Now managing clinic services.
As you can see, Kerry Linux is a specialized Linux distribution aimed at security professionals, and
it contains several non-standard features.
Okay.
Now the first thing, let's start with the search service or the secure shell.
Now, it is most commonly used to remote access computer using a secure, encrypted protocol.
Now, in that case, we will use command called system CTL.
Now, as we learned previously, many systems still, as you can see, control the system, the system
and service manager.
Okay.
So this is to control the system D.
Now you can read more about it.
The system D is something, kim, for process management and all of that stuff.
No worry.
This is not our subject currently.
Now system CTL, by the way, I can tap again.
System CTL then start.
Or stop.
Or restart.
As you can see, the status or status.
So let's start with the status as such.
Now you can see that it shows us that here, here you can see it is inactive.
Now to show more information, i must provide the sudo.
Now instead of typing the same command or the arrow button.
No I can do sudo shift one shift one or the exclamation mark.
So this will show this will provide the previous command which is system set as such and before it it
is sudo so sudo system city l status as such.
So if I press enter I can see that.
Yeah.
It shows this is the command now press again enter.
And of course it will need the password because this is a sudo command and yeah it showed us now and
now it show us it is inactive.
Now if I type the same command system still not without sudo.
I mean let's start that search.
You can see that if I press that it will ask us for authentication or the password for this to be done.
So in that case, which is using the pseudo so pseudo system, it'll start as a search.
Here you can see that.
Yeah.
Now it is worked.
How to check that system's status as a search.
Yeah, you can see that.
Here it is.
It is active.
And seven second ago.
Now you can see by default here we have the vendor presence and we have the disabled thing here.
Okay.
Now, this means that the vendor, which means that by default, when it comes or when it is downloaded,
by default, it will be disabled.
Now, what does disabled mean?
It means that it will not work or it will not run on the startup on the boot.
Okay.
So when I if I start this Linux machine, this asset will not work by default.
Okay, now here disabled.
This is the first disabled.
Okay.
This is the vendor Brexit here, the disabled, which means they are not the default behavior.
The actual behavior, which is will it run on boot up or it will not.
This is what is so by default.
It is disabled and it is disabled.
So I must enable it.
So when I start clinics, the research will run on.
So enable like that and press enter.
You can see that here.
It is enabled.
It will start creating some links and windows.
It is the shortcut, which means shortcut.
Don't worry.
We will talk about the symbolic links and hard links, soft links, all of that stuff.
Now, if I type status this time, you can see that this time it is enabled.
By the way, the vendor said this is this is still disabled and this cannot be changed, by the way,
because this is how it comes from the factory.
Just like that.
Okay.
So the the guys who created this as search tool by default, they say make it disabled for more security
and stuff like that.
All right.
But we enable it because we want it to be run over and over anyway.
Now, again, this is not for a blue team.
This is for red team.
So to be honest, we don't care.
Yeah.
Because this is not the system we are protecting or hardening.
This is our system to have attack on the systems.
Okay, so this guy Linux to attack systems?
Of course not in a malicious way.
I mean, in team tactics, but we need to understand how the bad guys think and work.
Now how to make sure the asset is enabled.
Now you know that the asset by default is using the port 22, the default board.
So I have net stat dash anti lp oc this is to show us.
NN Which means number three, which means.
TCB because this is a TCB protocol.
Now again, if you are not familiar with TCB, UDP, the OCI model, the board's number, I, I recommend
you to read more about it.
Okay.
Well, it is not a big deal.
Just have a just high level understanding.
Will do the job now, which means that the status of this is listening and PE.
So to protocol or program show the program so or PID ID so you can see that here we have it here.
So here it is.
It is 22 and it is listening on 0 to 0 200, which means anywhere.
And the foreign address is the same.
The status is or the state is listening and there is no idea what it did.
Now there is another command called SS, again, Dash and LP, and here it will show us that here 22
is running and it is running on anywhere.
002020.
Now this is for the service.
Now, let's talk about TB service.
Now, by default clearly comes with Apache or Apache two.
So I will use the same command sudo system ctl status.
Apache and Apache is two.
So you can see.
Yeah, it is inactive.
Now how to do such a thing, how to enable it and to start it as we learned previously.
First we need to start like this, then enable like this.
Now there is a shortcut for this actually which is sudo systems edl enabled.
Yeah, as we learned.
But what is the flag?
Dash.
Dash now.
Which means it will enable it on startup and the same time it will start it.
So you can see that.
Yeah, it has been enabled and it will show it should be started.
How to check that?
Yes, you are correct.
We will use the status command.
So here it is.
It is active and running this time.
Yeah.
Now, by the way, if you didn't provide the pseudo, it will not show all the information.
So you can see that here.
I already provided the pseudo so it show us all everything here as you can see.
Now, if I provided that without.
I provided the command without pseudo.
You can see that it will show less information as you can see.
So up here it show us this group c group thing and it shows us this as you can see.
That much HDTV, whatever.
But here it.
Show us the group without putting more information or some considerate, critical information.
Yeah.
Actually, sometimes it is a critical OC.
Now how to see what what it is running on by default it is the 80.
So again it's run as the anti LP and you can see that here it is running on board 80.
So this is what we need and what we want.
All right.
Okay.
So far, so good.
Thanks for watching.
Now I will provide more exercises on this, kindly to solve them.
And if you have any question, let me know.