>> Hey everyone, welcome back to the course.
In the last video,
>> we went ahead and logged into the lab.
>> We also took a look for port numbers,
we run a scan with RootkitRevealer.
We also went ahead and looked at any processes running.
Then what we did is we wrapped up the last video
by renaming our file.
That way we can hopefully blend in a little bit to
the naked eye if someone's analyzing this.
Now in this video, we're going to go ahead
and finish out our labs.
We're going to open the a1g.ini files.
If you remember, we renamed it to that
from the hxdef084.2.ini,
we renamed that to the a1g.ini
to hopefully allow it to blend in a little better.
We're going to open that file in
Notepad and make some very specific changes.
Again, I want to stress, make sure
you follow along with the step-by-step guide.
If you haven't downloaded the lab guide
yet, be sure to do so.
These are provided with the course to allow you to
go through the lab at your own pace.
The other thing I want to stress again is
make sure to get credit for the lab,
to check these boxes as you're going through
these different steps in the lab
to fully get credit for the lab,
so it reflects on your Cybrary account.
If you don't do that, if you just go through the lab,
and you don't check these boxes,
it's not going to track your progress.
If we go back to our lab guide here,
we're just going to type in this command
right here to open Notepad,
so Notepad space and then a1g.ini, our filename there.
At the command prompt, just type in Notepad
and then a1g.ini,
and just put one I there
and go ahead and launch it there.
Now you see it's going to open up
that Notepad document for us.
Again, I want to stress,
make sure you're actually following along with
the lab guide here and making
>> only the specific changes.
>> When I mention something
in the lab guide here that says, for example,
in step 21, under this Hidden table section,
change it to a1g.
What you're going to do is you're going
to change everything under
this section to just a1g.
You'll follow that same process for all of these.
If there's multiple things in there and
there's only one item to enter in,
just make sure you change
those multiple things into just this one item.
That'll make more sense as we
actually go ahead and type these in.
First things first, let's go
ahead and under Hidden table,
we're just going to type in a1g.
Now as you're going through this,
you can use Control S to save as you're going
through the Notepad document here to
save the changes that you've made.
Step 22, we're going
to go here and under the root processes,
which is so the next section down,
we're going to change these two file names.
The first one will be change to a1g.exe,
the second will be change to cmd.exe.
What you can do for the second one is just take out
the r and that'll change it for you.
Let's go ahead and do that.
We'll change this first one here.
That's going to change you a1g.exe,
and then the second one here will change to cmd.exe.
You can highlight and type that in,
or you can just take out the r and do it the
lazy way and just save that as well.
Now the next thing we're going to do is
under the Startup runs section,
so it's right down here in the middle,
we're going to add this path here.
It's going to be a little bit of typing
here and I'll just talk you through it.
Under startup run, just space down a little bit there.
I usually space down a couple.
We're going to go ahead and type this in.
We're going to type in this path,
so C colon backward
slash and then documents and settings,
backward slash admin,
backward slash desktop,
backward slash nc.efc for Netcat.
We're going to put a question mark.
We're going to put a space and then dash
L space dash t space p,
and then 1901, if you recall,
that's the partner we talked about
earlier that we were going to use.
We'll put a space dash e,
and then we'll put our next path,
which is just C colon backward
slash Windows, and then system32.
If I spell it right, that'll work better. There we go.
System32 and then backward slash cmd.exe.
Just double-check yourself there,
make sure you type that in correctly
>> and then move on to
>> the next step of our lab guide there.
If we go back to our lab guide in step 24,
what we'll see here is that under
the Hidden ports section we're going to add in 1901.
Again, that same port number
that we were talking about earlier.
If we scroll down here to Hidden Ports right here,
we're just going to space down and put 1901.
Let's go back to our lab guide here.
Now under the Settings section,
we're going to make several changes.
Here's a Setting section right here.
We're going to make several changes.
So that password one,
we're going to change that to just the number 1337.
We're going to also change
the driver name and the driver file name as well.
That'll be the last changes
we make to this particular file.
Just go ahead and if you need to pause
the video and do steps 25 through 27,
and that'll make those final changes for us.
But we're going to go through
>> that step-by-step as well.
>> Under Settings, if we go to Password right here,
after the equal sign,
we just want to change all of this to 1337.
The next thing here under the Driver name,
down here near the bottom,
we want to change all of this to just a1g.exe.
Then finally, under
the Driver filename, the very last one there,
we're going to change all of this to just a1g.sys.
Go ahead and just save all that.
Now since we've made all the changes,
you can go ahead and close out this
Notepad document, that's perfectly fine.
We'll come back to our command prompt here.
If we go back to our step-by-step guide here,
you'll see that now we're at step number 28.
We're just going to basically refresh
that Notepad or that executable document.
We're going to go ahead and refresh that,
that way we can go ahead and run the rootkit.
The way we do that, we just enter in
this command right here at the prompt.
Let's go ahead and do that. We're going
to type in a1g.exe,
and then we're going to put a space,
and we're going to put a dash,
a colon, and then the word refresh.
Just run that, that'll refresh it for us.
Now if we type in a1g.exe,
that will actually go ahead
>> and run this rootkit for us.
>> Once we've done that, if we come back
our step-by-step lab guide,
we're going to type in task list again,
and that's going to show us if that process is running.
If it's running we were successful, if it's not,
we need to go look at our syntax and also look at
the Notepad document and make
sure that we've typed in everything correctly.
Let's go ahead here and step 30 and type in task list.
We'll see if we notice the a1g.exe process.
You'll see we see alg right here,
but if we come down just a little bit,
you see a1g.exe along with our Netcat as well.
You see that we were successful there,
we are able to run that.
Let's go back to our step-by-step lab guide here.
Now the next thing we're going to
do is we're going to take a look and
see if Netcat is
listening on port 1901
which again is this port number we specified.
Here in Step 32, we're just going
to enter in at the command prompt,
this netstat space dash ano, and type that in there.
Now we're looking for port number 1901.
If we look here on our list,
you'll see right there, 1901 is listed.
We know we're successful there.
It's actually listening on that port number.
If we go back to our lab guide there,
you'll see one question,
is it listening on port 1901?
In my case, yes.
If you get a no there,
if you're answering no to that question,
go back, make sure you're
typing all the syntax correctly.
Also make sure that Notepad document,
open that file again and make sure
that you've added everything correctly in there.
In this video, we just went
through the next steps of our labs.
We went ahead and launched
the rootkit and we verified
that it's actually in there working.
We're going to wrap up this lab in
the next video with the final steps.