>> Hey, everyone. Welcome back to the course.
In the last video, we wrapped up
our lab of just analyzing malware.
We went ahead, and created a malicious executable.
We then analyzed it through
different means, and we finalized the lab
by doing a hash calculation on our particular file.
In the future, if we were analyzing files,
we could compare that hash to
future malware that we might
experience, and see if it's the same thing.
In this video we want to go ahead
and start our rootkit lab.
Again, I want to stress that we're using
an older rootkit here to learn the fundamentals.
This step-by-step lab guide
is available in the resources section.
If you haven't downloaded those already,
be sure to download those for the course.
This allows you to pause
the video, and go through the lab at your own pace.
Now you should already be logged into
the cybrary website.
If you're not, make sure you're logged in,
but if you're watching this course,
in most cases, you should be logged
into the site all ready.
The first thing we're going to do is search
for rootkit in the catalog here.
That will give us this rootkit lab right here.
Let's go ahead, and select that.
We'll select the Launch button.
Then at the next screen we'll select
the launch item button to actually launch the lab.
Now it might take a few minutes to
go ahead, and launch the lab all the way up.
We're going to go ahead, and
pause the video until it fully
launches, and then I'll restart once the lab is up.
Once the lab boots up, it should actually take you
directly into this Windows XP desktop.
In this lab we're going to be using
a tool called rootkit revealer,
which is also an older tool.
Hence the reason why we're using a Windows XP desktop.
But again, I want to stress we're just going over
the basic fundamentals in this particular lab.
Let's go back to our step-by-step lab guide here.
First thing we're going to do
>> down here is step number 6.
>> We're going to go ahead, and launch
the rootkit revealer, and then just run a scan with it.
Now, it may take a few minutes to run the scan and you
might also get some prompts around licensing,
so just agree to the license terms that you get.
Go ahead, and double-click this shortcut
icon here on the desktop.
That's going to launch the tool for us.
You see, I get a license agreement, disagree to that.
If you get it. You might
get a couple of them. There we go.
Then you'll be taken inside the tool
and we're just going to go ahead, and run the scan is,
as mentioned, it might take us a couple
of minutes to run the first scan.
Once a scan is complete,
you'll see that it's actually
going to list out a couple of
register files and save that this
>> is potentially malware.
>> These are actually false positives,
so don't worry about that,
but you should see a couple of results
on this initial scan from your side.
Let's go ahead and close a rootkit revealer here.
It's going to X out of that, and we're next
going to go to the command line.
The way we do that in Windows XP,
>> if you're not familiar,
>> just go to the Start menu, and you can go to Run,
and then CMD, and just Enter,
and that'll bring you up a command prompt.
Let's go back to our step-by-step lab guide.
We just ran the scan with rootkit revealer.
We went ahead, and we've launched
our command prompt window.
Now we're here at step number 11.
All we're going to do is type in task list.
Now we want to just see
what tasks are running on this particular device.
Does task list all
lowercase and press "Enter" on your keyboard there.
You see, we've got several tasks running.
Now in this lab, what we're going to do is we're going
to be mimicking these various processes.
Specifically this alg.exe,
we're going to be creating one called a one g.exe,
which is going to be our malicious process.
In that way we can mimic that.
In a lot of times, malware would be doing that.
It'll be trying to look similar to this.
The average person wouldn't be able to
go through and actually say,
Oh, that's a malicious file.
The next thing we're going to do is
we're going to check for open ports.
The way we do that is we're going to type
a command called netstat.
We're going to type netstat.
Then we're going to put a space, and dash lowercase a
n. We're just going to see if we have
any ports open on this particular device.
Of course we do.
Now for our purposes on this lab,
we're going to be using a port number 19, and 01.
You'll see here down a step 13,
I've got that notated here.
Just make a note of that.
You don't have to memorize that.
You'll see that in later commands in this lab,
I actually just list that same port number in there,
but just be mindful that that's
what we're going to be doing.
You don't see 1901s listed here.
What we want to do when we're
setting our malicious process to a specific port.
We want to try to increment by
a small number to an existing port that's open.
That way somebody analyzing this may not
notice the difference, or may not notice.
They may think that that 1901 is something legitimate.
Because we've listed it
right near these other numbers here,
these other active port numbers.
The next thing we're going to do at
the command prompt here is just change the directory,
so we're just going to do it here.
Now, one thing I want to stress
before we continue in this lab,
if you want to get credit for actually doing this lab,
what you'll want to do is you want to make sure that
you specify these percentage task complete.
You notice I don't do that in these labs.
I just go through it but just make sure you
check these boxes here, and that
I'll go ahead and actually track
your progress in this particular lab.
Just make sure you do
that to get full credit for this lab.
Going back to our step-by-step lab guide here,
we're going to use this command here
to change our directory.
We're just going to go ahead, and type in cd space.
Then we're going to type in that path.
Capital C, colon backward slash,
and then documents and settings.
Then we're going to put a backward slash again,
we're going to go to admin, backward slash desktop,
and then a backward slash h x D as in dog,
E, F. Then the number 084.
Then we're going to put a space, and then
files and a backward slash.
Go ahead and run that there.
You'll see that it'll change our directory
to this path right here.
Now if we go back to our step-by-step lab guide,
what we're going to do is we're going to
rename a couple of files here.
Steps 17 and 18,
we're just going to do together.
We'll first type in this command here,
>> and press "Enter".
>> Then we're going to type in this command here and
press "Enter" to rename that file as well.
At the command prompt, just type in rename space.
Then our first file name, which is hxdef 084 dot exe,
and we're going to rename that to a1g dot exe.
If you recall when we looked at the processes,
we notice one was alg dot exe.
That's why we're naming this a one g dot exe,
because a lowercase L and the number 1 a lot of times
will look very similar. We'll go ahead and rename that.
We're going to go again to Step 18 and rename that file
as well. We'll do rename.
Now what you can do on your end is you can just
press the up arrow and I'll back out of that.
You can see you can press
the up arrow there if you want to,
and that will allow you to
quickly put the change in there.
I'm going to go ahead, and I'm just
going to delete all that out,
and I'm going to type it in manually
just to show you the entire thing again.
Rename and then this time it's going to be hxdef 084.
But now the file extension is going to be
dot two, and then dot INI for the file extension.
We're going to change that to a1g dot INI, or
initialization file. We'll change that there.
If we go back to our step-by-step lab guide,
the next thing we're going to do is we're actually
going to open that file in notepad,
but we're going to stop
the video there and we'll pick that
>> up in the next video.
>> In this video, we just went ahead
and got into the lab itself.
We went through and we looked for
processes running along with the port numbers.
Then we've gone ahead, and changed our directory.
Now we just rename the files to
different file names so
that way they hopefully blend in a little bit.
In the next video we're going
to go ahead, and finish on our lab.
We're going to open the a1g
dot INI file inside of notepad,
and we're going make some specific changes.
Definitely make sure that you follow along with
the lab guide, and make sure you're making
the correct changes so this actually works for you.