Hello everybody and welcome back.
And in this tutorial I will show you some of the advance use of the map which is basically using the
scripts that are already pre installed in clinics.
Now Scripps can be used for anything to discover for example a stage host key to discover some of the
more abilities to stage brute force to basically do a bunch of things as we will see right here.
There are a bunch of scripts that are already in our clinics machine.
So first of all in order to get to them you just want to change your directory into the user share and
map.
And if you go into that directory and type your pal s you will see something rectory called scripts.
Now let me enlarge this right here.
So if you change your directory to scripts and type here or else you will see that it will print out
a bunch of these top N S E files which are basically already pre installed and map scripts that you
can use for basically any type of scan you want.
So for example let me just show you first of all how to use them.
So if you type here and map you will see the minus minus script option which is right here and then
basically type your equals and then the name of the script it is simple as that.
So in order for you to use the script to specify this option and that equals and then you specify the
name of the of any of these files right here which are basically scripts and you run them on your target
IP.
Now we will try out one of the scripts for now one which will be DSH brute force which will be also
one of the first attacks active attacks on the target.
It will basically brute force it to try a bunch of passwords for the sage on our target.
Now for that target you can use any of your two machines you want.
You cannot use scandal and method or Web site as it says Do not try.
Deep Web site could force a message on the map site.
So you want to either run your methods point the ball which showed how to install in the previous videos
or you can basically run any other machine that has the port 20 to open.
Now in my case I will run a wasp which I will show you how to install in some of the next stories.
From now on just on your methods potable since Matt spreadable also has the SSA port open
so let me just wait while this opens right here.
It doesn't take long to basically prompt me with username and password soon.
It's pretty similar to the methods portable.
This is just unfair to machine that a trans punch all the vulnerable programs on it.
So as you can see starting up armor profiles on starting post guess Eskil database in a bunch of these
other stuff.
This is the machine that we will use in the next section which would be worth testing.
So let me just pull the plug in right here
and we don't need this anymore.
We just need to find out what the IP address of this machine is which is 1 9 2 that once you see that
one that 7 so if we only scan the coast for now on the map.
So we do a basic scan.
You can see that finishes relatively fast and it keeps us bunch of these ports open only DP ports.
And as you can see we have the 22 DCP such port open.
Now while scanning method applicable you should also have these port open.
So as long as this port is open on the target machine you can run this scan.
So the scan that we are the script that we are looking for.
If it up here we want to find the SSA it's great.
So in order to narrow our options as this type here tell us and then we pipe that into crap as a sage
so it will only show us the scripts that have SSA Internet now from all of this.
We can use any of these but from now on I will just use the sage brought that.
And as e we copy the name of the scripts and in order for you to run the script you type here and map
minus minus.
Script equals and then you paste here the name of the script.
You can just copy paste it from here and then the only thing you need is the IP address which is why
I do that 168 that wanted seven.
Can just press your enter and as you can see it started good forcing our target if it finds the user
name and password you will be able to a search into that machine and basically do anything to it.
This is a very serious attack.
It can get you into trouble especially if you find out the password and actually looking into that machine
and start changing stuff.
So only use this on the machines that you do own.
Now for this specific machine I don't think it will find the password but I'll just leave it run.
Just in case I don't think that's the password and user name is stored in these list that it is using
in order to put forth the message target
so they can take some time.
It depends on the list that you use.
So let me just call this right here since I thought it would finish a little bit faster and better I
would just type here.
Control C in order to close and we stopped the brute force.
Now let's say once again we want to find that and you want to change the password list for example as
you can see it has the specific password list that it uses in order to brute force the target.
So what you want to do is to narrow
the script that you are using which in my case is a sage root and what you want to change right here
is the option where it gives us the password list.
No not really sure where that is.
You can just.
I believe it's right here usage here.
It's right here so pass that list.
I believe you change that and it will change the password list you're using.
So you can also change the port which is 20 to basically a sage will most likely always randomly port
22 but there are cases where the people want stuff on the other port just to prevent the attacks.
So you might be needing to change that as well.
So here you can see that the through is 22 NSA to basically just change d 22 into any port number you
want that funds SSA on it and you will be good to go.
So if there are any other options that you want to change right here you can change it in the file itself
if it requires that for example the port the password list.
And once you do that you just type here controls oh to save and try to save under that name and control
X to exit and you will be good to go.
Now you can run the script again and it should change your password list and port number.
Now let's say for example you want to find out the was key for that particular machine.
So we just copy which isn't really useful but let's just try it.
Why not store and map.
Script equals
box script equals search was key and then the IP address of our target machine.
Now as we can see it gave us the message was key to basically just these DSA and they're saying it really
isn't that useful but sometimes it possibly could be.
So you can you can experiment with all of these scripts right here in the next three hours show you
how to download some of these scripts online from the keep repository that we will use in order to scan
for specific abilities.
So let's just recap in order to get to these scripts folder you just go to the user share and map scripts
directory and the syntax is basically and map the stash script equals and then the name of the script
itself and you just specify the IP address so that's about it for this material was rather short and
in the next one.
As I said we will download some of our own scripts.
So I hope I see you there and take care.