Narrator: So the first thing we want to do 2 2
is we want to learn what the IP address 3 3
of our culling machine is since 4 4
we've just plugged it into our victim network. 5 5
So let's go to the Terminal 6 6
and because this is a Linux machine, 7 7
we're gonna use IF Config. 8 8
You can see here that we've got the IP address 9 9
of 192.168.56.102, 10 10
now the network mask is 11 11
255.255.255.0 which tells me that the scope 12 12
on this network, is a class C with 254 IP addresses. 13 13
So it goes from 192.168.56.1 14 14
through 192.168.56.254 15 15
with the broadcast being reserved at 255. 16 16
That's good information to know as we move forward. 17 17
So the next thing we want to do is we want to 18 18
bring up zenmap and to do that, 19 19
you're simply gonna type in zenmap 20 20
from the command prompt and to make sure 21 21
my command prompt is still available for me 22 22
to use afterwards, I'm gonna hit the 'and' sign 23 23
which means its gonna run it in the background. 24 24
So now zenmap pops up and we can start doing our scans. 25 25
The first scan we want to do is the least intrusive 26 26
so we can figure out what machines are on this network. 27 27
To do that, we're gonna do a ping scan. 28 28
Our target for this network is gonna be the entire network. 29 29
So I'm gonna use 192.168.56.0/24 30 30
that will tell me that I want that entire subnet. 31 31
Now, another way you could write this, 32 32
is we could actually say 0-254 which would be 33 33
all of those addresses as well. 34 34
But in our case, I would like to use the cidr 35 35
notation of /24. 36 36
Now you'll notice here in zenmap that we actually 37 37
get the command line syntax for nmap, 38 38
right here shown for us. 39 39
So zenmap is gonna use nmap to do the work for us, 40 40
but then its gonna take that detail 41 41
and bring it back to us in a graphical format. 42 42
Now right now, our profile selected is the intense scan 43 43
and that's gonna be way too intensive 44 44
for what we're trying to do. 45 45
So we're gonna go down and select a Ping scan instead. 46 46
Notice that the Ping scan is just -sn 47 47
and the IP address range that you want. 48 48
Now I'm gonna click scan. 49 49
Now here in this main tab, 50 50
I'm gonna make this larger for us. 51 51
Now here in this main tab, what you'll notice is 52 52
you're gonna see the result that nmap would provide you. 53 53
In our case, all we did was a Ping scan, 54 54
so it searched 256 IP addresses 55 55
and it found four of them that were up. 56 56
Those four is the server, the dhcp server we set up, 57 57
one of our virtual machines, our second virtual machine 58 58
and then our Kali Linux box ourself. 59 59
Now we don't necessarily know what 60 60
these two Machines are at this point, 61 61
we just know that they're up and taking requests. 62 62
But since we do know that one of the two is our own machine, 63 63
we don't need to scan that one any more 64 64
because we don't need to attack it. 65 65
We want to attack these other two machines. 66 66
So what we're gonna do is we're gonna take it a step further 67 67
and we're gonna start doing different scans 68 68
as we can gather different information. 69 69
Now if you notice, if I click on the ports and hosts tab, 70 70
there's no ports yet because we haven't scanned any ports. 71 71
We've only done 'Is this machine up or down?' 72 72
but here we can see in the Topology our network 73 73
and you'll see that there are four hosts connected 74 74
and we can also do a fish-eye that makes 75 75
it a little bit easier to see. 76 76
You can see that we do have four hosts on the network. 77 77
We have the three machines, plus the one dhcp server. 78 78
Now if we look at host details, 79 79
all we know is the status that it's up. 80 80
The only reason we know that is because it did a ping, 81 81
we haven't scanned any ports yet. 82 82
This is important to realize. 83 83
So, lets go ahead and go back to our nmap output. 84 84
Let's try a more intensive scan, but only targeting it 85 85
to the two machines that we want to look at, 86 86
which were 101, excuse me, 100 and 101. 87 87
From here, we're gonna do what's called a quick scan. 88 88
Now if you notice here, the quick scan is gonna do 89 89
some of the most common ports for us 90 90
and find what information we can about this 91 91
so let's go ahead and do a quick scan. 92 92
So here is what nmap would have given you 93 93
if you were doing this in the command prompt. 94 94
The scan report for 101 and if we look at 101, 95 95
you'll see all of these ports are open. 96 96
That is a lot of open holes that may be vulnerable 97 97
for us to do exploitation later. 98 98
Now if you notice that 192.168.56.100 99 99
all the ports were filtered. 100 100
That's interesting to know because 101 101
that one was actually our Windows machine 102 102
so we're gonna have to take a look 103 103
at that machine later as we go forward. 104 104
But with the quick scan, we have identified 105 105
that this 101 is a very vulnerable box. 106 106
That was our Metasploitable machine. 107 107
Now, if we look through it, 108 108
we're gonna see some port numbers 109 109
and those ports are gonna be important 110 110
to help us identify what this machine is. 111 111
So as I look through it, I see we have 112 112
ftp and ssh and telnet. 113 113
Those are common in Windows and Linux, 114 114
but the ones that aren't are things like rpcbind 111. 115 115
This 139 and 445, those are common of 116 116
Microsoft and Windows machines. 117 117
Notice though that there's not a 135 118 118
which is another netbio port that is 119 119
commonly seen on Microsoft. 120 120
So what this is telling me is that 121 121
this machine which I think is Linux 122 122
is running some Microsoft services 123 123
and they're probably running Samba 124 124
to do file sharing with Microsoft. 125 125
If it had 135, 139 and 445, I would assume 126 126
it's a Windows Machine. 127 127
But we're gonna be able to determine that later 128 128
when we do our numeration. 129 129
As we keep going on, we'll see the login and the shell again 130 130
very common Linux things, we also have nysql. 131 131
We have a vnc player and x11. 132 132
X11 is an extremely common Linux thing 133 133
so that again is one of those things 134 134
that tells us it's probably Linux. 135 135
Now if we click on the port and hosts tab, 136 136
there's actually an easier way to see all this information. 137 137
So if I click on the host I want to look at 138 138
and I click on the port and hosts, 101, 139 139
you'll see that I have open and closed states 140 140
in this case all these were open ports 141 141
that we're looking at. 142 142
The port number and the ftp so it makes it very easy 143 143
to see graphical representation. 144 144
Now if I click on host details, 145 145
it doesn't know what type of host this is yet, 146 146
but it did find that there was 82 closed ports 147 147
and 18 open ports and we did look at 100 ports 148 148
which was pretty noisy of us. 149 149
You can see under Scans, this is the history 150 150
of the scans we've done before. 151 151
We've done our Ping scan and now we've done our Quick scan. 152 152
Now if we want to get a little more intrusive, 153 153
we can do what's called an intense scan. 154 154
What we're gonna do is do an intense scan 155 155
and then we're gonna hit scan. 156 156
Now, the intense scan is gonna look 157 157
at the open ports and the closed ports 158 158
and its also gonna try do some basic enumeration for us. 159 159
So try to figure out what this machine is or isn't. 160 160
So in our case, we're looking at it. 161 161
We're doing a stealth scan right now, you can see that. 162 162
This scan will take us a little bit longer 163 163
because its going through a lot of information. 164 164
One of the things it does try do 165 165
is it tries to do an OS detection. 166 166
It was unable to do an OS detection of the .100 system. 167 167
Again, with the text-based information, 168 168
it's gonna give you a lot of information. 169 169
We can go through each of this individually if we want 170 170
but all of this is gonna be shown 171 171
in a much more graphical format 172 172
for us to use as we move forward. 173 173
So let's go ahead and go over here to the ports 174 174
and then click on the host. 175 175
If you notice over here, our OS changed 176 176
on the .101 machine, that metasploitable machine. 177 177
If you'll notice, we have a little Linux icon here. 178 178
We now see all of the open ports again. 179 179
But notice the difference here from before. 180 180
Not only is it ftp but we know that 181 181
it's vsftpd version 2.3.4. 182 182
This is an enumeration piece. 183 183
You'll see that our Apache is version 2.2.8. 184 184
You'll see that they were running Samba 185 185
which again, Samba Debian is a Linux version of file sharing 186 186
to allow it to share with Windows work group users. 187 187
So our guess at this being a Linux machine 188 188
did pan out to be right. 189 189
In this case, we have MySQL version 5.0.51 190 190
and again, these are all important to know 191 191
because we can take this information 192 192
and search the cve database and be able to find out 193 193
what known exploits there are for these particular services 194 194
so this is all part of that information gathering stage 195 195
for us to plan our attack. 196 196
Then we're gonna move further down 197 197
you'll see here we have a metasploitable root shell, 198 198
we have irc channel, Unreal irc debian 199 199
and again http with a Tomcat/Coyote JSP engine on a Apatche. 200 200
So we also have another ftp up here on port 2121 201 201
so lots of different things that we can go after 202 202
as we start attacking this machine later on. 203 203
Now let's take a look at that Windows machine we had. 204 204
You can see here no ports were identified. 205 205
If we click on host details, 206 206
it was unable to identify the fact that this was Windows 207 207
and if we go to Linux, you'll see that 208 208
this not only was able to figure out that it was Linux 209 209
but that it's most likely Linux 2.6, 210 210
somewhere between version nine and version 33. 211 211
That's gonna ... And it gives us an accuracy used 212 212
based on the ports that it saw. 213 213
So based on what ports it had 214 214
and the responses it received from those, 215 215
it's able to tell us with 100% accuracy 216 216
that this is Linux 2.6. 217 217
It also does this based on tcp sequencing, 218 218
in our case it didn't do a very good job of it. 219 219
It also can do this based on IP sequencing, 220 220
our case it didn't collect any of that. 221 221
Again, more tcp sequencing and then we have some comments 222 222
that we can locate at the bottom, 223 223
there were no comments. 224 224
So, based on the ports used and the way that it responds 225 225
it understood that this was Linux with 100% accuracy. 226 226
So it did a lot of that enumeration for us. 227 227
Now, Windows has not been responding. 228 228
Let's go take a look at our Windows machine 229 229
and see why that is. 230 230
Let's go into our Control Panel, 231 231
we'll go to our security center, 232 232
so you'll notice the Windows firewall is on. 233 233
We're gonna go take a look at the Windows firewall 234 234
and see if that's the reason why its not responding to us. 235 235
So, in this case, we have the firewall on 236 236
and the only exceptions are the ones in the exceptions tab. 237 237
If we look here, there wasn't a whole lot of exceptions. 238 238
If you notice, File and Print Sharing was not an exception. 239 239
Let's go ahead and let that be an exception right now 240 240
because most home networks only use file and print sharing 241 241
to be able to share files and printers across their network. 242 242
Then, lets hit okay. 243 243
Now let's go back and try our scan again. 244 244
So now that we've set the exception and the firewall, 245 245
we're gonna scan the Windows machine again 246 246
using that quick scan. 247 247
That's gonna do the 100 most common ports. 248 248
So we'll scan that machine and you can see now, 249 249
because we've opened the Windows file sharing 250 250
and allowed that exception, 251 251
that we can now identify port 139 and port 445 252 252
as part of that machine. 253 253
Now if we go to the host details, 254 254
let's see if we can figure that out. 255 255
We still can't figure that out yet, 256 256
so we're gonna have to do a more intensive scan. 257 257
We'll go back here and do an intense scan on 100, 258 258
just the one machine and we'll scan again. 259 259
Now, it's discovering the open ports on 139 and 445, 260 260
it's gonna do a syn stealth scan 261 261
to try to be a little bit sneaky for us 262 262
as it goes through 1,000 commonly looked at ports. 263 263
Now if they happen to be looking at this network traffic, 264 264
they're probably gonna see this, because going port one, 265 265
port two, port three, port four, going all the way down, 266 266
you're gonna end up seeing something. 267 267
The other thing, because this is an intense scan, 268 268
it's actually using 138 specific scripts 269 269
as it goes through and does this. 270 270
This is how it's able to do things 271 271
like the enumeration for us. 272 272
Figuring out what ports were open is fairly easy 273 273
with the scan but now it's actually using 274 274
those different scripts. 275 275
It's gonna see those open ports and based on the way 276 276
it responded from each of those ports, 277 277
we're gonna be able to determine what version 278 278
of the operating system it's using. 279 279
So as we scroll up here in our text, 280 280
we can see some information that was found from the script. 281 281
Again, port 135 and 445, we believe it's Windows XP 282 282
based on the way it responded. 283 283
We also got the MAC address and based on that MAC address 284 284
we know it's a virtual box. 285 285
In this case we also can see the operating system scan 286 286
was unreliable because they couldn't find at least 287 287
one open and one closed port, 288 288
they only found those open ports, 289 289
the firewall blocked the rest of the ports from us. 290 290
But they believe that it's Microsoft 2000 or XP. 291 291
Now why would it be 2000 or XP? 292 292
Well, Microsoft XP and Microsoft 2000 293 293
share a common code base, just like Windows Vista and 2003 294 294
share a common code base. 295 295
Windows 7 and 2008 both share a common code base. 296 296
2012 and Windows 8 also share a common code base 297 297
so as they move forward in these, 298 298
you can start seeing this overlap 299 299
and you a lot of times get one where it thinks 300 300
its one or the other or both. 301 301
In this case, it did a fairly good job. 302 302
It realized it's either Windows XP, 303 303
service pack two or service pack three. 304 304
Or Windows 2000, service pack four. 305 305
In this case, it wasn't able to do the prediction 306 306
through tcp sequence, but it can do it based on 307 307
the information we see from the port scans. 308 308
Now as we scroll down, we had some enumerations run as well. 309 309
In this case, it did a netbios check, 310 310
it found the name of the computer, 311 311
the name of the computer is John's PC. 312 312
It also gave us the fact that 313 313
he's in a work group not in domain. 314 314
We also know the fact that we're still, again, 315 315
using Windows XP based on snb that we found. 316 316
Snb being the file sharing. 317 317
Then it did a trace route, in our case the trace route 318 318
goes immediately there because we're on the same network. 319 319
After it did all the scanning, it runs through a couple 320 320
other different reports and scripts, 321 321
tries to find as much information as it can, 322 322
and it did all of that scanning in about 323 323
50 seconds for one host. 324 324
This is important to know because if you're doing 325 325
an intensive scan, it does take some time. 326 326
This was on a network that was on the same network 327 327
on the same machine, meaning it was very quick. 328 328
If I had to go all the way across the internet 329 329
to another host and I was getting numerous hosts, 330 330
that time goes up, the more time you're spending, 331 331
the more packets that you're sending, 332 332
the more likely you are to get caught. 333 333
In our case, we sent out 2,035 packets, 334 334
but we only received 15 back 335 335
so the chances of us getting seen 336 336
was 2,035 times that we sent information to them. 337 337
There are ways we can be a little bit more sneaky 338 338
with these tools, it just depends on the profiles we use 339 339
and the way we configure them. 340 340
Now as we go into ports and hosts, 341 341
we click on our Windows tab here. 342 342
The .100 machine. 343 343
You'll see the fact, again, based on that text output we had 344 344
in a nice graphical format that we can see. 345 345
We then go into Topology and we now see 346 346
that there is some sort of a lock on this, 347 347
meaning there was a firewall of some sort. 348 348
Then we're gonna go here to the host 349 349
and here we can see that we scanned 1,000 ports 350 350
and of those, only two were open and 998 were filtered. 351 351
Filtered means that there was some sort 352 352
of firewall there blocking us. 353 353
Again, the accuracy, the fact that we are Windows 2000 354 354
are very accurate in this case 355 355
and they do that based on the port that they saw, 356 356
the one they made their decision on was 139 357 357
which was a netbio file sharing. 358 358
The class is Windows 2000 and as I said before, 359 359
Windows 2000 and Windows XP share a common code base 360 360
that interact the same way, 361 361
so they look very similar in traffic. 362 362
So, as you can see, we can be very invasive 363 363
or very quiet in our scanning techniques, 364 364
it really depends on the level of information 365 365
that we're trying to gather. 366 366
The question now becomes, 367 367
how quiet do you want to be in your hack? 368 368
Well, that's gonna depend on why you were hired 369 369
by the organization in the first place. 370 370
Are they looking for a realistic hack 371 371
to challenge their defenders and find their weaknesses? 372 372
If so, then you would want to be very, very quiet 373 373
to get that realistic threat. 374 374
But, if you're tasked to provide the defenders 375 375
a simple emulation of an adversary of a script kiddy, 376 376
you'd want to be really noisy 377 377
and that way they can find you quickly and take you down. 378 378
It really depends on the intent of the assessment. 379 379
Again, these tools can be used very sneakily, 380 380
do the customization, or very loudly, 381 381
it all depends on how well you understand your tool set, 382 382
your intent and your method during the hack.