Now, managing clinic services, as you can see, Kelly Linux is a specialized Linux distribution aimed
at security professionals, and it contains several non-standard features.
OK, now the first thing let's start with such service or the execution.
Now what is most commonly used to remote access computer using a secure, encrypted protocol?
OK, now in that case, we will use command call system Seitel.
OK, now, as we learned previously, man systems ideal, as you can see, control the system, the
system and service manager.
OK, so this is to control the system.
Now you can read more about it.
The system is something Kim a tool for process management and all of that stuff.
No, this is not our subject currently.
No system CTL.
By the way, I can't bring step again system.
Then start.
Or stop.
Or at a start, as you can see, the status or status.
OK, so let's start with the status such.
OK, now you can see that it show us that.
Yeah, here you can see it is inactive now to show more information, I must provide that sudo.
Now, instead of typing the same command or the arrow button.
No, I can do pseudo shift to one shift to one or that exclamation mark.
So this will this will provide the previous command, which is system set.
And before it, it is so, so sudo systemctl status as such.
So if I press enter can see that.
Yeah, it show us this is the command.
No, again, enter.
And of course, it will need the password because this is a pseudo command.
And yeah, it showing us now and now.
Yeah, it's show us it is inactive.
Now, if I type the same command system and not without sudo, I mean, let's start to that search.
You can see that if I press that, it will ask us for authentication or the password for this to be
done.
So in that case, which is using the pseudo so pseudo systemctl start as a search here, you can see
that, yeah, now it is worked.
How to check that systemctl status search.
Yeah, you can see that.
Here it is.
It is active and seven seconds ago.
Now you can see by default, here we have the vendor processed.
OK, and we have that disabled thing here.
OK, now this means that somebody at the window, which means that by default, when it comes or when
it is downloaded by default, it will be disabled.
Now what does this mean?
It means that it will not work or it will not run on the startup on the boot up.
OK.
So when I if I restart this Kelly Linux machine, this asset will not work by default.
OK, now here disabled.
This is the first disabled.
OK, this is the vendor Brissette here the disabled, which means they're not the default behavior on
the actual behavior, which is will it run on boot up or it will not?
This is what is so by default, it is disabled and it is disabled.
So I must inability, so when I restart clinics, the search will run on water, so any event like that
and press enter, you can see that here it is enabled.
It will start creating some links and windows.
It is the shortcut, which means shortcut.
Don't worry, we'll talk about the symbolic links and our links, soft links, all of that stuff.
Now, if I Typekit status, this time you can see that this time it is enabled by the way they've interpreted
it.
This is this is still a bit and this cannot be changed, by the way, because this is how it comes from
the factory.
Just like that.
OK, so that the guys who created this as a search tool by default, they say, make it this way for
more security and stuff like that.
Right?
But we enable it because we want it to be run over and over anyway.
Now again, this is not for a blue team.
This is routine.
OK, so to be honest, we don't care.
Yeah, because this is not a system we are protecting or hardening.
This is our system to have attack on the systems.
OK, so this Kalanick's to attack systems, of course, not in a malicious way.
I mean, in maritime tactics.
OK, but we need to understand how the bad guys think and work.
OK, now how to make sure the asset is enabled.
Now you know that the US is by default, is using the abort 22.
OK, the default abort.
So I have Netstat A. LP, OK.
This is to show us and which means no T, which means TCB, because this is a piece of protection.
Now again, if you are not familiar with TCB, you would be the though I imagine the boards.
No, I prefer.
I recommend you to read more about it.
OK, well, it is not a big deal.
Just have a just high level understanding.
Will do the job OK?
No idea, which means that the status of this is listening.
And b so to protocol or program show the program.
So or so you can see that.
Yeah, we have it here.
So here it is.
It is twenty two and it is listening on zero two zero zero zero, which means anywhere.
And the point this is the same, the status is or the state is listening and there is no idea what to
do.
OK, now there is another command called S s again Dash and T LP, and here it will show us that, yeah,
twenty two is running and it is running on anyway.
Zero zero zero zero.
OK, now this is for the service.
Now let's talk about active TB service now by default.
Kelly comes with Apache or Apache2.
So I would use the same command sudo systemctl status.
Apache and Apaches two.
So you can see, yeah, it is inactive now, how to do such a thing, how to enable it and to start
it, as we learned previously.
First, we need to start like this, then enable, OK, like this.
Now there is a shortcut for this actually, which is pseudo systems.
The L enable.
Yeah, as we learn.
But what is the flag dash dash now, which means it will enable it on startup and the same time it will
start it.
So you can see that, yeah, it has been enabled and it will.
It should be started.
How did you do that?
Yes, you are correct.
We will use that status command.
So here it is.
It is active and running this time.
Yeah.
Now, by the way, if you didn't provide the pseudo it, we're not sure all the information, so you
can see that here.
I already provided the soda, so a choice or anything here, as you can see now, if I provided that
without.
I provided a command without Sudo.
You can see that it would show less information, as you can see.
So up here, it shows us this Group C groupthink and it show us this, as you can see.
That magic three, whatever, but here it shows us this group without putting more information or some
considered critical information.
Yeah, actually sometimes it is actually.
OK, now how do you see what what it is running on?
By default, it is the 80.
So again, it's run as the NTSB.
And you can see that, yeah, it is running on Port 80.
So this is what we need and what we want.
All right.
OK.
So far, so good.
Thanks for watching.
Now I will provide more exercises on this kindly to solve them.
And if you have any questions, let me know.