So in this section, what we are seeing here is how to attack such a site now to do this.
First, we are going to use information gathering, which is used to so us the install program operating
system on the target system and running services on the target and put associated with these services
from these installed services.
We can try and get into the system.
We can do this by trying the default passwords also.
So there is a lot of people that install services and configure them.
So we will have another example of this as well.
So the first problem with these services is that sometimes a lot of services are designed to give someone
remote access to that computer, but they obviously need to have some security implementations.
People often miss configure these services so we can take advantage of these misconfiguration and gain
access to these computers.
And the problem with these services is that some of them might even have bad news.
A lot of them will have winnability like remote before overflow code execution, winnability, and this
will allow us to gain full access to the computer system.
So the simplest way of doing this is something that we have already seen, which is Zinnemann.
So we use MAP with the IP on the Web site using ZENN map, we will get a list of all the services and
then Google each one of them to see if they contain any vulnerabilities.
We have seen before that the actual device is actually a website.
If we want to get the IP of the website, we have to do.
For example, if we want to get the IP on Facebook, so we have to ping Facebook dot com and we will
get their IP now.
We will be able to rensin map against Facebook IP and get a list of all the services on Facebook, but
in the section we are going to rinse and map made multispectral device, which basically a computer
device.
OK, so we are going to meet this war ZENN map in the same way as we did before.
To open the map, we will open the terminal.
And.
Let's zoom it first and type here, Zend map, OK, and hit enter.
So now we will bring up the application.
OK, so we can put any IP, which we want to test.
But in this video, we are going to enter the IP target of the device, which is then the to door.
OK, so we are going to scan and then this will give us a list of all the install applications.
OK, so we are going to do intensive scan and hit on a scan.
It will take some time.
Not more than two to three minutes, but it will take some time.
So you have to wait till the completion of all these things.
OK, you have to wait.
Because it's going to.
A can, a limitless electoral device, or we can see a virtual machine, so it will take some time.
So please make sure that your calendar next multispectral device should be in the same network, which
is not OK.
So this varies.
It will be very easy for us to understand how all these attacks and how to perform all these attacks.
OK, so as you can see that the scan is running and we are having here and map output so we can see
the output and we have both source topologies whose details and is.
So we are here inside the unmap output.
So whatever it will is scan, it will come inside this particular tape, which is an output.
So this is for operating system.
This is for all services host, OK.
So you have to wait till the completion of all this process, because it is a scanning something and
it will take some time.
So let's see here next ping.
OK, OK, OK, OK, I.
Need to open it again.
ZENN map.
OK, so now not typed in door to door and heading to.
So it will start scanning, so this is a road map.
So this is the.
God, all this is what we can see the syntax of doing intensive scan when you're using an map.
OK, so this is what we get from the scan machine.
OK, so this is what you can see here.
So the process is going on, so you have to wait till the financing of this because we need some very
important and juicy data from this particular scam.
So we have to wait till the completion of all this process.
So we are having a port or topologies.
So we are not having anything inside all of these tabs.
OK, so this is the.
We this is the way to scan and map, so just click on and map output, let's see.
Is it.
Completed or not?
OK.
So the information that we want is now completed.
OK, so once the scan is finished, we will have open ports and a lot of services.
Now we will go to and map output and the shake board by board and read for the services and Google the
name of the services, for example.
And what we can do here is we can see we have Potente, which is FPP Port EFTPOS, a type of service
that is installed to allow people to upload and download files from a remote server.
FPP service, which is also called file transfer protocol, usually uses username and password, but
we can see that this service has been mis configured and it allows an anonymous FPP login.
So in this we will be able to login without a password.
OK, so all we have to do is we should download FTP clients such as Fiscella.
Now we will be able to connect using IP address on Potente when we can.
Also Google and FPP server, which is in which is in our case is BSF deeply to dot three, dot four
and see whether it has any issue or if it has any misconfiguration or if it is has any monochord execution
exploit or anything else.
So once we Google this, we can see that we as FPP has Batool installed with it.
It literally came with the back door when it has released.
We need to Google the service one by one and check whether they have any any misconfiguration or any
exploit installed.
Okay, so now look at the port.
No.
Flight one to.
Which is OK, which is, I think, here.
OK, so this is the 5.2.
OK, so this is a post put number five.
So now let's assume we went on them one by one and we could not find anything.
And we reached the number five, went to Turkey.
OK, so now we are going to Google the service that is running on five went to port because we don't
know what it is.
After Googling, we know that net out as it is a remote execution program.
If you managed to login with this, we will be able to execute on the target computer.
So this program uses art as such login, which is a program that starts with Linux similar to SSL.
It allows us to execute remote commands or control on the computer system or the target computer.
So now let's go back and see how we can connect to the OT as such.
Our login service.
Let's look at that.
How to install or how to get net get package.
And we can see that.
The that will divide this open to so the target computer running on one, two, and we can see that
in here, it uses the art as a service to connect.
So we need to install art as such plain package to connect to that service.
And it is a clean program for remote connection.
Now, what are we going to do here is we are going to simply open the terminal window here.
Let's make it zoom.
OK, let's minimize all the windows.
OK, so what we are going to do here is we are going to type, abnegate, install or as such.
So this is the command abnegate is going to install and configured it for us.
OK, now heading into.
So once it installed, we are going to use our log in to log in because the hospital told us that it
uses our logging program to facilitate the logging process, we are going to do our logging again and
we don't know how to use this app so we can choose help like logging.
So this is the baby, how we can use this, so the next thing that I'm going to do here is I'm going
to simply type our login, OK, hyphen.
So what is hyphen L?
Hyphen L is nothing word.
This is the important thing.
Are the user name and host, which is the target IP address and root and ordinator to I think OK five
now hit enter.
So now, as you can see that we are having information related to Target here.
OK, as you can see that we are having the information.
About the target.
OK, so this is the information that we want to get from the target site.
OK, so I log in L and door to door 2.5.
So everything is correct.
So this is information that we want to get from the target site.
So this is the basic manual way of getting access to the target computer by exploiting the misconfiguration
of an install service.
So the login services are not configured properly.
All we had to do.
Just Google what came with that boat, and we managed to log in and gain access to the target computer.
So this is all for this lecture.