As ethical hackers who are performing information gathering or recon and scanning one of the next steps
we would take after we find the list of candidate servers, especially some servers that we might have
forgotten were on our network, is to run in map against them, to figure out what was running on those
servers and then find out if maybe there are some vulnerable services or if some servers have been compromised
already.
So in MAP is our network map or we're going to use that in Caleigh Linux to see what might be on our
network.
To do this, we actually want to run one additional.
We could turn on both.
We wanted to, but we at least want to run one additional server and I'm going to do the medicine floatable
to server.
And in this case, we're not going to leave my floatable running for very long.
So it would be OK to open the network settings.
And I'm going to turn it over to the public.
Matt, Matt.
Network public.
Matt just said that it'll be on the same network as MSA Edge, Win Tin and our Kelly Linnik spox so
that we'll be able to see it.
One other option will be turning all three of these machines over to the private Matt as well.
And remember to log into Matus floatable if you haven't before, it's MSF admen and MSF admen as the
username and password and it will not show you that password.
Is your logging in?
You can see we're still set up on meds floatable from a few lessons back when we were installed it.
I'm going to do because the I f config.
The IP address for Meadow's political is tendo that three men are on the command pseudo I-F down or
interface down with zero double ampersands pseudo f up ethe zero.
And now we have a Tendo DOT nine address that will allow us to find that out on our network.
And then for a user, go ahead and log in as well.
Yeah, I'll log in.
As with password.
And remember, for these Windows 10 machines, password is capital P little a SSW zero r d exclamation.
And once we get logged into the Windows virtual machine, I'm going to type in my search bar, CMB.
The command prompt.
And I'm going to choose run as administrator.
And I'll run I.P. config.
To get the M the IP information, the IP address.
But you can see I did get a 10 Odah nine address on my Windows machine, so it's time to switch back
over to Kalli.
And let's get a clean terminal window and we'll make the font big enough so that you can read it.
The great thing about IMAP is that we can use everything from the command line there, graphical user
interface tools as well.
But I'm going to say, in fact, the Zen map is one that you can install with a quick pseudo Apte install
Zen map.
But I'm going to use N map and map and I know that I'm on my Tendo Dot Nine Network, so I'm just going
to see what machines are on this tendo dot Nine Network.
And I could say turned out Odos nine, Dotto slash 24 phone to scan all 255 possible machines or addresses
on that network, or I could say 10 dot odah nine, tattoed dash 20.
I think most of my IP addresses are in that low range.
I saw a tornado at nine on my Windows box.
So I'm going to run in map.
It'll take just a moment because it's going to run through all 20 of those possible addresses.
But it doesn't take too long, and I found one machine, at least at 10, that Audette nine dot in my
case 10.
But I can go up a little bit.
Found something.
It turned out okay.
Nine.
Seven.
But all the ports are closed.
And then turned out okay.
Nine to ten.
But Odah nine.
Not one.
This is my gateway.
My my connection.
Out to the internet through my host computer.
Here is my DHS server that gives me IP addresses so you can see a few of the things that we set up when
we first configured our network.
But turned out Odah nine to seven could be something 10.
DataDot nine, dot 10.
So this one looks like it's got a whole lot of open ports.
In fact, some pretty interesting ones.
So this one turns out to probably be our our Meadow's floatable box so we can do a little more information
on in map scan by doing something like an S.V., a dash S.V. search.
That would give us actually version information, dash lowercase s uppercase V for an ID map scan would
show us the exact version of each of these pieces of software.
So let's try that really fast.
So our command would be in MAP and our server address.
Now it's 10 dot o dot nine, dot 10.
So I'm just scanning that one particular server and I'll do an add a dash s v a versioning scan against
that.
It's going to take a little bit of time, but it'll be worth it.
When my finishes, you will see not just the ports or the logical connections that are running the services
running on that that Metis floatable virtual machine.
You'll also see the exact version information or at least really close.
So in my pass, some scanning ability to gather information about which version of each one of those
services are included on that machine.
So some really useful information.
In fact, you can see that somebody has already hacked into this metal split Pable box and they've left
a root shell self.
You know how to telnet in.
You can connect to that fifteen 24 port and actually take over that Metis political machine remotely.
So normally when you run in math, you're trying to gather information about the machines on the network.
So we saw how we could do that with.
In map with just a range of addresses, either attended Odah nine dot o slash 24 or tendered Odah nine
oh two 30, dash 30.
And then we can once we find individual servers, we can run scans against them like we did here to
determine what software might be running on that.
Even up to a possible backdoor shell into the computer that somebody had already left there.
That happens from time to time.
If you left a server on your network that you forgot about, a server administrator left the company
or somebody just plugged in a device and left it running.
Let's see one other quick scan, though.
I want to try to scan my Windows computer.
So this was a good, thorough scan of my Kelly from my Kelly Box into my Matus floatable.
But let's take a look at the other machine so I know that my Windows I.P. address was turned out okay.
Ninety nine.
But I didn't see a computer.
It turned out okay.
Ninety nine from my Kelly computer.
Well, the reason for that is actually the Windows firewall.
So the Windows firewall gets a bad rap, but it actually does something important.
So just by default, with Windows 10, it's almost always on the windows.
Firewall is blocking you from these drive by scans.
These IMAP scans like the one I just performed.
But we can turn that firewall off just for this one test.
We can say net S.H. Advance firewall, ATV firewall.
Set all profiles state off.
Now it's a long command and I'll put a comment down below so that you'll be able to copy and paste that
if you want to.
But that command will turn off the Windows firewall and you'll see windows in our virtual machine pop
up and say, wait a minute, the Windows firewall is turned off.
Well, now we know the IP address and our Windows machine is not protected from those scans.
So let's switch back over to Kelly.
It's clear the screen with the control l or the word clear.
And now let's.
In math.
That Windows computer.
So it's going to be almost the same as the scan for my Matus portable box.
But the I.P. address is different.
So I just press the up arrow and then I'll replace that tendo Doda nine dot tin with Tendo Dot nine
dot nine is the IP address.
My Windows computer got this time.
So we'll do a C version scan against that turned out okay.
Nine dot nine.
And now without the Windows firewall running, we should be able to see a few services there.
We do.
So you can see that this is running a few things.
Port 135.
That's an Arpey C or mote procedure call.
That's a handy port to have open if you're managing this computer across the network.
But it's also a potential vulnerability if we're searching for the ability to break into that computer.
You can see we've got a couple of other services running on their net bias and see information about
the computer for the network.
So just by turning off the Windows firewall, we've not only opened up this machine to a drive by scan,
we've done a full version scan against similar services so we can see exactly what's running on each
of those ports.
So if you don't take anything else out of the house of the windows scanning, at least now, you know,
the Windows firewall does do something.
It protects you from just a quick drive by in maps scan of your network.
So it's important to leave that firewall running and to have antivirus and a firewall to protect you
from snooping eyes out on the Internet.
Well, coming up in the next section, we're going to see how to take it one step further and use a
graphical tool that will help us do a quick scan of a network and more.