Instructor: Right, so the first step
into the server-side attacks
is information gathering.
Information gathering is very important
because it will show us the operating system of the target,
the installed programs
or the running services on the target,
the ports associated with these services.
Now, from these installed services,
we can try and get into the system.
We can do this by trying the default passwords
and we've seen this before
in the network penetration testing part
where the iPad had a SSH service installed,
which basically give you full access to the computer
if the person still uses the default password,
which was alpine.
So we can do this with any other service.
And we'll see another example here today.
Another thing that we can do
is there is a lot of people that install services
and misconfigure them.
So we'll have another example of this.
A lot of these services are designed
to give access to that computer
but they obviously need
to have some security implementations.
People often misconfigure these services
so we can take advantage of these misconfigurations
and gain access to these computers.
Another problem with these services.
Some of them might even have back doors
and we'll see an example of that.
And a lot of them would have vulnerabilities,
such as remote buffer overflows
or code execution vulnerabilities
that allow us to again gain full access to that computer.
Now, the simplest way on doing this
is something that we've seen before,
which is using Zenmap.
So we use Zenmap using the IP.
We get a list of all of these services
and then google maybe each one of them
and see if they contain any vulnerabilities.
Now, we've seen how we use Zenmap before
but I just wanna convey the idea
of anything is a computer
and we've seen before how the Metasploitable device,
this device is actually a website.
It has a web server running.
So websites are nothing different than this.
If you want to get an IP of a website,
all you have to do is just do a ping,
so for example, if we're targeting Facebook,
so all we have to do is ping facebook.com
and we'll get their IP right here.
So we have Facebook's IP and we'll be able
to run Zenmap against it
and get a list of all the ranked services on Facebook.
Now, obviously I'm not gonna do that
because I'm not allowed to do that.
What I'm going to do
is I'm gonna run Zenmap against this Metasploitable device,
which basically is a computer device
and that's what we're interested in to testing.
So again, I can't really stress this anymore.
Anything is a computer,
whether it's a website, a server,
any online service, a phone, anything is a computer.
So you can go about penetration, anything the same way.
So I'm gonna run Zenmap,
just the same way that we did before.
So I'm gonna go on my activities.
I'm just gonna look for Zenmap.
And here is Zenmap.
And I'm gonna put the IP
of my target of the Metasploitable device,
which was 10.14.04.
So remember, in the network penetration testing part,
we used to put the base IP
and put it over 24 to cover all the IPs around us
on the network.
In this case, you might be testing a remote IP.
So for example, on the Facebook case,
all you have to do is just put the Facebook IP in there
and test it.
Now, that's granted that you have permission to do that.
Now, I don't have permission,
so I'm not gonna do that.
What I have permission to do
is test my own device,
which is installed on the same network as me.
So that's why I'm putting that IP.
But you can literally put any IP you want in there
and test it.
So I'm gonna hit on Scan.
And this will give me a list
of all the installed applications.
Okay, so the scan's finished now.
And we have a lot of open ports,
a lot of services.
What I advise you to do in this case now
if you wanna do a simple test
is you literally go on ports,
port by port, read what it is
and google the name of the program.
So for example, we have port 21 here.
That's an FTP port.
FTP is a service that's installed
to allow people to upload or download files
from the remote server.
So we can see, usually FTP services use a username
and a password
but you can see that this service
has been misconfigured
and it allows anonymous FTP login.
So unlike the SSH that we used before
in the network penetration testing,
we used the default password.
With this, you'll be able to log in without a password.
So all we have to do is download an FTP client,
such as FileZilla
and you'll be able to connect using this IP address
on port 21.
Now, I'm not gonna explain this
'cause it's very simple.
You literally download the application and connect to it.
What else you can do is you can google this.
This is an FTP server.
You can literally google this
and see if it has any issues,
if it has any misconfigurations,
if it has any known code execution exploits.
So I know if you google this now,
this particular application
has a backdoor installed with it.
For now, I'd like to show you something simpler,
just so that we make this shorter.
So what I'm going to do now
is I'm gonna have a look on the 512.
So let's assume we went on them one by one.
We couldn't find anything
and we reached the 512/tcp port.
So I'm gonna copy this.
This is the service that's running on this port.
So literally, I don't know what's this,
so I'm gonna copy it.
Go on Google and google it.
Okay, so we're gonna have a look
on the first result that we got here.
And we can see that this is a remote execution program.
So that's very nice, that's very cool.
So if we manage to log in with this,
we'll be able to execute commands
on the target computer
and it uses the rsh rlogin.
That's a program that ships with Linux
that allows you, similar to SSH in a way,
that lets you execute remote commands
on the target computer.
So let's go back and see how we can connect to this.
So this is all cool.
So let's see the package,
what comes in with this package.
And you can see this is Ubuntu.
So the target computer system
was running on Ubuntu.
If we go, so it's running on Ubuntu here.
And you can see that in here,
it uses the rsh-client service to connect.
So this is the package that you need to install
to connect to the service.
And as you can see, it says client program
for remote shell connection.
So let's go back and let's install rsh-client.
So we usually, as we did before,
when we need to install something,
we do apt-get
and we do install and we'll write the name
of the program that we want to install.
So it's rsh.
Now, apt-get is gonna install it for me
and configure it.
And once it's installed,
we're gonna use rlogin to log in
because remember, the first page told us
that it uses the rlogin program
to facilitate login process.
So I'm gonna do rlogin
and again, I don't know how to use this app,
so I'm gonna do the help to see how to use it.
And we can see that the format is rlogin.
You put the options that you want.
So what's important here is the username
and the host, which is the target IP.
So this is what we're gonna do.
We're gonna do rlogin.
We're gonna put the username as root.
Again, we said root is the user
with the most privileges on the system.
And we'll put the target IP, which is 10.20.
Now, as you can see now,
we are logged in to the Metasploitable machine here.
And if I do id to get my ID,
you can see that I am root.
If I get where I am, pwd,
I'm in the root directory.
I can list stuff.
If I do a uname -a,
that'll list the host name and the kernel
that's running on the machine
and as you can see
that I am in the Metasploitable machine
with root access.
So this was a manual way, a basic way
of gaining access to the target computer only
by a misconfiguration of an installed service.
So the rlogin service was not configured properly.
All we had to do is just google what came
with that port and we managed to find
or we managed to log in and gain full access
to the target computer.
Now again, the key point here
is you do a Zenmap scan
and then you go on each port that you find,
you google that port
and you'd be looking for misconfigurations,
default passwords, if this target service came in
with a backdoor or a code execution.
Maybe it just wasn't programmed properly
or it had a flaw that can be used to gain access
to that computer.
Now, we'll have examples of these things
in future videos as well.