7lOCiOpw2WyC%2Fimage.png?alt=media\&token=df85ceb9-28c6-4db4-927b-639da9b0cd51)

</details>

<details>

<summary>Question 3: What is the plugin ID of the highest criticality vulnerability for the Windows authenticated scan?</summary>

1. Click on the first critical vulnerability and on the title you will see the plugin ID

![](https://3367244783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK3YP1U2Fck03eUZ2XijJ%2Fuploads%2Ft1tHSIA4ONd0HjPfCTNs%2Fimage.png?alt=media\&token=69e3340a-d9ba-4594-8284-a010393bd636)

</details>

<details>

<summary>Question 4: What is the name of the vulnerability with plugin ID 26925 from the Windows authenticated scan? (Case sensitive)</summary>

1. Go to the scan results and filter the results with Plugin ID&#x20;

![](https://3367244783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK3YP1U2Fck03eUZ2XijJ%2Fuploads%2Ftvme2WYY96sjGTS3LvwN%2Fimage.png?alt=media\&token=6c7b5788-5eb3-4acb-9b00-81a84603c727)

2. Once filtered you will see only the results with the filtered criteria&#x20;
3. Click on the vulnerability and on the title you will see the name&#x20;

![](https://3367244783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK3YP1U2Fck03eUZ2XijJ%2Fuploads%2FEUhwkN3B4DnNaekVJkSU%2Fimage.png?alt=media\&token=fa302bb7-1ada-483a-8228-697c7cf5d892)

</details>