WEBVTT 00:00.770 --> 00:01.969 Hey, everyone, welcome back to the 00:01.970 --> 00:03.379 course. So in the last video, we 00:03.380 --> 00:04.459 wrapped up our discussion with 00:04.460 --> 00:06.049 banner grabbing, so we wrapped up 00:06.050 --> 00:07.050 Module four and with 00:08.180 --> 00:09.739 banner grabbing as well as operating 00:09.740 --> 00:11.089 system fingerprinting is technically 00:11.090 --> 00:12.349 renumeration that we're doing. 00:12.710 --> 00:14.278 But here in this particular lab, 00:14.660 --> 00:15.949 we're going to discover some other 00:15.950 --> 00:17.289 ways to do enumeration. 00:17.300 --> 00:18.889 So we're going to use a tool called 00:18.890 --> 00:20.899 Zend Map, as well as using the dig 00:21.050 --> 00:22.390 in finger commands. 00:23.090 --> 00:24.299 So let's go ahead and get started. 00:24.530 --> 00:25.909 So you should already be logged into 00:25.910 --> 00:27.230 the Siberry lab environment. 00:27.500 --> 00:28.339 We're just going to search for 00:28.340 --> 00:29.340 ethical hacker and 00:30.410 --> 00:31.609 we're looking for the top option 00:31.610 --> 00:32.989 here, the certified ethical hacker, 00:32.990 --> 00:33.769 S.H. 00:33.770 --> 00:34.909 Once you found that, just go ahead 00:34.910 --> 00:35.910 and click on it and 00:36.740 --> 00:38.049 then click the launch button here. 00:38.360 --> 00:39.589 We'll have one more button we need 00:39.590 --> 00:40.759 to click, which will be the launch 00:40.760 --> 00:41.599 item button. 00:41.600 --> 00:42.829 And then it launched the lab 00:42.830 --> 00:44.090 environment in a separate window. 00:44.120 --> 00:45.679 Now, if you're doing this lab on 00:45.680 --> 00:47.149 your own machines, on your own 00:47.300 --> 00:49.399 virtual network, then by all means, 00:49.730 --> 00:50.629 you'll just want to make sure you 00:50.630 --> 00:52.429 change your IP addresses and you 00:52.430 --> 00:53.749 just want to open a terminal window 00:53.750 --> 00:54.950 inside of your Kelly Linux. 00:55.380 --> 00:56.659 Once we get to that point and you 00:56.660 --> 00:57.739 should be able to follow along 00:57.740 --> 00:58.870 without any issues. 01:00.420 --> 01:01.619 All right, for everyone else that's 01:01.620 --> 01:03.049 using the Siberry lab environment, 01:03.450 --> 01:04.679 you're going to go ahead and look 01:04.680 --> 01:06.199 for the using enumeration tools 01:06.930 --> 01:07.739 lab. 01:07.740 --> 01:08.780 So it's going to be this one. 01:08.790 --> 01:10.139 It's about halfway down the page. 01:10.200 --> 01:11.430 So it's this one right here. 01:11.930 --> 01:13.049 Just go ahead and click on that and 01:13.050 --> 01:14.129 then click on the start button. 01:14.730 --> 01:15.899 Once you do that, you'll see all the 01:15.900 --> 01:17.030 virtual machines here. 01:17.100 --> 01:18.100 We're just going to go ahead and 01:18.600 --> 01:20.309 activate these or turn these on 01:20.610 --> 01:22.139 the way. We do that as we just hover 01:22.140 --> 01:23.879 our mouse over top of each one and 01:23.880 --> 01:25.580 select the power on option. 01:26.310 --> 01:27.680 So just do that for all of these 01:27.780 --> 01:29.519 will take about 20 to 30 seconds to 01:29.520 --> 01:30.790 boot all the way up. 01:30.810 --> 01:31.919 So while that's doing that, I'm 01:31.920 --> 01:33.359 going to pause the video and we'll 01:33.360 --> 01:34.879 use a magical fast forwarding again. 01:35.070 --> 01:36.959 And once they've pulled up here, 01:36.960 --> 01:38.579 then I'll restart the video and 01:38.580 --> 01:39.659 we'll move forward with the rest of 01:39.660 --> 01:40.660 the lab. 01:41.990 --> 01:43.459 All right, so we see that all of my 01:43.460 --> 01:44.629 machines are booted up now. 01:44.660 --> 01:45.839 Now, if you have not finished 01:45.840 --> 01:47.506 booting all the way up here and if 01:47.540 --> 01:48.919 they're not showing all the green 01:48.920 --> 01:50.341 button that says on that, you 01:50.750 --> 01:51.979 just want to pause this video real 01:51.980 --> 01:53.089 quick and wait until all your 01:53.090 --> 01:54.090 machines come online. 01:54.350 --> 01:55.369 Now, we're not going to be using all 01:55.370 --> 01:56.389 these different machines in this 01:56.390 --> 01:58.099 particular lab, but it's just a good 01:58.100 --> 01:59.239 habit to get into of making sure 01:59.240 --> 02:00.514 everything's booted up and 02:00.680 --> 02:02.149 functioning properly so you can 02:02.150 --> 02:03.739 continue on with any labs that you 02:03.740 --> 02:04.740 happen to be doing. 02:05.600 --> 02:06.819 So let's go to our lab document. 02:06.830 --> 02:07.759 We're going to see which machine 02:07.760 --> 02:08.638 we're going to click on here. 02:08.639 --> 02:09.799 So we're down here at step number 02:09.800 --> 02:11.270 six. So we're going to connect 02:11.870 --> 02:13.549 to the Windows 10 machine, which is 02:13.550 --> 02:14.779 the lab, Quinten. 02:15.380 --> 02:16.419 So let's go ahead and do that as 02:16.430 --> 02:17.299 we're just going to go ahead and click 02:17.300 --> 02:18.259 on that one. 02:18.260 --> 02:19.579 It's going to take a moment or so to 02:19.580 --> 02:20.740 pull the desktop for us. 02:20.750 --> 02:22.039 We'll also see a command prompt 02:22.040 --> 02:23.608 window. Usually that will pop up 02:23.690 --> 02:24.649 randomly. 02:24.650 --> 02:25.849 We'll give that a second or so to 02:25.850 --> 02:26.960 pop up and then go away. 02:27.230 --> 02:28.879 And once we've done all that, we're 02:28.880 --> 02:30.589 going to double click on this Vincey 02:30.590 --> 02:31.519 viewer icon. 02:31.520 --> 02:32.419 So you'll see there's a command 02:32.420 --> 02:33.439 prompt window I mentioned. 02:33.770 --> 02:35.120 So now that that's out of the way, 02:35.150 --> 02:36.079 we're just going to go ahead and double 02:36.080 --> 02:37.370 click on this little icon here. 02:37.850 --> 02:39.614 The viewer on it looks like a little 02:39.680 --> 02:41.529 orange icon or a 02:41.600 --> 02:43.340 tiger's eye is really what it is. 02:43.670 --> 02:44.659 We're just going to double click on 02:44.660 --> 02:45.660 that to open it up. 02:46.430 --> 02:47.929 Now, by default, it should have the 02:47.930 --> 02:49.819 Calli Linux machine IP 02:49.820 --> 02:51.339 address in there for us, if for 02:51.740 --> 02:53.599 some reason it doesn't, I've listed 02:53.600 --> 02:54.949 it there in the step by step lab 02:54.980 --> 02:56.689 guide and you can just manually type 02:56.690 --> 02:57.690 it in there. 02:58.360 --> 02:59.639 All right, so sun sets in there, all 02:59.650 --> 03:00.669 we're going to do is just click the 03:00.670 --> 03:01.670 connect button. 03:01.870 --> 03:03.369 Now, before we enter the password, I 03:03.370 --> 03:04.620 just want to mention again that all 03:04.630 --> 03:05.979 the step by step lab guides are 03:05.980 --> 03:07.179 available in the supplemental 03:07.180 --> 03:08.620 resources section of the course. 03:09.220 --> 03:10.269 Go ahead and download that and you 03:10.270 --> 03:11.799 can get all the documents, as well 03:11.800 --> 03:13.330 as information about the assessments 03:13.540 --> 03:14.769 that you'll want to take as part of 03:14.770 --> 03:15.770 this course. 03:16.690 --> 03:18.189 So in this password field, we're 03:18.190 --> 03:19.359 actually just going to get the word 03:19.360 --> 03:21.026 password with a capital P and then 03:21.190 --> 03:22.990 replacing the O with a zero. 03:23.020 --> 03:24.149 So let's go ahead and do that now. 03:24.520 --> 03:26.079 So we'll type in capital P and the 03:26.080 --> 03:28.119 lowercase HSW, 03:28.690 --> 03:31.029 the number zero and then a lowercase 03:31.030 --> 03:32.030 R D. 03:32.350 --> 03:33.579 So once you touch that in, either 03:33.580 --> 03:35.289 click the button or just press enter 03:35.290 --> 03:36.519 and you keyboard and that will pull 03:36.520 --> 03:38.119 up R. Kelly Linux desktop for us. 03:38.440 --> 03:39.309 Now we're going to see an error 03:39.310 --> 03:40.539 message. As soon as this pulls up, 03:40.540 --> 03:42.399 you'll see it. We see a no session 03:42.400 --> 03:43.840 for PID eight thirty eight. 03:44.110 --> 03:45.369 Don't really worry about what that 03:45.370 --> 03:46.599 is. It doesn't pertain to our 03:46.600 --> 03:47.679 particular lab. We're doing. 03:47.680 --> 03:49.179 So just click the button to make 03:49.180 --> 03:50.180 that go away. 03:51.190 --> 03:52.089 All right. So let's go back to our 03:52.090 --> 03:53.049 lab document here. 03:53.050 --> 03:54.219 So we've went ahead and typed in our 03:54.220 --> 03:55.689 password that launched our Kelly 03:55.690 --> 03:56.979 desktop here in step ten. 03:57.550 --> 03:59.019 And then step one here is we're just 03:59.020 --> 04:00.459 going to go ahead and open up the 04:00.460 --> 04:02.199 terminal window. So in this 04:02.200 --> 04:03.759 instance, the way that we do that is 04:03.760 --> 04:04.899 we double click on this root 04:04.900 --> 04:05.979 terminal icon. 04:05.980 --> 04:07.179 So let's go and double click on that 04:07.180 --> 04:08.180 and open it. 04:08.770 --> 04:09.849 Now, if you happen to be following 04:09.850 --> 04:12.039 along at home in your own virtual 04:12.040 --> 04:13.389 lab environment, and this is the 04:13.390 --> 04:14.409 point where you'll just want to go 04:14.410 --> 04:15.550 ahead and launch a terminal window 04:15.700 --> 04:17.366 if you haven't done so already, so 04:17.380 --> 04:18.752 you can go ahead and run the 04:18.760 --> 04:19.760 commands that we're doing. 04:19.990 --> 04:21.639 Now, if you are running your own 04:21.640 --> 04:22.719 lab, I do want to mention that you 04:22.720 --> 04:24.219 want to make sure you have Zend map 04:24.220 --> 04:25.220 installed. 04:25.300 --> 04:26.680 So just kind of double check that. 04:26.890 --> 04:28.329 Pausa. Video if you need to, but 04:28.330 --> 04:29.259 just double check. You have that 04:29.260 --> 04:31.029 installed for everyone else, for 04:31.030 --> 04:32.439 everyone using the Sabari lab. 04:32.950 --> 04:34.079 You have that here. 04:34.090 --> 04:35.949 So once we type in the command, 04:36.040 --> 04:37.657 it should launch them for you and 04:37.810 --> 04:39.378 then we can continue on with the 04:39.400 --> 04:40.400 rest of the lab. 04:41.740 --> 04:43.089 So let's go back to our lab document 04:43.090 --> 04:44.090 here. 04:44.500 --> 04:45.676 So now we're at step 12. 04:45.700 --> 04:46.629 So we're just going to type in this 04:46.630 --> 04:48.219 command here, Zend map and the at 04:48.220 --> 04:49.179 symbol. 04:49.180 --> 04:50.169 And all that's going to do is leave 04:50.170 --> 04:51.444 the terminal window in the 04:52.000 --> 04:53.319 background for us. So in case we 04:53.320 --> 04:54.339 want to type something else in 04:54.340 --> 04:55.500 there, we could certainly do so. 04:55.810 --> 04:57.639 So then map and the at symbol 04:57.760 --> 04:59.350 or the excuse me, the ampersand 04:59.360 --> 05:00.370 symbol, not the symbol. 05:00.640 --> 05:01.839 So let's go ahead and type that in 05:01.840 --> 05:02.840 now. 05:03.040 --> 05:05.109 So then map and then the ampersand 05:05.110 --> 05:06.531 symbol or many people call it 05:06.970 --> 05:08.439 the end symbol. 05:09.070 --> 05:10.359 Once you type that in just press and 05:10.360 --> 05:11.928 turn the keyboard, it's going to 05:12.100 --> 05:13.389 take a moment and it should open up 05:13.390 --> 05:14.529 then map for us. And that's what you 05:14.530 --> 05:15.609 see there, that little Pop-Up 05:15.610 --> 05:16.569 window. 05:16.570 --> 05:18.309 I always like to just maximize this 05:18.310 --> 05:19.779 here. You don't have to do so, but I 05:19.780 --> 05:20.949 like to maximize it to make it 05:20.950 --> 05:21.950 easier to read. 05:22.720 --> 05:23.949 And so all we're going to do now is 05:23.950 --> 05:25.089 we're going to type in our command 05:25.090 --> 05:26.649 here in the command line and then 05:26.650 --> 05:27.939 we'll cook the scan button to go 05:27.940 --> 05:28.940 ahead and run it. 05:29.530 --> 05:30.669 So let's take a look and see what 05:30.670 --> 05:31.879 command we're going to run today. 05:33.390 --> 05:34.229 So you'll see here we're going to 05:34.230 --> 05:35.699 run and map, we're going to run it 05:35.700 --> 05:37.320 at a speed of eighty four, 05:37.600 --> 05:39.269 we're going to do the dash so we can 05:39.270 --> 05:40.379 look at things like the operating 05:40.380 --> 05:42.046 system or at least try to see what 05:42.240 --> 05:43.240 the operating system is. 05:43.350 --> 05:44.879 So, again, part of our enumeration 05:44.880 --> 05:46.569 aspect, we're going to make it a 05:46.590 --> 05:48.059 verbose scan so we can get as much 05:48.060 --> 05:49.170 information as possible. 05:49.350 --> 05:50.939 And then, of course, this is our IP 05:50.940 --> 05:52.259 address we're going to scan against. 05:52.260 --> 05:53.730 This happens to be the PEA Lab 05:54.180 --> 05:55.649 D. 01 to that top 05:56.100 --> 05:57.270 virtual machine we have there. 05:57.420 --> 05:58.469 That's our server machine. 05:58.470 --> 05:59.590 So we're going to run against that. 06:00.300 --> 06:01.770 So once we run this command, a 06:01.980 --> 06:03.059 couple of questions we'll take a 06:03.060 --> 06:03.899 look at here. 06:03.900 --> 06:05.370 So if we see any open ports at 06:05.790 --> 06:07.319 all and then also what operating 06:07.320 --> 06:09.269 system does then 06:09.270 --> 06:10.589 map, which again, is just a goofy 06:10.590 --> 06:11.700 version of N map. 06:12.030 --> 06:13.199 So we want to see what operating 06:13.200 --> 06:14.850 system is it showing or at least 06:15.030 --> 06:16.739 what does it think that the target 06:16.740 --> 06:17.740 is running? 06:18.300 --> 06:19.349 All right. So let's go and type this 06:19.350 --> 06:20.740 command in without further ado. 06:20.880 --> 06:22.109 Now, you'll see in the background 06:22.110 --> 06:23.519 there that we've actually got a good 06:23.520 --> 06:24.779 chunk of this already in there. 06:24.780 --> 06:25.829 Right. So you see in the command 06:25.830 --> 06:27.790 line we already have and map dashty 06:27.810 --> 06:29.809 for dash a dash V. 06:29.940 --> 06:31.559 So actually all we have to do and 06:31.560 --> 06:33.089 that's why I did this on purpose 06:33.090 --> 06:34.364 like this. By the way, all 06:34.950 --> 06:36.209 we have to do now is just actually 06:36.210 --> 06:37.799 type in the IP address and run the 06:37.800 --> 06:38.699 command. 06:38.700 --> 06:39.749 Now you're welcome to talk in the 06:39.750 --> 06:40.970 full command if you want to. 06:41.430 --> 06:42.809 That's kind of up to you for our 06:42.810 --> 06:44.069 purposes. I'm just going to type in 06:44.070 --> 06:45.569 the IP address and go ahead and run 06:45.570 --> 06:47.309 it. But again, it's good practice to 06:47.310 --> 06:48.529 type it all in if you want to. 06:49.260 --> 06:50.339 So we're just going to put a space 06:50.340 --> 06:51.919 here and then type in one or two 06:52.200 --> 06:54.180 that one six eight zero 06:54.450 --> 06:56.369 one once 06:56.370 --> 06:57.479 you've tried that. And again, just 06:57.480 --> 06:58.639 go ahead and click the scan button, 06:58.650 --> 06:59.459 it's going to go ahead and run the 06:59.460 --> 07:00.689 scan. I'm going to pause the video 07:00.690 --> 07:02.219 here because it does take a moment 07:02.220 --> 07:03.690 or so to run this particular scan. 07:05.610 --> 07:07.049 All right, so we see the scan 07:07.050 --> 07:08.009 results I have here. 07:08.010 --> 07:09.439 Now, if your scan is still running, 07:09.450 --> 07:10.739 go ahead and just pause a video and 07:10.740 --> 07:12.149 just wait until yours is complete so 07:12.150 --> 07:13.370 you can take a look at the output. 07:13.920 --> 07:15.199 Now, we have a couple of questions 07:15.210 --> 07:16.409 in our lab document that we want to 07:16.410 --> 07:18.209 answer here. So question one, is 07:18.210 --> 07:19.199 D.C. open ports? 07:19.200 --> 07:20.621 And then question two is what 07:20.730 --> 07:22.494 operating system does the tool think 07:22.830 --> 07:24.359 that this particular target, which 07:24.360 --> 07:25.928 is our server again, our lab, DC 07:26.370 --> 07:28.319 01 server, what is this tool 07:28.320 --> 07:29.629 think that it's actually running? 07:30.330 --> 07:31.319 So we're actually going to start 07:31.320 --> 07:32.759 with question two, or at least I am 07:32.760 --> 07:34.426 on my side just because that comes 07:34.860 --> 07:36.428 a little sooner from where we're 07:36.600 --> 07:37.890 looking at right now in the 07:38.970 --> 07:39.970 command output. 07:40.080 --> 07:41.159 And then we'll be able to see the 07:41.160 --> 07:42.720 port information a little later on 07:43.200 --> 07:44.699 are so free. Scroll up just a little 07:44.700 --> 07:45.719 bit here. You'll see kind of near 07:45.720 --> 07:47.129 the top. I've already got 07:47.130 --> 07:48.509 information about the operating 07:48.510 --> 07:50.250 system that it thinks is in use. 07:50.410 --> 07:51.869 You'll notice that it shows Windows 07:51.870 --> 07:53.879 Server 2012 as well as Windows 07:53.880 --> 07:55.546 seven, as well as possibly Windows 07:55.920 --> 07:56.920 eight point one. 07:57.840 --> 07:59.639 Well, we know from our information, 07:59.640 --> 08:00.779 or at least from the information 08:00.780 --> 08:02.201 I've given you, that playbook 08:02.850 --> 08:04.379 zero one is actually a Windows 08:04.380 --> 08:05.380 Server device. 08:05.610 --> 08:07.276 So we could easily tell, like, OK, 08:07.320 --> 08:08.309 well, this is probably going to be 08:08.310 --> 08:09.437 Windows Server 2012 for 08:10.170 --> 08:11.170 the operating system. 08:11.580 --> 08:12.869 However, as an attacker, as a 08:12.870 --> 08:14.009 penetration tester, we probably 08:14.010 --> 08:15.089 wouldn't have that internal 08:15.090 --> 08:15.869 information. 08:15.870 --> 08:17.819 And so we would just know that this 08:17.820 --> 08:19.388 particular device is potentially 08:19.800 --> 08:21.515 running a Windows operating system, 08:21.660 --> 08:22.569 one of these one. 08:22.570 --> 08:23.729 So what we're looking for 08:23.730 --> 08:24.749 vulnerabilities, we're going to be 08:24.750 --> 08:26.699 targeting specifically something 08:26.700 --> 08:28.649 that maybe runs on Windows seven, 08:28.650 --> 08:30.480 Windows Server 2012, as well as 08:30.660 --> 08:32.600 Windows eight point one, or finds 08:32.669 --> 08:34.237 individual exploits that work on 08:34.559 --> 08:35.969 these different operating systems 08:36.120 --> 08:37.499 and just try them against the 08:38.280 --> 08:40.109 against the target to see if we can 08:40.110 --> 08:41.428 actually gain access and do our 08:41.429 --> 08:42.429 nefarious stuff. 08:43.700 --> 08:44.929 All right, so the other question was 08:44.930 --> 08:46.730 regarding ports, so if you call 08:46.760 --> 08:48.181 question number one, was D.C. 08:48.290 --> 08:49.340 any open ports at all? 08:49.460 --> 08:50.689 And if we scroll up just a little 08:50.690 --> 08:52.069 bit, at least on my results and 08:52.070 --> 08:52.849 everyone should have the same 08:52.850 --> 08:54.467 result, then we do see that, yes, 08:54.800 --> 08:55.909 there are some ports open here. 08:55.920 --> 08:57.439 We see the port numbers and we also 08:57.440 --> 08:58.969 see that as TCP and not likely to 08:58.970 --> 08:59.970 be, for example. 09:00.900 --> 09:02.569 Ah, so this video we just want took 09:02.570 --> 09:03.991 a quick look at Zimbabwe, run 09:04.490 --> 09:05.666 a quick scan in our Zend 09:06.530 --> 09:07.969 map tool, and we took a look at the 09:07.970 --> 09:09.349 output to see what kind of operating 09:09.350 --> 09:10.879 system, as well as any ports that 09:10.880 --> 09:12.169 might be open on this particular 09:12.170 --> 09:13.787 target. And the next video, we're 09:13.850 --> 09:15.080 just going to go ahead and use a 09:15.320 --> 09:16.398 command called DYG and 09:17.240 --> 09:18.619 then we'll also use a finger command 09:18.620 --> 09:19.399 right after that.