Frequently exploited Linux services.
So now that we've taken a look at how
to exploit multiple inherent vulnerabilities on Windows,
ranging from gaining initial access to a target system
to privilege escalation, fault system vulnerabilities,
and of course, the process of dumping NTLM
hashes from memory, we can now turn our attention
to the Linux operating system.
And to get started, let's get an idea
of the frequently, or some of the most
frequently, exploited Linux services.
But before we do that, we actually
need to get an understanding of what the Linux operating
system is, how it was started, why it was developed,
and of course, where it is typically deployed.
And this will all really set up the stage,
or will actually contextualize, or give you
an idea of what types of services
are frequently exploited and the types of services
that you're likely to encounter when dealing with a system
or host running Linux.
All right, so what is Linux?
Well, Linux is a free and open source operating
system that is comprised of the Linux kernel, which
was developed by Linus Torvalds, and the new toolkit,
which is a collection of software and utilities
that was started and developed by Richard Stallman.
This combination of open source software
is what makes up the Linux operating system as a whole,
and it is commonly referred to as GNU/Linux.
All right, so whenever you hear someone
saying I installed Linux on my laptop,
or installed Linux on my server, what they really mean
is that they installed GNU plus Linux or GNU/Linux, right?
And the reason for that is because the Linux
kernel or Linux originally is just a kernel.
And a kernel as we know, is the core of an operating system,
and alone it really can't do much for end users.
And when it was developed, or during that time,
about the same time in parallel, Richard Stallman
was actually working on a toolkit--
a GNU toolkit, a collection of open source tools
and programs-- and actually found
that he could pair this toolkit with the Linux kernel
to form a complete operating system, which we now
know as GNU/Linux.
And to give you an example of some of the GNU tools
and programs-- and they really are important
and you must have used them by now.
An example of these utilities are the cat command,
the LS command, the CD command, the make directory command.
All of these tools are part of the GNU toolkit.
And what that means is that without the GNU toolkit,
Linux would really not be what it is today, and vice versa,
right?
The GNU toolkit would not be what it is today
without the Linux kernel.
So it's very important that we appreciate
both aspects of what make up the Linux operating
system as a whole today.
All right, now, in terms of where Linux is typically used,
we need to get an idea of distributions.
And if you've ever worked in the IT industry before,
or if you've ever worked with a computer before,
you must have heard of the term Linux
distribution or Linux distros.
Linux distributions are essentially just variants
of the same operating system.
The only thing different between them
is the fact that they may use different desktop environments.
And that's one of the great things
about using Linux is you have the ability
to customize your operating system based on what you need,
right?
And many of these distributions have different development
ideologies and philosophies.
And they're really developed either for a general use case
or for a specific use case.
So, for example, Kali Linux is a Linux distribution
that was developed for penetration testers
and security researchers.
So that means it will typically have the tools installed,
or package that you typically require
to perform a penetration test.
Then you have general purpose distributions,
like Ubuntu, which again was developed for anyone to install
on their computer or laptop, or even on their server,
and they can then install the additional tools
that they require on top of it.
And of course, we have many other distributions
like Debian, Arch Linux, Manjaro, Linux Mint, MX Linux,
et cetera, et cetera, right?
Now, Linux has various use cases.
I think that's a fairly simple to understand.
At this point you can install it on a laptop or computer.
But really, the area where it has succeeded the most
is in the server space.
So it is typically deployed as a server operating system.
For this reason, there are specific services and protocols
that will typically be found running on a Linux server.
Now, these services will provide an attacker
with an access vector that they can utilize to gain access
to a target host.
Having a good understanding of what these services are,
how they work, and their potential vulnerabilities,
is a vitally important skill to have as a penetration tester.
So whenever you run across a Linux server or a server
running Linux, you'll typically find
a few services across your entire experience with them.
And let's actually explore some of these services.
So, depending on what the Linux server has been configured
to run or host, you'll typically find that it has a web server,
and typically it will be Apache.
So what is Apache?
Apache is a free and open source cross-platform web
server, released under the Apache license 2.0.
Apache accounts for over 80% of web servers globally.
So really, most web servers out there
are running Apache or a variant of Apache.
And like with any other web server technology,
like Microsoft IX and NGINX, it will run on Port 80,
and in the case of an SSL certificate,
it will run on Port 443.
You then have the most important service, which is Secure Shell.
This is something that you will typically, or rather always,
find on a Linux server, because it is really the only way
to remotely gain access to the Linux server, which
makes sense, especially if the server is
being hosted on a server farm and not physically on premises.
So, SSH stands for Secure Shell.
SSH is a cryptographic remote Access Protocol
that is used to remotely access and control systems
over an unsecured network, like the internet.
SSH was developed as a secure successor to Telnet.
So if you guys remember Telnet, Telnet
was essentially a remote access or remote control
protocol that run on Port 23.
SSH runs on Port 22.
And the upside to SSH over Telnet
is that it supports authentication-- both username
and password authentication as well
as key-based authentication.
And SSH as we know runs on Port 22 right now.
The other protocol that you might find,
and you really will find quite a lot,
is FTP which is the File Transfer Protocol.
This runs on Port 21.
That's TCP.
So, FTP stands for the File Transfer Protocol.
It is a protocol that utilizes TCP port 21
and is used to facilitate file sharing between a server
and client and vise versa.
So you'll typically see that an FTP, the FTP protocol
is paired with a web server.
And if you have ever bought a domain and hosted a website,
you know that you can transfer your website files
to the web server with FTP.
So FTP essentially allows you to essentially facilitate
file sharing between the server and a client and vise versa.
So you can upload files to a server
and you can download files from the server.
And FTP also supports authentication, username
and password authentication.
And of course, you might be understanding or guessing
what the attack vector is going to look like right now.
All right, you then have Samba.
Now, what is samba?
Because you can see that it runs on Port 445,
and if you remember, SMB runs on Port 445.
Samba is essentially the Linux implementation of SMB.
It is the open source Linux implementation of SMB,
and is essentially used to allow Windows systems to access
Linux shares and the devices connected to the Linux system.
So you'll typically find Samba configured
to run on maybe a desktop running Linux.
And that can be very rare, but it's very important
that you understand how to exploit
Samba or the various types of exploits
you can run against Samba.
All right, so now that we've explored or got
an understanding of some of the frequently exploited Linux
services, let's get started with our first vulnerability
that we're going to be exploring.
And that ties into the Apache web server.
We are going to be exploring how to exploit the shell shock
vulnerability in the next video.
So I'll see you there.