Melville see how easy it is to take over a remote computer.
We're in the same local network as the victim.
That's why we've managed to bypass the demilitarized zone firewalls of the network that normally block
ports the majority of attacks are local attacks
the attack unfolds as follows.
We have a computer that will be the victim and the attackers computer will start up the a split environment.
This framework is automatically installed in the back check five Linux The Met a split framework includes
tools for scanning remote computers.
The results of the scan will automatically be saved in the database.
The specific tool we use is and map which we already know.
We're using the information stored in the database to conduct the attack that will exploit vulnerabilities
found in other computers that have already been scanned.
Let's check to see if we're connected to the database.
Right now we're using POST grid as well.
However other databases such as my YOU school can be used to we would like to see the results from the
scan in the database.
We invoke the D.B and Napp command.
From now on the basic end maps text will be supported.
Now we'll examine routes to the computers we're trying to infiltrate.
This will help us discover which machines are in the same network bazars and which are two or three
routers away
because we're discussing the fourth layer of the overside model will now take some time to discuss the
TCAP and UDP scanning mechanisms.
As the attacker would not like to be discovered until now we have avoided this by hiding our IP address
among many others.
We can also try packet fragmentation.
This means to use one packet to send so much data that they can't fit in the frame of a lower layer
protocol.
What part of this data will be sent and one IP packet and the rest in the next one.
This won't affect the delivery because the receiver will assemble the fragments back together into one
packet.
However if someone tries to intercept the packets being sent they may not be able to assemble them.
They will not manage to reproduce the whole session.
We'll send the night packet and use the parameter f option to force the packet fragmentation into eight
byte Pardes
will also detect the operating system and perform a stealth scan.
Finally we must type the IP addresses or names of the computers we're going to scan to make the attack
less noticeable.
We'll scan the computers one at a time starting from the first one we'll use random IP change.
This is to deceive intrusion detection systems looking for certain patterns
the information we will scan is identified by IP 1 9 2 1 6 8 0 1 1 5.
And the second by IP 1 9 2 1 6 8 0 1 2 5
you know you can see the complete command executing all of the above operations
rescanning local and that were computers so it shouldn't take much time.
Let's look at the result.
One host is online GCP ports 1 3 5 and 4 4 5 are open.
We can see the port 1 3:9 is open as well.
This information tells us that there is a Windows 2000 or XP operating system running on the computer
because these systems have the above mentioned ports open by default.
And that managed to precisely determine the operating system including the service pack version installed
the computer is only one hop away which means it belongs to the same local network.
Now let's check the data stored in the database.
It contains the records about two computers.
The first one is the result of the scan we've just performed.
We can also learn that services are running on these computers.
We could list our potential vulnerabilities of these services
instead of there.
Let's try to exploit them to conduct an automated attack the information you can gather from the fourth
layer of the us-I model is enough to take control over a remote computer with security issues.