Recogniser e inventario de superficie

1. Criar pasta e mapa inicial

No Windows 11, abra PowerShell e ajuste o numero do student.

$StudentNumber = 1
$Prefix = "10.50.$StudentNumber"
$Evidence = "C:\ECSS-M14-Recogniser"

$Assets = @(
    [pscustomobject]@{ Asset = "Windows Server"; IP = "$Prefix.10"; ExpectedRole = "AD DS/DNS/RDP" },
    [pscustomobject]@{ Asset = "Windows 11"; IP = "$Prefix.11"; ExpectedRole = "Workstation" },
    [pscustomobject]@{ Asset = "Ubuntu Server"; IP = "$Prefix.12"; ExpectedRole = "Linux/Wazuh/Docker" }
)

New-Item -ItemType Directory -Path $Evidence -Force | Out-Null
$Assets | Export-Csv "$Evidence\01-asset-map.csv" -NoTypeInformation -Encoding utf8
$Assets | Format-Table -AutoSize

2. Coletar identidade da estacao Windows 11

Registre nome, usuario, dominio, rede e rotas.

"===== Hostname =====" | Out-File "$Evidence\02-w11-local-recon.txt" -Encoding utf8
hostname | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8

"===== Usuario =====" | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8
whoami /all | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8

"===== IP =====" | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8
ipconfig /all | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8

"===== Rotas =====" | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8
route print | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8

"===== ARP =====" | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8
arp -a | Add-Content "$Evidence\02-w11-local-recon.txt" -Encoding utf8

Anote: nome do computador, usuario logado, dominio ou workgroup e gateway.

3. Validar dominio e DNS

Se o dominio estiver configurado, os comandos abaixo ajudam a identificar o controlador de dominio.

nltest /dsgetdc:ECSS.LOCAL
nslookup ECSS.LOCAL
nslookup $Prefix.10
nslookup $Prefix.11
nslookup $Prefix.12

Se nltest falhar, registre como evidencia e siga o lab.

nltest /dsgetdc:ECSS.LOCAL *> "$Evidence\03-domain-check.txt"
nslookup ECSS.LOCAL >> "$Evidence\03-domain-check.txt"

4. Reconhecer servicos com comandos nativos

Use testes TCP curtos contra cada ativo.

$ServiceChecks = @(
    [pscustomobject]@{ Target = "Windows Server"; IP = "$Prefix.10"; Port = 53; Service = "DNS" },
    [pscustomobject]@{ Target = "Windows Server"; IP = "$Prefix.10"; Port = 88; Service = "Kerberos" },
    [pscustomobject]@{ Target = "Windows Server"; IP = "$Prefix.10"; Port = 389; Service = "LDAP" },
    [pscustomobject]@{ Target = "Windows Server"; IP = "$Prefix.10"; Port = 445; Service = "SMB" },
    [pscustomobject]@{ Target = "Windows Server"; IP = "$Prefix.10"; Port = 3389; Service = "RDP" },
    [pscustomobject]@{ Target = "Windows 11"; IP = "$Prefix.11"; Port = 3389; Service = "RDP" },
    [pscustomobject]@{ Target = "Ubuntu Server"; IP = "$Prefix.12"; Port = 22; Service = "SSH" },
    [pscustomobject]@{ Target = "Ubuntu Server"; IP = "$Prefix.12"; Port = 9443; Service = "Web admin" }
)

$ServiceResults = foreach ($Check in $ServiceChecks) {
    [pscustomobject]@{
        Target = $Check.Target
        IP = $Check.IP
        Port = $Check.Port
        Service = $Check.Service
        Open = Test-NetConnection $Check.IP -Port $Check.Port -InformationLevel Quiet
    }
}

$ServiceResults | Format-Table -AutoSize
$ServiceResults | Export-Csv "$Evidence\04-service-recognition.csv" -NoTypeInformation -Encoding utf8

5. Coletar inventario no Windows Server

No Windows Server, abra PowerShell como administrador do lab. Se o dominio existir, use a conta labjoin quando necessario.

$Evidence = "C:\ECSS-M14-Recogniser-WS"
New-Item -ItemType Directory -Path $Evidence -Force | Out-Null

hostname | Out-File "$Evidence\01-hostname.txt" -Encoding utf8
whoami /all | Out-File "$Evidence\02-whoami.txt" -Encoding utf8
ipconfig /all | Out-File "$Evidence\03-ipconfig.txt" -Encoding utf8
Get-NetTCPConnection -State Listen |
    Select-Object LocalAddress,LocalPort,OwningProcess |
    Sort-Object LocalPort |
    Out-File "$Evidence\04-listening-ports.txt" -Encoding utf8
Get-SmbShare |
    Select-Object Name,Path,Description |
    Out-File "$Evidence\05-smb-shares.txt" -Encoding utf8

Se o modulo Active Directory estiver disponivel, colete tambem:

Get-ADDomain | Select-Object DNSRoot,NetBIOSName,DomainMode,ForestMode
Get-ADComputer -Filter * -Properties OperatingSystem,IPv4Address |
    Select-Object Name,OperatingSystem,IPv4Address
Get-ADUser -Filter * |
    Select-Object Name,SamAccountName,Enabled

6. Coletar inventario no Ubuntu Server

No Ubuntu, registre identificacao, IPs, rotas e servicos em escuta.

mkdir -p ~/ECSS-M14-Recogniser
hostnamectl | tee ~/ECSS-M14-Recogniser/01-hostnamectl.txt
ip -br address | tee ~/ECSS-M14-Recogniser/02-ip-address.txt
ip route | tee ~/ECSS-M14-Recogniser/03-routes.txt
ss -tulpn | tee ~/ECSS-M14-Recogniser/04-listening-services.txt
systemctl --no-pager --type=service --state=running | tee ~/ECSS-M14-Recogniser/05-running-services.txt

Se o Wazuh ainda nao foi instalado neste ambiente recriado, registre isso como observacao. Nao instale neste lab.

7. Montar matriz de risco

No Windows 11, use o resultado dos servicos para criar uma matriz simples.

$RiskMatrix = $ServiceResults | Where-Object Open | ForEach-Object {
    $Level = switch ($_.Port) {
        22 { "Medio" }
        53 { "Medio" }
        88 { "Alto" }
        389 { "Alto" }
        445 { "Alto" }
        3389 { "Alto" }
        9443 { "Medio" }
        default { "Baixo" }
    }

    $Action = switch ($_.Port) {
        3389 { "Permitir somente via Guacamole ou origem administrativa" }
        445 { "Revisar compartilhamentos e firewall local" }
        389 { "Manter restrito a maquinas do dominio" }
        9443 { "Exigir senha forte e acesso apenas interno" }
        default { "Validar necessidade do servico" }
    }

    [pscustomobject]@{
        Target = $_.Target
        IP = $_.IP
        Port = $_.Port
        Service = $_.Service
        Risk = $Level
        Recommendation = $Action
    }
}

$RiskMatrix | Format-Table -AutoSize
$RiskMatrix | Export-Csv "$Evidence\05-risk-matrix.csv" -NoTypeInformation -Encoding utf8

8. Gerar relatorio final

$ReportPath = "$Evidence\06-recogniser-report.html"
"<h1>ECSS Modulo 14 - Recogniser</h1>" | Out-File $ReportPath -Encoding utf8
"<p>Student: student$StudentNumber</p>" | Add-Content $ReportPath -Encoding utf8
"<h2>Ativos esperados</h2>" | Add-Content $ReportPath -Encoding utf8
$Assets | ConvertTo-Html -Fragment | Add-Content $ReportPath -Encoding utf8
"<h2>Servicos identificados</h2>" | Add-Content $ReportPath -Encoding utf8
$ServiceResults | ConvertTo-Html -Fragment | Add-Content $ReportPath -Encoding utf8
"<h2>Matriz de risco</h2>" | Add-Content $ReportPath -Encoding utf8
$RiskMatrix | ConvertTo-Html -Fragment | Add-Content $ReportPath -Encoding utf8
Invoke-Item $ReportPath

O relatorio deve mostrar o que existe, o que esta aberto e qual acao defensiva seria recomendada.

9. Evidencias para entregar

• 01-asset-map.csv
• 02-w11-local-recon.txt
• 03-domain-check.txt
• 04-service-recognition.csv
• 05-risk-matrix.csv
• 06-recogniser-report.html