And would you look who finally got the adept labs to work for a course?
Hey, it took me a while, but I got there.
And that's so we can actually play along at home and make sure that we're all
following the same sheet music.
Now I have this opened up already.
You could see all the lab starting up and everything.
Just keep in mind that when this pops up, that we have a hyper V manager
working in the background to crank up all of the sub virtual machines.
So while that's happening, I want to point out that we have a sin map,
wire shark and a VM information text document that includes the subnet that
we're on and username and passwords for all the machines that we're working
with.
If you start to do some practice and let's say double click on Kali and it
does it open up, by all means go into the hyper V manager to see if your
systems have started up.
They're highlighted in blue.
Now we're going to be doing this inside of our Kali box because that's where
our practice needs to be focused on for the entirety of this course.
And we're going to be doing a quick examination of our classy subnet.
Now we're under the assumption that there are no other systems on here.
And we're going to be also, I don't know if you could see it in my very tiny
window,
but where my hand is, is the in map cheat sheet that's earlier in this skill.
Inside of our Kali box, we are unsure if we are the only four systems on the
network.
We see the three on the far right that I've just highlighted.
Kelly, the one in the middle will move to desktop and win 10 along with our
host
system that the lab is actually running off of.
So we need to go in and make sure that we do a in map dash F.
And we're going to leave the timing option alone.
And we're going to type in 192.168.0.0/24.
I want to point out here that this is very similar to a quick scan that you
would
get inside of the Zen map.
The difference being is that we are missing the dash T3 flag for this.
And that's excuse me, the T4 flag.
And on our cheat sheet on the bottom left, you can see that T3 is the default
timer.
So if you don't have any time identifying on here, it's going to take three by
the fault.
Now right out of the gate, we have a response.
And if you go through your response, you'll see in this lab that 0.51, 52, and
50 are up
and running along with 0.1.
And it comes back with some services available to you.
And I want to make sure that we understand that this is just a very quick,
"Hey, are you there?"
And whatever is available to the actual system itself.
Now going a little bit further, the challenge is going to be focused on OS
fingerprinting.
And that allows us to be able to identify within reasonable suspicion that a
system
is a particular operating system.
The reason that this is critical is because a lot of our vulnerability
assessment
and scanning that we move to later on is going to be based off of that
operating
system fingerprint.
So as an example here, I just want to type in "inmap - uppercase O" and then
192.168.0.1.
Now 0.1 is the host lab VM that we've got logged into.
And the -O is going to be able to try and tell us best guess based off the
information
that we have available to us what operating system we're using.
And when I say best guess based on information available,
I'm talking about ports and responses from those ports.
You'll be able to see in your own lab here that those five ports identify
and have specific responses from them that give us a best guess scenario on
what particular server we're running.
And in this case, it believes that we're either running 92% probability
Windows Server 22, 11 or Windows 11 or Server 2016.
So it's somewhere in that ballpark of guessing as far as what it thinks it is,
and it has a couple other guesses behind that as well.
Now this is going to change up a little bit because just for instance,
if we go in N-map-f and this time we say -1 and just do the actual host system,
you'll see that we have actual ports opened up.
Well now we want to see go back up in our results and see if there was another
system that was up.
And we think there is 1 at 52.
And that is we're going to check our Hyper-V manager here real quick, go to the
WENTIN,
and it should give us some information on networking.
It's 51, my mistake.
So now we're going to go to 51 and just do a quick -f on there.
And you'll notice that no ports came up.
Now the reason behind this is that there is a firewall in place on that Windows
10 workstation
by default configuration that prevents us from being able to go through and
figure out what ports are opened up.
And that's where we're going to kind of go into the challenge because if we go
ahead and do a -0 for OS fingerprinting
inside of that or for that 51 address which is that Windows 10 system,
we know if Windows 10 couldn't install it.
Once this runs, you're going to see that it's going to have a best guess of
just Microsoft
because it doesn't get a lot of port response to it.
And here we are, we have our results back and you can see right here that too
many fingerprints match this host to give a specific OS details.
And it's only saying Microsoft because of the MAC address itself,
based on the information that we have from the MAC address, we can assume,
based on the first three
character sets within that MAC address, that it's associated with a vendor that
belongs to Microsoft.
The 00155 Delta category.
And you can look up a MAC address table for common vendors if you want.
But you'll notice we didn't get any ports and that's because that firewall.
Now I'm going to give you a hint real quick if you go into the Windows 10 work
station and then you go into start, or excuse me, on the bottom right.
And go into Windows security.
And then go into firewall and network protection.
There's three options there domain private or public network and all three fire
walls are on which one will you need to disable in order for you to be able to
go through and fingerprint with accuracy.
This particular workstation right here.
That's actually going to be the question for this portion of the skill.
And as we go into the challenge, we're going to see if we have to do anything
else similar to that to be able to fingerprint the rest of the server.
the server virtual machines that are within our concrete.