>> Hey, everyone. Welcome back to the course.
In the last video,
>> we went ahead and launched a rootkit.
>> We then verified that the process was running.
Again, the process we created the
A1G.exe that was running.
We also verified Netcat was running,
and then we went ahead and verified
that port 1901 was actually listening.
We were able to see that we were successful
>> in actually launching rootkit.
>> In this video, we're going
to wrap up the rest of the labs.
We're going to take a look
>> and run another scan with RootkitRevealer
>> and we're also going to take a look at the rootkit
>> and verify that we can actually access the host.
>> Let's go ahead and get started.
>> First things first,
>> we're going to just minimize our
command prompt window here,
and we're going to double click back on
the RootkitRevealer and launch that again.
Now before we run our scan,
we just want to go to Options
>> and make sure that both things are checked here.
>> Makes sure that scan registry
>> and also hide standard NTFS.
>> Make sure those are checks.
>> They should be by default but
>> just in case you're not make sure you check those.
>> Then what we're going to do is just run another scans.
Here in step 35, just click the ''Scan" button.
Again, it might take
>> a couple of minutes to run the scan.
>> I'm going to briefly pause
>> and we'll come back once my scan is complete.
>> Once you've run the scan,
if you go back to the lab guide,
what you'll see is question number 2 here.
One of the scan results now show you.
If you recall earlier when we run the scan,
we just noticed these top 2 here
>> which are false positives.
>> However now, because we've ran the rootkit,
we notice a couple of registry keys here
>> that we probably want to take a look at,
>> because they're malicious.
>> Now we're not going to go into the registry
in this particular lab.
That's outside the scope of this little mini course.
However, in the real world what you would
want to do is go look at these registry keys
and see if they're actually malicious or not.
Or if there's some more false positives.
The next thing we want to do an RN is
we're going to go to the Kali Linux machine.
The way we do that, just come over
here on the right side of the lab
>> and select the Resources tab
>> and then you'll see the Kali Linux machine right there.
Just go ahead and select that.
That'll boot up the machine for you now.
With this particular Kali Linux machine,
there'll be some arrows down
here at the bottom that you'll see
>> and you need to click and drag and slide up.
>> This here, you can actually log in.
Just click and drag it,
>> and then you'll see the login box there.
>> Same login as you normally would with
Kali Linux root for the username,
and then TOOR for the password, again, all lowercase.
That's going to go ahead
>> and pull the Kali machine for you.
>> Now while it's doing that,
we're going to go back to our lab guide here.
With the Kali Linux machine,
we're going to launch a terminal.
Now in this particular instance of Kali,
it's going to be on the left side
>> which is a more recent version of Kali Linux.
>> You'll see it on the left side of the screen there.
It's going to be that little black box.
We're going to go ahead and launch the terminal window,
and then we're going to try to connect
>> to that Windows machine using Netcat.
>> If we are successful,
we'll run a couple of commands to
take a look at the information we get back.
If we're not successful, we need a backup
>> and go back in the lab document and just make sure
>> that we've completed all steps properly.
>> Here in Kali Linux, just click the little black box,
that's going to launch the terminal window for you.
The next thing we're going to do
is we're going to use Netcat.
We're just going to type in Netcat at the prompt.
We're going to put a space
>> and then the IP address of the Windows machine.
>> 10.0.10.20, and then space 1901.
If you remember that's a port number
>> we talked about earlier.
>> Go ahead do that,
>> and we can see that I'm successful in my side.
>> I established a connection we see here that
the prompt we get now is a Windows prompt.
We know that we are connected to that machine,
but we don't know if it's really that Windows machine.
Maybe it's some other machine
>> and I messed up or something someplace.
>> Let's type in host name and just verify that
>> that's the machine we need and we see yes it is.
>> That's the Win XP
>> and don't worry about the naming convention here.
>> That's just going to be the actual host machine,
and now they've named it here in the lab.
Let's go back to our step by step lab guide.
The question is, what is a host name?
You can just fill out that there,
and that'll verify that this is actually
>> the Windows device we were looking for.
>> Now what we're going to do,
>> we're going to go back to that Windows machine.
>> Let's click back on our Windows XP machine,
under resources on the right side there.
Again, like I mentioned before,
just make sure that you're checking these boxes to
complete your lab progress as you're going through it.
I'm going to go ahead
>> and close out RootkitRevealer right here.
>> We're going to go back to the command prompt.
If you've minimized it, just make sure you go back.
You definitely should minimize it.
If you don't, it's going to stop the process
>> from running and so you'll want to go ahead
>> and just repeat some of the steps in the lab.
>> Once we're back at the Windows Command Prompt,
we're going to type in task list again.
Let's go ahead and type that in.
You'll see again that we're running the A1G.exe
>> and then nc.exe processes.
>> We see those in there.
Now what you want to do on your end of things,
because your numbers probably
going to be different than mine,
is make a note of the process ID numbers.
These numbers right here.
For example, with the a1g.exe,
you want to just shut down
>> if you had the same number,
>> you would jot down 1704.
For the nc.exe,
you would jot down this 188.
You're going to need those numbers
for the next part of the lab.
Again, just make sure you jot those
>> down to make sure you have those
>> and they're probably going to
>> be different on your end.
Just jot them down,
put them in your phone notes real quick,
whatever the case might be,
throw him a Notepad document or some text editor, etc.
But just make sure you make a note of those because
you will need them for this next part of the lab.
What we're going to do now
is if we go back to our lab guy,
we were to type in this command right here.
Instead of typing in PID right here,
we're going to type in the actual numbers.
Again, that's why you need to make
a note of those numbers,
so you can go ahead and kill off those processes.
Let's go ahead and do that.
>> We're just going to type in task kill.
>> We're going to put a space, /F,
space /pid.
That's the process ID number,
and then we're going to type in the first number,
which in my example is going to be the
1704 for the a1g.exe.
That'll go ahead and kill that process.
Then what I'm going to do,
>> I'm going to do the lazy way.
>> I'm just going to press the up arrow,
and then just change the number here.
You can type it all the way and again if you want it.
We'll just type in the next number
and kill off that process as well.
The next thing we're going to do,
is we're going to type task list again,
and the question is, are those processes
>> still running or are they stopped?
>> We'll take a look
>> and see if we see those processes again,
>> and you'll notice at least on my end
>> that I only see the alg.exe,
>> and I don't see the nc.exe or the a1g.exe.
I was successful in stopping those processes.
On my end of things, question number 4 here,
I would answer no.
I stopped those processes.
If they're still running on your side,
just run this command again and make sure
you're entering in the correct process ID number,
and if you're still having problems,
just back up in the lab
and make sure you've entered everything correctly.
in this video we just wrapped up our labs.
Again, we located those processes.
We use Netcat to connect
>> from our Linux machine to our Windows machine.
>> We verified the connection.
We verified it was the correct machine
by using the command of host name,
and then we came back to the Windows machine.
We located those suspicious processes again,
we found the process ID number.
We then entered in the task kill command
>> to kill off those processes and we verified
>> that they were actually stopped.
In the next video,
>> we'd just go ahead and wrap up this course.