So today we're gonna go ahead and start with legacy and legacy is going to be a Windows machine.
The reason we're starting with legacy is Windows is a very familiar operating system.
The difficulty rating is very very easy as you can see and I think it will be a nice introductory video
on what to do.
So I have connected to the network.
I'm going to open up a new tab and I'm going to start with my scanning process here and in order to
scan this machine this machine is going to live at 10 dot 10 that turned up for I'm going to type in
the command here
and I'm going to hit enter now.
This should give you time to type it in and follow along.
While this is going on let's talk through some things first things first we are running a cool a tool
called n map this cool tool is network mapping.
So it stands for network mapper what we're doing here is we are looking for open ports now and that
can run on the TPP side and the UDP side.
Right now we are working on the T S.P. side.
So what we are doing is the syntax here is we are scanning for all here this capital means all we're
searching for everything we're searching at a dash T which is a speed of four.
The speed runs 1 through 5 and we're looking through all ports one through sixty five thousand five
hundred and thirty five.
Don't quote me on that I'm not sure but I think that sounds right.
And then lastly we're scanning against this IP address.
Now that may be a little confusing and I may have gone through that quick.
So let's go ahead and just do a math dash dash help and we can talk through this a little further.
So if you're ever confused with anything and you need to know what syntax is if you come into a dash
help of a program or you can use the man command in Linux you're going to get something similar to this
a printout of all the commands and what they do.
So let's cover again what it is that we just did.
Now we did and map and map by default runs this dash as asked.
We didn't actually hit the type it so this stands for a stealth scan.
Now a stealth scan is a basic scan.
It was meant to be stealthy back in the day.
And it's really not.
We'll talk about this here in a second.
There's also the dash as you for UDP scan.
So really all you're going to be using is between these two you're going to want to look on the TCB
side and the UDP side and we'll talk about that as well so we need to specify what ports we're going
to scan if we just leave it out.
If we take out the dash P dash we're going to be scanning against the top 1000 ports.
Now we can specify specific ports like Port 22 here or they've got port 53 111.
This is UDP here.
So you can specify specifics you could specify a range.
But it's really just easier to scan all parts if you're scanning the top 1000 very quick.
Maybe that's OK.
But in all reality it's best to scan all ports because you don't know if a high number of ports going
to be out there.
That's not a common port that's running some weird service and you don't know what's going to pop up.
So on the TCT side very important in my opinion to be running dash P Dash.
Now when you're scanning UDP you don't really have to specify the ports.
If you were to scan all ports on the UDP side you're going to be scanning for ever.
So my opinion is to just leave out the ports on the UDP side scan the top one thousand and play around
with it get accustomed to how you like scanning.
But for me personally I don't miss much by not scanning outside the top 1000 and I don't have enough
time to wait for all sixty five thousand ports to report back on a UDP scan so coming through and doing
a little bit more we could skip down just a little bit.
You see a lot of stuff in here that we're skipping over S.V. we're doing service detection dash 0 for
OS detection operating system.
Now those are actually all covered if we scroll down under this dash a.
So we're doing OS detection version detection script scanning and trace route so we don't need to specify
all those switches.
We just need to specify a dash a.
And it works just fine.
You can see down here is somebody specified dash a as an example.
Perfect.
OK.
And then the last thing is this timing.
So we've got a TI 135 and it says the higher is faster that is accurate.
I personally like to scan it at T for.
You could also get away with scanning a T three.
I have noticed no performance issues or miss ports running at either of these.
Now t one might be very slow for you and T five might be fast but t five might miss some things and
to one might take forever if you're in a time crunch.
Now we've been scanning this already and we're at ninety nine percent.
We've been scanning for almost five minutes here and you can see that the average scan may take anywhere
I've had them take from seconds to over an hour before.
But this is my my my method here right.
This is the easiest simplest way to scan a machine.
You will see all kinds of and map syntax out there and maybe you find something in here and you start
playing around with things like Max retried or a rate limiting or something else that really you know
you find your niche.
My niche has always been keep it simple stupid.
And that's exactly what I'm going to do here.
I'm just going to keep it very very simple.
And for this machine I am scanning on TGP I am not scanning on UDP we will focus on that and a later
machine that actually needs the UDP scan.
But in a perfect world and in theory you should be scanning UDP as well.
The only difference here say we want to scan this in UDP is we would just paste this here and we would
add in front of this as you like we saw and that would scan for UDP instead of the stealth scan then
we talked about now we've got our scan back but before we do this this is a for dummies course.
So I want to talk through everything that I possibly can.
First things first we need to talk about the TCB handshake now the three way handshake if you're not
familiar from networking classes is something like this all this type it out real quick and then we
can demonstrate it.
So we've got a sin a sin ACH and then attack.
So when we want to connect to a port add a specific IP address we say hey I want to connect to you.
And this is a sin packet sent right now if we're able to connect to that port that port is open then
the server or IP address that we targeted responds back with sin ach.
And if we want to establish a connection to that port we respond back with ach.
Now we can demonstrate this.
We can come over to here and if we go in we just say something along the lines of Why are shark not
in capitals.
Just say why you're shark and we're going to capture on our ether net zero.
That's absolutely fine and you're gonna see a bunch of stuff starting to come through that's OK.
As well we are looking for a handshake and one quick way we can generate one is just by going out to
Google and hitting Enter and then going a pause this and sorry I smacked my microphone there.
So if you heard a smack that was me and then we can filter by C.P. dot port is equal to four four three
like this and we are just looking for any sort of handshake that came through here that looks like there
is a sin packet sent a sin accent and then we'd have an act packet back.
Normally they're a little closer together.
Let's see if we can find one.
There's a client.
Hello there.
So this is over.
This is over ITV 6.
That's interesting.
So you see that we went out to four for three.
We requested a sin that server responded back to us and said sin act.
You can't connect to my part on four four three.
And then we said OK we acknowledge that we do want to connect and the client said back to us.
Hello.
So this is done over IP six but you can see that there's other things going through as well for IP for.
Looks like most of the traffic coming through right now is IP 6 but yours should probably have IP before
and if you want to capture or similar to this you should be able to capture that three way handshake
why is this important Well let's take a look at this.
So when we are doing scanning we're doing something called stealth scanning.
And like I said earlier this scanning used to be stealthy.
Nowadays it's not stealthy.
If you scan with this you're gonna get picked up by any decent Sim any kind of detection it's gonna
pick you up scanning but you should know what you're doing right.
And this may come up in interviews.
How do you scan.
What's the process for a cell scan.
And only one thing changes.
This act here becomes what's called an iris T.
Now this artist T stands for a reset.
This whole process goes from hey I want to connect you to all right.
You can connect me to us saying no just kidding we actually don't really want to connect.
Well why is this important.
Well we're establishing here that we want to connect to a port in at the port is open.
Well we're going to get a response back that says hey Sinek we're open for business and we're going
to say just kidding because we don't actually want to make the connection to the port.
Now if we make a connection the port we're not really being stealthy.
Again the scanning is not really stealthy anymore.
But this was the logic behind it so let's go ahead and close out of this and let's take a look at our
scan and talk through it so our scan came back and we've got a few things here.
Now we've got our scan result and the scan results dash a gives us a lot of detail.
If we don't trigger with a dash a all we're going to see is the port.
And if it's open that's about it.
You're not going to see service information or version information that could be incredibly useful.
So we could see that two ports came back as open one port came back as closed.
So it triggered on this three three eight nine but it doesn't actually see it as open.
So what does that leave us with.
Well that leaves us with a port one thirty nine and a port for forty five.
And if you're not familiar these are SMB related.
So on windows these tie directly to SMB on Linux 139 would tie to samba which is basically the same
thing.
So these are file shares folders that are out there being shared by a user or accessible by users.
These are very very common when we're scanning internal networks and very common to see you know in
a Windows environment especially but most computers if you think about your work environment have some
sort of shared folder structure so and then it comes down here and it takes a best guess at the Windows
operating system.
Here you can actually see that the version pulled back as Windows XP.
OK.
And it's guessing that it's anywhere from XP to 2008.
That's a really broad guess.
But it's thinking it's windows and it's correct that it's windows.
This is not always correct.
Just a heads up.
But sometimes it gives you an inkling OK.
And then we come down here in this dash a also provide some script results.
Now we can get some things out of here we can see that there is a net bias name of legacy.
That is the computer name.
We also get a mac address.
You can see we're running on a VM where Mac.
That's fine.
And then we come in here and it says OK we're running on Windows XP.
This is a definite.
Now we know for sure that we're running on Windows XP and this is important because if we're fingerprinting
machines and we're looking for exploits these exploits sometimes our operating system dependent.
So knowing the operating system will help us later on a lot of the times again we see the computer name
and the net bios computer name we see the workgroup slash domain here and we can see the security mode
now.
This is going to come up in later videos if you are getting to the more advanced stage you're looking
for internal pen testing.
I do have a video out there on SMB relays and how to get shells.
If you ever see message signing disabled this is dangerous.
You might also see something along the lines of message signing enabled but not required.
That is equally as dangerous.
This is a finding on a pen test report and could allow an attacker to get a shell.
Now I'm just noting that out there so you keep that in the back of your mind not as important for this
lesson today but if you're ever curious there are videos out there and you could read up on this.
But it's a little bit more of advanced topic so down here we have traced out information.
This isn't really that important or attacking an internal lab OK so we have one port really two parts
one service.
OK.
We're going to be attacking SMB.
Now there are a couple of things that I really like to do when I'm looking at SMB.
The first one is I like to go to SMB client.
Now if you never use this that's OK.
It's a built in tool to Kelly linux.
You just start typing SMB client and you can hit TAB and it should autocomplete for you.
The next is a dash L that is to list out any of the files that are in there.
And then we're just going to type in the IP address similar to this.
And we said we were at DOT for I believe and hit enter.
So invalid parameter.
Let's try one other thing I like to do it would double or quadruple and then double on the backslash
is there.
Let's try.
Alan still getting invalid parameter.
We might not be able to access this with the the way it's listed right now.
We can try connecting and you can see there's just really no connection here.
We could try listed out all different kinds of ways.
And it's just not going to work.
Now in some cases if we had a a root password that was anonymous and we tried to log in it would say
hey you're in.
Here's a listing of all the files that are in the share.
That's bad in this case.
We're not getting a listing of all the files in the share we're getting this status invalid parameter.
And it as of right now is kind of a dead end and that's OK.
So if we were able to connect which you'll see in later videos we can use SMB client and say there was
like a common one is a dot admin folder here and we say admin and we want to connect to that.
We could try to connect and it would let us connect with password or no password then we're money right.
We we can enumerate the share we can pull down information but here we're just not getting any access
at all.
So and that's fine.
So what we're gonna do instead is we're going to enumerate this a little further.
Now a tool that is out there and you may have heard of is called a noon for Linux.
I don't like using this if you like using it that's fine.
In my case in most instances I've ever tried using it.
It has not work has been broken.
So what I like to do is actually run medicinally which is MSF console hit enter on that and it's going
to take a second to spin up especially if this is your first time spinning it up.
Now let's let this run here and then I'm going to search for SMP underscore version.
Now this didn't come up when we first did our map scan and that's OK that's kind of common but we can
copy this auxiliary scanner here and we can use this to try to detect it now let's talk about Metis
boy as well.
And I should note that my explanations I'm not going to repeat myself as we go further and further into
videos.
I'm going to assume that you have watched the previous video and that you kind of understand where we're
at as we go along.
But this video's probably gonna be really really detailed and broken down on some of these topics especially
if you've never seen it before.
So auxiliary modules now there's a few different modules you can see here there's exploits auxiliary
posed payloads etc. Meadows boy is a treasure trove of options.
Now what we're doing is auxiliary and we can think of auxiliary as pre exploit so auxiliary is our scanning
our enumeration our information gathering.
There are over a thousand different auxiliary modules in this instance we are using auxiliary module
to look for an SMB version.
It does not always work but it works a lot.
Now the SMB version is really really important if we can pull it down because historically SMB has been
incredibly vulnerable.
If you can think back to Most recently we have had the want to cry slash Eternal Blue slash whatever
you want to call it the M.S. 17 dash 0 1 0 exploit ramp SMB and in the past as you're going to see in
a minute.
There have been numerous SMB exploits.
So because of that it's very critical to try to detect not only the version but the operating system
you're running on because that is important as well.
Now we already have an operating system listed here.
So we're gonna go ahead and just try to find a version we're gonna say options and you can see here
what's required and what's not.
Only thing that's really required of us that is not set already here is this.
Our hosts.
So that stands for remote host.
All you can think about is that's what we're going to be attacking.
Now we can say set our host tend not to hand out turned up for now.
If this module can only take one host it will say our host.
If you notice this can actually take multiple hosts with an s.
You can enter in a side or notation and you could do something like slash twenty four if you're trying
to see every single machine in the network.
But in this instance we're only attacking one box setting one.
Our host is fine.
OK.
We can say options again just to make sure it really set for us.
And then we're going to type in a run or if you really want to feel cool you can type an exploit.
Either way at all where and we can see here.
OK.
Now we are running Windows XP Service Pack 3 and it really doesn't tell us anything else about the SMB
version.
That's a bummer.
So we don't know anything else but S&P version.
That's OK we can start with what we know so we'll copy this information then right and we're going to
go out to Firefox and just go back to Google if you went to there when you were doing our our handshake
and we'll just paste this in and then Google will learn you eventually but if you start typing an exploit
It'll start coming up.
Right.
So we can start looking for the different types of exploits that exist.
One that I like to look for there's two Web sites.
OK.
In my opinion there's two Web sites I look for out the bad.
One is exploit D.B. dot com.
We can open this one.
The other one is rapid 7.
So let's look at both and here.
This is a PSP three exploit.
It's possible.
Now one thing that we didn't do and I should have typed in is we didn't describe the service and that's
bad on my part.
Let's type an SMB Windows 3 and now because I looked at this and I said I'm not sure that that's actually
SMB.
Let's go ahead and close this one and the first one that comes up for us is actually going to be M.S.
0 8 0 6 7.
Now this possible that this is on exploit database but you can see one of the things that comes up on
your save tabs if you're on a newer version of Cally is your exploit dash DV exploit database.
This is where you're gonna find a lot of exploits that you can just download perhaps modify and run.
But here today we're not going to have to do that rapid 7 is the other Web site that I like a lot.
Why is that.
That's because rapid 7 actually makes this here are medicinally.
So because they make Meadows blight and because it's medicinal a module we come here we can see that
this is actually a medicinal module that means we can just run this in those fly and perhaps get a shell.
We don't have to mess with exploits of exploit D.B. we don't have to download anything it's already
built into a tool that we have.
OK so let's go ahead and just look at the directions here.
It's always best to read the instructions and see if this has to deal with what we're dealing with.
So it says that a target's Windows XP but two thousand three will often crash or hang.
So it's important to note that in case we're running on a pen test and we don't want to you know crash
a server it's always important to see you know if if there's any kind of denial of service here right
now this looks good.
We're gonna do is we're just going to copy this and we're going to paste it here
and then we can just say options again similarly we have these set our host.
Now I can just tab up to where I set the our host and is still that and now it says exploit target.
So it's always best practice to say show targets to see what kind of targets are available for us.
And holy crap.
There are 72 so we know we're running SPF 3 windows XP XP 3.
Probably the English version if we wanted to pick it out but we could just leave this alone.
It looks like there's automatic targeting and it will figure it out on its own.
If for some reason we are sure on this exploit and the automatic targeting is failing now we can come
down here pick out the target and go from there.
But let's go ahead and take a look.
By just running this and seeing what happens
and it's detecting the target it detected that it is XP XP 3 English perfect and then it ran it and
said maternity session one opened.
Great.
This means we have a shell we have access on the machine.
Now what we just did is called a reverse shell.
There are mainly two different types of shells that we could run.
One is a reverse shell and one is the other is a bind shell.
Now reverse shells what they do is we set up a listener.
We set up a port that we're listening on.
See this handler here.
So we're listening on port four four four four.
When we exploit the machine we tell it hey connect back to this IP address on these ports.
And that is a reverse shell.
When a victim connects back to us that is considered reverse shell.
When we connect to a victim.
So say we run an exploit and we open up a port and then we say hey let's connect to that port that is
considered a bind shell.
The majority of your time when you're doing lab testing is going to be running with reverse shells.
Even when you're doing internal testing now external testing if you're doing real pain tests sometimes
you're going to want to use a bind shell unless you want to setup port forwards on your router or wherever
you're testing in order to trigger back into your machine.
A lot of times is just way easier to do a buying shell.
But sometimes you have to get flexible and do both.
But the majority of time you're gonna be working with reverse shell.
So from here a couple of things we should do.
The first thing is we could say get you I.D. let's see what user level we're at.
Okay.
We are a authority system now authority system is the highest level if we are a system we have own this
machine completely and we just lost our session here.
Not sure why.
Let's go ahead and run it again see what happens and it's possible that we we lost this machine here.
So let's go ahead and just see
and there is a connection timeout.
So I've had this happen with hacked the box as well.
So what happens sometimes is hack the box just you know you lose the you lose your session and hack
the box it used to be that somebody could reset the box on you.
It looks like that.
You can actually still reset on people so I'm not sure if somebody just reset the box on me or what
happened but hopefully you don't have this experience but this is a good one to keep in the video just
in case you ever run into this.
So team you're trying to run it it might not work right this second.
That's fine.
Let's go ahead and talk about this anti authorities system.
So when we're system on a machine that means we have the highest highest privilege level we can do whatever
we want on that machine.
Right.
This is a local local level but we are full authority.
This is equivalent if you are a Linux user to being root on a Linux machine.
OK.
So we have the highest potential level that that we that we need here right.
So let's go ahead and try to run one more time.
If this fails I'm going to go ahead and refresh and try restarting my box on my end and
somebody has cancel termination of the machine.
Don't know what that is.
Guys I'm going to pause this video.
Get the shell back up and then figure that out.
Give me one second.
All right.
I am back and we have a new session.
So again we did it get you Idi and let's go ahead and look at one other thing here we're gonna get assists
info and what we're looking at facility info is we're looking at this here we want to make sure that
we have an architecture that matches the mature fritters shell so our x eighty six here on the architecture
matches the mature British shell on windows this is good this allows us to do a lot.
So one of the things that we can do and let's type and help with your brand new to meadows flight we
have a lot of things that we can do here that come through look at this list.
Now don't be intimidated by this list.
You will learn it as it goes in most of these you'll probably never use some of the interesting things
as we can navigate around the file system.
We can download files from the file system.
We can upload files to the file system and we can make directories.
We could do a lot of Linux commands that are typical if you're used to using Linux.
There are some great networking commands.
Now if we're doing post exploitation we get a shell in the machine and we are in a real network looking
at the ARP table or the ARB cache.
Really good looking at your IP address your eye.
I have config IP config really good looking at your routing table really good net stack.
Same thing.
So looking at where you're at from a networking perspective once you get a shell.
Very very good idea.
Some other things that we can look at we can see what processes are running.
This is very useful.
We can shut down the machine if we want to.
We can do some crazy stuff too like a key scan or a keystroke.
Dumping here we can capture the keystrokes and we can dump them.
Very scary.
We can do a screenshot of the desktop.
We can do a screenshot of the webcam.
We can record the microphone.
This can be incredibly malicious.
Right.
These are things that we should not be doing unless we have absolute permission to do them.
So Metis boy is just just show you.
It's a very powerful tool.
Now there's a couple of things in here that we can do.
If we did not have authority system we could try to just type and get system sometimes as crashes a
machine.
So if you have a shell on a machine in a network and you're doing a real pen death.
Be very careful with this.
Perhaps ask how sensitive the machine is.
And if you crash it as somebody available to turn it back on.
So no of this one and no this one hash them.
Now let's type in hashtag.
Now hashtag is dumping these Sam.
Now the Sam is what stores are local user passwords and we are dumping the hashes here.
So with these hashes we can take these off line and use a tool something like John the Ripper or hash
cat and we can try to crack these against the word list.
Now if you never cracked passwords before this is something maybe you should look into if you're at
this point.
Take these off line and go try to crack them.
I have no idea what's going to come up.
You can eliminate the guest the help assistant and probably the support.
I would try to crack the administrator password and this John user account and see if you can get either
of them as I said I haven't done this before.
So you could try and see if either of them are crackle against a worry list.
It's always good practice.
Now another thing you could do is copy the hash here the second part of the hash and you can use tools
like crack map Zack or PSA Zack.
There's a lot of tools out there where we can take this hash and try to do something called past the
hash.
Now it's not going to work in this network and that's OK.
This whole lesson and course is going to be about enumeration and exploitation.
It's not really going to be about all the advanced attacks we can do.
There are other courses out there the zero to hero talks about these topics as well.
So what we're really after is again enumeration exploitation.
I'm giving you some ideas of things that we look for once where once we're in a machine this hash here
we can pass that around.
See if it gets us in any other machines in the network.
Again it's not going to work here because we're only against this one machine in this one isolated network
and we could try again to crack it and we can see it that pass where the ATM and password logs is in
anywhere.
I have an impersonal experience never cracked an administrative password but gained access to every
single machine in a network because they were passing the hash around they were using the same hash
on every single machine.
So very critical to check this trying to pass it around see where you can access to.
Very very easy to do.
So from here we can also type in the word shell and you will notice that this gives us something similar
to a command prompt if you are following along and you're you're doing these machines and you want to
have some fun take credit.
One thing that we can do is we can see over to the users folder and looks like let's see you to see
this night.
This is an older machine it's going to be something different.
It's going to be documents and settings.
So we'll see these in the documents and settings and then we'll say they're here and then we can go
into John and we can say they're just show you but we could type going to see the desktop and then we're
gonna say there one more time and we'll type it and type.
User got.
Now you can take this.
I don't know if I've already done this for this machine.
You can copy this one income over a legacy and then you can just go into submit user flag and that'll
work just fine.
So it'll it'll submit your flag for you and then you can do the same thing with the root.
So you can just go you can go see the administrator slash desktop and then on the desktop you should
have the root text.
You can go ahead and type that and also capture that that flag there and submit it to hack the box.
You won't get any points for it but you can count it under underneath your own.
Well you know which ones you've done before and you haven't done before.
So with that being said other things that we're doing in the shell here we can be looking for you know
we could be looking for sensitive files and data things that are out there if you like to navigate around
a shell.
You can absolutely do the same thing from a medicine point slash maternal critter shell so we can hit
control C and go yes we want to cancel but we're still in the shell right.
We could save TWD.
We could seeded a seed of all that slash like this WD.
And there's a little bit of character escaping you saw I had to use two back slashes.
That's pretty pretty standard.
We can do a dir here and you're seeing pretty much the same stuff that we just were.
So you don't actually have to dive into a shell.
This is just showing you the flexibility of return fritter.