Hello and welcome to Command Line
Basics. In this video, we're going
to learn about Linux networking,
too. I'm Christopher Howard.
Let's begin.
So we're learning objectives for
this video to learn about the TELMA
command, the SS command
and learn the NC
command as well.
Some free assessment, which program
provides encryption by default?
Is it A, NC,
B or C,
Telma?
The answer is B, SS
H stands for Secure Shell
because it is automatically
encrypting already by default.
So the net can in the telnet
commands to not encrypt
when you're connecting remotely to a
machine. So it's very
important to make sure that we're
using S.H.
if we're using this in practice
for real on protection systems.
That way nobody can just sniff the
data and see what we're doing.
So at the TELMA Command, this is
used to remotely connect to a
terminal on a machine.
And like we were saying, it should
not be used today because there is
no encryption and everything is in
plain text.
But it is a useful protocol if you
need to connect remotely to a
machine.
And so I'll give a brief
demonstration about this, will
capture some packets and we'll see
exactly how
dangerous this is.
So I'm going to be on my sift
machine and I'm going to
start Wireshark in the background
so we can capture these packets.
All right, and Wireshark is
up and we are capturing packet's
now, so now I'm going to
run Telnet and connect to this
remote machine.
So it's going betelnut and then the
address and by default
it uses for twenty three for
Tellman.
So I'm going to use the
local login for the
workstation then I'm connected to
and then the password.
Now I don't want you to see my
password because I've
logged in.
So now we can type in a few other
things. We can look at what's
inside of this folder in my home
folder there we can
do you name
A to exactly which type of Linux
this is. We can look at the kernel,
all that information and
who am I?
I'm Sande's Forensic's.
So and now in order to quit,
I'm going to use exit and this
will quit directly out of this
telnet session.
Now, if we go over here and we are
in Wireshark,
we can take a look at the telnet
protocol we have here.
So I'm going to stop this captcha
now if you right.
Click and go to follow
and TCP stream,
you can see all
of the activity that we were doing.
So let's go ahead and
take a look at one end.
So if we look at this end, this is
what we were seeing says Sift
Workstation login sans Forensic's,
you're only a little bigger.
And then the password.
And now if we look at what
was sent back, we could see
this was the password.
And now if we can look at the
everything together, we can see
this is my password in plain text
right in front of it.
And anybody that was listening on
the wire can take a look and see all
the activity that we were just doing
and learn everything that we did.
So it's very important to use a
secure program in order to
be able to protect yourself
from unauthorized listening.
Now we have the H command, so
we'll do this again.
It'll show a brief explanation.
Captured some packets so we can see
that this encrypted terminal section
uses certificate based encryption
and it's not allow the plain text
the conversation so we can't
just have someone listening to it.
So let's go ahead.
Go back to the Linux machine.
I'm going to close out of the stream
and we're going to capture some new
packets.
All right, and now I'm
going to bring up our previous
comment
and then just type SNH
and I was going to ask you for
the password.
Now I forgot to change
the username, so
I'm going to exit that
real quick.
And now for SFH,
sometimes you'll need to do
the username at
the IP address that you're
connecting to.
So now it's asking me for this sans
Forensic's password
and I would try to hide the
password. But you already know it
from this video.
And you could see we're in
now. We can type unless
you do or you name again
or if config.
Take a look at the interfaces on
the other machine and
now stop catching packets and we
can see there's some SFH connections
going on. So let's follow that
stream and take a look
at that. It is just a
bunch of gobbledygook down here.
So all of this is this is
negotiating of the type of
connection that's going on before.
But we don't see the actual log in.
We don't see the actual commands
being passed because this
is the encryption that's going on
down here.
And you can read this.
I can't read this.
It's a very secure way to connect
remotely to machines,
have that terminal access remotely
in a secure fashion.
All right, now I
have met and see, this
is a very, very simple network
protocol, and you can use it to
quickly and easily set of
connections between two computers.
And because it is so easy
to use, it is used in malware
very frequently.
And in order to set up a listening
server with Ngarkat, you're going to
use the Ency Dash
LP and then the port
that you wanted to listen on.
So let's go ahead and give a quick
demonstration of that as well.
So I'm going to close out of
Wireshark.
We don't need this anymore.
And now I'm going to type inside
LP and let's
say we are going to listen homeport
one, two, three, four.
And now and see Nickens just
going to sit here and wait.
And now from
our let me
exit out of this as this age
connection real quick.
There we go.
Now I'm going to do and
see this remote computer.
And then the point we're going to
connect to one, two, three, four.
And you can see there's no
kind of welcome screen.
There's no introduction because it
is such a simple, low,
low overhead protocol.
All it does is it just makes that
connection and then leaves
it up to you.
So let's take a look
now. Let's go over to the machine
and check that out. We have the
Hillo on this end.
And in order to not be rude,
let's say, well, hello there back
and we have hello there back.
So that cat is
a very, very simple protocol that
you're going to see use very often.
And because of its simplicity,
it is used in malware pretty
frequently
art to post assessment.
It is not alarming.
Define and see that
listening for connections on port
forty four or forty four.
Is this true or false?
The answer is false.
It is extremely alarming to find
and see that you see on a Windows
machine listening to connections
on port. Forty four.
Forty four.
And if you're not familiar with
MÃ©tis Floyd, this is the default
notice Floyd Port that is used
when you're using
exploits.
So finding a
executable running and
with cat on forty four
or forty four is exceptionally
alarming and should be investigated
further.
All right. So in this video we tell
the command of the SS command
and then the NC command
and we captured packet's, analyzed
them and saw just how much more
powerful the SS H Command is than
the Telnet command.
And I hope to see you in the next
video.