Hey, everyone, welcome back to the
course of the last video we went
ahead and we made
sure our virtual machines were on,
we went ahead and launched Putty.
We attempted a initial
connection against Playbook
zero one. We found that that would
not connect until now, potentially,
because maybe it's not listening on
that port for that particular
server. We then tried again
with pleb DM's zero one, which
was one of the two one six eight
zero two IP address.
And we were successful.
At least you should have been successful
in establishing a telnet connection.
They would have then asked you for
the username password again, that
was going to be administrated with a
capital A..
And then the password was password
with a capital P and a zero instead
of a instead of an oh
excuse me.
And so that took us to question
number two.
Were you able to gain access?
In my case, the answer was yes.
And actually, in your case,
hopefully the answer was yes as
well.
Ah, so now what we're going to do,
we're going to click back on P Lab
DMCA once we're here at step two
of our step by step guide and we're
going to stop the Wireshark packet
capture.
So let's go ahead. You can also to
click back on P Lab D.M.
zero one, and then just click this
little Red Square icon at the top of
the Wireshark here on the top left
to stop our capture.
All right, let's go back to our lab
document, so
now in the applied
display filter box for Michigan is
going to be applying telnet as our
filter.
I want you to keep in mind, though,
just kind of FOIA, and that's why I
noted it here. Sometimes this lab is
a little slow in applying the
filter. So it might take a few
seconds or so to respond
to the command that you've typed in.
So it's kind of FOIA on that.
And then what we're going to do is
we're just going to basically right.
Click to follow the TCP stream.
So similar to what we had done in
the previous lab.
We're going to follow the TCP
stream. Slightly different here
because this is a different version
of Wireshark.
We're going to be selecting follow
and then TCP stream after we
right click. It's not it's going to
be follow TCP stream, so it is going
to fly and you'll see what I'm
talking about in just a moment.
So first things first.
Let's go ahead and filter this.
So we're just going to type in the
word telnet here in this filter
box at the top and then just click
this little arrow right here to go
ahead and apply that filter.
You'll see, once we do that, the
protocol just changes to say only
telnet and we're going to go there.
Now, what we're going to do again is
just right. Click now.
Intellect follow,
it's about halfway down.
There are three quarters of the way
down and then Tsipi Street.
And so what you're looking for is
you want to look for the username
and password. Now you want to
look for that. His name and password
we typed in in some instances
with this particular environment,
sometimes it saves if you've kind
of figured a previous username
and password or anything or just
kind of entered one falsely on
purpose, sometimes it will save it
for some strange reason in.
And when you go to do this like lab
again, it will
just basically save that
in there. So when you look at the
packet capture, so I'm saying all
that to say that this is why you're
seeing that the login
name, at least on my end, is showing
this. So that's likely because
now you're seeing that on your end.
Definitely let me know, because that
means there's an issue with the lab
itself.
But I know for a fact I've typed
this in on purpose before
and that's what I am and
consistently seeing.
So it's either an error with the lab
or it's just
me typing that in and it's
saving the information.
So either way, not really
applicable too much to what we're
doing in this particular lab.
So we do see that there is a user
password there. So question
number three for me at least, was a
yes. Now, if you don't see a
username and password there, then
make sure you just continue
repeating the step of right
clicking, opening the packet,
you know, the TCAP stream
and take a look, taking a look
to see if the username password is
in there. Again, our goal here is to
take a look and see if we can find
a username and password.
So we see here that, yes, I did have
a username, a password there,
potentially, that's something
valuable in this case.
It's not you know, it's just a test
environment.
But in some cases, it might be
valuable information that we can
then use to compromise a system
or we can use it to, you know,
change somebody's password, then,
you know, escalate privacy
privileges depending on the type of
user they are, et cetera, et cetera.
So many things we could potentially
do with that. Again, just another
tool in the arsenal that we can use
is Wireshark.
So this lab, we just touched on some
more use of Wireshark
and the next video we're going to go
over actually applying some
different filters in addition to the
telnet, we just said now why should
we apply some filters to TCP
dump as well as Wireshark?