Original subtitles

1

All right I hope we've been having fun hacking so far.

2

So far we managed to get through access to our target machine purely on information based on the end

3

maps can and this video we're going to see how we're going to utilize information provided to us by

4

the NSA scanner to get truth access yet again.

5

And I'm going to be looking here at the very first vulnerability reported by Nessus title D-B an open

6

S-sh open SSL package a random number generator weakness.

7

And as we've seen before Nessus tells us what poit and what protocol is affected.

8

Obviously also the IP address and some reference information which can be the ideal CV and so on.

9

These are particular references if we want to get more information about the vulnerability itself.

10

So for example CVP 2008 0 166 is the partic. number assigned to this vulnerability.

11

So if I go and look up this number I can find more information about this particular vulnerability and

12

I'm going to do just that.

13

I went and looked it up and I tested a few options without thinking you through the entire process which

14

by the way as penetration or as an ethical hacker you should be doing.

15

So what I've done is I went through some of these links here.

16

I read through them.

17

I tried out a few tools and eventually I decided on one that I thought would work and that particular

18

one is a good hub link that has collected a number of different exploits for this particular vulnerability

19

as you can see here.

20

I'm going to choose the path and one obviously can choose any one you wish.

21

And the reason I chose this particular expert not just because it didn't Python but because the person

22

that wrote this exploit has written some detailed instructions on how to use it which makes things a

23

lot more easier.

24

So as you can see here there are three different steps to executing or running this exploit.

25

The first step is we have to download a particular file and then we extract these files.

26

And then lastly we execute or we run the exploit.

27

So let's start with the first that the very first thing I want to do is I want to download the exploit

28

file or this python file that you're looking at right now.

29

And to do that there's a download link on the export database page.

30

I'm going to copy this link and using that to get which we've seen already I'm going to download the

31

script on my machine.

32

I'm going to try it out very quickly just to make sure that the script late and to run Python scripts

33

all you need to do is type python and the script name.

34

And here we go it looks like it's working perfectly.

35

It gives us some output that tells us how to use the script which is something standard that you see

36

in most of these clips.

37

So now we start by following the instructions.

38

I want to download one of these two files that the expert try to ask us to download.

39

I'm going with the second one before I do actually let me explain very briefly about what this vulnerability

40

is and how it works.

41

You've seen in a previous video how we set up the S-sh server and you've also seen that the S-sh server

42

requires certain encryption keys for us to log in without going into the details of encryption and how

43

it works.

44

Think of the security as some kind of a password that locks you in.

45

Not exactly but think about it like this for now.

46

Just wanna and in certain older versions of Debian there's been an issue in generating the skees.

47

If you remember when we set up our S-sh server on Kally I recommended that you guys change the keys

48

because sometimes if you download a ready made image you'll have preset keys that somebody could guess.

49

So in that particular version of Debian what happens is if you generate these skees there's a certain

50

bug that limits the number of generated keys to everybody.

51

So sort of having millions or billions of possibilities.

52

That makes it impossible for somebody to guess your key.

53

There was a bug that made the number of games generated very limited meaning that somebody could write

54

the script and try to guess your key because the number of guesses will be limited.

55

And this is the expert that we're going to be running now.

56

This particular file that we're going to be downloading here is the set of possible keys that can be

57

tried.

58

So one of the skis that we're going to be downloading is going to be the successful key that allows

59

us to log in into S-sh to download this file.

60

I'm going to copy the link.

61

And again using Dobry get I'm going to download it on my machine.

62

Now notice that this is a hard not be easy to find.

63

We talked about compression in earlier videos but just for the sake of this video I'm going to assume

64

that we have no idea what this file is or how we can uncompress it.

65

So I'm going to be using some of the tips that I told you about before.

66

The first thing I'm going to do is type file and the name of the file and this will tell me that this

67

is a ABC to compress data file.

68

So now I know that these two or these two stands for Zip two.

69

And to find out what can I use to deal with that file I'll type I propose it to

70

see that there are a number of options.

71

The one that seems the most probable is the visit to Tool.

72

So I'm just going to use that with the minus minus help option to see what can I do with it.

73

And you can immediately know this and the second option that D-minus the decompresses the file.

74

So I'm going to go with the minus the option and follow that with the filename.

75

It takes awhile for the file to decompress.

76

And now I have a tie file of Tifa.

77

Again we went to Todd files and explain how you can untied files.

78

But assuming that we have no idea what Todd file is we can still follow the same process and type file

79

the file name the type.

80

This tells me that this is a tight archive.

81

And I type I propose time which gives me a number of options.

82

I'll go with the tide option and without going through the help options we've seen this already it's

83

extract be verbose and the filename.

84

And as you can see here all of these are possibilities that we're going to be trying against our target.

85

And one of them hopefully will work.

86

Now we took two steps to decompress and anti-this fine.

87

So we used the basic tool.

88

And then we use the time 2.

89

However we could have done that.

90

And one quick step using the TOD.

91

XXVII.

92

J.

93

F option J deals with the Bizet files.

94

Let me delete that and let me quickly list the contents of the directories just to double check that

95

everything is that perfect.

96

Now I can run the script let me run it again.

97

And as you can see here in the output example this tells me that I need to run the script with a directory

98

where I have extracted the keys then followed with the host IP which is my target IP then followed with

99

the port number.

100

And this is why it's extremely important to do what scanning because as we've seen before we had different

101

FTB servers running on different ports.

102

I cannot just assume automatically that this is going to be running on port 22.

103

In most cases yes it is.

104

But in case the target had a different server running on another port let's say 22:22.

105

Then why attack would have failed if I just automatically assume that it's on port 22 only.

106

Here it is on 4:22 so I'm going to go ahead with that.

107

And then the last option that I need to specify is the number of threads.

108

That basically means the number of connections that I'm going to make simultaneously to the S-sh server.

109

So how many keys am I trying at the same time.

110

I can go with a big number like 100 or 50.

111

However that might overwhelm the SH server and it might have dropped the connection.

112

So even if the key is correct I would fail to detect it.

113

So I'm going to keep it on the low end and go with 10 only this is going to take a while.

114

So I'm going to speed up the video

115

as you can see here.

116

It's still going so I stopped recording so I don't keep you guys waiting for the whole guessing process

117

but now I have an output from the strip that says a key is found.

118

And the expert writer or the script writer was kind enough to tell us exactly what command we need to

119

execute to use this key and log into the target.

120

And here's the command.

121

It's S-sh minus l route which says use the username route.

122

Please log in as root minus B-22 which you should have guessed by now is port 22 minus ise specifies

123

what key I'm going to be using.

124

And towards the end is the IP address of when I want to log into.

125

So I'm going to copy paste this run it.

126

And here we go.

127

I'm logged in as root.

128

Perfect.

129

So that's another way we managed to get into our target as it was to terminate the S-sh connection.

130

I'm going to type exit.

131

Now here's the thing I want to copy these keys and keep them in a separate directory because the ones

132

that already end there's thousands of other keys and I don't want all of that.

133

I just want to keep this piece that worked so I can use them later on.

134

But how am I going to find these keys among tens of thousands of other keys.

135

We're going to be using simple tricks that we learned in previous videos.

136

So let me copy the first few characters of the name

137

and then I'm going to create a directory called it kids.

138

This is what I'm going to be saving these keys.

139

Now if I do as itis a slash 2048 look at that.

140

There are thousands of keys in this directory.

141

So what I'm going to do now to find the exact name of the key is to type and to grab and the first few

142

characters now the L S gave me the exact names of the keys that I need to copy it ignore the rest and

143

the grepped only the keys that I want.

144

So now I know what the name of the key is.

145

And all I have to do now is copy this name and it should copy command from the target for that to the

146

destination for the because there are two keys.

147

I'm going to be using a wildcard again.

148

And now if I do an S on the keys directory my keys have been copied and I can use them later on.

149

Perfect.

150

So go ahead and give that a try.

151

And when you're done here's your mission for the section.

152

We just finished attacking the service on port 22.

153

There's another service on port 23.

154

See if you can attack it and get access to the system through it.

155

And notice you get truth access or not.

156

If not can you still execute commands as root.

157

So even if you logged in but not as root can that particular users run or execute commands as root when

158

you're done with 4:23.

159

Go ahead and try port 5 1 3.

160

And the question here will be did you use the same commands to connect to both ports 23 and 5:01 3.

161

Or did you use different commands.

162

And lastly what about Board 1 5 2 4.

163

Try that board as well.

164

When you're done let's move on to the next video.