All right.
Welcome back to the.
Official Cert COP series for the certified Kelly Linux PEN Testing Certification.
We're going to talk about exploiting Windows Systems, Linux and even some OS X.
So essentially you can call this category the operating system exploits.
So this is our general outline.
We're going to look at the different types of security controls.
We're going to talk about technical, administrative and physical controls.
We're going to look at owning systems with Metasploit.
We'll look at systems, different types of exploits, how to generate payloads and things of that nature.
We're also going to get into some ARP poisoning attacks, the address resolution protocol.
We'll look at how our plays a role in different types of attacks.
We'll get into some of the different phishing attack vectors.
We'll look at phishing, smishing whaling, spear phishing.
And we're going to also talk about the various countermeasures and how organizations can protect themselves
against these different types of attacks.
So this is our chapter flow.
We're going to look at that Metasploit Metro Spider, which is stands for Meta Interpreter, but it's
essentially the command interpreter for Metasploit.
We'll talk about pulling windows machines.
We'll look at our poisoning phishing and we'll follow up with some demos and then the different countermeasures.
So first, we need to understand.
The different types of controls that exist with respect to information security.
So there are physical controls, there are technical controls and procedural alcohol controls.
So technical controls you can think of.
These are things that use technology, things like firewalls, encryption, passwords, anything that
uses a technical implementation method.
Then you have the administrative controls.
These are usually more policy based things like user awareness training or acceptable use policies or
password reset policies.
These are things that have to be at.
Implemented and enforced by your administrative elements like your H.R. Human Resources.
Then lastly, you have your physical controls.
You have controls that you can touch.
So physical barricades, security cameras, door access systems, man traps, anything that you can
physically put your hands on.
So let's talk about technical controls.
So these are using technology to reduce vulnerabilities.
So the goal with these controls is not to completely remove risk, because that's not a realistic idea.
Risk is always going to be there.
Risk is going to be something that is inherent in any type of.
System.
No matter what you do, any kind of business, even driving down the street, if you think it's something
non-technical that has an inherent amount of risk.
So the goal with these controls is to try and get risk down to as close to zero as possible, or at
least mitigating the different threats that are out there.
So encryption, we mitigate unauthorized people being able to access our important files so we encrypt
them so that they cannot be easily read.
That could be encryption on a disk.
That could be encryption done in transit.
Lots of different ways to do encryption.
Then you have antivirus software, things like desktop antivirus that check for malicious signatures
of known malware and some of them even implement behavioral detection.
But that's another type of technical control.
Then we have intrusion detection systems and intrusion prevention systems.
Many of the devices these days just combine both functions together, and they're generally thought
of as being able to.
Detect threats, but not able to actually prevent them.
So if you have an IDs versus an IPS and you want to prevent different vulnerabilities, you would want
to go with an IPS at a minimum, then you have firewalls.
So firewalls.
For years they were the last bastion of security between the dangerous network, otherwise known as
the Internet and your internal corporate network.
Although these days, firewalls can be almost anywhere.
They can be on the host, they can be on the network, they can be in the cloud.
They could be on your personal mobile device.
These are all different types of technical controls that are out there.
And then lastly, of course, lease privilege kind of runs the gamut of all systems, any system you
want to give the least amount of privilege possible from an access control perspective, don't give
somebody full administrative rights on a Windows machine when maybe they can get by with power use or
don't give somebody root access.
But maybe all they need to do is sudo to root.
So those are technical controls.
Then let's look through administrative controls.
So things like risk assessments, vulnerability assessments, penetration tests.
Now these even though these are administrative or management controls, they do have potentially a technical
component to them.
So don't get those confused now.
But most of these, you know, risk assessments, vulnerability assessments, like we've talked about,
they have to be driven by some type of management policy from the top down, from your C-level executives
all the way down to your lowest level.
Other types of administrative controls are user awareness and training.
So when you first get your account, you have to go through some type of training that says you're not
going to do anything inappropriate with that account.
And then, of course, you have your configuration and change management.
You might hear it called CRM.
This is essentially making sure that people aren't arbitrarily making changes to systems without actually
documenting things.
And then, of course, you've got your media protection, your contingency planning, continuity of
operations or coop, which is a very common term.
These are all administrative controls.
And then, of course, your physical and environmental protections, your HVAC systems, your temperature
control systems, your thermostat, these these are all managed by.
An administrative method.
And then lastly, we have the physical controls.
So anything you can physically put your hands on, whether that's a camera, whether that's a door system,
an access badge system, of course, signs.
Security guards say keep out, don't know.
By entering on this property, you consent to search or some other type of action.
So those are security controls.
So what is exploitation?
So we've looked at vulnerabilities, we've looked at exploits in Metasploit, but exploiting can really
be a lot of different things.
It could be software or hardware.
So exploitation means taking advantage of some vulnerability that results in a loss to a company.
So usually that involves privilege escalation.
You get access to a system and then you elevate privileges to root or to an administrator.
And then you take over that system.
And use that system to perform other nefarious things like denial of service attacks or botnets or many
other different things.
So that's exploitation.
So there are essentially two types of exploits.
We have local and we have remote.
Local generally means you have to be on the same network or have physical access, some type of local
access to the system.
Remote means generally it can be done over the network.
So how do we.
Get access to some of these systems and build exploit code while we've looked at Metasploit.
So Metasploit is known for its anti forensic and evasion tools, some which are built into the Metasploit
framework.
And basically the process goes something like this you choose an exploit.
Check and see whether the target system is vulnerable.
Figure the payload.
Figure out how you're going to encode.
That payload and send it to your target.
So NSFW venom, as we've talked about, is the combination of MST payload and MDF and code.
They essentially replaced the old methods of creating payloads outside of the Metasploit framework.
So the advantages are it's one single tool.
It's standardize across the command line options and it's much faster.
So this is an example of a payload generation on Windows System.
Let's go ahead and run one more boot up into our Kelly Linux machine because we've seen how to do exploits
inside of.
Metasploit move?
Not necessarily.
Gone through an exploit, an MSF venom.
So we'll type the MSI Venom Command and then a dash a.
And then what platform we want.
MSF then on let's look at the main page first.
So payload generator and coder.
And there's some different you can pick what architecture you want to use with the dash.
A
You know, we're going to do a dash dash platform.
And where I use windows and we're going to do dash for the payload.
And we have picked Windows Shell because we want to get a shell on a Windows system.
We want a TCP binding.
And with that, we're going to do the Dash E x86.
So Ash Shikata.
Underscored Jay and I and then dash B and then we put in our.
No bite.
What?
And then Dash I.
As long as we make our mistakes, we should get our payload.
And it might take a little bit since I'm doing it in a virtual machine.
It means I probably made a mistake for the.
So since we were having issues with that payload, I went ahead and picked a different one.
So, so myself venom dash p I'm using the PHP interpreter reverse TCP shell.
I put the host as the IP of the target and the port that I want to use.
And I had it output the payload to example dot php and there's the payload.
That was created by the MSF venom.
30,688 bytes.
So this is what would get run on the target system.
So I can generate from MSF payload as well, which we saw in the previous module.
So if we go the strain and go into our.
Return greater.
Session.
First we have to start up Metasploit.
You is payload shell buying TCP.
And want to.
And there's a lot of payloads because I didn't quite type it just right, which does tend to happen
with the command line.
So again, you want to make sure that you're just being mindful of the.
The case sensitive nature.
So really you can pick.
Any payload that you want out of this menu here, it doesn't matter which one.
There you go.
So we've got our payload now or essay we're going to go ahead and generate.
We can look at Dash H, which will tell us what to do.
We're going to go ahead and generate without any parameters.
Oh, yeah.
We got to set the the host.
So we want set elbows to.
Unknown.
216873.
And we're going to now we're going to generate
and there's our payload.
We can do the same thing with removing the no bytes.
We've already done that.
We're not going to do that.
There's other tools by which you can create these types of payload.
There's the fat rat.
There's and MAP has its own scripting language.
If you remember, if we go into a new tab here and we go into the
IMAP directory, we have some payloads.
And these are all the different payloads that come built in to and map.
So depending on what version you might want to do, of course, there's Wireshark is more of a tool
for capturing packets.
If you want to look at Wireshark, it's built into Kali Linux.
It's under the.
Let's see.
Or they put it.
Under the sniffing section, along with some of the other sniffing tools.
But notice it's already open here and we're going to just use the Ethernet zero.
So I didn't run this from pseudo, so that means I don't have permission to run it.
So you want to make sure you run Wireshark as a route?
I'm going to go ahead and close that down.
Okay.
Let's try this again.
But the correct permissions are the correct.
Yes.
Okay.
Now we have it.
So we can go ahead and start capturing and immediately we're going to start seeing bits come across
the wire.
We can see frames.
We can see information.
We can see the IP address.
We can see the source and destination MAC address.
We can see what type of packet it is.
So this is going out to an Eero router and broadcast.
Some of these are standard CTP traffic symbol service discovery protocol.
I'll see what happens when we open up a web browser.
Should start to see some ICMP connections.
And some TCP connection as well.
Look, there's there's some ARP traffic.
Say who has the IP address for this?
And we've opened up our browser and let's just go to CNN.com and we'll start seeing some TCP queries
coming across.
We're currently on 205.
And essentially this is how you can look at your network and look at the traffic and see what ports
and things are open, what how protocols are communicating.
And see it gives you a message at the bottom and has live capture in progress and it tells you how many
packets are being captured.
This number on the left hand side is just arbitrary.
So if I want to filter out just TCP traffic, I can do that by just typing in stuff in the search box
here.
Maybe I want to TCP dot port equals.
Maybe just what's on port 88.
I only want to see from particular ports and if I want to stop capture, I hit the stop button and now
I can actually save this as a file.
I can even open captures from other places, use different utilities to analyze the traffic if I right
click on one of these streams.
These TCP streams.
I can actually follow the stream and I can see the data that was sent back and forth between the website.
And my virtual machine.
I can look at the whole conversation and I can only look at one side at a time.
I can change the format if you want to see the raw input.
Maybe the animal.
You can change it to different different formats to hex traffic, which you can see the hex in the the
bottom pane here.
If we move this up and we scroll down a little bit.
You'll be able to see the hex over here.
So ideally, if this traffic is in the clear, you'll be able to see anything that's in plain text on
the right hand side that potentially can get you things like passwords, session tokens and many other
things.
So that's Wireshark.
Let's go ahead and close that.
So before we get into ARB, we saw some ARB traffic.
There are BAS actually addressed resolution protocol and we can look at ARB traffic from the command
line and it's got an enclosed screen and we can see these are all the the IP addresses and MAC addresses
that this network interface card knows about, that it's able to talk to and what interface.
You might have a few more, you might have less, but ARB can be very useful in finding out information.
And it's a chatty protocol that essentially if a system wants to communicate with another system over
a network, it has to first send out an hour broadcast to find out what IP address and MAC address that
that system is on so it can update its own cache.
The cache is essentially a table that each device has and it stores that information.
That's what I just retrieved there from the command line.
So maybe I want to dash vee for her boss mode so I can get a little bit more information.
If there actually is any there or about a particular host.
So maybe I want to delete an entry or potentially I can also use this command to add a new entry.
So if I was an attacker and I could change the ARP cache.
Then I could potentially redirect traffic to myself or to to my website.
So that's one of the things we're going to look at here momentarily.
So how does art poisoning work?
Well, an art poisoning attack is where an attacker sends messages to the local area network via armed
traffic.
So in this case, we have the one computer, the 1921680.102.
Wants to talk to the .104, which is this computer over here.
Now, the attacker can associate their Mac address with another host's IP address, which essentially
means that all the traffic is going to be sent to them.
So notice the attacker says, Hey, this is my Mac address.
Send me all the traffic that was destined for this other host.
So.
Our poisoning is essentially changing the or our spoofing, as it's called.
You can intercept, modify, then collect the traffic data across the network.
This could be the start of other types of attacks like man in the middle or session hijacking.
So what is our spoofing?
Well, our spoofing is essentially where you forge packets.
If you send another a bunch of our requests to try and overload a switch.
So essentially what you'll end up doing is you'll run a tool like ARB scan or.
The top method here as in windows.
Let's look at Caylee first.
Let's go ahead and clear the screen.
Let's go ahead and look at our DASH scan.
So this is the AAB scanner.
So if you set up what options you want and what hosts you want to actually scan.
So there are some options here for the different types of packets and different headers you can you
can modify.
And here's some examples.
So our scan interface.
So I'm going to use the Internet zero interface.
What's that?
Interface equals Ethernet zero.
And I'm going to send it out over the network 1921687.0 slash 24, which is the network I'm on.
So now it's going to go out and it's going to send in our request to all those packets.
So all the packets came back for the eight hosts that responded.
There is another tool called ARP spoofing where I can essentially
and sometimes it may not be installed in your Kelly Linux distro, so you may have to go download it
from the repository.
So in that as does sometimes happen, these tools get removed removed from the distribution.
So let's look at one other tool for spoofing.
Mac addresses.
There's a tool called Mac Off, which essentially will flood a network with a bunch of Mac addresses
to try and essentially poison the Mac table.
So it works like this Mac off Dash II and then the interface name.
So in my case, it's Ethernet zero.
So I'm going to press enter and again some tools get taken out of the repository.
So as does happen sometimes tools getting removed.
So if the Mac, iOS and the ARP spoofing tool do not come up for you, you have to do an app to get
install DCF sniff, which is the library that contains these tools.
So once you do that, then you'll be able to run these commands.
No problem.
So Mac off Dash I and the interface I want to flood it with and notice it's going to send.
Essentially, I think it's like 130,000 Mac addresses out that interface.
So if, if I were connected up to a corporate switch, I potentially flood the switch table to update
new Mac addresses into its ARP cache.
Now there are ways to block this with port security and other things, but this is one tool for doing
that.
And then we have our spoof.
So this, this tool will allow you to intercept packets on a switch lan by essentially forging.
ARP replies, So you put the interface and you put which one you want.
Which hardware address to use when you're restoring our configuration and then you put your target.
And then R is the if you want to poison in both directions.
So let's say I want to go upstairs.
Dash II for Ethernet zero.
Dash C for both.
I want to do dash T, I'm going to have my target be one on 21687 not t 23 and I mistyped it.
AAP Spoof.
Are.
So couldn't our four spoof post 1921687.2 or five.
And so we changed the gateway to the layout of the router and we're getting our replies back from.
That particular.
System.
So essentially all we're trying to do is spoof our requests to our target to pretend to be.
The router and essentially get that target to send all of the traffic back to us.
So go ahead and kill that tool.
So we've got different information in there now.
So that's our spoofing, Mack Flooding.
And next, we're going to look at some of the different tools by which you can do Man in the Middle
Attacks.
We have Ed Kapp, which is in Kali Linux.
We also have Cain and Abel.
We've looked at our scan, so let's go ahead and we're going to open up our terminal and we're going
to look for a file called Error Dot DNS.
So there's the enter cab DNS file.
And we're going to open it with a text editor like Leaf Pad or something like that.
And we have to give it the full path.
So there's no leaf pad on this one unless I'm going to go out and stall it because I like that text
editor.
It's another it's another option.
It just comes with some of the versions of Carly, the older versions.
But those, again, they, they update with new things and yeah, you can always just install it.
It's pretty lightweight and user friendly.
And it's a little more visually appealing on some of the the default ones.
So let's go ahead and open up.
Edward Dance.
And so there's the file.
Zoom out a little bit because.
It's not.
Let me zoom out.
That's okay.
It happens.
So we're going to.
Add a new entry in here.
So we've got to go to anything that's not in the.
Cause there's lots of different things in here.
So we're going to ping a site called Hack this site.
And let's open up our terminal here.
This is keeping track of the outer cap hack.
This site is a legal site to be able to practice ethical hacking, penetration testing and all that
kind of stuff.
So we're going to go ahead and copy this IP address and we're going to go back to our DNS file.
I want to go down here to where it says.
Let's see.
Or is it that?
No one likes Microsoft.
We're going to say Google.com.
I'm going to make it a record.
I'm going to have Google dot com point to that IP address we just copied.
But so evidently I did not actually copy the IP address.
One moment.
Or my terminal.
Go.
All right.
Let's see if I can actually get that.
IP copy.
Copy.
Okay.
Let's go back to the site and we're just going to put it right here.
Paste.
Okay, good.
Now we're going to go ahead and hit file save.
Now what we're going to do, we're going to look for the error cap program.
Under the sniffing and spoofing section.
This is the outer cap, GraphQL.
There is a command line version, but we'll look at at our cap.
GraphQL.
And the program will require authentication.
And I typed in the password wrong.
They had the caps lock key on.
So make sure I was paying attention to your.
Make sure it's case sensitive.
So we're going to go ahead and go to the host lists.
Hosts lists.
So I say that's fine.
Oops.
So they've changed it a little bit.
So in our host list, we're going to.
Go to our target machine and we're going to look for that IP address.
As we've already got some hosts that are pre-populated in their.
So we'll just use this.
This one here.
Add the target one.
Now.
We got to find we got to add the.
The Fall gateway as well.
It's going to run another scan for hosts because we should be getting.
There we go.
I'm going to add that the target to.
There's a default gateway.
So now we're going to click on.
They've changed a little bit in the graphics, so we're going to go ahead and do many metal art poisoning.
Notice there are different plug ins you can you can do here as well.
You can set it to log different ways.
Go ahead and click play.
And it started the unified sniffing.
And essentially we're going to add in a DNS spoofing plug in.
Where's it at?
DNA spoof.
And I say, Oh, it's already okay, so it's already loaded.
So we're good there.
So now we're going to go to Google.
On the target machine.
Now we're going to try and browse to that Web site and we should be redirected to.
The hack this site IP address.
Now we can see that we've got our poisoning moving for group one.
Group two.
So group two is the default gateway, and the group one is our actual target.
So what are the countermeasures we can use to protect against ARB spoofing while there is a utility
called XR?
There's Comodo, A.R. there's you can do static ARB entries on servers.
You can set your IDs to check continuously for a large amount of traffic on local subnets.
So the ZAP tool, this is the anti spoofing detection.
It's free.
You can donate, but all you have to do to get started.
You can write both on Windows and Linux.
If you want to run it on Ubuntu, which is what Kali is based on, you'll just have to make sure you
install a couple of different.
Prerequisites.
So let's go ahead and go back over to our terminal.
Okay.
They're going to go pseudo.
They're going to paste.
I had already had zero in there.
So we're going to install ZAP and we'll be able to see.
So again, there may not be this may not work for Cali because some of the repositories aren't there.
But if you're want to install on something like Ubuntu, that would be the best recommended practice.
And again, some of these tools get out of date.
They do have a VPN package that you could install as well.
So if you're getting a problem, you might have to.
Change your.
Repository information your sources not list.
So just be aware of that.
So let's talk about phishing attacks.
Phishing are very prevalent attacks in.
The world even in.
The age of lots more security.
So phishing attacks are one of the easiest ways to get information.
From your target.
They are often used in conjunction with attacks like social engineering.
There are many different types of phishing attacks, and they happen to banks, social networking sites,
large corporations, gaming sites, all kinds of phishing attacks that exist and lots of different attack
vectors.
You can see on the graphic here for.
The different targets for fishing.
If you go to our website like Net Craft, you can actually look at the.
They keep track of all the
fascist top level domains or the current fishing attacks.
So you can click on individual countries and see how many fishing incidents they are per the number
of sites.
So if you go to somewhere like Russia or maybe China, like one out of every 12 sites is fishing.
Greenland apparently has no fishing sites.
You can look at the the tracking chart to see who has the most fishing incidents.
So Haiti is one out of two sites, but they have much less sites.
So if you look at someone like China, one in 12, that's a much more impressive number.
So phishing attacks can be done via pop ups.
They can be done with toolbars, all kinds of different add ons.
There are lots of different ways, either via email or text message will get in to some of the different
methods here.
Basically, the attacker sends an email to the victim, gets the victim to click on a link on a fake
page.
It redirects them to a different page.
And now they're able to do things like steal credentials.
And many other things.
Sometimes there might be phishing attacks on the local network.
So what can an attacker get from these types of attacks?
They can get admin rights, your email username, credit card information, your Social Security number,
anything that they could use to purchase something to gain that knowledge or to maybe sell your identity
on the Darkweb, especially your your health care information.
And it's easy to set up a website to be able to deploy these types of attacks.
So the different types of phishing attacks and they each have their own sophisticated sophistication
level.
So remember that spear phishing is different than whaling.
Spear phishing targets specific groups of users, employees, customers, whereas whaling targets high
level executives.
Then you have clone fishing.
Phone fishing.
Is cloning some type of information or some identity?
And essentially this can be done with something like the Social Engineers Toolkit.
The common phishing could be cloning a legitimate website in order to gain credentials or setting up
a fake website that looks very much like, say, Twitter, for example.
And then you have.
Wailing for your high level executives, you're sea level executives.
I want to talk about each one of the different types here.
So spearfishing targets victims who put out personal information on the Internet.
To be able to look at things like your profile or maybe your Facebook, your MySpace and the old days.
So the more the more types of attacks that attackers put out, the more chance they have of success
as phishing and often in conjunction with spam.
Email can be very lucrative because it doesn't put a whole lot of risk on the attacker.
So attackers will set up messages that say, you know, you have to do this.
Now as to why they need sensitive information, there's urgency like your bank is contacting you and
they're going to ask you for your password.
Otherwise, you're going to lose some data.
They concoct some kind of a story that.
Makes you believe that you must do this now, otherwise there's going to be a problem.
So victims are often asked to click on a link, open up a malicious attachment.
This can even be done with things like mobile apps.
Click on a link to download the app to your phone and then takes over your phone.
So all they need to be successful is one click or one link.
So spear phishing versus regular phishing.
Phishing is broad and generally automated and is less sophisticated.
Spear phishing means the attackers already done their homework and their.
They've researched the camp, their target thoroughly.
So let's look and see how we can create our own phishing page using Kali Linux.
So first, we're going to open up the social engineers toolkit.
It sits under the.
The Social Engineering menu.
And Kelly.
So you can click on it there.
Or you can just type in Setauket and you'll get the same.
And you have to run it as route.
So that's.
One of the things to keep in mind.
And you have the first time you run it.
You have to agree to the terms of service and provide.
You're not going to do bad things with it.
Code named Maverick.
And this is their website, the trusted SAC, where you can get more information on how to use it.
Let's just say we want to perform a social engineering attack.
And so we want a let's look at website attack vectors.
So we can pick different modules that are built into the social engineering toolkit.
So I choose the type of attack, and then I choose how I want to.
What kind of payload?
So let's say let's do the Java applet.
And I'm going to look at the website template.
I could clone a site as well.
Am I using that or port forwarding?
I'll say no.
So what lesson or do I want?
This is what I wanted to do.
And then I have to decide whether I'm going to use my own self.
Self generated applet built in one.
I'll just.
In this case, I'll just use the one built into the social engineer toolkit.
So depending on the template that I want, if I want to use Google or Twitter.
So it's going to inject the Java applet attack into that cloned website and I want to pick what type
of session I want.
And I'll say I want the interpreter.
Payload will just go with the default.
Pick the port that you want it to listen back to.
And what payload do I want to deliver?
I'll do the just reverse TCP.
And so I want so.
So I have a patch running already, so I'm going to go ahead and have it stop the Apache Service within
the SC toolkit.
So once that's done.
It is now launched.
The Web server site has been moved.
The Web server is now listening.
So the attacker would set up some type of email payload to get the user to click on it.
And then that's going to move me back in to Metasploit.
So it already started the reverse handler.
And now we're ready to go.
Now all we have to do is wait for our potential victim to visit the cloned website or click on the email.
Ultimately, there are many different ways to do phishing attacks.
They're evolving day by day, and scams are becoming better and better.
The sites that are set up look like legitimate banking sites.
There's even phishing mobile apps.
And these sites may look exactly like the real thing.
So users have to become even more tech savvy and they have to improve their user awareness training
to make them less susceptible to clicking on phishing emails.
There's no really prevention method except for education.
Because phishing is so cheap and easy to do.
You'll want to be.
Make sure that.
Whether you're shopping online, whether you're doing banking, you know, communicating information
only via phone or via secure websites, you want to have some type of out of the normal band of communication
where your bank your bank will never call you and ask you for your password.
They may send you a authentication token or something like that, but they're not ever going to call
you out of the blue.
And, you know, things like the Social Security or not, Social Security, the Secret Service scam
that says they're going to come arrest you.
The regular people may be very tempted to fall prey to these phishing attacks.
So, bottom line, don't click on links, download files or open attachments from unknown senders,
even if it's from somebody that you might know, like your boss or maybe your a family member.
Never send out personal or financial information, even if you are.
Even if you're sure that there's no threat of that person.
Just just to be on the safe side.
And also beware of any links or emails or any extra downloads that come with even from legitimate sites
that you've been to many times.
To keep yourself from falling victim to these types of attacks.
So this is a summary of the tech, the things we went over.
We looked at the different security control types.
We looked at technical controls using technology, firewalls, encryption.
We looked at administrative controls, using administrative or management methods.
We looked at physical controls, things you can physically touch.
We looked at MSF Venom, which is Metasploit frameworks, payload generator, which outside of the MSF
console.
We looked at exploiting different ways to do software hardware exploits.
We talked about phishing.
We talked about spear phishing, whaling and even Smishing.
And then Vishing, which is doing phishing over the phone or over a voice over IP connection.
And then we have ARB spoofing the address resolution protocol where we send a bunch of forged ARP requests
and replies to overload the switch and set it back into learning mode.
We also looked at how to men in the middle using ed cap.
So now let's do some practice questions.
What is are the different types of payload connections that can be generated for Windows exploits using
Metasploit?
Is that a mature, prettier shell reverse HTP connection?
B Shell TCP only.
C interpreter only or d.
A and b.
The answer is a interpreter.
Shell and a reverse HDP connection.
Number two, what is the command that's used to generate Windows payloads using MSI Venom?
Answer is a massive venom dash p for the payload, the windows slash interpreter slash reverso.
ANC are very similar, but.
There's a slight difference there.
It's missing the mature operator section.
And the other two are not correct.
You could have ruled out D because it said Windows and you wouldn't be in a Linux payload for
number three.
Oops.
Which command prints the table on the terminal or command prompt?
Is it a route?
BBC mod.
See our dash w or d?
Our dash a.
Answer is d arb dash.
A Let's take a quick moment to briefly touch on the root command, because we've not yet touched on
it.
Just open up a new.
So the root command is not in Linux, but you can look at the ARP command does work.
So the root command does work, but it's a little bit different than in Windows and Linux.
It's just root and Windows.
It's root print.
So the root command can get you the routing table and Linux.
You can change things, you can add routes, delete routes.
So essentially functions much like a rolling table on an actual router.
Now let's look over at windows.
If we open up a command prompt and we do a root print that will actually give us our routing table for
our system.
So it gives you both IP version four and IP version six.
As well as any active routes that are there.
If you see it as on link, that means it was generated by the connection.
If you see it with a lower metric like this top one here.
This is always going to be the preferred route unless I put any routes in myself.
These are what are known as persistent rounds.
There are none on I.V. version six because routing is not enabled for IP version six right now, but
that's Linux and Windows Root table now with C-H Mod, that is for setting permissions on files.
So that would not have anything to do with ARP.
And ARP Dash W is not the correct command to print out the ARB table.
So let's do the next question, which is the built in calisthenics tool that's used in capturing network
packets on the command line.
Now, we did look at Wireshark, but we did not look at this particular one.
We looked at end map, and we know that Inline is part of Metasploit, so that is not a packet capturing
tool.
So the correct answer is TCP dumps.
So let's see briefly what you can do with TCP dump.
If you don't have Wireshark and you want to be able to sniff traffic on the network, you can use TCP
DHCP.
It's generally available on about every distribution of Linux that is out there.
So you can set it to just start capturing packets, you can set it to verbose mode, you can even tell
it to just write to a file.
If you don't give it any any information, it'll just start displaying the packets on the screen so
much like Wireshark does.
Except to be dumped just sends it out to the terminal.
Now, what if we want to do?
And I want to write it to a file.
So I want to capture only what's going over the ether in that traffic.
I'm going to go ahead and close a couple of these terminal windows because we got too many of them open
now.
We're going to go to the browser here.
Open up a few tabs.
Because we want some traffic to show up.
This is hack this site dot org.
So this is a.
A place where you can practice legally your trade craft and it's free, safe and legal.
So they gave you permission right on the front of the website.
So if you need a safe place to be able to practice these things, this is one good example.
There are several other ones you can actually host yourself.
OWASP has a practice website called The Juice Shop.
You can actually download it and load it up on your Linux box and it looks just like a fully functional
website.
It's written in no JavaScript Express and Angular, and it has a bunch of different challenges and bugs
to be able to find.
So you can actually install this and run it.
There is another one called the Buggy Web app.
So again, an effort to make you better at ethical hacking and make you not get in trouble in the process,
give you a lot of different resources to be able to perform these types of tests legally on your own
network, on your own systems.
So this one has over 100 vulnerabilities just by itself, and it has not only PHP, but also a MySchool
database, and it could be run on Linux and Windows.
Also, they have a virtual machine called Bibox, which comes with the buggy web app pre-installed.
So if you want to run it from your local system.
As a virtual machine, you can do that.
So we give you a lot of different places to practice these tools.
So keep in mind that capturing traffic may have legal repercussions depending on where you are in the
world.
So don't just assume that all these tools are legal based on your country.
Check the local laws in your local area with your local government.
So let's go ahead and look at the the tax file we created.
There's all the packets that were dumped out.
And you can see we can save this to a file.
We can analyze it later, we can take it to another system and analyze it.
So so that's TCP dom if you have we looked at Wireshark, we did not look at the the command line component
of Wireshark, which is t shirt, which works very similar to
TCP dump.
So of course they don't want you to run it as route, but it's going to show the traffic in much the
same way.
And we can see the packets are numbered and we can see the source and destination address and we can
see what type of protocol it is.
We can see the TCP connections going back and forth.
So there's a lot of useful tools for doing packet capturing on Kali Linux as well.
So TCP dump was the correct answer to the question, but I wanted to take a moment to show you that
because it's an important tool to add to your repository.
It's a number of five.
What are the different types of exploits?
Local and remote.
Passive and active.
Local and passive.
Or local only.
Answer is a.
Local and remote are the two types of exploits.
These are some of the acronyms we talked about.
And so to recap, we covered the different control types.
We covered Metasploit.
We looked at going after Windows Systems with Metasploit.
We looked at our poisoning attacks.
We looked at phishing attacks as well as some of the countermeasures.
I hope you enjoyed this lecture.
You now have a better understanding of the different types of attacks you can do with Metasploit, about
our traffic, about man in the middle line, as well as phishing attacks, and how you can protect yourself
from these types of threats.
Thank you and we'll see you in the next module.