OK, so the first thing that we're going to do before we get into searching for X is because this one
doesn't really involve an expert, but it's very useful to know about.
So we're going to take advantage of Telnet really quickly.
So as a remote management service, as you know, that runs over Port 23, if you remember from that
section.
I also just brought it up.
Anything over Tona is unencrypted and that's why they replaced it with Esses each.
So it is used, you know, and I've seen this in, like, you know, corporate environments on, you
know, different assessments that Tony did actually use.
You can actually use a protocol analyzer to sniff the traffic because it's set in plain text.
It's not encrypted.
So we can actually read everything that's being sent over that port.
So what we can use is an application that's called Wireshark Protocol Analyzer.
It's going to allow us to sniff all the traffic on the network and be able to find exactly what we want.
So let's go ahead and switch over to our VMS and, you know, get things going.
OK, so we're back in a colonics machine.
So what we're going to do now is we're going to try to use Wireshark to actually capture credentials
being sent in plain text over Telnet.
So I have my medicine portable machine running all summer windows, time machine running full later.
This portable machine is running.
I know the IP address.
So what we're going to want to do is actually open up Wireshark.
So it's going to be a pseudo wireshark and it should open up and ask for your password.
So I know that the Ethernet connection for mine, for this network is one and you can confirm that on
your own.
Just go and do I have config command from the terminal and you'll be able to figure it out.
So this is the interface of Wireshark.
So what you're going to want to do, like I just said, is choose the interface that you want to listen
over.
We want to listen over this one.
As you can see, that's the subnet right there on this 192000, one six eight five six subnet.
That's subnet for my, you know, host only, you know, virtual box network.
So I'm going to double click that one and choose the listen over it.
So what are you going to do is going to start to Absher packets, you know, that are actually running
over this network.
So the one thing I will bring up is that with virtual box, there's some limitations with network capturing.
So instead of having another device try to log into the midst of all of its own content and capturing
it, what we're going to do is we're going to try to capture the traffic coming from this CALEIGH machine
logging over into it.
We do know the credentials, but it's going to be the same that you would see it if like this was like
a regular network with actual machines, you would be able to see the traffic here as well.
So I just wanted to let you guys know that.
So we have Wireshark running, as you can see, is capturing packets and stuff, just capturing all
the different little packets running across the network right now.
Not really too important, like, you know, what's going on right now.
So what we want to do is actually initiate like a tunnel connection over to our midst political machine.
And when we do that, we'll be able to come to Wireshark and play with some filters and actually be
able to see what happens.
So what we want to do is actually go over here and we're going to use the Tonette command.
If you don't have it installed, you could just do a quick pseudo install on it and install it.
I didn't have it on here for some odd reason.
I thought it came by default.
So we're going to be one of two down one six, eight, five, six to one or four, because I know that
that is my disposable box and I'm going to put a port number.
So we want to connect over Port 23.
So now we're getting the login screen, as we can see, and has asked me for a long answer.
I myself am in and then password MSF.
And now, of course, you wouldn't be doing this on an assessment.
You would be capturing somebody else logging in.
But like I said, network limitations with virtual box.
But this is the same thing if you are like on an actual network, which it was.
So let's say like, you know, I'm an administrator on this network and I just logged in here and,
you know, I'm doing stuff cool.
So if we go back over to our Wireshark, we're going to see heightism telnet traffic right here.
So what we can do is actually use this filter.
And there's a lot of different filters that you can do here.
Like you can do like you can search my IP address and only show, you know, things that have that IP
address as a destination or source.
You can support what we're going to do just 10 minutes on it.
And now it's going to actually show us all the Tonet package that is actually captured right now.
So what we're going to want to do is actually look for the once you see, like, this gobbledygook down
here, so.
What we are going to do is scroll through these packets and look for the one that says password, it
might take you a second, but you usually will typically find it is a pass.
Judgment passes that I want this password right there.
So when we find that one, we're just going to.
Right.
Click it to follow and then the TCP stream and then bam.
Now it's actually showing us everything.
Now sit over in plain text.
So as you can see it saying the log and it's a little bit misconstrued, I believe it has something
to do with virtual box.
It has MSF admin that has the password right here as members of.
So we just found some credentials in plain text.
So now you can actually go, oh, we know it works, but you can actually go and actually log in now
to that machine using those credentials.
And now, you know, you've officially, technically launched your first attack on a machine.
So that'll get you in there.
So when you are in assessment, you should look out for tonight.
So now let's get into searching for understanding some actual exploits.