Enumerating network information on Linux.
In this video, we will be exploring
the process of how to enumerate various bits
or segments of network information
that are really important to, essentially,
obtain or gather during post exploitation, right?
And we're going to be focusing on how
to do this on a Linux system that we will be compromising.
So again, you should have a good idea as to why
this information is important.
And in regards to what information we're looking for,
specific to Linux, we are, of course,
going to need to identify the current IP
address, which we pretty much would have already obtained.
But we all also want to obtain additional information
regarding the network adapter or the network interface
card, and the gateway address, as well
as additional information like the actual hosts file
and the various hosts contained within the hosts
file, the default DNS server being used,
as well as internal networks if this system is connected
or if the target system is connected
to any internal networks.
We also want to get an idea of the various TCP and UDP
services that are running on the target system
and their respective ports.
And of course, try and identify other hosts
on the network that we can then pivot onto.
So again, network information is really
important during the pivoting phase of the post exploitation
phase.
So again, this is all of the information
that we're going to be looking for in regards
or in the context of a Linux target system.
So we are going to be utilizing the same lab
environment that we used in the previous video.
So we're going to start off by gaining access
to the target system.
We've already identified the vulnerable service
that we'll be exploiting.
After which, we can begin performing or enumerating
network information.
With that being said, I'll be seeing you
in the actual lab environment.
All right, so I'm back within the lab environment.
And of course, the first step is to identify the target IP
address because it will change whenever you restart the lab.
So we can type in ifconfig, and we can take a look
at the interface ethernet1.
This is our Kali Linux IP.
In your case, this is going to be different.
The only thing you need to do is just
copy the value here and change the 2 to a 3,
and that's the target IP address.
So we already know that the target
is running a vulnerable version of vsftpd
that we can exploit using a Metasploit framework exploit
module.
So I'll start off MSF console, and that'll
take a couple of seconds.
After which, we can set up the global variable
for the RHOSTS value or option.
So we can say, setg RHOSTS, hosts and paste in the target
IP.
Make sure to change the 2 to a 3, and we can hit Enter.
This is going to ensure that RHOSTS value is set globally,
so that whenever we load any module, really,
the RHOSTS value will already be set for us.
So we can search for the vsftpd exploit module.
There it is.
So I can then copy the actual name of the exploit
module and say, use, and I can then paste it in there.
And if I show the options, you can
see that target IP is already specified.
I can then type in exploit, and we'll
give this a couple of seconds.
There we are.
We should obtain a command shell session,
which we can then upgrade to a Meterpreter session.
So I'll use the control and Z keys
on my keyboard to put this into the background.
So I'll say yes.
And if I'll start my sessions, we
want to upgrade session 1, which is our command shell session,
into a Meterpreter session.
So we can say, sessions -u1.
Hit Enter.
That is going to give us a Meterpreter session
or upgrade our command shell session into a Meterpreter
session.
There we are.
And if we list out our sessions now,
we can now utilize session 2, which
is our Meterpreter session.
So I'll say sessions 2, and there we are.
So let's take a look at how we can perform network information
enumeration with my interpreter first.
So again, like we did on Windows,
you can obtain the current IP address and the actual network
interface details by typing in ifconfig.
And you can see right over here that we
have various interfaces.
So we have the first interface, which
is your loopback interface.
This is standard on Linux.
That is your local host or your loopback adapter.
That is essentially configured for your local services
or essentially configured to your local host IP
address, which is 127.0.0.1.
We then have interface 2, which is highlighted here.
Interface 2, in this case, appears
to be a virtual interface, which, in this case,
is not really important.
But then, we have Interface 6180, which
has the name of ethernet 0.
Remember, this is on the target system.
This is not on the Kali Linux system.
It provides us with the MAC address right over here
of this particular interface.
It then provides us with the IPv4 address.
So this is the target IP address as we already know.
We can also obtain or get a list of the currently running
TCP and UDP services by typing in the netstat command.
So we hit Enter, and you can see this will
display the connection list.
So this is sorted based on protocol-- the Local Address,
the Remote Address, the State, the User, the Inode,
and the PID, which is the process ID or the program name.
So firstly, you have your TCP connections.
And then, at the bottom, you have your UDP connection.
So you can see that port 21 is listening on the local address
on--
this is the actual vsftpd service
that is running on port 21.
You can see the state is set to listen,
and the remote address is 0.
You then have a port 6200, which is interesting.
That gives us an idea as to what other services might
be running on specific ports.
You then have the following.
It looks like we have-- this is listing on the local host
with--
not really the local host because it
is 127.0.0.11 on port 38275, but it's currently--
the state is said to listen.
What we're interested in is the established,
in this case, because we are trying to identify
our Meterpreter session.
So given the fact that our Meterpreter session utilized
or set up the actual L port value was set 4433.
This is our Meterpreter session.
You can see this is the Kali Linux IP address,
and we are connecting-- or rather, the target system is
connecting to our listener on port 4433,
and it is set to establish.
So again, this gives you an idea of what TCP and UDP
services are currently listening or running on the target
system, as well as providing you with an idea
of various connections.
And it sorts them based on their state, so you can go through it
and identify state or services that are currently listening
or services that currently have a connection established,
et cetera, et cetera.
You can also display the routing table with Meterpreter
by simply typing in route.
And in this case, it'll display the routing table.
So the key information that we're interested in here
is the gateway, right?
So it looks like the gateway on this target network
is the following address here.
So it's going to be the first IP address within this network.
And yeah, that's very important information.
Because in some networks, this may be the router
or it could also be the DNS server and the DHCP server
all in one, right?
So that's very, very important.
It also tells us that no IPv6 routes were found.
Now, that we've taken a look at how to essentially enumerate
network information with Meterpreter,
we can open up a command shell session.
And I'll open up a bash session here.
So /bin/bash -i.
There we go.
Fantastic.
And we can run the ifconfig command,
which is a Linux command.
And that'll essentially-- in some cases,
it'll tell you that the command is not found.
That just comes down to the distribution
that you have just gained access to.
A quick way around this is to use the IP command.
So I can say ip a and s, and this
will display all the interfaces or the actual adaptors.
So as we were able to obtain it with Meterpreter,
you can see that we have interface 1, 2, and then,
of course, the third interface, which is ethernet 0.
And this, of course, contains the inet or the IP address
of the target system as well as additional information
like the MAC address right over here.
All right, so you can utilize ifconfig
or the ip a s command, right?
And that'll give you an idea as to all the interfaces
that are essentially connected to the target system,
and this is where you typically find other networks
that you can pivot to.
We can also, again, get all the contents of the networks file.
So I can say, cat/etc/networks.
There we are.
And this will essentially display a list of interfaces
and the configuration.
So you can see that we have the default interface loopback
and the link-local, right?
So whenever-- if the ifconfig utility is not installed,
then you can utilize the ip a s command
or you cut all the content of the etc/networks file.
We can, of course, get the hostname, which
we have obtained previously, and that
can be done by cutting out the content
of the etc/hostname file.
There we are.
And you can see, we already know that the system--
the host name is victim1.
If we want to essentially enumerate the content
of the hosts file, we can do that by saying cat /etc/hosts,
and this will essentially-- this will essentially show you all
the hosts as well as the actual domain pertinent to that
particular IP address.
So again, this can be quite important
if you are trying to identify internal domains that you
can access.
So again, this is configured locally.
So again, for example, if I added another host,
I could add the Kali Linux system
and specify the IP address of the Kali Linux system.
And again, that is something that we'll
be exploring during the actual pivoting
section of this course.
We can also display the DNS information by cutting
the contents of the /etc/resolv.conf file.
So resolv.conf.
If I hit Enter, this will display the main name server.
This is the DNS server that is used by default. In this case,
it connects to 127.0.0.11.
If you're working within a real network,
then this will typically be the default gateway.
Not in all cases, but in the case of Linux.
But in this case, because this target system
is running on Leonard, which is a cloud-hosting provider,
it is going to utilize the default name server specified
by Leonard, right?
So yeah, that's how to display the DNS information
or configuration for that matter.
Now, if you want to find other systems
or you want to display the ARP table, which, essentially, will
give you an idea of other systems
that are part of the network that the target system you have
compromised is a part of, you can, again, run the ARP command
and say, arp -a.
And if the command is not installed,
that's perfectly fine.
If the ARP utility is not stored, as I said,
that's perfectly fine.
What we can do is we can terminate this command shell
session, and we can go back into our Meterpreter session, which
looks like it's died.
So if we list all sessions, I'm just
going to upgrade session 1 once more
to show you how to work around that
and how to actually get information regarding
other systems that are connected to the network.
So I'll say, sessions once again.
And the Meterpreter session is now in session 3.
So if I open up the Help menu for Meterpreter,
you can see right over here on the Networking Commands,
we can utilize the ARP command to display the host ARP cache.
So I can say, arp.
And in this case, you can see that we
don't have any other systems connected
to this particular network subnet, right?
So again, if we were performing pivoting or we would like to--
if we wanted to identify systems that we can pivot to,
then we would typically utilize this command in conjunction
with a few others.
All right, so that is how to perform network information
enumeration on Linux.
We have gathered quite a lot of information.
As I said, when working in a real environment,
all of the information you will be getting
is equally as important.
And of course, in this case, because this is a very simple
system, we haven't been able to identify
any other internal networks, but we
will be covering this during the pivoting
section of this course.
With that being said, that is going
to conclude the practical demonstration
side of this video.
In the next video, we will be exploring
the process of how to enumerate services and cron
jobs on a Linux target system.
So I'll be seeing you in the next video.