One way our vulnerability scanners and other tools work against POSIX-based systems like Ubuntu, and even against Microsoft systems, is that the vulnerability scanner will go out and make a remote connection to the targeted system, providing that it has permissions and the capability to do so.
And this allows it to be able to go through and probe for more potential vulnerabilities and do a whole lot of different testing.
Well, inside of Linux, that remote connection is a little bit more straightforward and a lot less notifications, a lot less of the notifications than Windows.
The polite way of saying that it's just straight to the point.
And that's because inside of Linux, you can simply use SSH to connect to a remote session instead of having to go through the big to-do of remote desktop.
I'm going to show you an example of it real quick, because inside of our lab environment, you can see here that I have Ubuntu pulled up, and then I'm going to hop on over to Kali.
Now, I'm going to simply just push up, because I was testing this just a second ago, into SSH learner at 192.168.0.51.
When I press enter, you can see right there that it's asking for the actual password to the system.
And learner's password is password.
Now, what happens here is that you are taken straight to the actual working home directory of that targeted system based on the user that we've logged in as.
And I'll just type in pwd, and you can see that we are at slash home slash learner, because we logged in as learner.
Pros and cons here, right? Pros for the pen testers. We can get in and get straight to the point, and it's low overhead on bandwidth, because there's no GUI to be had here.
Con. There's very few notifications, if any, that this is actually going on.
And if the user or administrator are unaware of the fact that SSH is enabled on the targeted system, you notice behind the Kali box that was running, there were no notifications or alerts that we remoted into the actual system itself.
And that's because, generally, Linux just assumes that we know what we're doing, because when we commit to something, we commit.
And in Windows, they ask us 5,000 times if we're sure.
Now, good and bad here. The good thing is that inside of Linux, we can definitely go in and make the connection right away, along with making sure that it's pretty quick with low overhead.
Bad news here is that if an attacker makes it inside of this POSIX-based system, well, guess what?
They can run around and do a lot of other stuff.
For example, just earlier in the previous portion of this skill, we were taking a look at looking at the sudoers explanation.
Well, that can be done here.
And anything that you could do inside of the GUI, you can definitely do inside of the actual terminal itself, because the GUI is not needed to run a Linux operating system most of the time.
So, being that we're at the bash of the targeted system, which is our Ubuntu box, we're on the Kali here, we're essentially full-fledged into having permissions to do whatever we want to do, including if we wanted to do things like PSOX, to see what services are running on the targeted system.
Now, this comes with the idea that SSH is default in a lot of the Linux operating systems out there, but I do want to show you that you do need to scope this out before you start making those connections.
Because let's say that, for an example, that the target system that we're going to does in fact have SSH installed, does have everything opened up for us, but for some reason has an IDS or IPS somewhere on the network or even on that host, that when we try to make that connection, it lets us know, or it's filtered.
The port itself is available, but filtered.
Well, that's where we need to use tools like Nmap to be able to go through and scan on those particular systems, if anything's opened up.
And as you saw, I was opening up Nmap, Zenmap, that is the GUI form of this, to be able to run an intense scan on 051, which is the Ubuntu system.
And as it's going through here, you can see that not only has it identified it as a Linux, and by the way, you could remember earlier in the skill, we were talking about vulnerability scanners and other programs.
This is one of those other programs.
But if we go into ports and services for the actual system itself, you can see here that on the Ubuntu box, port 22, TCP, meaning SSH, is open for communication.
Now, in the Nmap output, when you actually go through here and see the actual ports themselves, you will also get an SSH key.
Generally, this is self-signed, which also opens up a whole other can of worms because the system itself is not on a domain.
It's not using any kind of PKI system.
It's just taking our word for the fact that we're making a point-to-point connection with an unsigned certificate.
Does this inherently carry any risk?
Yes.
Does this mean anything if we're the user?
Not always.
It could be that we're just doing a point-to-point with maintenance and keeping an eye on everything.
But if this is a self-signed certificate, then that means that we're not going to have the encryption going from point A to point B all the time.
Which means that if an SSH tunnel is open and we're a pentester and we're listening to the actual traffic of the network,
we might be able to pick up a data going backwards between the Ubuntu box and whoever,
and eavesdrop on that traffic since it's not being fully wrapped and encapsulated.
Now, inside of here, we can also see that port 80 is open as well, too.
That's less of a concern for us, but I just want to point that out that it is open and available on that particular system.
And again, Linux will identify itself as being what type of operating system it is inside of Nmap.
But you notice that one of the things that didn't pop up was the status of filtered.
And I mentioned that earlier because if there's a firewall on the system or even on the network,
the port will come back as filtered or maybe non-responsive at all together.
That being that it's open on here means that we're either on an IP address that is allowed to go through and touch that system with no problems,
or there's no firewall whatsoever.
Firewall, you say?
Well, I'm glad you asked, and we're going to be taking a look at that in just a second.