Port scanning and enumeration.
Welcome to the first video within the Linux Exploitations
section of this course.
So again, we're going to be performing a black box
penetration test on the Linux target,
as we did with the Windows target.
And the first step will, of course,
involve performing port scanning in order
to identify open ports on the target,
as well as the services that are running on those open ports.
And we can then start performing some basic enumeration
to learn as much information as we can about these services
and what they are used for in the case
or in the context of services that
might be slightly ambiguous in regards to the actual function.
So again, I just want to reiterate something
that, again, if you are going to be utilizing the same lab
environment for this entire section,
you have the ability to go through the pen
test in one sitting or in one go and then refer
to these videos as a reference.
Now, do note that, once you terminate the lab environment,
any data that's stored on that lab environment
will be wiped, so keep all your documented notes offline
or within a note a note-taking application or note-keeping
application.
And of course, after every termination
or after every restart, the target IP address
within the lab environment will change.
So do take that into consideration.
All right.
So again, all you need to do to get started
is just fire up the lab environment.
And I'm also going to switch into the lab environment,
and we can take a look at how to identify open ports
as well as the services running on these open ports
on the target system.
All right, so I'm back within the lab environment.
And the first step will, of course,
involve identifying the target IP address, which can easily
be done by taking a look or catting out
the contents of your hosts file, which contains DNS entries
or DNS records.
And the target IP should be assigned
to the following address-- so demo.ine.local,
and this is your target IP right over here.
Now, again, as I said, every time you
restart your lab environment, this is going to change.
So always check for the latest IP.
You can also ping demo.ine.local.
However, I also have to mention that this actual address here
might change to something like ap.ine.local or lab.ine.local.
So just keep that in mind.
Always consult with the host file,
and you should be able to obtain the target IP that way.
All right, so let's get started with port scanning.
Now, again, you have the ability to output
your actual scan results into the Metasploit framework.
But in this case, I'm just going to be performing an Nmap scan.
And my objective here is to identify the open ports.
So we can perform a service version detection scan
on the target system, and we can scan
the port range of 1 to 10,000.
So this is TCP, of course, so 1 to 10,000.
And you can also increase that to the entire TCP range,
which is about 65,535 ports.
And I can paste in the target IP there.
I can also output it into a readable format
by saying, oN or -oN and then specifying the file name.
So I can say you know nmap_10k.txt,
and that'll save it within that file,
which I also recommend that you do for later access.
So I'll hit Enter, and I'll give this scan
a couple of seconds to a couple of minutes to complete.
And let's see what services are running on the target system.
All right, so the Nmap scan is complete.
And let's take a look at the results.
So right over here, we have all the services
that are running on the target.
There are quite a few.
So starting off on port 21, we, of course, have FTP,
and the version is vsftpd 2.3.4.
Interesting.
I think we actually covered this or identified a vulnerability
within vsftpd 2.3.4 in one of the earlier videos
that could be a possible entry point.
We then have SSH and OpenSSH 8.2p1,
which is currently not vulnerable to any particular
exploit.
So the only alternative is to perform a brute force.
And the great thing here is that it provides us
with the distribution name.
So we can tell that the target is running
Ubuntu, although we are not really sure
about the version of Ubuntu.
And interestingly enough, we actually
have Telnet running on the target.
That's always something nice to see once in a while.
So for those of you who are not familiar, Telnet--
it was essentially the old the first version of SSH.
And, of course, it had a lot of issues
with security, one of which was a lack of encryption
of the data that's being transferred
between the client and the server.
And open SSH it was developed as a more secure alternative.
So that's good to see that we have Telnet.
It's always an interesting service
to test or play around with.
We then have SMTP running on port 25.
And the version is Postfix.
It looks like we also have another open SSH server that's
running on port 51.
Interesting.
And in addition to that, we have a web server right over here,
running on port 80.
And it's saying it's Apache httpd 2.2.8 (Ubuntu) and DAV.
I have covered DAV--
or WebDAV-- in the system in Host-Based Attacks course.
So could we actually launch an attack there?
We have RPC.
We have SMB, which, in the case of Linux, is Samba.
So Samba is the open source Linux implementation
of SMB for Linux.
And again, it works exactly the same.
We also have a few ambiguous ports here.
So 512-- you can see that, whenever Nmap provides you
with the service and then a question
mark at the end, that means that it's
not really sure what this service is
and what it's used for.
So we would probably need to manually check
these ports with Netcat to see what banner they actually
bring up.
So we have 512, 513, 514.
And then, on 1099, we have a GNU Classpath grmiregistry.
On port 1524, we have a service called ingreslock?,
although that's something that we'll need to test.
We have a MySQL database server running on port 3306,
and the version is 5.0.51a.
And we get the operating system or the distribution release
name there.
On port 3632, we have a service that's quite difficult
to tell what it is.
So distccd.
We have a PostgresSQL database service or server
running on port 5432.
And we have an irc server running on port 6667 and 6697.
That is UnrealIRCd, or the UnrealIRCd daemon,
and Apache Jserv on port 8009.
And on port 8180, it looks like we have Apache Tomcat.
And 8787, we have Ruby DRb RMI.
OK, so these are very interesting services.
And, of course, I'll be taking you
through how to exploit some of the low-hanging fruit
in terms of vulnerable services.
And there are quite a few--
or fairly less than the Windows system.
But again, these ones are much more interesting
and are different, and that's why
I wanted to highlight both Windows and Linux.
So let's try and identify or learn
more about these weird services here, like 512, 513.
So again, whenever you don't get a service or the actual banner
from a service with Nmap--
again, this is where manual banner grabbing
would come into play.
So we can say Netcat and nv, specify the target IP
and the port that we would like to learn more about, so 512.
We hit Enter, and we don't get any banner.
And if we type in a system command,
it doesn't look like anything much here.
So again, that could be a dead end.
So let's keep our eye on that.
We then have port 5134, which says login.
We hit Enter.
Can we log in?
It looks like it's saying, Connection reset by peer.
So can I enter something like, test, for example?
Reset by peer.
Interesting.
Very, very interesting.
We then have port 514.
So I'll hit Enter and again, we're connected. ls--
you can see broken pipe.
OK, OK.
Very interesting stuff.
And let's take a look at the last one, which--
it looks very interesting.
That's on port 1524.
So I'll say Netcat nv.
And we're looking for port 1524, or we
want to connect to that port.
I'll hit Enter.
And what do we have here?
And this is one of the really cool things
that I wanted to share with you.
So what has just happened here?
I've connected to a specific port on the target system
with Netcat, and I've received a root shell
on the target system.
Well, what this is a bind shell listener.
And if you remember, if you go back to the Bind and Reverse
Shells section of this course, I mentioned how bind shells work.
You need to have the listener on the target system,
and then the attacker connects to the target system
or to the listener on the target system with Netcat,
and that's exactly what we did.
So port 1524 is a bind shell listener,
and it's provided us with root access on the target system.
So again, this is why you should always perform manual banner
grabbing, and I just set this up to demonstrate
what a bind shell listener would look like if you set it up
on a Linux system or even on a Windows system, and the fact
that you really can't tell what it is.
So again, if we list out the contents of this directory,
you can see we're on the target system.
If I get the distribution information--
so I can say cat /etc, and we can say *release.
You can see it's running Ubuntu, and it looks
like it's running Ubuntu 8.4.
Interesting.
Very, very interesting.
OK.
So if we take a look at maybe a few directories on the Home,
let's see what we have in there.
It looks like we have a few directories.
We have FTP, msf admin service, user, et cetera.
All right, so this was just a simple demonstration or example
to show you how bind shell listeners work
and how you can connect to them.
And, as I said, if you followed along with those sections
closely and you also, again, took into consideration banner
grabbing, then this would have been a very easy initial win.
However, for the purpose of this video and the next videos,
I am not going to be using the bind shell listener for access.
We're going to be finding more legitimate ways because you'll
hardly find a bind shell listener running
on an enterprise system or a system that
has been set up by a company.
So that was a really, really cool example
that I wanted to highlight there.
OK, so we've been able to identify
most of the important services, like the web server,
and we can learn more about it.
Let's actually open this up in the browser.
And it looks like we have WebDAV configured.
So if we click on that there, this
is the target system's hostname.
And we have a few web applications.
Now, these two web applications are intentionally vulnerable
web applications that have been set
to highlight or to demonstrate web application pen tests.
So again, I wouldn't recommend targeting any of them.
But we have a web app called TWiki.
We also have a phpMyAdmin, which is very, very interesting.
We have already targeted that in the Windows Exploitation
section.
And we have WebDAV.
OK, so if you've actually gone through the system
and Host-Based Attacks course, you
should be familiar with what WebDAV is
and how it can be exploited.
So we have a very good mix of services here, some of which
we can actually explore.
And again, I'll not tell you what
the next video is going to be.
And again, the reason for that is I
want you to actually go through this yourself
and try and gain access via another vector,
apart from the actual bind shell listener
that we actually use to gain access.
So that is going to conclude the practical demonstration
side of this video.
Now, as I said, you can also output your Nmap scan results
and import them into the Metasploit framework.
But in my case, I'm not going to be doing this.
I'm going to be targeting each of these services individually.
And yeah, so that's going to conclude
the practical demonstration side of this video.
All right, so that concludes the port scanning and enumeration
section of video within this section.
In the next video, we're going to be taking a look at how
to target the next service or our first service
on the target system.
So I'll see you there.