Once we have our connection established and we're actually inside of Betapreder, there
are some subtle differences between us targeting a Windows system and a POSIX-based system,
like Ubuntu. For instance, we won't have to be dealing with command prompt and PowerShell
or going back and forth depending on ease of use because it's just shell all the way
across inside of Ubuntu. Now with that being said, let's go ahead and start doing a little
bit of triage on the system, similar to how we did inside of Windows. Now we will see
some differences between how this interacts with Ubuntu versus how it interacted with
Windows, but we're going to go through some of the same commands that we did for our Windows
triage. We'll start out with inside of Betapreder, going to shell. I do want to point this out
real quick because inside of our actual Ubuntu system, you will see that we have our prompt,
our dollar sign for bash. But inside of Betapreder, as I zoom in for you here real quick, you
can see that we have nothing past channel one created. Do not let this trick you or
scare you because it's there. You just don't see it. For example, let me go into shell
real quick and I just typed in shell. Oh, excuse me. I'm already in shell. That's why
we're here. My bad. Let me type in who am I? And you can see right here that the next
line output is learner. So that shows that we are actually inside the shell itself. And
I said, don't let it fool you, but like it did me, you could see that we are able to
commit commands and get all the information back from that. Now we already did the first
part of identifying who it is that we're logged in as, but can we get a little bit more info
about that user? And because we're in a POSIX based system and environment, especially inside
a shell, I can type ID. And this will tell us, as I zoom in for us again, not only do
we have the actual user ID, but we also have group affiliation as well along with those
group IDs. So every group that the learner account is a part of, you will see in there
and along with the actual group ID. So if we're a part of a domain environment on the
Ubuntu box, it would actually pop up in here along with that group ID as well. So I'm going
to pop out of shell and I'm going to type in exit and go back to Meterpreter for a minute
to show you the get UID. And it shows you again, the actual user name. But now what
about the SIDs that we just saw inside of shell? Get SID. You will see here one of the
very quirky differences. The get SID command is not supported by this Meterpreter type
in x64 Linux. Now this doesn't mean that it won't work for Linux. It just means that
the specified payload that we have making this connection, it just doesn't work with.
So you can find other different payloads to work with that version of Linux or that type
of Linux, and they would probably work, but we don't necessarily need get SID. And that's
why it's not in the code box below this video. We can use, we'll be back to more info in
a second. I just want to show you a couple of more inside of Meterpreter such as get
LWD, local working directory. And you can see that one still works because we show home
Kali desktop and we use PWD to show the working directory on target system. And that one works
as well. So home learner desktop. Now these are very close in naming conventions because
of how we did everything for our lab setup, but it's on us to be able to pay close attention
to things like that to make sure that not only do we not get caught, but don't mess
anything up. So let's go back into Shell through Meterpreter. Again, we're back at the blank
line after the channel was created. And now we're going to walk through the stages of
getting more information about the actual system info inside of Shell. Now, first we
kicked off with uname-a and that gives us a little bit of output as far as Linux and
that we're on as learner and some, you know, all the version numbers and everything like
that. And it does indicate that we're in a virtual machine environment. And this is a
very basic detail output, but because we're in Ubuntu, we can go a little bit further
in this and go into lsbrelease with an underscore and dash a. Oh, yep. Underscore. And you could
see here that we get a little bit more info in a little bit more friendly formatting,
distributor ID Ubuntu, description of Ubuntu and version and numbering. And again, that's
really good, but we can do better because we can also say hostnamectl. And when we do
hostnamectl, we're talking about good info here because we have not only the static hostname,
the icon name being the actual computer name, so to speak, the chassis is VM. And believe
it or not, this is actually a hardware identification for Ubuntu and POSIX based systems. And because
it couldn't detect the actual hardware and it not being a physical system, it identified
that it is in fact a virtual machine. It gives us the actual virtualization information as
well. Microsoft. And then further down, you can see that firmware versioning is Hyper-V
UEFI. This information is really, really good because that tells us that we're in a
virtualized environment and that there's more the ICs, right? So if you have permission
and inside of your ROE, you've identified the Hyper-V or virtualization environment,
it will point out VMware as well too. So you could start finding ways to be able to attack
that specific network that underlines the entire virtualization process. So just something to keep
in mind that this is helping you find out that there's more inside of that organization than
what they may have told us. Now, I do want one last comparison here. I'm going to clean this up
and zoom in for you real quick. I jumped out and went into a meterpreter for sysinfo. And you can
see here that the system info gives us the IP address, OS, architecture type, build type. Great
information, but we definitely get more when we're in the shell and it can do something like
lsb-release-a to get all that info. But do remember too that since you are on a POSIX-based system,
you could always run iafconfig and get the network configuration of that specific system.
Iafconfig, because we're on a POSIX-based system, we've left the world of ipconfig behind.