Hey, everyone, welcome back to the
course. So in the last video, we
went over operating system
fingerprinting, we just ran a quick
command, I guess a couple of IP
addresses and we're able to see that
both of them were Windows operating
systems.
And one of those, it was suspecting
that it was possibly Windows Server.
And we again, we already knew that
that it was a server and was running
Windows operating system on the
server. And we if we have
explored a little further, we would
have noted that it was Windows
Server 2012.
So in this video, we're going to
talk about banner grabbing.
So we're just going to go through to
a quick lab on banner grabbing.
Again, Obama grabbing is this is
allowing us to send a
command to the target system.
And then the hope is that it will
kick back some kind of error or
other information that will provide
us with information about the
operating system and the version of
whatever software is in use.
So let's go ahead and get started.
You should be logged into the
Siberry lab environment already,
or at least the Siberry site that
we're going to go to the search box
and type in ethical hacker
and it should pull up our lab
environment for us, which is going
to be this top one here, the
certified ethical hacker or S.H.
go ahead and click on that and then
select this launch button here.
It's going to take us to another
screen here. We're going to click on
the launch item option
and now it should launch the lab
environment for us.
So once it does that, we're going to
be looking for the banner grabbing
lab.
So we see it here, it's going to be
the fifth option down on the left
side here. Just go ahead and click
on that.
You'll see a starbound, just click
on that. And that'll actually pull
up our virtual machines for us.
Now we're just going to turn on all
these virtual machines.
So the way we do that, we just hover
our mouse over top of it, select
the power on option.
And then it should boot up those
machines for us.
I'm going to go ahead and pass a
video because it takes about 10 or
15 seconds to pull those up
and I'll restart the video once all
mine have launched for me.
All right, so all of my virtual
machines are put it up again, if
yours are not go.
This video, just wait for them to
come back up and usually only takes
about 10 or 15 seconds and they
should all turn green for you, which
means that they're all on.
All right. So the next step in our
lab is actually connecting to this
lab, say zero one machine.
So here in step six.
So let's go ahead and do that.
Now we're just going to click on the
name there and it'll pull up that
server for us.
It might take a second or so, but
you'll see a server manager window
opening up. Just go ahead and
excited that once it opens, we don't
need to worry about that for this
particular lab.
And then all we're going to do here
is actually just start the Apache
Web server so you'll see right here
on step nine, that's what we're
trying to do.
So let's go ahead and do that now.
We're going to do that by clicking
on the app icon.
So this orange colored icon has an X
in the center of it.
Going to click on that.
It's going to take a second or so to
launch up for us here.
And then we're just going to make
sure we just click start for these
bottom three options just to make
sure there's no errors that happen
in the lab.
And we're just going to go ahead and
minimize that. Now, let's move on
with our lab document here.
So our next step here in step 10,
we're just going to connect to the
Windows 10 machine, which is a P lab
when 10 machine.
So just go ahead and click on that
on the far left side here.
And this one's going to take a
second or so to pull up the desktop
for us. You may also see a command
prompt window open up.
Just ignore that and let it close
again. It just takes a second or so
to close.
Once it's fully booted up here,
we're going to double click here and
step 11 will double click on the
Vincey viewer icon.
So it's that orange colored icon
on the desktop that looks like a
little tiger's eye.
So this one right here.
So we're just going to double click
on that. It's going to open up our
connection box for us here.
You'll see by default it puts
the Kelly Linux machine IP address
in there for us.
So all we have to do is click the
connect one to connect.
Now it's going to prompt us for a
password.
And so the password is here in step
14. It's going to be the word
password with a capital P, and then
that's actually a zero and not a
capital. OK, so let's go
ahead and type that in there.
We're going to type in capital P
lowercase HSW,
the number zero
lowercase R D and then either
click the OK button to enter on
your keyboard and that will connect
us to the Calli Linux machine.
Now once it does that, you'll see an
error message here.
We can ignore that and just either
click OK or just click the X to X
out of it.
And then our next step overlap
here in step 16 is double
clicking on the root terminal icon.
That's just going to launch a
terminal window for us.
So if you're following along
in your own lab environment, you're
just going to you just want to
launch a terminal window and start a
Kelly Linux and you'll be caught up
with where we are.
All right, so now we're going to
type in this command here, so here
in step 17, we're going to type in
we're basically just going to run a
sound scan against Port A-T.
We're going to do aggressive mode.
And the goal here is to try to
figure out what kind of operating
system we may have in use.
And so aggressive mode is basically
just telling us, like, what's the OS
and use, what are some other items
as well? And we're going to run it
against our server IP address again,
which is epilepsy zero one
machine.
So let's go ahead and take this
incident to type and map space,
dash lowercase s capital s first.
So and map space dash lowercase
s capital s, we'll put
another space there, we're going to
type in the dash lowercase P
space and the number eighty to
specify Port 80.
So that's P space 80.
We put in another space
that we're going to type in the dash
capital A and then finally our IP
address there. So dash capital
a space and
then one entry to that one six eight
zero dot one and then just press
enter on the keyboard.
Might take a moment or so to run
this particular scan.
You may get that prompt there about
Windows firewall.
You can just out of that or just
ignore it. Eventually it will go
away.
And so our scans running there.
So it might take a moment or so.
I'm going to go ahead and pause the
video here and then we'll pick back
up when the scan is complete.
All right, so we see the scan
results in the background there, so
a couple of questions that will want
to answer is we're looking at those
results. Question number one, what's
the operating system of our target?
And then question number two, what
services are running on the open
ports?
So let's take a look at those.
Well, let's start with the operating
system question, because we see the
output right here.
So, again, it's estimating that
we're running some kind of version
of Windows.
And when it gives us some details
here on the OS, it's saying,
hey, it might be Windows Server
2012, may also be Windows seven,
could be Windows eight point
one.
But in some capacity, it's a Windows
device, or at least it's assuming
it's a Windows device.
Now, we know that the device we ran
the scan against this, a pilot say
zero one, which is a server, which
is actually Windows Server 2012 that
is running there. So we know that
that's the correct answer there.
But if we were a criminal attacker,
we probably wouldn't have all that
information, but we could see that
it's a Windows machine.
And so we could start looking at
vulnerabilities for Windows machines
and figure out what we can use to
attack this particular device.
All right. So the next thing we want
to take a look at and see is what
kind of services are running on the
ports.
So if we got any response from ports
at all, we want to see the services
running on those ports if we scroll
back up here.
We will see what kind of services
are running, so we see that since
we ran it against Port 80 as part
of our scan command, we only
see port areas or output.
But again, we know that.
And if we didn't know that, we could
look at the output, but we know
that's going to be HTP.
You'll also notice that it tells us
the Apache version here.
So we see that it's version two
point four point two three, which
could allow us to find
vulnerabilities for that particular
version, if that's an outdated
version of that particular
that particular piece of software.
So we see we get some good
information back on this particular
lab.
In the next video, we're going to
move into so in this video, we
covered banner grabbing, we just ran
a couple we ran that command there
to see what kind of output we got
back. We want specifically wanted to
find out what operating system
was in use, as well as
what services were running on the
port. Again, we specified Port 80,
so that's why we got back just Port
80 in our results.
But we were able to see that it's
running a patsy for the
DP, for the Web services,
and we were able to see the
versioning of Apache as well.
So in the next module, we're going
to go over a numeration, so we'll
take a little closer look at things
like dig as well as running Zend
map to see if we can get more
information about our target.