Now in the previous lecture we had the quick look on the map and how it can be used to gather information.
So in this lecture we'll build up on that.
The main scan that I want to show you right now is the quick scan class.
This scan takes the quick scan.
Why step further.
So first of all it'll be slower but it's going to show us even more information.
So first we're going to be able to see the Operating System running on the Discover devices.
We will also be able to see the device type whether it's a phone or a laptop or a router.
And we'll be able to discover the program and the program version running on the Discover reports.
So before for example we were able to discover a port 80 is open but we didn't know what program is
running on this port or what version of this program.
Getting the exact program version is really helpful when we get to the gaining access section and you'll
see then how we can use that to exploit vulnerable services and gain full control over the computers
that have these services installed.
Now straight away when you look at the results you'll see that we got much more information than all
of this comes around so far.
So the first thing you'll notice is the icons beside the IP is of the Discover devices these icons represent
the Operating System running on these devices.
So right now we have the operating system for all of the connected devices and now it's still not the
programs running on each of the discovery reports and the visions of these programs.
So for example if we look at the 190 were 6 8 12 the Apple device on the lasker and we knew that for
20 to open and we knew that SSA is running on it.
What we don't know what original SS who was running.
Right now we can see that it's running open.
SS Hage rogier six point one.
So we can go on Google and look for exploit and on vulnerabilities in this specific version and we might
actually find something we'll actually talk more about that in beginning access section.
Now if you look at the device type you can see that it's a media device.
It's a phone.
So before we knew this is an Apple device but we didn't know whether it's a tablet a phone or a Mac.
Right now we know that it is a phone.
It's also discovering that it's running uphill.
As for five or six.
Now it's actually running a version of voice.
I'm not entirely sure.
I think nine or 10 but still it's close enough.
It's getting me it's telling me that it's an apple is selling me that so far and it's running.
I'm all ears.
So this is really really good.
Now if we go to the next device here the one to us six eight one twenty.
This is a Linux Device.
And when we run the quick scan we were able to identify port 80 and it for 9 1 5 to open.
But again we didn't know the program running or the cerebus version running on this port.
So right now we know it's partly hishe TTP.
Two point two point twenty two it's running one two or so ago.
Now we have the operating system the exact version of the service running so we can go and look for
weaknesses and exploits in this specific version and this port.
We didn't even know what cerberus was running on it.
Right now we know it would say pmp Service and the server is media Tom beaupré MP we have that exact
version again.
So again we can go ahead and look for exploits in these specific provisions and if we discover any We'll
be able to gain full control on this computer again if we go down to the 1 9 2 1 6 8 1 to any to 2 million
we can see that it's running a Microsoft tissot gtp a pier for it's 5 3 5 7.
You can also browse by the services so from here on the left if you click on services you'll be able
to categorize the discovered clients based on the services.
So if you click on haish TTP we'll see all the clients that harbour city service running.
If you click on SSA we can see the Apple device here.
It's the ONDI device that has a cessation service running.
So let me actually show you a quick and find example.
If we go back here to the hosts and go back to the Apple device the 1 9 2 1 6 8 1 12 as we see it.
As I said we know it's a phone.
We know it's an Apple phone.
We know that it has an associate Service installed on it running on port 22.
And we know that SS here which is a service that allows you to remotely execute system commands on the
computer to that that has the SAS hate Service installed.
Now obviously before you can use the service you have to use a user name and a password.
Once you authenticate it'll allow you to execute system commands remotely on that computer or on that
phone.
Now by default you as devices do not have an SSA server.
Usually when you jailbreak the phone or the device it'll automatically install an SSA server and the
password for that server is to Alpine by default.
That's a l i n e.
Now since we know that this is an iPhone and it has portway to open with open SSA server we know that
this phone has been broken now since the phone has just broken.
We know the password to log in to SS Hage is Alpine unless the user changed it.
Now most users do not even know about this and even the ones that know about this like myself are too
lazy to change it so it's always worth a try if you discover a phone like this in the same network.
It's always worth a try to go and try to connect it with the default password.
So I'm just going to go to my terminal and I'm going to try to connect to this phone using a stage so
I'm going to type SS hitch route which is the user name for the admin clinics.
1 9 2 6 8 112.
This is the IP of the phone.
I'm going to hit enter.
It's asking me if I should trust this connection I'm going to say yes and now it is asking me for the
password.
And like I said when the phone is Joe broken the password is set to Alpine.
So I'm going to type a l p r n e.
I'm going to hit enter and as you can see I logged in as the root.
So right now I have the highest privileges on the phone and I can do whatever I want on the system.
And now we can use system command to completely controlled the phone.
Now this is a little bit ahead of time.
We are still in the a kayaking section.
So don't worry too much about this we'll talk more about it in the gaining access section.
But just a quick example that I want to show you of how powerful information gathering is because we
literally did not exploit anything right here.
We just relied on the information we gathered and we were able to hire an iPhone that is connected to
the same network as us.
Now like I said map is a huge tool.
I highly recommend you go ahead then try the other profiles in here and like I said was done with the
chorus.
I think the anmar book would be a really really good read.
Will also use up much more in the gain access section and we'll see how we can use this information
to gain full control over the computers using code execution vulnerabilities and so on.
Well in this lecture I just wanted to give you a quick overview and we'll build up on this as we go
through the chorus.