TL;DR Walkthrough of the TryHackMe room Vulnerability Management.
A full list of our TryHackMe walkthroughs and cheatsheets is here.
Background
I am happy to say that I passed my college class on the Secure Software Development Lifecycle (SSDLC) yesterday. I wanted to reach through the monitor and strangle the guy who created their exam, but a pass is a pass. They kept calling it the SDL, the material was just as dry and boring as Project+ was, and their given multiple choices sucked. I would read the question, know the answer immediately … and the right answer wasn’t an option to pick.
I credit self study for CISSP, CASP, Project+, and the MGT512 course work sent us to for getting me through that ordeal, and of course TryHackMe’s rooms focused on the SDLC helped a ton.
This is the last room I knocked out under the Security Engineer and DevSecOps pathways to get ready for that college exam. I had to tweak, update, and re-configure OpenVAS on my Kali VM to get the room done, so I’m posting my notes on that process just in case it helps anyone else.
Our howto on setting up OpenVAS is here.
— — Task 1 — -
No answer needed
— — Task 2 — -
The process encompassing vulnerability scanning and other factors, such as risk acceptance, is called?
Vulnerability Management
Is the overall objective of vulnerability management to increase an organisation’s risk exposure? (yea/nay)
Nay
— — Task 3 — -
What is the CVSS for CVE-2013–1048?
4.6
What is the Access Complexity for CVE-2013–1048?
Low
With the fictional CVE-2023–2022, what would the CVE ID assign year be?
2023
— — Task 4 — -
We have already scanned an Ubuntu machine; therefore, answer the following questions based on the scan report of LinuxAppTask task.
No answer needed
After scanning, what is the total number of medium-level vulnerabilities?
1
What is the severity score for the vulnerability “ICMP Timestamp Reply Information Disclosure”?
2.1
What is the operating system and the version number of the target machine?
Ubuntu 20.04
— — Task 5 — -
Download the LinuxAppTask report in PDF format. What is the severity rating of the vulnerability in the report, where the solution type is “Workaround”?
Medium
What is the solution type for the “TCP timestamps” vulnerability?
Mitigation
What is the CVE for “ICMP Timestamp Reply Information Disclosure”?
CVE-1999–0524
— — Task 6 — -
Create a ticket for resolving the “Cleartext Transmission of Sensitive Information via HTTP” vulnerability.
No answer needed
As a Security Engineer, the priority of a remediation ticket for a critical vulnerability must be (high/medium/low)?
High
— — Task 7 — -
The process of listing vulnerabilities as per their order of priority is called?
Prioritise vulnerabilities [TryHackMe’s spelling, “Prioritize vulnerabilities” won’t get a go on THM]
Which phase entails updating and strengthening resilience plans and restoring any compromised capabilities or services caused by a cybersecurity event?
Recover
I have read the details regarding all five phases of the NIST CSF.
No answer needed
— — Task 8 — -
No answer needed
Updating OpenVAS
I had to run the below to update OpenVAS and get it working right again for this room.
pg_lsclusters
pg_dropcluster --stop 16 main
pg_upgradecluster 15 main
pg_dropcluster --stop 15 main
apt install postgresql-16-pg-gvm
sudo runuser -u postgres -- /usr/share/gvm/create-postgresql-database
sudo runuser -u _gvm -- gvmd --migrate
sudo gvm-check-setup
sudo gvm-start
Summary
Oddly TryHackMe asks which vulnerability had “Workaround” as the solution, but all 3 listed “Mitigation” in OpenVAS. Either THM was wrong, which happens sometimes, or it’s because I updated OpenVAS right before doing this room and THM was running an older version when they setup the room.
It’s rare that this mismatch in results and ‘the right answer’ on THM differ. Just be aware of this one in case you’re knocking out the room.
My next class is on Cybersecurity Management, so I am going to continue TryHackMe’s Cybersecurity Engineer pathway for now. Good luck to everyone else in your own studying!
References
OpenVAS setup: https://happycamper84.medium.com/openvas-setup-1708695c62fe
