Hi, and welcome back to the Deep dive into
Network. Assessments by easy console. This
is section, Tree on someone
with network assessment. In this video will take
a look at a sasin remote Information, Services Onan
at work. So I'll take
a look, very common
Services, only target system. So here
we are pocket, Kali Linux, a simple
Netflix on to actually determine whether
our Target how to
put together a port on a to. The sport is remote
desktop protocol cuz you stash be on. Remote
desktop protocol uses Port 3389. So
let's see
if our target has a spot open. If it does. Well,
definitely. We know it's a Windows system has Windows
users RDP removed as a protocol that
said, answer on.
Currently we could see 3389 Conover
Target. So this means, hey, well
damn must be RDP running
on a Target itself. So how
could we not send to let Seguin. Ministrator
password?
Okay, no, password to login to
remove Target, so you can
use it to such as Hydra. Let's a
Hydra - 4 is
a specified time. Anchor dash fuse -
L specify administrator ISO
Woods, l, specifies,
a username / password.
So you can do. Capital P unspecified to
specify
a single password of these. Capital p, a specified wordless.
So there's a ton of food list in
the US are /. Share.
Slash witless directory.
Cypress stopped a couple of times you
could see in number of directors exists here, but I have
a specific would listen to The Rock you, which is already extracted.
And we specify RDP protocol.
Cool on slash slash on the
target survey enter hydras going
to actually use the woods from this witless.
With this particular username against
us Target on the RDP service, this
phone, it will display the
username and password on our tune on
the 5th, so, I couldn't answer, and let's see what happens. And taking
some time, we can see it's actually attacking the
RDP service. A couple of
seconds of going through the wood list at Fallen already peas. Definitely
open on Port. 3389. This is
a target. We have a login name.
I have a password, which is pretty awesome.
What we can do next is at
10 to log end to this target. So remember,
username is administrator in
the skis. On the faucet is Wagner. So
we can do our the stop
a specified to use a name. Like
to specify the password, specify the
target audience for spider resolution. So
they sent a note and this is going to open up a
remote desktop protocol session from our
Carly last machine too, or Target
itself. So, like so enjoy yourself.
We actually in our Target
machine and our
deepest ocean.
So we have full control on. We
are the administrator log off, and as
you can see, it's that simple, taxi Crockett password.
However, please keep in mind that the
password list is only as good
as the password actually exists within the wood file.
Since our system is Windows Vista system are, we
could switch for very specific vulnerabilities on ports
on a Target over the past few
years. There's a very well known. Vulnerability in
the blue little blue
house affected, many Windows operating system that is
on porch or just simply
Saudi to do probably Legacy systems. So they
get started. I'll let see if Windows Server,
SMB is running at least
super message, block on this version of Windows. So
let's do pseudo and map
specifying the votes. So, SMB
runs on a few votes. So
that's can between 1:36 to
1 to 2.
And let's also include 445 as well to
together with our actual time,
which is 172 TT. 1.21.
It ends meet
until my pseudo password.
That Antonia wants more are we can see if
any of these ports are closed on a fuse
actually open. So this
is a bit suspicious, but we still
have 445 who, which is SMB as well. So,
let's try to see whether
this target, which is about 20. What
is vulnerable to Eternal blue, which is
the vulnerability actually going to do Sudoku.
Msfconsole to Open. Mat
has white like so good. So
let's give this a second to
two.
Are tomatoes poisonous loaded. So you can see there's a
number of exploit more use, auxiliary more. You
some pulse exploit more use the lute and
coders no operations and Division.
So you can search for SM. Actually,
you could switch for MS.
17 - 01 Subaru Impreza.
Answer this will show us all the more you
set a related to eat, you know blue suit, each of
these here is the model. I can
see sideswipe more useful windows. We could see
the category and the actual name of the
model. We all saw the number. We all saw the
description as well that tells us what emoji does. So let's
say for example, if you want to use this Foose model, well, this
is an exploit but we want check to see whether
our Target is wonderful to to
the SMB. All remote, code execution,
could use a disc auxiliary scanner to
actually to. And what? All the talk is one of those or not.
So did you use and we
could simply copied in time or you like Sue, copy
right-click piece?
Annex a good type of options to see what options
are required options here
to see. Are we have? Yes, this is
a reset. Yes, for our
who was with all our, whose voice is not set. Alarm roses
actual Target or our boat
or remote Pro to set as well. Treads is
one. So let's do set on.
Let's we set our host and
specify or remote host,
which is 172. 30. 1.
21. Enter
options. One more time. I could
see now the our house while you said we can
simply divert wrong or we could type exploit to
actually launched a small. You but since it's an auxiliary, let's just
typed the wrong is Enzo.
All right. Now they perform is
this country to man. I saw is here who says
like leave one rule to Amazon teen 010 and
a system seems to be a Windows Server. 2008 R2,
standard. Are we have
the bill number to get over to Sue's Park number as well?
So I'm going to type back to go, back to the previous in
the face of my lisp light. Good types.
Which one more time.
I can't seem to find it again. I'll
just have to search.
A sweet one.
7.
- 010 Cadenza a
Natasha uses for exploit. It
works and will be able to perform remote
code execution on our Target. So I'm
going to copy this.
Use this model.
That type of options on child
assault. We have appealed automatic
couple on to this actual exploit. So
what's the purpose of the exploit? On
Apple text Floyd is what is advantage of
the volume of the phone herbal tea on the Target on
the victim's system. The payload is
what happens next to break in,
on a payload is going to create what
he called, a reverse TCP shell. What
is what? I use metal printer to help us communicate with
remote system.
After this, we actually need to
set. Let's see. So yes it is.
So we decided our who's for exploit
and we also need to set the local host for
the elude glucose loses all IP address.
On. Swear. Will call back to honest.
Using 84 44444. You could
use another pot if you want. But just with Simplicity,
I'm going to leave this house for for for, for 2 minutes
to set our host on
its 17238 at
1:21 to set.
I can't remove my IP address. So I'm
going to check it here right now by patd are and my
IP is the 27th a
copy. This
I want to see set alarm piece
of my IP options one
more time. And now we have two
are who set up the local who
set such as good. So now we
could type exploit on hopefully.
This should work. So let's see. Three who won?
Derrigo. It's chucking. It seems
to be the horses. Honorable. It is sending exploit
and it will dance and the people across. So
let's give this a couple seconds and it
seemed to be working at. Send the payload and
know that it's all. We have a matter for discussion.
So super awesome. Super, so
allows us to communicate with the hose remotely.
The cool thing about my favorite author, is it runs
a memory on the target system, which means
he does not write any sort of data on the disk and its
everyday uses. The chances of being detected
or it reduces try detection.
You can type help to see a list of all the
awesome commands you could do.
So let me screw up. We have
the core commands, which is pretty awesome. We could
get in. Follow the system. We have
file system commands so you can copy data.
We can upload it later. We can move across files. We
have networking commands here, which
is super amazing. We are system commands,
we have using the fuse commands
result. We could even capture keystrokes. We
can even take screenshots and view the
victim's mother or desktop in
real time. We could put it on there, even
clear through their speakers on even
more. Now, what a cool things that
you like to do is lie to you when I get to hashes of
the user's password, what a local
users password like some
person. So I'm just saying that we are able to
get all the local usernames and passwords. Well, not
the Apostle specifically.
What are password hashes. So this here
is LM hash on this one
and the other hash using the username and
hash has all the passwords. We don't
necessarily need to perform password-cracking Wendy's, password
hashes. We could perform techniques new. A spacer with
some fellows has to gain access to Systems
& services without even cracking.
The password. Soup also actually.
So, just to give you an idea on how we could
use fossil hash. I'm going to copy this hash over
the administrator. Password on Rambo.
This is this his administrative account. So I'm
going to open in Utah. That perform
a pasta harsh technique really quickly
just to get an idea on how awesome
this is.
So what I'm going to do, I'm going to use that too. But
just call Pasa hash on this is
actually come on, so it's p. T, h - 1X
- Capital you for
the username, which is a Ministry to put up
the sun sign, here during a specified, the l,
m, a n, t, l l, space,
double slashes. The
target IP address, I could
see CMD. So what's going to happen is we
should get a Windows shell coming back
to our system. To try this out 321. Derrigo.
We actually pretended, to
be the administrator. Are, we
did not even need to provide actual password.
We simply literally passage
across an ethic and this
looks really familiar. This is Windows command
prompt. Should I type u r? Y
I am the administrator on the
actual Target system, which is
super cool. Actually.
So now let's all go back to our first female where we
have all met over to session. We could
type. Let's say for example cyst in food to determine what
type of system that we have just broken into.
Of course, ethically are you see we have
the whose name we have the operating system architecture. We
could deteriorate someone let's say for example, I
do mean or not
song. I want to do mean for example of some group. So it's
not want to do mean.
The thing about running my toothbrush, so we can even determine what
is a privilege or the
use of privileges submit their precise. Running on the target
system. We could use a composite of
get ID. I could see. We are currently the system. Well,
we have some level privileges on
the actual victim system, which is
pretty cool.
No, just say I'm Old. Brick Inn in Tulsa storm is, how do you
want to try to remain as undetectable as possible?
So this means to see what if we could
migrate or process into a less suspicious
process. So, in
other words, you could see all the processes running
on the victim's system. For example, you
could see the process I put self
on who is running. Process on a
little description as well. What if we
could migrate or purses into a less suspicious
process so you
can use it for sex PlayStation models, such as the type one
supposed.
Okay, so you supposed to see Windows
Windows managed? I
could see my great and try this out.
So he's running them. Are you against this Host? This
is a current process, which is
pool, SV. EXE. The process ID.
It created a new process called set,
new timer, 30 XE. I am my greeted our
process from this number to this number.
Sweet words on the target system
or the victim's system. Deal thing
that I know Todd is running, but it's actually me to
print. It out. Is using that particular shell. Super cool.
Fumo. If you want to get Lexie to
Windows me to Shell on our system and I
shall, and just, why are we have the Windows command
prompt type? Who am I an eye
on the system? So that
Woods if I had a system, this means I have high-level privileges as
computer actual administrator. This
mean, to say, I could also perform any
sort of options. I can upload stuff, download stuff,
copy Dieter my greedy to
do anything on this
system because this is a highest level of privileges on
a compromise system, which is super Mason
in this with you. You look
at exploiting, Network Services, which is
SMB, open remote, desktop protocol.
In the next with you will be starting section 4
which is Advanced network security techniques on you?
Take a look at it objectively and items
which will be covered in the next section. I hope
this video hospital phone to see you and I'll see
you in the next one.