Hey, everyone, welcome back to the
course. So in the last video, we
wrapped up our discussion with
banner grabbing, so we wrapped up
Module four and with
banner grabbing as well as operating
system fingerprinting is technically
renumeration that we're doing.
But here in this particular lab,
we're going to discover some other
ways to do enumeration.
So we're going to use a tool called
Zend Map, as well as using the dig
in finger commands.
So let's go ahead and get started.
So you should already be logged into
the Siberry lab environment.
We're just going to search for
ethical hacker and
we're looking for the top option
here, the certified ethical hacker,
S.H.
Once you found that, just go ahead
and click on it and
then click the launch button here.
We'll have one more button we need
to click, which will be the launch
item button.
And then it launched the lab
environment in a separate window.
Now, if you're doing this lab on
your own machines, on your own
virtual network, then by all means,
you'll just want to make sure you
change your IP addresses and you
just want to open a terminal window
inside of your Kelly Linux.
Once we get to that point and you
should be able to follow along
without any issues.
All right, for everyone else that's
using the Siberry lab environment,
you're going to go ahead and look
for the using enumeration tools
lab.
So it's going to be this one.
It's about halfway down the page.
So it's this one right here.
Just go ahead and click on that and
then click on the start button.
Once you do that, you'll see all the
virtual machines here.
We're just going to go ahead and
activate these or turn these on
the way. We do that as we just hover
our mouse over top of each one and
select the power on option.
So just do that for all of these
will take about 20 to 30 seconds to
boot all the way up.
So while that's doing that, I'm
going to pause the video and we'll
use a magical fast forwarding again.
And once they've pulled up here,
then I'll restart the video and
we'll move forward with the rest of
the lab.
All right, so we see that all of my
machines are booted up now.
Now, if you have not finished
booting all the way up here and if
they're not showing all the green
button that says on that, you
just want to pause this video real
quick and wait until all your
machines come online.
Now, we're not going to be using all
these different machines in this
particular lab, but it's just a good
habit to get into of making sure
everything's booted up and
functioning properly so you can
continue on with any labs that you
happen to be doing.
So let's go to our lab document.
We're going to see which machine
we're going to click on here.
So we're down here at step number
six. So we're going to connect
to the Windows 10 machine, which is
the lab, Quinten.
So let's go ahead and do that as
we're just going to go ahead and click
on that one.
It's going to take a moment or so to
pull the desktop for us.
We'll also see a command prompt
window. Usually that will pop up
randomly.
We'll give that a second or so to
pop up and then go away.
And once we've done all that, we're
going to double click on this Vincey
viewer icon.
So you'll see there's a command
prompt window I mentioned.
So now that that's out of the way,
we're just going to go ahead and double
click on this little icon here.
The viewer on it looks like a little
orange icon or a
tiger's eye is really what it is.
We're just going to double click on
that to open it up.
Now, by default, it should have the
Calli Linux machine IP
address in there for us, if for
some reason it doesn't, I've listed
it there in the step by step lab
guide and you can just manually type
it in there.
All right, so sun sets in there, all
we're going to do is just click the
connect button.
Now, before we enter the password, I
just want to mention again that all
the step by step lab guides are
available in the supplemental
resources section of the course.
Go ahead and download that and you
can get all the documents, as well
as information about the assessments
that you'll want to take as part of
this course.
So in this password field, we're
actually just going to get the word
password with a capital P and then
replacing the O with a zero.
So let's go ahead and do that now.
So we'll type in capital P and the
lowercase HSW,
the number zero and then a lowercase
R D.
So once you touch that in, either
click the button or just press enter
and you keyboard and that will pull
up R. Kelly Linux desktop for us.
Now we're going to see an error
message. As soon as this pulls up,
you'll see it. We see a no session
for PID eight thirty eight.
Don't really worry about what that
is. It doesn't pertain to our
particular lab. We're doing.
So just click the button to make
that go away.
All right. So let's go back to our
lab document here.
So we've went ahead and typed in our
password that launched our Kelly
desktop here in step ten.
And then step one here is we're just
going to go ahead and open up the
terminal window. So in this
instance, the way that we do that is
we double click on this root
terminal icon.
So let's go and double click on that
and open it.
Now, if you happen to be following
along at home in your own virtual
lab environment, and this is the
point where you'll just want to go
ahead and launch a terminal window
if you haven't done so already, so
you can go ahead and run the
commands that we're doing.
Now, if you are running your own
lab, I do want to mention that you
want to make sure you have Zend map
installed.
So just kind of double check that.
Pausa. Video if you need to, but
just double check. You have that
installed for everyone else, for
everyone using the Sabari lab.
You have that here.
So once we type in the command,
it should launch them for you and
then we can continue on with the
rest of the lab.
So let's go back to our lab document
here.
So now we're at step 12.
So we're just going to type in this
command here, Zend map and the at
symbol.
And all that's going to do is leave
the terminal window in the
background for us. So in case we
want to type something else in
there, we could certainly do so.
So then map and the at symbol
or the excuse me, the ampersand
symbol, not the symbol.
So let's go ahead and type that in
now.
So then map and then the ampersand
symbol or many people call it
the end symbol.
Once you type that in just press and
turn the keyboard, it's going to
take a moment and it should open up
then map for us. And that's what you
see there, that little Pop-Up
window.
I always like to just maximize this
here. You don't have to do so, but I
like to maximize it to make it
easier to read.
And so all we're going to do now is
we're going to type in our command
here in the command line and then
we'll cook the scan button to go
ahead and run it.
So let's take a look and see what
command we're going to run today.
So you'll see here we're going to
run and map, we're going to run it
at a speed of eighty four,
we're going to do the dash so we can
look at things like the operating
system or at least try to see what
the operating system is.
So, again, part of our enumeration
aspect, we're going to make it a
verbose scan so we can get as much
information as possible.
And then, of course, this is our IP
address we're going to scan against.
This happens to be the PEA Lab
D. 01 to that top
virtual machine we have there.
That's our server machine.
So we're going to run against that.
So once we run this command, a
couple of questions we'll take a
look at here.
So if we see any open ports at
all and then also what operating
system does then
map, which again, is just a goofy
version of N map.
So we want to see what operating
system is it showing or at least
what does it think that the target
is running?
All right. So let's go and type this
command in without further ado.
Now, you'll see in the background
there that we've actually got a good
chunk of this already in there.
Right. So you see in the command
line we already have and map dashty
for dash a dash V.
So actually all we have to do and
that's why I did this on purpose
like this. By the way, all
we have to do now is just actually
type in the IP address and run the
command.
Now you're welcome to talk in the
full command if you want to.
That's kind of up to you for our
purposes. I'm just going to type in
the IP address and go ahead and run
it. But again, it's good practice to
type it all in if you want to.
So we're just going to put a space
here and then type in one or two
that one six eight zero
one once
you've tried that. And again, just
go ahead and click the scan button,
it's going to go ahead and run the
scan. I'm going to pause the video
here because it does take a moment
or so to run this particular scan.
All right, so we see the scan
results I have here.
Now, if your scan is still running,
go ahead and just pause a video and
just wait until yours is complete so
you can take a look at the output.
Now, we have a couple of questions
in our lab document that we want to
answer here. So question one, is
D.C. open ports?
And then question two is what
operating system does the tool think
that this particular target, which
is our server again, our lab, DC
01 server, what is this tool
think that it's actually running?
So we're actually going to start
with question two, or at least I am
on my side just because that comes
a little sooner from where we're
looking at right now in the
command output.
And then we'll be able to see the
port information a little later on
are so free. Scroll up just a little
bit here. You'll see kind of near
the top. I've already got
information about the operating
system that it thinks is in use.
You'll notice that it shows Windows
Server 2012 as well as Windows
seven, as well as possibly Windows
eight point one.
Well, we know from our information,
or at least from the information
I've given you, that playbook
zero one is actually a Windows
Server device.
So we could easily tell, like, OK,
well, this is probably going to be
Windows Server 2012 for
the operating system.
However, as an attacker, as a
penetration tester, we probably
wouldn't have that internal
information.
And so we would just know that this
particular device is potentially
running a Windows operating system,
one of these one.
So what we're looking for
vulnerabilities, we're going to be
targeting specifically something
that maybe runs on Windows seven,
Windows Server 2012, as well as
Windows eight point one, or finds
individual exploits that work on
these different operating systems
and just try them against the
against the target to see if we can
actually gain access and do our
nefarious stuff.
All right, so the other question was
regarding ports, so if you call
question number one, was D.C.
any open ports at all?
And if we scroll up just a little
bit, at least on my results and
everyone should have the same
result, then we do see that, yes,
there are some ports open here.
We see the port numbers and we also
see that as TCP and not likely to
be, for example.
Ah, so this video we just want took
a quick look at Zimbabwe, run
a quick scan in our Zend
map tool, and we took a look at the
output to see what kind of operating
system, as well as any ports that
might be open on this particular
target. And the next video, we're
just going to go ahead and use a
command called DYG and
then we'll also use a finger command
right after that.