Hi, within this lecture, we're going to see what we should do when we first hack into a system and
then we are trying to enumerate some information, we're trying to gather some information related to
that system in order to find various ways to escalate our privileges.
So if you run Al-Saleh in our Debian system, you will see a folder called Tool's.
If you go over there and write Al-Saleh, you can see there are a lot of tools over here available for
your convenience.
So these are placed in the vulnerable machine for you so that you can understand how to use them.
But again, these are tools that you can actually use within a real pantheist as well.
But I will try to avoid it.
I will try to avoid using them, at least in an intense way in the section, because we want to learn
how to actually manual works, manual ways work in a better way so that we can do whatever we want to
do in any given environment.
For example, Linux exploits GISTER is a fantastic tool, but maybe you cannot download anything when
you hack into a server, even in the TMB folder as well.
So maybe it's even though you know how to use it, even though you know it's a very good tool, maybe
you will not be able to use it.
So you should understand what you should do in order to enumerate, in order to gather information.
So first of all, let me show you what I mean by Linux.
Please register.
If you search for Linux exploits, register in Google, you will be presented with a lot of options.
And this is the one that we are looking for.
As you can see, this is a Basche script, OK?
It actually tries to gather information related related to a given system and search for ways to exploit
and search for ways to escalate your privilege so you can just run it here and see for yourselves.
But again, doing all of those things manually will be better for you, at least for discourse.
And after that, if you learn about this stuff, you can always come back and just or you can always
use Linux exploits adjuster in a real world example or in a real CTF as well.
OK, so I'm going to go back and say, clear, so what should we do when we first hack into system?
Of course you may want to run.
Who am I?
Because you may want to see what kind of user you're in and you may want to run ID to see the groups
that you belong to or what kind of ID that you are using right now.
You get run, you name A in order to understand what kind of Linux version that you're currently in
so that maybe you can understand the kernel exploits, that you can take leverage.
We're going to see about that in a couple of lectures.
OK, of course you can go for Cat version to gather maybe a little bit detailed, more detailed version
of the Linux that you're in.
You can also get the Etsy issue to see if any description or any kind of useful information is over
there or not.
And then later try to do this when you just take into a system, OK, just do this automatically around.
Who am I?
You name a cat proc version cat.
That's the issue.
And try to understand what you can do with this information.
There are a lot of currently exploits that can be used in cats and also in real life.
Pantazis as well.
You can run oh like this o u x a u.
Sorry.
So this is a u x will give you the current processes that is going on in the system.
So you can see if there is anything funny going on.
Ah, you can see what kind of users are running, what kind of operations, what kind of process.
Maybe we can gather some information over here.
Maybe you can see the Apache server is running under this user and some other process is running under
this user.
So if I can do with something with that, it may lead to privilege, escalation, something like that.
It's always a good idea to ramp's or PSA ukes in order to see all these details over here.
OK, so maybe you can create a not static C as usual and just put all of this information in there in
order to keep your notes in a constructed way, in a simplified way.
But it's your call.
Maybe you can just catch.
That's the password.
Of course, you can do that and of course, you should do that.
You can see different users over here and you can see what kind of things they're doing over there.
And be aware that even though we actually kept the ETSI password all the time, we see all this basher's
we see all these shells, but we don't see the password.
Right.
Even though it's called a password, it doesn't contain any password in this file.
So it used to it's used to contain the passwords actually over here.
But then Linux actually separated this password into another file.
So ETSI Password only contains this information, whereas etsi shadow.
So make sure you kept the outside shadow as well.
It's Ishido actually contains the passwords over there and most of the time we're going to have to become
rules in order to see the ATSE shadow.
But it's worth a shot.
If you hack into something like some server, make sure you check the cat ATSE Shadow as well.
If you can get the passwords over there, then it would be very easy for you to decrypt this passwords.
Of course, it's going to be hashed.
It's not going to be like in a simple string.
But again, you can try to decrypt it and then you can actually use the root password to become root
or any other passwords that you can gather.
So if you're on the config, of course, you can see the current IP addresses and stuff.
So far over here, we don't have any fancy thing going on.
We only have the 88 zero.
But if you have some other networks connected to each other, like in a complex network, maybe if you
hack into a corporate server or something like that, you can always run IP route in order to understand
how they're connected to each other.
And if you can actually go from here to another network or something like that, it's always a good
idea to check it as well.
OK?
And of course, we can check for the AARP tables if you get the complete ethical hacking course for
me.
We have checked that a lot during the men in the middle of framework attacks, if you might remember.
So you can just run AARP, of course, in this case, you can just run the AARP as well in order to
see the Mac addresses and the IP address pairings over here.
However, in this case, we don't get much because it's simple.
It's a simple CTF over here.
It's not even a CTM.
We just hack in and try to escalate our privileges.
But make sure you take in all of that.
You can just look for if config AARP, AARP and IP route in the networking section.
Of course, you can locate the passwords like this.
You can just run locate password to see if a user, for example, just saved a file called password
that protected in order to unsecured.
He saved their passwords.
And as you can see, there are a lot of password dot files over here.
It's worth a shot to check it to see if you can get something out of it.
And this is real life example.
Okay, people do this every time, so maybe we can just get this out and try to see if we can get something
useful over here.
So even though in this case, we don't get it.
Make sure you check for the passwords so you can check it with locate or find.
You can just find name, password.
If you do that, you will get a lot of results like this because libraries or the limbic system files
and folders contains a lot of things called password as well.
So it really doesn't mean that you get something useful out of this, but also you may simplify defined
command that you run.
And I believe I did something wrong because we are getting a lot of things over here.
It won't be useful at all.
Yeah, Périgord.
So I misspelled the name password, so it should be something like this, the name and the password
like that.
OK, so maybe we can just actually write this into them as well so that we get rid of the output over
here.
OK, and here you go at this we found one, OK, that, that, that is the one that we have found with
the locator as well, I believe.
But again, just make sure that you run it like this or you can actually search for the ID, RSA, for
example, you know.
To find any file that may lead you to another server or maybe in a privileged way in the same server
as well, but in this case, we don't have that.
So these are some basic steps that you need to do for enumeration once you get into a system so you
can gather much more information over here.
Of course, you can use the exploits register.
You can use some other automated tools as well.
However, make sure you take in all of those and do this manually in order to learn this stuff, at
least for the seats that you're working on.
After that, you can run an automated test.
Of course, that will be much faster and that will be much more comprehensive than what you generally
do.
But again, to understand the theory, to understand what each what you should do, it's always a good
idea to run this manually.
So another comment that you should run is history, as you can see.
It gives me it gives us the history of the comment that has been executed in this show.
And over here we see a lot of things.
Maybe it will do much, maybe it won't do much.
However, it's worth a shot.
OK, so you can maybe see some, like, passwords or maybe some useful comments that the previously
logged in user has executed.
And we can just leverage that as well in our testing.
So far, so good.
I believe it's done.
We're going to disappear and continue within the next lecture with our first leverage, first escalation.