all right hello world this is cs50 on to
my name is Colton Ogden and today we're
joined by C's fifties Nick Wong Nick
hello thanks for joining us no stream
what are we talking about today we're
talking about Kali Kali Linux County
yeah so yeah great question I think a
lot of people have heard of Kali more or
less but basically it is a penetration
testing Linux distribution so it is
geared towards pen testers all over the
goal is for them to be able to just spin
up a device with a fresh OS and they
have all the tools that they would
possibly want to do pen testing so I see
in the chat everyone's talking about
hacking pen testing and hacking our
difference really and kind of intent and
permission but not much else both have
to think like attackers both have to
understand the systems that they're
attacking the networks that they're
attacking both have to understand a lot
about how people think and there's many
more things not not covered in those
three topics that are also part of pen
testing and hacking the difference Kay
difference being pen testers are I would
say a hundred percent of the time asked
to do the heck
hey there's maybe a corporation or an
individual or an institution that asks
pen testers to come in and test the
security of their network or test the
kind of resilience of the network to
being penetrated by external forces or
attackers hackers are usually not asked
to attack people I think the only time
that would occur is if someone thinks
that they're so secure and they
challenged people to hack them but that
is the kind of key difference there but
both have been known to use Kali Linux
we will have to kind of go through a
couple of terminologies here in that
like black hat white hat pentester
hacker and Script Kitty are kind of the
five key words I think we should cover
because we've kind of covered a little
bit of pen tester and hacker there's
black hat and white hat which kind of
correspond right just white hat and
black hat that correspond where a white
hat hacker is someone who tends to work
as a pen tester they're employed that's
their job they get money and they're
legally allowed to do certain things a
lot of times in pen testing scenarios if
you're hired by like a company that has
sensitive data they have very strict
rules on what you're actually allowed to
do maybe
you guess a password username combo and
that's you don't you don't go any
further
or maybe they say okay you've got that
and now you are allowed to spread a
virus from machine to machine but you're
not allowed to do anything else from
there the virus can take information no
occasionally there's other companies
that might say hey extract as much
information as you can get at the end of
the week tell us what you got and we'll
verify that that was like the right
information
now blackhat hackers are what you think
of usually when you say hacker that's
that's the person who's going around
snooping through the system putting
viruses on things doing all sorts of
terrible stuff maybe for good purposes
in their minds but it is certainly
illegal or it should be very illegal
United States laws on hacking are
actually a little questionable and
whether or not they actually do what
they say they do I think you can look at
the Senate interviews of our Congress
interviews Zuckerberg and pitaya and I
kind of tell you what you need to know
as far as where our lawmakers are on
hacking legislation or just
technological legislation somewhat
removed yeah that's a good way to put it
okay yeah it's a it's a long time and I
see the chat David is mr. robot is
lurking the Samians is that I saw the
first episode I saw I watched the first
episode of mr. robot because he is
always talking about it and I was super
psyched to actually see that very good
chef Callie so you can see pretty
prominently yeah yeah especially towards
the later season after season one they
don't use a ton but season 2 and season
3 you'll see there that Connor
yeah yeah pull it up on my screen but
yeah very cool Nick code 2 or is Linux
your thing so I mean those aren't
necessarily mutually exclusive I do love
Linux systems I tend to be a lot better
with Linux systems than windows for
example but I do also code quite a bit I
code mostly in Python in C++ but I'm
pretty familiar with like our if you
count that as programming nothing
against our I'm sorry the other
scientist I really like Python I'm not a
huge fan of our MATLAB I guess if you
count it and JavaScript and jQuery and
things like that
a lot of web development stuff as well
have a seafood descent on what topics to
cover on stream or games
oh yeah that's yeah you know and I do a
lot of the streams will get a lot of
ideas and we'll kind of talk about it
but a lot of it is cater towards the you
know the folks expertise who have the
time to come on stream it's usually you
know senator know what the folks are
familiar with but we'll take suggestions
if you have suggestions different let us
know
good oh you should be wearing a black
hoodie actually yeah I should have
brought yeah I'm having my like hacker
black hoodie probably true so what is
the overall I guess sort of flow the
stream statement what how am I gonna
demonstrate Kali Linux so originally I
was going to walk through some of the
tools that are included in Kali Linux by
default and kind of explain what they do
and so on and we're still going to do
that but we're going to contextualize it
a little bit and so the way that we've
kind of imagine the scenario is a
somewhat common scenario actually right
now and I think they'll actually get
even more common as we go where I used
to we're gonna pretend this is all a
scenario I know some of this was
actually personally true but you know
it's all scenario at this point where
we're gonna say that Colt and I work for
a company and I'm a network admin or
kind of like a sysadmin I do stuff on
the computers I called my manager and
Colton's not happy with my performance
one day and makes perfect sense fires
and once I'm fired I have most companies
I think try to implement this in such a
way that they like clean out your access
very quickly but this company doesn't
really do that so I get access to the
machines for around a couple hours
before I get fired plus I kind of knew
the firing was coming you know I keep
sleeping on my shifts and I eating
bananas or whatever so I have kind of
known that that one does as one does
when there sis admitting you need
something it's actually it's an illusion
to our cyber security competition and so
I you know I'm doing that and I know I'm
gonna get fired so I kind of mess around
with some of the systems they all still
work everything stores it's all
operational will actually demonstrate
that it's still operational you know
added some things misconfigured some
stuff through some services around you
know there's there's some other things
going on there and I am super familiar
with Kali Linux so I made it really easy
for Kelly to attack you so you fired me
I no longer have direct access to the
systems and now Colton being the man
good man
as he went through he changed the
passwords yeah and that was it and
actually I just don't even do that sort
of like that's actually a pretty good
step
so the passwords are new now he changed
into things he heard of this thing
called leet speak so he he modified some
of his passwords so that there'd leet
spoken now I guess that's very secure
yeah it's very secure and we're gonna
talk about why Kali is kind of a cool
it's the best tool for script kiddies if
and I know that someone somewhere I'm
positive will comment on either YouTube
video the Facebook stream so one of
these dreams will be like you're handing
script kiddies all these tools to attack
people it's like yeah that's true that's
probably true but it's not like they
don't have the Internet
you know you can go Google things and
it'll it'll tell you but yeah I think
that my point on the stream is I'm going
to very much emphasized that it's
important for us to understand how these
tools work and what they're doing and
why they're important because as a pen
tester and as someone who like very much
advocates for ethical hacking and wants
people to be aware of these sorts of
things I think that it's really just two
sides of the same coin to understand how
someone could hack you and to understand
how to defend against the attack and if
you want to be better at attacking
someone you should be better at
defending systems as well they go
together so I like as Lee points out he
could chat these are true parts right me
sleeping on the job I've never thought
I'm aware of full job but I got you okay
someone asked what on your notebook what
Linux you run and they're assuming arch
I actually really like Arch Linux I've
since switched away from arch towards
something called alpine Linux I think
it's a little bit more just like direct
modularity concepts but I generally
really like a boon to because it comes
with so many things that I can then play
around with it's a very standard distro
people it's pretty easy for people like
beginners to understand so there's a lot
of support in the community and it's
pretty versatile I can use it to be
optimized for almost anything
the main complaint that I would have is
that a lot of its default things have
become very clunky the one that I
particularly dislike is system resolve D
which is the kind of default DNS
resolver onigen to systems I really
disliked it I don't I just don't like
the way it's set up I don't like the way
that it
manages DNS I don't really understand
exactly what the paradigm was that
they're trying to follow and they dubbed
it but I'm sure that it made sense for
them I just don't particularly
understand it but I do really like I've
been to in general and I really
appreciate the community that's around
it and I wholeheartedly support it so I
actually generally use Evangel enix but
I use so I have another laptop that was
given to me when I fixed that person's
laptop and that laptop dual boots a been
to this store actually has trouble boots
it drove it's an abuti distro a Windows
distribution and a calli distribution so
I have it wouldn't do desktop calendar
stop and Windows desktop so yeah that is
kind of what I use I actually use a Mac
for like most work and things I use
Linux stuff for when I'm being a little
bit more white hat hacker II but I
really like my Mac Mac is also a UNIX
based system so it ends up being very
similar in a lot of important ways yeah
so let's see there's some other stuff
going on in the chat I see I think I
joke from buck see I just want to save a
pink message and get a pong answer it's
very funny your pong answer might
contain a remote shell ICMP shells or
ICMP reverse shells are really cool we
won't be building one on this chat there
will be other River shells I quote Marie
has a fuel but um we there will be other
things and so you're like what's a river
shell and we'll talk about that when we
comes up and then Fisker says is command
and bash the same in Mac and Linux of
most part there I mean bash is a type of
shell it is a particular shell to the
born again shell and so that shell works
I think to my knowledge works almost
exactly the same in Mac and Linux on
Linux distros Mac there are some things
underlying it that like change
implementation details but I think
otherwise it's pretty much the exact
same I use that from both I've also
heard people really like sea shell I've
almost been can convinced to switch to Z
shell but I have not yet there's another
shell called fish that I really like but
I haven't had the chance to like sit
down and get like acquainted with it
super well it just looks really eloquent
and beautiful so I might switch to it
but for the most part I like bash I'm
pretty familiar with Z show but
I like Pascal most at the moment yes
Savage put in a sample of that name it's
awesome a baby's arch oh very cool our
test all sorts cool beautiful why not BB
and asks Igor voltaic right so let's see
um I've been to is a Debian based system
it's very similar it's more like they
kind of Forge from each other but I
don't use Debian myself just because I
got acquainted with them into first I
think that a lot of these systems at
some point they're all kind of the same
if you can get them to work for what you
need then there's no reason to switch
how did you said which Linux distro is
best for you I think it is pretty much
the same answer right it's like if it
works for what you want to do then
that's great and I think that the more
you learn what you're actually want to
do the more you realize what things have
tools already built in and are just
gonna be me and you probably Google I'm
guessing like depending on your
objectives yeah exact answers like I'm
running a bunch of data science stuff OS
X works fine but I've been to might have
like an abou to light distribution that
renders graphics pretty you know poorly
but does all the computations really
well might be really useful or maybe the
entire reverse is true it's kind of up
to what you need and what you like and
then skins oh so LM one says a general
Linux question as distro hoppers how do
I say or share my data between installs
I heard I can partition the boot and
home as long as you're not switching up
your filesystem entirely yet you can do
that you could have a boot partition and
then just a home partition that you
mount between different distros pretty
reasonable you have to be fairly
familiar with like auto mounting things
but it's not hard there's a lot of
tutorials online
I'm very reasonable tux man 29 says on
the importance of making sure people
know about these risks someone close to
me once worked for a police department
didn't even have tech security briefings
didn't know why plugging a random USB
key on your work computer was bad yeah
it's actually a huge problem not even
just in police departments although that
very much exemplifies the problem but in
general so there was this there's a
group hack five really cool would
recommend blowing them up a take a
little number five and they're super
interesting they do all sorts of cool
like white hat stuff and they have a
really cool podcast on it as well and
they did this little kind of social
experiment at a local university where
they took a bunch of us DS
and threw them around the campus except
there USBs would ping back to them they
actually contain beacons that said hey
I've been plugged into a computer that
was not sandbox it was not air gapped it
was not protected in any way I'm just
literally on someone's machine and it
didn't do anything malicious it was
literally just to kind of demonstrate
what goes on and they found it was
something like 68% of people would like
grab these us piece but I think the
actual staff with 68% of their us these
were picked up and plugged in that they
know of and so some of them might have
just like dieter program yeah so yeah
very much useful to keep in mind and
there's a lot that goes into that
dominate says we provide some pointers
and have it start adrián to wait out
acting you know just google it answers I
don't know what exactly you would Google
except for how do I get started in
white-hot hacking okay but I think that
the way that I got started in the way
that I think works really well for a lot
of people that like hands-on learning is
take a system that you built right so at
home I use a bunch of raspberry PI's I
think they're awesome they're beautiful
like small computers you can put almost
any sort of reasonable OS on them and
configure them to do something like DNS
or an SMTP or some servers so not only
do you gain understanding of that server
that device whatever let UVA
understanding of how the configuration
works because a lot of hacking stuff
deals a lot with like engineering people
and engineering kind of the
configuration or being aware of how
things are commonly configured and then
taking advantage of that configuration
the other thing that you might want to
do if you're interested in it is I mean
yes taking courses in white hat hacking
will give you exposure which is very
useful it is actually kind of one of the
biggest issues with trying to get into
any topic really is like how do I know
what I don't know you know like how do I
see the space of things I just don't
understand and I think that classes are
really useful with X they provide a
structure they also have a bunch of
people who have that knowledge googling
particular things like can I go you know
maybe how do i hack into my own Wi-Fi
network it's a really interesting one so
I will always advocate test upon
yourself right like it's kind of like
you know you test hot water in yourself
before you give it to baby or whatever
it like do that because it's not illegal
for you to hack yourself
from what I know with like some kind of
caveats where it's like if you work for
a corporation count yourselves the
corporation act corporation that's
illegal
but like you know there's certain things
where like that you can I guess twist my
definition but generally speaking if
you're at home and it's your own home
Wi-Fi and you own the Wi-Fi and the
router yeah maybe like test that see if
you could do a man-in-the-middle style
attack can you reroute someone's traffic
to your device instead of to your router
things like that there's all sorts of
things though to keep going so Al Gore
says what do you think about FreeBSD to
be honest I hate it in our competition
two weeks ago we actually had a machine
that ran team previously and the kid
that was on that we assigned to it was
like question how do i do things I was
like and I think boots star oh wow boos
stop again stop cool I said what is
Chrome apps that is the browser-based OS
that is provided on Chromebooks so
Google's things and then there's some
stuff about spoiling mr. robot I'll
pretend I didn't see it I've totally
done that in college so Ellen ones kinda
brings up a point about like plugging us
bees into things randomly there are kind
of like safer ways to do it where like I
could make sure that that USB gets only
plugged into like a sandboxed virtual
machine for example that's not
necessarily super safe
you could you could feasibly come up
with ways that the USB doesn't think
what you think it doesn't do what you
think it does so you think that look
like us bees may not actually be us bees
they might register themselves as
hardware devices it's like an Ethernet
port for example and so maybe I plug in
a USB it tells your computer hey I'm the
Ethernet port I'm actually your entire
internet port I'm the only Internet port
that matters and then your browsers
whether or not you're logged in might
try and connect through that and send
some information to the usb or the USB
it's not really a USB and then that USB
might send some information back in
poison your browser cache and then when
you log in you're screwed anyway so it's
really important to be like this
no such thing is too safe I think in the
world that we live in a moment and
summon Ali says how do i balance
learning skills pentesting web
development i want to be a jack of
multiple traits like you guys and it's
funny that you say that because the
phrase is often jack of all trades
master of none that's what people will
say it's kind of like a well you know a
lot but you don't know anything and well
enough to be good at anything but I
think that that phrase gets misquoted in
that it's the full phrase of something
like jack of all trades master of none
better than a master of one or something
and so there is more to that phrase and
I think that it's really important in
this case to you follow what you're
interested in but take things that look
difficult and force yourself to do them
so like let's say you wanted to go into
using FreeBSD oh yeah it's fine I think
that would be a really useful thing for
me to go and do and you don't even have
to like be that good at it so much does
just be exposed to it you want to see as
much as possible and then you can kind
of delve into stuff as you go a lot of
it I think deals with just being curious
really it's just like oh I I was
recently on the Kali Linux site making
sure I knew a little bit about its
history and kind of where it came from
and also just checking if they'd updated
their images they had they included a
new thing called wire guard and it's a
VPN client and a firewall or sorry
server and I was like oh that's super
interesting so I you know commands tabs
that and push it off into a new tab
didn't open it for like seven days but
eventually it went to it and it was
really cool and I was like oh this is
awesome I actually ended up building a
wire guard VPN because I thought it was
so cool like today so I think that that
sort of thing is really useful Iger
vertic plates at the bottom test
networks like hack the box there's some
other ones like Metasploit a bowl and
like sec gen allows you to generate
those boxes and things those are really
useful but it's not you don't just stop
there right like you you go into those
you start to like test some of these
skills there's all sorts of other things
that you can like go and experiment with
that are very similar I think it's a
good place to start right like you start
there and then as you kind of like
google tutorials and read things you
know just like open up the other things
that look tangentially
staying in other tabs and not all of
them will be like I've seen all sorts of
things I'm like I don't care but there
are a lot of things where it's like oh I
didn't even know that I would have cared
about this that I discovered like d3
which is a JavaScript library for God
I'm like everybody's using it everyone
who's our like graph QL and things like
that so there's all sorts of ways to
kind of get really good at these sorts
of things cool sorry it's star star ner
to 111 says BSD is great for firewalls
that's true although there are a lot of
firewalls that can be implemented as
software firewalls and then you could
put it on their own dedicated box and
essentially have a hardware firewall I'm
sure someone will yell at me for that
but like it effectively can be that way
depending on your use case it's actually
very related to use case and for me that
works fine but I would imagine for some
people it would be better to just have
like a Palo Alto firewall for example so
yeah and I think the advice and the rest
of the chat is very worthwhile
challenge yourself pick things that are
worthwhile protip not BSD just like me
I think it's funky it's kind of the same
reason that I dislike Windows and so on
just popping yeah everyone is cruising
on the chat and I think we can let's see
yeah let's take way into into Kelly
because I think folks are probably very
eager to uh to see you want me to bring
up your screen on my screen I think
we're all set up so we have two screens
going on I also have labeled my screens
a little bit more effectively no hideous
hands like the chat they're all angrily
typing their comments on the YouTube
just to be clear the inventors of
previously very brilliant people and
I've never even used that I'm just
on it because it's really just
like yeah and I'm sure they have very
reasons why they don't like me I loved
in - I'm sorry I keep reading the chat
you guys are saying great things we
really appreciate that actually as
happens behind a soup
great name still great name any Gentoo
fans I say yes I actually had to dive
for a company on a Gentoo system for a
while and I really liked the penguin
that comes up to tell you how many cores
your OSS or
has access it's really dumb but like
when it loads my boots it has like the
little penguins the Gentoo penguins and
it puts how many of them that you have
cores it's pretty amazing and it detects
hyper-threading in things like what if
it did it oh my god like a Google like
multi like giant distributed system
which Bank or would that be sick people
asking why your why your see matrix is
just red today I'm really glad you guys
thank you for noticing
so no rainbow on this one today because
I feel like kind of red and blue or the
two theme colors of the hacking world
except for black and white black and
white being the descriptors for the
people red and blue being the
descriptors for kind of like what
they're doing and blues for you yeah so
you're the great so we are beyond the
evil person and actually this is the
callee tool that is painful looking
which is kind of awful to read I'm
realizing it I might switch that to
something let's see we can configure
this a little bit maybe just like a
really pale red yeah we're gonna ship
that hue the saturation down yeah we're
gonna just put that down a little bit we
can also like a pantry that's it's
better yeah no you guys can still look
at this without going blind this is our
hacker interface and this one is blue
double console at the moment what's it
what's the text look like on that one
okay okay cool so this is our interface
that Colton will also have up just so
that we can like see what's going on for
him but yeah we have blue for kind of
blue team good guys manager and we have
red for Cali things that are going on
stuff like that and accurate burn arcs
and so FD got 92 count hexagon kills in
an hour RN damn gosh thank you very much
with fall appreciate it
let's see wait I wanted to bring up the
Kali Linux desktop background its iconic
I don't have a desktop version running
right now but this is in there's in the
show I think they had a black and white
version but with the same yeah it's that
kind of thing let's go find that one
that's like you could type into images
like oh I think it was maybe the second
image though it might just be a baby
just doing
- robot Kali Linux you'll probably see a
screenshot oh we tried - it's like it's
like the third row there we go it's like
yeah it's like that first one any of
these yeah I think this is the one that
he had might be using um and I actually
really liked the light the quieter you
become the more you are able to hear I
think that's a reference to like phrase
from ninjas or samurai conflating those
two would be really insulting so yeah
it's like kind of like ancient phrase of
like if you kind of just like silence
yourself you can hear all sorts of other
things but yeah it's this beautiful kind
of idea very cool and it was basically
just invented for pen testers someone
having a really good suggestion try red
on black so I might do the kind of
similar but opposite and that background
color I can edit my text color I believe
I may be not able to do like a black and
then this is kind of red that's fine you
have a red prompt like my prompt is red
you know this is kwb yeah so this is
Kali this is good this is the cool
people lefties for something universal
as well yeah thank you cool so someone
asked what separates different Linux
distros and that's a very broad question
there are all sorts of things that
separate them but one of the main things
is kind of like different sets of like
user paradigms so like different ways
that users should really be approaching
things so if you do for example really
focuses on like everything has like
these services and processes and it's
very much like how am I going to adjust
things based on what services are
running what's the status of these
services how do I turn things on and off
it's modeled I think a little bit closer
to made me not have originally been
modeled this way but it looks as if it's
a lot closer to like a more like a
desktop experience if I go into the
event register which is what this is I
can do like a pseudo service status
status all loops and see what services
are running everything is in file
systems and stuff like that
and there's just all sorts of stuff
going on here so in Cali you can
actually do the same thing there very
sim
in terms of like what they have access
to on the underlying side so this has
also a lot of services for some reason
the countess trave is running away to us
yeah it's very fast and part of that is
due to the fact that Kelly is meant to
be pretty fast so if we kind of scroll
through all the services there are some
extra ones on Kali that you might notice
beef is one of them and then there's
another one that's worth noting I think
the Metasploit service is in here
somewhere
burrito is another one engine x4 this
NBD and video persistence and then
there's some other ones worth pointing
out and some red socks and there's
probably some ones that I missed but
there's a bunch of services and tools
built into Kali that are very useful for
us to do things with and so on so for
example nmap exists on county by default
so does Medusa which is also very useful
at MSF console or Metasploit framework
console for those of you who aren't
familiar we're going to spend a decent
amount of time in that today because
it's super useful it is probably the
most accused of being a script Kitty's
favorite toy but it has all sorts of
reasons for being a script Kitty's
favorite toy because it makes a lot of
things that non script kiddies do very
convenient it builds them in so if
you're already aware of how to build
those things you don't wanna build them
over and over again yourself and you're
like hmm if only there was a tool that
would do this that tends to be the kind
of like go-to tool it does have a pretty
Windows heavy focus but in recent years
and part of the past two years I've seen
a lot of packages added to it that
support Linux based attacks and exploits
and that's really cool so well maybe
maybe not cool for people who are
getting hacked with it but it is very
cool in concept and it helps make pen
testers a little bit more well-rounded
so I really like that and so those three
tools we're gonna talk about a decent
amount today Medusa is a really useful
tool for cracking passwords brute force
style and what it does is it basically
just says hey give me a service and tell
me a password list and a user list and
I'll just go try them and there's all
sorts of parameters for it if you
you kind of read through these it can do
all sorts of cool things you give it a
host name or even a network that it can
attack you can tell it to stop after
cracking one password username pair or
log into a file as all these kind of
like things that you can add to it that
make it really useful you'll see it in
action in a little bit and it's a really
useful tool so I think one of the great
things about Kali is maybe I'm a pen
tester who is working on the fly you
know I don't necessarily have a whole
lot of time to set up it's like how do I
go as quickly as possible
to attack the company that I'm in and so
what I might be able to do is I just
have a bootable version of Kali on a USB
I plug it into a machine boot it into
Kali and that machine is already
connected to the network has all the
tools I could possibly want and I just
go it's very fast right so it is pretty
useful for me to be able to do something
like that so yeah as is being pointed
out in the chat and map is a network
mapper I use it by default there are
other ones
nessus and things like that but I'm
going to stick to nmap because I think
it's a very simple one I think it's
really useful Medusa is a password
cracker there are many others and also
most of these other tools that I when I
say many others are also on Kali so you
could go and like find John the Ripper
is also I don't know the actual let's go
take a look there is a John the Ripper
version somewhere on here John the
Ripper is another pop popular password
cracker there's a lot it looks like yeah
there's many tools on here this is where
the desktop version has an advantage as
you can kind of like skim through a
little they have modified which is like
yes magic thing biography is very useful
for doing all sorts of stuff and then
there's just the tons of things in here
too if you want to do X attack oh thank
you it's just done you're right I don't
use it often so John the referees on
here there's all sorts of stuff that you
can do and we're going to focus on three
tools in particular just to kind of like
hit at the three main things for like
networked attacks where we're not given
access to like the Wi-Fi network but
like aircrack suite is also on here the
B framework is on here there's all sorts
of stuff that you can do so I think it
would take us way too long to try and go
through
hold them but we'll go through some of
the key ones that I particularly enjoy
and they give you access to kind of the
common things that you might encounter
needing to do as a pen tester or hacker
yeah so we've kind of discussed how I am
on Cali and I know where his machine
sits so I'm gonna go kind of copy his or
I'll go into my phone screen over here
actually we're gonna just tale so y'all
don't read all of what's going on there
at config cool and this is his key
alright sorry his IP so that's where
he's sitting you guys shouldn't be able
to touch either of the Cali or weak
devices they're both on AWS they're out
there but they do block everyone's touch
this attempts except for our two so if
you can I please Lowe's now so the first
thing I'm gonna do is I'm gonna just
kind of ping what's going on with Colton
make sure I can touch whatever he's
doing and I get a response I really hope
that's you
I might actually tail that with an extra
line I don't remember if the Cali demos
at the end or you okay yeah that's you
cool so I can ping you and I kind of
know that your host is there which is
great and one of the first things that I
might go and do is I might say okay what
services are still running because I
know that it's been like a day since
manager got on there and I want to go
and yeah make sure you didn't shut down
any of my favorite services so and Matt
is a really useful tool for that I can
do just nmap with no flags and give it a
host and it'll just do a really quick
scan of common points and just go being
doing what's open and any map actually
has all sorts of powerful tools like hey
take us host that's a zombie and use it
to ping other things so that they can't
necessarily trace back who's doing the
pinging to me as the like deadly host so
you always just immediately know that
that server has a database on it yes
yeah so I can see that you have my
sequel open and as your X network admin
I was hoping you know I was really
excited that you kept that opening
because you know you used to have me go
on vacation and I had to still
administer the database so I left myself
a remote user
which and maybe my convict was a little
off I didn't restrict it to a specific
IP what I should have maybe done is had
a VPN that I could access and then be
accessed the server from that VPN but I
was like well you know we don't use it
that often so it's not worth sending all
that up so I just left it open to
everyone that's ok and so someone says
brute-force sequel XSS or cross-site
scripting attacks are useless nowadays
these are so common
I actually wholeheartedly disagree with
that in pretty much every way in that I
except for the fact that they are so
common that part I do agree with they
are extremely common and I think the
intuition says that Oh everyone's heard
of these of course you would protect
against them however that's not true
people do not protect against
brute-force attacks in any meaningful
way one of the most meaningful ways
would be to use randomly generated
passwords that are very long however
people don't want to have to remember
all these passwords or use a password
manager or they just can't be bothered
to use two-factor authentication I can
brute force people's passwords fairly
easily and I don't need to brute-force
your password in particular I can just
rip force in general and a lot of
attacks are not directed at one person
they're usually directed at just anyone
who walks by and if I happen to get a
key
I went right so it's a very from the
attackers side it's pretty easy I can
sit in a coffee shop and man in the
middle of the Wi-Fi that's going on and
then it's not too difficult for me to
just snoop on everything that everyone's
doing intercept the TLS handshake and
maybe just figure out what yours is what
you guys are talking about now there are
other things that are much more advanced
and interesting sounding there's all
sorts of beautiful attacks going on
right now but we don't necessarily need
to do that I can guess people's
passwords you can actually write a web
scraper for like someone's public
Facebook account and you say brute force
is terrible but maybe I tailor my
brute-force attack so maybe I say ok I'm
trying to attack an individual person
I'm targeting them and I want to say ok
well I know that their Facebook account
is open to the public so I scraped their
entire Facebook history everything that
they've ever liked everything they've
ever looked at everything that they've
ever posted I scraped the whole thing
four key terms
I used my favorites random package from
the Python NLP package framework
I grabbed out key or important things
over some threshold and then I used John
the Ripper to generate a comprehensive
password list using everything they hold
dear all dates all numbers that are
significant to them as well as common
additions and subtractions adding one
two three and as things meat speak
things like that now my brute force
attack is actually really good it's
pretty likely that I will be able to
crack one of your passwords somewhere
pretty quickly and you might say oh well
you know the person that you're
attacking might have done blah and you
can always kind of play that game with
yourself like they might have done this
then better than that more than that but
while I'm brute-forcing you I might look
for other avenues of attack I might know
your birthday now because I say your
Facebook I might call up your you know
health care provider and get some other
information on you and I healthcare
providers just use your birthday the
check of yours so I'll just do that I
gathered some other information about
you maybe call your bank answer some
security questions
I now have your bank account and I might
say or maybe I don't have your bank
account but I have some information
right and the more information I get the
closer I am by a lot to grabbing things
on what you're doing so there's all
sorts of things that you can do and
that's just with brute force there's all
sorts of stuff that you can do with
sequel injection attacks people don't
sanitize the strings very well even
though that's taught in the intro CS
class at almost every school I know
sanitize your strengths sanitize input
strings data is not different for anyone
weight data is just data so there's all
these dangerous things that people just
do and a lot of them are really just out
of laziness or compatibility right let's
say I've turn on cross-site scripting
attack protection but it breaks a bunch
of the other things on our website
well management might come up to me and
they might say hey we can't afford to
lose $5,000 a day just because you want
to protect against an attack that's
never gonna hit us that's pretty
rational from where they're sitting
cross-site scripting attacks don't
happen that often right it's unlikely
that you're gonna get hit so okay I turn
it off and four years later we realize
that we've actually been compromised for
the past four years you know I'm like
you might say well that's never happened
but the Marriott or whatever that hotel
chain that had been actually 10 years in
her home that's exactly what happened
and it wasn't you know cross-site
scripting but they just hadn't been
compromised this whole time he's like
320 credentials worker all right sorry
300 engines we're like compromised it's
the entire population of the US
these sorts of things a lot of times it
sounds like it's super complex and super
difficult and some things are and like
social engineers and people who are like
researching in these things they're
doing some pretty crazy stuff they're
taking like air-gap machines and
listening to frequencies and guessing it
stuff and using math to do stuff they're
breaking algorithms and doing all sorts
of cool stuff but what I'm talking about
is just good old-fashioned like taking
use of people's kind of social
weaknesses and yeah as people point out
in the chat a lot of what I mentioned
was social engineering but hacking and
using social engineering that's just one
of your tools right it's just as
important as having Kali Linux or having
nmap or other tools that can do these
for you it's how I get information right
a hackers game is really how can I get
as much information as possible without
anyone knowing that what they're giving
me is important and that's the real
trick at the end there is people will
often say I don't care who knows this
it's not important and they'll say who
cares who knows what my favorite color
is or what Street I was born on none of
that's interesting not to you maybe but
those are your two first security
questions for your bank account so now
that I've got those and your bank
account I can validate myself as you
anywhere because people often assume
banks are safe but Santander had a
security vulnerability where it would
redirect you to its HTTP site instead of
HTTPS which means that if I'm man in the
middling something on you know Starbucks
Wi-Fi and I've just redirected you all
through my router that then redirects
you on to the Starbucks Wi-Fi hey I see
you sent Endocyte I have your bank
account walking information now your
bank didn't protect you so there are all
these things an implicit trust that
people put in the things they use
services they use and that's dangerous
something that I saw a little while ago
where I was asked to do this by the
people who did it so it was as little as
aboveboard but I was able to use a
sequel injection to get access to
someone's database on a certain forum
online and their sequel injection was
protected against like easy like oh do
this or this and it'll drop everything
or whatever their login information was
sanitized that was good but there's
search bar on their website they had
built it themselves
and they didn't think that anyone would
try to do anything weird with sequel in
that it's a search bar it's not
interesting
and so when I did was I sequel injected
things into their search bar and I
changed one of the discipline text
displays that was being auto-generated
they were selling things so it would
query their database and then it would
return something in this spaces where
like products should go with the return
from that database query and so what I
did was in the sequel injection I
replaced their database query with my
own and then the website would just tell
me what I wanted to know
in fact it told me all their users
passwords they weren't hashed and it
told me all the credit card numbers also
not hashed nothing in for something
interesting and so then I emailed them
and I said hey you know I've completed
my pen test my remote pen test and you
know here's where you can pay me here's
the flaws I discovered here's how you
should fix them there are probably more
right like I only discovered it at X Y &
Z flaws and I think that they're really
serious and important I think that they
should be your priority right now but
there are many many more that you
probably need to go fix here my
suggestions as to where those are and
I'm by no means a professional pen
tester has been doing this for years but
it was a really cool experience and it
was important to them that someone do
that for them and now I'd be hugely
criminal and an abuse of the like white
hat trust that I get has someone who was
paid to do that but it's scary right
because those people all trust that
service too to not do that and so there
is this kind of like problem with us
trusting people in you know that provide
these services we kind of trust them
like kids trust adults you know where we
think they know better than we do and
not always you know Bobby Knight points
out that Facebook save passwords in for
a while this is another one where it
just didn't look like what it was you
know they saved plaintext passwords in a
log file somewhere and it was just the
engineer who needed the log file didn't
think of it as a security problem and
the people who thought of it as a
security problem didn't know about the
log files and like that's a gross
oversimplification but it's roughly what
happened and it's a huge problem it
exposes passwords for what 50 million
people that's horrifying or 20 million
people go to google it if you want the
actual numbers but it was a lot of
people and that's horrifying Facebook
has a lot of your personal information
on it I can in I can take your identity
if I can steal a lot of your Facebook
stuff and kind of think about it if I'm
clever of how I put that back together I
could probably take your identity
and that should scare the crap out of
you buddy it shouldn't make you more
paranoid it is worth being paranoid and
having a little bit less convenience in
your life to not lose something like
your identity or your bank account or
things like that yeah so that's kind of
my like quick rant on what I think some
of these things are about but yeah
anytime you think you're safe that is
where you are at your most danger in
danger point because when you think
you're safe
hackers are like oh good you know you're
not trying to do anything to get me
right and remember that while you don't
maybe think like an attacker that's
great and I'm really proud that you're a
good person
I guess um but hackers do and they're
constantly thinking like attackers and
they're looking for path of least
resistance right like if I see you and
you've got like great passwords it's
probably not worth their time and that's
like one thing is like okay well I
couldn't crack the password in four
minutes so I'm gonna move on to the next
person and that's easy like it I just go
find your grandmother or something and
I'll just hack her against that it's
like this just then you're just looking
for the easiest path and so what I'm
pointing out here on this is like yeah
we're walking through callek Cali and
like doing all sorts of interesting
things
but we're walking through stuff that
I've deliberately compromised right I've
put a bunch of stuff on Colton's mesh
are on the Colton's like virtual machine
there that is all broken there's bad
configs everywhere there's bad stuff
working around he has terrible passwords
but they are LEEP spoken the scenario
was really set up just for me to be able
to demonstrate Kali but the point that I
tried to make was I pulled from like
stories that I've heard or things that
I've actually seen when I did this
people love to leet-speak passwords why
do you think John the Ripper has an
option to leet-speak
all of the password dictionary that you
pass it uh-huh
like these things happen all the time
and it's a lot of times people just lazy
yeah like it's just convenience so we've
done mapped his scan and I'm actually
gonna add another couple flags to nmap
so we're gonna do this which is going to
make nmap a lot more verbose so I added
three V flags you can keep typing v to
make it more and more verbose but we're
gonna just let it kind of run it scan
there are many types of scans that nmap
can run I would recommend looking
through the documentation if you want to
know some of them but I also ran a full
so this is now going to scan a lot more
it's going to fingerprint his OS it's
going to try and tell me as much
information as I could actually find
about his machine so we're going to let
that run for a second and then map might
take a little while depending on how
many ports you throw it through and yeah
I see it on the on the chat people say
hey I think many people will break the
law if this frame
my point is thoroughly do not break the
law I am fully on the side of the
lawmakers even though I think they're a
little bit behind and slow I think that
protecting people is very important
because if you hear hey a bunch of
people don't know what they're doing and
out of convenience do all these sorts of
like terrible practice and security
things and you are happy because it
means they're easy targets
you should probably seek some form of
therapy and or like double check what
you're actually thinking because they're
humans just like you and if you think
that like oh but I'm above them because
I do all these great things you're not
people will kind of hack you what no one
is really so like you know there's all
sorts of things but don't get cocky you
know like we're all people and it I
believe it is our responsibility if you
do learn a lot of these things to then
help the people who don't know it the
sandwich says they saved all the
passwords in a huge vault with lasers
totally secure I'm not touching the
laser so it's all you
but if that's powered with Chrome OS I
might might go after you and then clave
says where's this channel about to the
channels about all sorts of tech stuff
and things and I mean Colton's done and
stuff from like genetic algorithms to
game development - here we are with
Callie there's all sorts of things going
on really just a brilliant idea on
Colin's part we have all kinds of
programming stuff today is more of
conceptual conceptual stream yeah and
we're gonna talk we're gonna hack you
it'll be a little bit you know permitted
lis hack him oh I'm allowed back mostly
I want to thank also show you that yet
and stop Aswan in the arts Colo for the
follow yeah thank you
and you'll notice our and maps springing
up saying our atom app script is
finished running so we're gonna go with
your information
yes dick Mehta 124's did this in all
previous live video going to be added to
the cs50 EDX course not the EDX course
but certainly the CS go to youtube
youtube.com slash cs50 and also we
showed them on our we show a red and
we'll show them on our Facebook page
yeah they're all it is alright so we get
a lot of output from this we're gonna
ignore some of them but we're gonna skim
through them so it
I have verbose mode on so it's just
telling you what it's doing as it goes
that's what all this stuff is but then
as I scroll down eventually I get this
so basically the first thing that tells
me might not sound super important but
it kind of is is that the host is up and
it responded with like a very normal
response
there was nothing crazy there was
nothing interesting going on but it was
just like hey I'm alive and that's a
really dangerous thing for a server to
do two things that really don't need to
know you know and for web servers that's
really hard because they do require
things like they do have to respond to
that but so it checks 997 closed port
are sorry check the thousand port style
your nice Ivanova we're closed
that's a pretty quick port scan I wasn't
like to run a full one might take a
little bit longer and you can boost that
by having like just more power but this
is a pretty simple server so we're not
gonna push it too much but the three
ports that we're open are really
interesting to me so if you're a web
server you really shouldn't have SSH
probably open maybe at least not to the
public like it shouldn't be responding
to SSH pings from me the World Wide Web
it should only really respond to SSH
from internal stuff so well the fact
that it came back and was like hey yeah
we're good knock yourself out you've got
some stuff on here there's SSH totally
fine valid here's actually the protocol
for it hey my next thing might be well
okay and usually I keep a notebook when
I'm like actually doing this and I might
say okay well SSH is open open and it
responds to the real world it also takes
passwords apparently so I'm gonna I'm
gonna keep that in mind and I might try
and query it myself deliberately okay
the next one is port 80 takes TCP and
they told me what the server is so it's
an Apache server here's the version I
might go and Google that maybe look for
some CDEs
so looking for vulnerabilities that have
been published about that version of
Pachi it has four different methods that
are accepted there's one disallowed
entry in robusta txt it's kind of weird
I don't know why it did that
you know I say here I'm actually suppose
up okay but like we don't know we don't
push we want to be too mean that's a git
repository or sorry not empty but a git
repository that I can go find it's
available published in Internet that's
terrifying I can go look at your git
repository stuff that's yeah thank you
for leaving that open and there's
apparently a web site going on there's a
PHP application going on there because I
could see you're good ignore and I'm
just kind of grabbing stuff you know
like I'm looking around and I'm kind of
fingerprinting I'm trying to guess you
know what things are you going on how
did you build this now I have an
advantage because I also what one I
built the system but - okay even under
this pretense I have a fired employee
I'm really mad that I got fired you know
that was my income and I'm just gonna
stick it to the man yeah to get back at
him and so I I know a lot about this
system and that's really dangerous
because I know how it works underneath I
know where things are on the network
it's not a very interesting network
there's only one device so it's not
terrible and of course you left my
remote access open so you know I
appreciate that
my sequel yeah yeah because I mean you
know in case you didn't hear I kind of
joke from earlier I used to work off the
beach a lot I'm pretty lazy and I would
need remote access to the my sequel
server because I'm the only one in our
company that speaks reads writes and
sleeps sequel so you kind of just left
it open for me which I really appreciate
and I might put force that too so yeah
there's a bunch of stuff on here seems
good to me really appreciate that
there's three attackable surfaces and
there's some Linux info okay you're
running the Linux kernel it's great kind
of figured this is all just running it
deep in it yeah this is just from
running in map with the a flag which
looks to fingerprint OS so it looks to
kind of thing printer services - it says
hey what are you running what things are
going on here what information can I
grab for you now a lot of script kiddies
do this and they're like yeah like I
have much information and I know where
to attack things now kind of but I would
recommend really sitting down and
thinking you know what is in map doing
because it's not necessarily super
intuitive although if you have a little
bit of networking background it should
and it basically just says hey I'm gonna
go send a packet of the appropriate type
to this port and I'm gonna see what
comes back and so if you're familiar
with like pings there are actually many
kinds of pings pings referencing like
ICMP which is the internet control
message protocol and there are many
different numbers that correspond of
different things but I might ping you
and might see hey do I get a host
unreachable back do I get a nothing back
are you doing certain things that time
me out there's all sorts of stuff that's
really useful to know on my end so nmap
can actually do that and map can run
just a straight-up ping scan it can run
like a comprehensive port scan it can
run port scans on specific ports on a
whole network they can do all sorts of
stuff and the graphic interface draws
you a map of everything was connected to
network thanks yeah very cool tool it
was built just one person and he's super
interesting we tried to get him to come
talk here but he's a little too busy for
us so next time but yeah very very cool
would recommend looking through it play
around with it scan your local network
maybe not your working network by those
hand like your home network I will
always advocate only scanning or doing
anything I'm like a home network that
you own the whole thing so if you live
in an apartment weird like your landlord
owns the router and stuff those get hey
make a DPC on AWS and scan that well I
just try so basically and map stands can
look malicious from depending on who's
looking and where because it might mean
that you might be like initiating a DDoS
or it might be like hey you're
fingerprinting the network that might
not be great you know like and if I'm a
network admin who's really like paying
attention and maybe we're out all of our
devices traffic through a centralized
firewall so I can see everything that's
going through and I deny certain things
from like DMZ and so on then maybe I see
you running a network scan and I go yeah
that's bad and I just shut down your
entire ability to communicate with the
network so yeah as starter it says abide
by the loyal and I don't necessarily
advocate that the law is always right I
advocate that you should fit within the
law and if you understand where it's
wrong follow the right process for
fixing it because it I'm not necessarily
an anarchist is basically saying so yeah
we've done have scans your stuff you
have all the services that I thought
were running still running which is
great so now what I might do is
okay SSH is up there - equals up there
and you have a website up so I'm gonna
actually just go to your website I don't
oh cool I asked all your IPO and you'll
notice this is our poor victim just like
wow there are two of us on here and
that's just me and cold you know me
being the pretend neutral party so I'm
gonna open up Chrome and I'm gonna go to
that IP and I'm gonna see what's up
there oh you were testing yourself on
dvwa and this is something where I want
to point out dvwa is a great way to get
acquainted with a lot of the things
we're going to talk about I'm not gonna
walk through it there's plenty of
tutorials online but it is a very like
good thing for you to go ahead and check
out so I don't really remember the
password I think it's admin and password
right oh cool man that was just kind of
random yes yeah this is a great project
I don't think it's updated a whole lot
anymore but you'll notice over here well
highlighting is not working the way I
think it does you can try all these kind
of like old class attacks and things I
think the insecure CAPTCHA is the one
that's probably the newest but there's
all sorts of stuff on here and there's
all sorts of like things to do there's
tutorials all over the place online you
can go ahead and follow them try them
out Bait and give you information on
like how to do this and its really worth
kind of playing through this so you have
like the brute force yeah the command
injection CSRF cross-site request
forgery and so on so it's really worth
kind of just like plan through this but
I left them up here because I wanted to
have a website up so that I could have
an attackable service but I figured why
not hit two birds one stone
put a website up so they go website and
something that I can also say hey you
should go and try out this tool or
activity to get you started so for those
of you who are asking how to get started
with stuff this is a great way to go it
gives you a bunch of topics to go and
explore - worth diving into most of them
go and take around getting good at this
you can change the security level of
dvwa it's currently on low shocker but
you can put it up to impossible even to
medium or high and so on all sorts of
things that you should try and like go
and figure out so worth playing around
with there's plenty of setup
instructions all over the place but I
used it to
of eight having an actual web app up and
also having a sequel database I needed
something to attack so I put that up
okay so you have a website up I'm gonna
go ahead and check your like robots.txt
because it told me that there was one
thing that was denied oh I can't access
the the /what Hat so far because I can't
access everything else so I can't access
just slash on its own with nothing in it
and that makes perfect sense because if
I go to just slash it redirects me to
like the index and I get redirect it
along but I could use something there's
a tool called der Buster which stands
for a directory Buster and it basically
lets me just enumerate all the things
that you have on here I'm not super
familiar with it so I'm really not gonna
demo ate a whole lot but it is worth it
to kind of like try out some stuff when
you go and like this is more manual it's
not automated I just I'm aware that
you've only explicitly denied me from
attacking and that just the slash on its
own I can't access it directly so I
can't see like a listing of all the
things in that directory I could see
like an HTML page like an HTML Drive
yeah exactly
but this and the fact that this is left
open and you know excuse me when I say
you I don't actually literally mean
colton he's innocent he does a lot of
really good things he's very good but
we're just gonna reference kind of the
general you the manager that did this
and you'll notice it leaves up all this
information about the server which is
kind of by default it also just tells me
all sorts of things about things in this
directory and this is kind of dangerous
so this is the get directory that's what
nmap told me that I knew to look here
and I might try and go to parent
directory still doesn't work so okay
it's it's definitely doing that pretty
well but let's take a look at your git
ignore because that's let them okay and
I can kind of explore around like this
which is really dangerous if I'm able to
just crawl through a directory at will
the actual file system directory that's
really bad if you know like no one does
that anymore we all use laravel and
Django and things and that's really good
I think
but WordPress still does sometimes and
there's all sorts of things that I can
try and do on these may be your Django
server doesn't redirect random URLs it
only redirects the ones that you thought
the people were going
go for this all sorts of sneaky ways
people go after you someone says what's
a script kitten and I would imagine an
adorable hacker that tries to go after
people using their claws and paws but it
script kitty oh I guess kitty also
sounds like kitty oh good for your heart
D and T in English sorry it's more of a
funny joke to me script kiddies are
people who they don't necessarily
understand what's going on underneath
they don't really care they see it's
cool tutorial online and they just start
throwing random scripts at people so
kind of end map as the scripts maybe
it's I would refer to as more of a
package or a framework or software but
or really package of software but script
kiddies might just say oh I'm gonna just
use nmap but I'm gonna figure out some
stuff and then I know that there's these
ports and like IPS that are meaningful
I'm gonna use Medusa and I'm gonna just
throw random things at it until things
work and there's not necessarily
anything wrong with being that way in
getting started but it's really not
ideal because you're not really
necessarily learning how it works or why
it works or anything like that you're
just kind of doing stuff so yeah I would
I would recommend not being called a
script Kitty so yeah it's very funny
that people are like it's good kitten if
you hack maybe you're adorable I can't
met yeah like I'm hacked into my
internet ID because like wow that's
pretty cute so I'm gonna kind of explore
around sometimes these things have like
admin interface is like an admin dot PHP
okay so it's not found and login dot PHP
we know exists cuz that was the original
page but there is a shell that PHP I
forgot that I put that there because I
wanted to one demonstrate that uploading
arbitrary files is really dangerous and
two I wanted a way to access your system
directly make sense you know I was we
never again this I I gotta be able to do
that so I left this thing called shell
by PHP M I knew I could traverse
directories randomly I left some of the
old commands that I ran in here when I
was testing with this work so this is a
really common type of attack in
WordPress websites where they allow you
to upload arbitrary files and so what I
might be able to do is I could upload a
file that's actually
what's called a PHP web shell so what
this does is it lets me execute commands
on the web interface and their output is
X is the return of the output that was
executed on the server so forget about
me meeting that ugly like Apache 2000s
look in your face to explore directories
I'll just use my bash commands to do it
it's basically a fancy version that PHP
script we did in the CTF yeah it is it
is exactly that but with a pretty nice
output and if you're like well I don't
know how to code a PHP output it is so
this is another common error that people
make is they accidentally put the wrong
permissions on things in fact if I
wanted to see what the permissions were
on stuff I could run the privations
command from a web interface and yeah so
it looks like certain things are owned
by root that's the upper directory
that's good oh but the shell is also
owned by root that's unfortunate so
somebody was just you know looking on a
web tutorial for how to set up a remote
access and it said hey I ran into this
permissions error where I tried to do
touch shell dot PHP and copying your
code but it didn't work why and some
unfortunate soul said hey if you have a
permissions error running it as pseudo
will work and so I did I ran into pseudo
touch and then I copied everything in
and that's the problem
so did you compromise my macbook i got
like two like two things here
yeah you do have some stuff on your
macbook as you discovered so dan and I
because we need to see how long that'll
take for you that's funny let's take a
long time a computer actually it doesn't
it's not running anything although maybe
trying to remove nobody might have yeah
I tend to wreck it yeah that's what's
just let's just cut to a shot of what
that looks like so that
what happened so to clarify while it
cold
nothing was just nothing close like not
[Music]
too much but we thought it'd be kind of
funny so I also wanted to test how
quickly I could put something on your
machine
um this one but dan and I were in here
and Colton actually went to the bathroom
and he left this machine unlocked and
then that kind of looked at each other
like wouldn't it be ironic if on ice
cream about security we then act cold
enough and the funny thing too is that I
thought about it - it was like we
actually questioned it for a second we
were like wait that's terrible but we
thought it'd be kind of funny that's not
so yeah I basically I have a USB stick
that I carry on me and it has a series
of viruses that can be put on machines
this is a very simple one all it does is
open up a shell back to someone else
well to me but I left it on his desktop
and I didn't hide it or put it anywhere
crazy if he's also on a guest account on
his Mac so I figured it being was
horrifying
um but yeah basically later on in the
tutorial we can we can make your Mac do
some kind of funny things as we know but
yeah I was kind of waiting to see cuz I
could see it on his desktop this whole
time and I wanted to see what he would
notice but there were things on it I was
like wait as I recognize that it has a
weird name it's the brave icon in case
anyone's familiar so I basically my USB
has the brave icon and I also am aware
that my USB if I unplug it before
rejecting it Mac OS just like freaks out
and doesn't know how to remove it
correctly and it leaves it on the
desktop until you put it in the trash so
it's like it's kind of funny and I
thought it was like it is kind of iconic
you know like stares back at you people
are saying waiting for fools yeah you
know I guess hackers a proposal Daley uh
we thought that was kind of funny to be
clear you know like pranking your
friends you know make sure they were
okay with it computers can be really
important to people
my computer has varying devices that if
you like tried to do that on my machine
I would um I'd have my own kind of
surprises for people for me I did
actually have someone steal my laptop
once but I have a technique on my device
that allows me to then access the webcam
from someone
and I see robot yeah a little bit and so
I kind of interacted with the person who
stole my laptop and I was like hey you
know I'm gonna clear my wet Drive if you
don't give it back
but also now that I know where you live
and things like that I'm also gonna call
the police on you and they're gonna
catch you hey I can see a lot of
information in your house and stuff like
that and I think it freaked him out oh
yeah he's like oh crap I was really
proud of that moment but also you know
don't steal people's things follow this
game you do yeah that's just nice but
yeah we have put a small very minor
virus on Colin's machine it's easy to
remove I can tell them how to remove it
it's also sandboxed away up from his
actual device so and I think it was
appropriate but it's just gonna cost
thirty bitcoins yeah I just need oh yeah
so we've kind of show that there's this
kind of this way for me to access your
device as route from the web so yeah
everything that we're gonna show you
you're compromising you're screwed and
there's just this alone is enough for me
to put arbitrary things on your device
this alone is enough for me to do all
sorts of things so then someone says is
it possible to steal Hardware through
hacking and I can't see the rest of
their chat message but that is kind of
funny so when you mind opening up the
channels alright this is good no I was
all good all right so they said it's
impossible to steal hardware through
hacking plant paint someone's MacBook
Pro um to my knowledge you could maybe
like social engineer it back I guess if
you hack the Senate address that was
somewhat shipping the MacBook Pro yeah
you know something somewhere to the game
is mister robot yeah we do which is
horrifying and then someone says friend
is a rubber ducky I believe you mean a
USB rubber ducky not that like I'm
correcting you I'm just repeating for
the audience they mean a USB rubber
ducky which is sold by hack five and
that's a USB looking device that can
actually do all sorts of things when
it's plugged into a machine it automates
a lot of attacks and they apparently use
this on people who do not lock their pcs
not necessarily legal but definitely
kind of funny and like within the right
social environment and parameters
it's about appropriate and it's a sexy
image of
next David Hasselhoff as your wallpaper
and then it runs a wind service which
plays Rick rolls on repeat nice yeah
that's very classy very very funny and
definitely I mean still illegal to
degree but like there are certain things
that you can do where it's like if it's
your friend and you kind of have like
anyone put yeah be aware of what's going
on and try and you know not be a bad
person but yeah so very funny jokes on
these all right so we basically have
thrown through kind of here's a PHP web
shell you'll also notice that's not
secured so all of my stuff being secured
is just not actually being secured
there's no HTTP no SSL we're screwed in
a lot of ways and I think that'll be
kind of a common theme yeah so this
website on its own is really dangerous
and if you just google PHP web shell I
think there's a github that pops up that
has like a ton of them but I think this
one is the one that I used right here
and there's just all of these our PHP
web shells if you find a vulnerable
WordPress website and they're paying you
to or they have asked you to hack them
see if you can upload it or another
alternative is maybe kind of in this
style where I know I'm getting fired but
I want to retain access to stuff maybe I
drop a web shell in the back somewhere
things that you wouldn't notice so I
called it shell dot PHP to one make it
easy to remember and to make it easy for
you to find but I almost kind of curious
are you on HDMI one I'm gonna show you I
would yeah okay
would you mind typing LS for me so we
can just see what's on your desktop or
not on your desktop just on the on the
host
I don't know everything's pretty messed
up right now you might have to just drop
nobody into an actual trash can't like
find her is like locked up that is very
annoying that was not necessarily
intentional I can't really look at this
relaunch my day that's more just because
I grabbed a USB that was okay got rid of
the Python script to is a expected
behavior
yeah it's kind of weird oh you know me
the desk or the oh the desktops tiny
launch finder or that was a yeah that
would do it and then this should issue
reappear baby what interesting well very
good to know we can hand you your virus
back if you like that's it man can I
guess oh emmalin yeah interesting so I
guess the guest version of this is oh
there you go I can access that there we
go and you got all sorts of stuff in
your directory yeah 99 a very important
director is yeah so you very important
directories all over the place
some of them probably contain stuff some
of them don't and there's all sorts of
stuff just sitting in there and
basically yeah so people are like oh
don't you know alias things and stuff
yeah I didn't mess Colton's computer up
at all I basically just threw a file on
there because we were waiting to kind of
see it until you figured it out
but yeah we just wanted to make sure
that you know it was kind of up there I
mean but yeah is if he kind of like
tries to find stuff on his vulnerable
machine on the device that we're using
it's kind of difficult and the reason I
wrote it this way was not just like
throw flack at him and kind of be
entertaining but really more based on
the fact that a lot of times in
production environments you have all
sorts of things going around and this
simulates a little bit easier one the
consequences of bad organization and to
the consequences are kind of the reality
of like you probably have a bunch of
files all over the place and directories
and things and they're really important
to some people but not others and it's
it's really difficult to keep track of
what's where so whenever anyone says oh
it's so easy to find a virus like it's
all over the place there are three
viruses and problems that have been
exposed to you guys since the beginning
of this stream I saw one person catch
one of them at the beginning of the
stream I don't think Colton saw it which
is great because he was busy doing
something else and I was also looking
for it but no one else is pointing out
these other viruses and they're sitting
directly in front of you so or they have
been at some point in the stream so my
point is basically that even with
obvious names I'm hang them like bad or
evil or shell dot php' they're all
sitting there I didn't try to obscure
the names or anything and hack
can write like I can obscure it so that
it looks like an actual name or a
username or a really common trick is to
say hey maybe your username is Colton
right and I switch I add a new user a
malicious user Colton except the L is a
one now you know a quick glance you may
never notice that that's a different
user than you now the computer right now
but you might not and Bobby Knights like
evil stuff wasn't it yeah you were right
I actually saw your message and I was
like yep and I was kind of hoping no one
else would see and so what Bob McKnight
pointed out is would you mind checking
just like what services you have up so
it's like a pseudo service - task status
- all and that's all one word sorry I
status all is just one thing so status -
all it's a very annoyingly built like
that yep perfect so you run that and
it'll very slow we have it through
statuses we're looking for one called
evil coat no there is this yeah yeah
yeah and that's a pretty awful you're
trying to stay on the down low
yeah you would notice that eventually
but my point is there you know what
50-ish people watching the stream I
can't actually tell but somewhere on
that ballpark and one person noticed it
and maybe another one was paying
attention or whatever in at dominates
says I didn't know the stream was find
Waldo hacker edition you're right but
neither was real life okay so it's kind
of my point is basically that it's
pretty easy to hide stuff in plain sight
and then I'm sure you were if you're
paying attention when Colton LS is in
this directory there's a bunch of files
called log keys so that's a key logger
that's built on his machine a nice it's
a pretty simple one but it is something
now I created a bunch of other
directories to obscure that there was
one of them is important not necessarily
one you think and then there's also this
thing called shell that PI named it
pretty clearly like I wasn't trying to
like be creative here I you know I'm not
too creative necessarily but um they're
all viruses they're all problems and
things
yeah Bobby that's really autonomous nice
talk wait there's all these things on
here it's so bad and you're right that's
exactly right
her bad thing is sitting on here but
it's really if you
familiar with these systems like maybe a
manager for example it's really
difficult to know what's bad and what's
not and it's kind of horrifying that
some of the services and stuff don't
really look super like correct like they
don't necessarily seem particularly good
unattended upgrades in English sounds
kinda bad like I'm not paying attention
to it and it upgrades things one of the
white hat jobs I had was to write a
virus that sat in the DLL for a Adobe
update so when I gave it to I kinda it
was a phishing attack so I emailed out
pretending to be the IT department for
the company that asked me to hack them
and I said hey you know I'm your IT
manager none of them knew their IT
managers name by the way so I just made
up a name and it worked like no one no
one was like huh do we even employ a Jim
Logan no like no one thought about that
I just did that pretended I was from
their IT service use an email that
wasn't even related to their company or
anything and managed to get past their
spam filters and in that email I said
hey we've discovered a really important
security vulnerability and it is
imperative and the email actually the
subject line said important to read this
now and I said it is really important
that you guys update your Adobe suite
software's right now because all of you
read PDFs
oh I don't know any of this but I'm
guessing and it's pretty reasonable and
64 ish of them out of a hundred
employees give or take it's all like
ballpark did it they install this virus
now the virus doesn't actually do
anything in terms of the security update
it doesn't update your Adobe suite it
does nothing but it does install a
script that runs back to Metasploit and
says hey I'm running now and I'm gonna
run every time they reboot their
computer computer in fact every time
they reboot their computer I'm gonna try
find a random device on the network and
I'm gonna hop into that device too
because Windows machines are on a domain
and sometimes that's possible so by the
end my little virus was on all their
machines and I told they're the people
who had hired me for
this kind of pen test and I was like you
know your employees have no clue what's
safe what's not not that they're stupid
or anything of that sort they're very
intelligent people but and so start nerd
points out how come these guys had admin
privileges on their pcs they didn't but
a pass the hash attack worked fine and
once I could get from their device from
their privileges to admin or sis
privileges that's pretty easy basically
once I'm on the device it's it's pretty
dangerous you really should be very very
careful I mean this stuff just wasn't
configured necessarily perfectly right
and it's hard to maintain perfect
configuration so ya hopped in easily can
I told them what was going on and I
recommended that well you know one you
should harden your domain for Windows
and also you should do all these things
but one of my main points was you got a
teacher in place what's going on you
know like they should have kind of as
Andre Patel and says like you should
have IT people and like communication
protocols in your company IP should not
just be randomly emailing the entire
company and saying hey do this and no
one should listen to someone who does
that like there should be protocols in
place for good reason for that reason
safety security so yeah there are all
these things that um should be done but
they're not and I think that's one of my
main points here is none of this is all
that crazy it's actually pretty easy and
like people do it like it's a real
concern you know you look at a hospital
there's stuff and domains and things are
often set up by non technological people
like they're just not familiar with it
it's not that they're stupid or anything
they're very smart they just it's it's a
domain-specific field you need someone
who's an expert in it because there's so
many ways it can go wrong
someone put I think a dork yeah now do
you think that's a Google dork is like
you can throw that through Google and
it'll give you a bunch of sites that
have all sorts of problems what is it
you know like you can try the sort of
thing out that sort of thing I would
recommend avoiding unless you know I'm
not going to officially endorse it and
I'm going to say that that is you know
you might be breaking laws if you go
throw a google dork in and grab a bunch
of random websites and then attack them
that's you know that's against the law
so you know it's worth knowing someone
says not all IT staff are Harvard
educated that is true I think it's not
necessarily that so much as
we need in general just better security
practices and advice and education
because people have a lot of devices now
but not necessarily they don't
necessarily know why they're dangerous
or how to make them more dangerous or
how to make them less dangerous and so
on there are a lot of dangerous things
out there and people aren't really being
educated on it so I'm pretty much all
for education but I'm also all for a
bunch of other practices that would
institutionalize making things safer for
everyone so a little bit less lecturing
we'll hop into some demos so we demoed
the kind of shell that was sitting on
your machine but there's some other
things we're gonna throw so I'm gonna
switch back over to mine
we're back in Cali hacker land yes and
what we're gonna do is I know his IP so
I also know that SSH is open so I'm
gonna go and throw a Medusa attack at it
which is gonna try and crack your
password and username now I have some
like reasonable guesses as to your
username I also aware of the user names
I also don't want to spend the next hour
cracking your pass right so I'm gonna
throw this through kind of like I kind
of know what the password is ish but
it's a really common password and it's
it's not wild that it's there so if you
read through these kind of flags I put
them up there for myself as well
lowercase H is the target host name
lowercase U is the user name and then P
is the file containing passwords to test
one line per password and then M I
believe is the module yeah capital M is
the module so basically what I'm gonna
do I'm gonna say okay let me do some Hsu
the username I'm going to try and crack
is same thing - it's a pretty reasonable
user now normally you'd have probably a
list of these user names you just try a
bunch of different combos I don't have a
password file now that is kind of
annoying hmm
I don't want to generate one and this
isn't gonna work if only there is a way
and there's a particular one that I'm
thinking of obviously does that like
a plaintiff dictionary you said one of
the utilities had a leet-speak
dictionary right it does so John the
Ripper does but I'm gonna just pull a
random and password thing from can you
type like output from John into Medusa
and then use it yeah and that's actually
a more common framework pipeline for it
where you don't necessarily do just
these I'm looking for just one that
looks like normal common credentials
particular thing I thought hangout
required dozens of screens and a cool
dubstep montage oh the deficit month
yeah actually is required you are you're
correct no I think that is very much the
oh sorry there are some swear words and
bad things on here so we'll try and skip
those didn't really sanitize sorry so
are you guys so I'm gonna just W get
that password list so I now have a
passwords list I also have a head got PI
that was a lie thrown to your machine
Angela I'm gonna nano that to include
the password that I want kind of up
closer to the top I don't remember the
password I actually used so I'm gonna
throw a bunch of them on there and one
of them probably works
let's see if this let's see if this
works I will try to add some dubstep
source um does Stephanie just a little
bit when I I'm not sure freaking here in
the house or not
yeah well this is kind of like more than
kind of like dubstep hi keyed up so a
little bit of a little bit of low volume
music again perfect yeah so we're gonna
throw Medusa at his SSH and now we know
that this will probably end up working
I think assuming I put the right
password in there and I'm gonna shoot my
screen a little bit so that things are
all on one yeah it goes so we go through
here and it says hey I found an account
there's the user of YouTube password
hello world worked so now if I go ahead
and host it's right here I'm just go
ahead and copy this I'm gonna just
verify that that's true this is actually
a terrible practice on my part to go
ahead and immediately verify that that's
true because he has any like
hypothetical dang it
typing live indoors if you have any sort
of like reasonable systems in place or
like how people are gonna start
suggesting like banning password usage
on SSH then this wouldn't really work
but it is very important to realize that
some people do have things configured
like this now one of the main problems
with how this works is in his SSH
conflict there is another problem with
the fact that I can just become route
immediately so password list route now
if you're like oh but how would you know
that without having built that sudo
bechamel tells you okay
the pseudo vegetable tells you what
things you can run as the super user
well if I didn't have access to just
being able to be super user by doing
this then I would probably try and guess
the same password see if I could become
the super user using that same password
a lot of people reuse passwords so that
would be a reasonable guess now the
reason this is a really dangerous way
for me as the attacker to just
immediately go for it cuz I don't have
like a plan of attack like I'm not
trying to put things on there yet I
don't have any like understanding of the
network I don't know enough so I
wouldn't really do this I was actually
way not testing because now if he types
W oops
there is a third IP that really looks
weird there's a third thing on here that
is really not good and so that would
generally be like oh hey I mean if
they're monitoring like people who are
logged in or they have
files that say hey there were a
bunch of unauthorized access attempts so
for example if they Kat bar log don't
whoops there's a threat his devotees I'm
sorry under vlog oh yeah so I forgot
there's a bunch of other evil keys on
there very nice kind of sticks out at
the wrong color and it's labeled
literally authorized evil Keith so I'm
glad you noticed um where's awesome log
oh there it is so if I can't hop that
log there are a bunch of things this is
a little too big
well shrink it down so it's all on one
screen looks like a Windows system
you'll notice that there were a bunch of
like authentication failures which are
really bad and like disconnections and
things um if you have like any sort of
standardized logging system or any sort
of reasonable like indexer or alert
system they would see those and go like
hey there's somebody who's trying to
force your password for ssh you should
ban them and someone recommends a stool
i tool like fail to ban yeah like that's
that's the whole point is to prevent any
kind of attacks however sorry about it
it is getting harder to read um I will
expand it again it was just hard for me
to read I couldn't parse through it so
yeah being very very careful about you
know look like this is just one of many
attack services and so eventually it
becomes too difficult for someone who's
like a jack-of-all-trades to actually
try and go through and then all of a
sudden there's a successful sue and I
became super you see so like logging
files
sounds kind of boring super useful look
at Splunk look at other se IMS look at
or s AMS look at it like the elastic elk
framework and stack like there's all
these ways to make this possible in fact
it even has a built-in way to do
centralized logging on Linux systems you
have remote syslog I can log anything I
want to a remote system and have it
analyzed stuff build indexes make it
searchable spunk does that for you and
it's a little bit prettier but so on tux
man says when I run a or site when if
you try to run an authorized sudo
command that says this incident will be
reported who was a reported - it's a
great question a lot of times no one no
one notices and that's horrifying
it's really important that like good law
practices are in place and that you know
what's going on in your systems and I
say that but the caveat is here the
thousand machines how the heck are you
gonna know what's going on in your
systems and that's where the systems I
recommend where it's like hey go and get
a Splunk system it's built for
enterprise go get an elastic stack that
can do all that for you
get it service that can index the logs
as they come through and graphically
display traffic and where it goes that's
what they're for and it's important it's
all very important so yeah there's all
sorts of things to check radford a says
it should send a email to the root user
which usually is not sent to any level
yes that's exactly what goes on it's it
meant if it's configured correctly it'll
send an email to someone and say hey
like yeah whatever is it never
configured correctly probably not but
maybe hopefully I hope so you know
there's all these things that are going
on we've now brute force as SSH the
Medusa attack that I used is not
necessarily super interesting to use
against my sequel but we'll throw it
against it anyway now this one is a lot
faster because I can test a lot more
passwords without getting deopt as
quickly now I have kind of oh well also
I'm using the wrong user sorry that's
like I really should have found it by
then although I'm really glad we could
pipe through so many passwords so
quickly so I'm gonna try like admin for
example very common my sequel password
and it doesn't look like we could hit it
so I'm gonna stop going I know that the
password that it that should work is on
there somewhere so admins not so much
what about like a remote admin sometimes
people try to be clever with their names
and what it really secure password to
very secure it sweet spoken no one knows
leads me and so start Nate says these
phantoms are amazing thank you yeah I'm
saying can you start executing arbitrary
Mike reason yes I can run arbitrary
sequel queries in fact they probably log
into your my sequel database and maybe
remove it for you
we can do that and that's horrifying
also maybe you have some like sensitive
information and
I can take that for you do you know I
can actually I store that for you such a
generous house yeah it is kind I'll just
sort for you and you can pay me to get
it back and that's how some of these
attacks work so that's maybe so for you
it's a kid it's a I was almost gonna say
it's a cute little it's a brilliantly
well-written tool and it does all sorts
of cool things oh but it's really useful
now what it goes in does is you know
it's some questions you should ask
yourself and try and answer are you know
why is the SSH one so much slower why is
it really suspicious to run these sorts
of attacks what's going on underneath
how do i how would I build this myself
what python utilities could I use for
this how about an R have an in C++ what
kind of things are happening underneath
the hood what routing things have to be
in place for this to work and so on so
as much as I am kind of just quick
demoing things it is important to keep
these in your heads so that you're not
just becoming script kiddies so yeah we
did no purpose we we have like
everything working out so that you guys
have to make sure that you're not just
like arbitrarily running scripts for fun
I think it's really important to
understand what's going on so we've run
some kind of standard attacks so I'm
gonna hop into the final the third
segment for today and the last one for
today and it's I think the coolest one
because I love Metasploit there are
other tools that are kind of similar
like CrowdStrike and Cozart cobalt
strike and so on we're gonna use
Metasploit because it's free and very
well written
there is a compatible GUI armitage that
I think is also from rapid7
that's a company that makes it and
definitely worth going ahead and like
checking out Bob McKnight says are you
gonna ddos I'm actually not going to I
don't embrace the machine I
I would love to it's actually fairly
easy to generate enough traffic to DDoS
stuff but especially because of his
device we actually just take a look it
only has one core so it's not super
capable of handling much it just has the
single processor zero index processor
there's not much there if you're
interested in kind of like researching a
little bit about how DDoS attacks are
working right now then there's a whole
new class of them coming out using the
it's using a caching I think memcached
is what it's using and it allows you to
amplify your DDoS attack from what one
device by like five thousand times or
something it was like it's really good
you should go read about it it's really
cool and well done and it's been used a
couple times where it basically uses
these caching servers that allow us to
have like much faster response times on
web pages but they're in the wrong place
they're open real basically just
misconfigured such that I can use them
to cache all of my DDoS stuff and
amplify it and then throw it all at a
database at once and the kind of hand
motion for that is perfect because it's
just this enormous flood of data going
after a machine now this machine can
handle a whole lot this one has like
what um maybe like a couple of mega but
like it's I think it's a gigabyte of RAM
give or take and one CPU and it's not
been optimized mr. built correctly
there's no load balancing it's not
distributed there's no that it's just
like a single device that's like hey
please don't tell me so you know we're
gonna we're gonna not ddos it but we are
gonna use it a little bit more so the
thing that I put on is a Colton's
computer was done using an MSF sorry
Emma so venom and
MSF commands are a little slow sometimes
but this is kind of the like help sheet
for it and go Google documentation I
basically said okay my payload is some
Python interpreter which is a particular
interpreter that is really compatible
with net Metasploit in the framework and
then I wanted to use a reverse TCP now
there are a bunch of other types of
shell I think there's like reverse HTTP
or HTTPS and so on you can list them out
and whatever I'm just super comfortable
with this one so I use it my out port is
equivalent to for for for just a port
that I want to connect back to me on my
L host is the host of the machine oh
sorry that's your machine I want it to
actually be my machine so we're gonna go
up a couple more like 10 oh I was one
off sorry there we go
so I could put this L port or sorry L
host as this there's a bunch of other
flags and you can encode it remove no
bytes you can make it compatible with
different encodings and
making an executive bowl for Windows
we're gonna just leave it as kind of the
default so it's just a random like just
a normal very vanilla you would a virus
detector would find it and even most of
these encodings they'll find and then I
would normally pipe it to the like ahead
da PI but I'm actually not going to it
has like my favorite signature virus
someone's gonna go and impersonate me
now I'm doing that I just realized yeah
so I'm gonna switch my new favorite
signature virus h3h3 just yeah that's
way too big and if I run this it now
sets the el portal host parameters for
the payload and I have kind of just
generated a piece of code and it looks
like this but I'm gonna explain what it
does a little bit so that we're not just
arbitrarily script kidding things so if
I pipe this into like dev null so that
you can see what the actual output of
the command is to standard error the
actual like virus gets output standard
out the output of MSF venom which tells
you how it worked and what went in that
gets pipes to senator so you can
separate the two so basically this
command is or it's kind of just like a
series of commands the reason that's
base64 encoded this make it just smaller
it's an easier representation of the
data and you'll notice that there's a
couple of familiar Python commands up at
the top like import base64 for the
encoding and decoding step import cysts
that I have access to the actual
underlying sista that Python touches and
then exec so I want to execs acute the
string that is in here in Python and the
thing that is in there is so the thing
that is in the exec kind of argument
lets me decide all sorts of stuff about
the parameters of the actual code that's
in there if you go and decode this it
basically opens up a port connection
back to wherever your Metasploit kind of
server is running and it says hey here's
a connection you can give me stuff give
me the actual bulk of the virus and send
it back to me and then I'll execute that
underneath no so about ignite the string
is not random this string is actually
meaningful you can go and decode it and
it will tell you all of the actual steps
that the Python
two runs seal 45 says you didn't set
your keep passing bytes or set the
version to allow MTurk shell for the
root level yeah we didn't do any custom
configuration however this still allows
me to get access to whatever that and
all right sorry whatever privilege is
the person who runs it have so this
isn't a particularly interesting virus
it's not complex it doesn't decrypt
itself doesn't do anything autonomous
it's not super crazy but it does do some
stuff that's a little dangerous so it is
I mean as any access to your system is
dangerous so it is still worth kind of
looking at and this is more of kind of
like a brief like here's how you can
generate payloads really quickly in fact
we were able to generate one we myself
and Dan were able to generate one while
colt was in the bathroom taking like
five minutes or so and we were able to
not only generate it but I moved it from
the device that was generated on to my
device to a USB put it on his machine
and then put everything back without him
really noticing for like an hour or so
yeah that's wild I think that's just
because I pulled the USB out before it
was I didn't know if I like restart that
would probably do it yeah it'll refresh
your your guest account I think so yeah
we basically do all sorts of things so
oh steel 45 says you're discussing the
bypasses maybe but how are you going to
do that without setting the version for
the callback of interpreter yeah so
bypassing antivirus you would normally
have to do kind of like you'd have to go
through some like gymnastics to
eventually do some gymnastics you you
have to take some steps to actually
bypass some AV so you should probably
encode stuff you can add all sorts of
like fluff code to make things look like
less like a virus signature you can have
it have like some sorts of behaviors
that are very non virus like maybe does
have some advanced stuff with it
sometimes it'll sandbox stuff and then
run it as they says poor colton your
machine should be okay it's basically
just like messy what do you say
messy unplugging of a USB I don't want
to cry yeah now when you and decrypted
it'll be a giant man anyway so yeah
there are a lot of things that we would
have to do to get this to be workable
however I'm not trying to arm all of the
script kiddies you do have to figure out
how some of these things work yourselves
I'm not trying to give a literal how-to
I'm like how to create a virus and hand
it to someone but it is worth kind of
knowing and seeing how it works
so what we're gonna do is we're gonna
run the actual Metasploit console which
gives us access to kind of be like part
on the back end that I can use now this
is something where it is kind of useful
to look at the services that are being
run so we're gonna run this zero maybe -
I have a refresh rate like this we're
gonna just run the regular restart
wasn't working well that's wild I
promise I did not actually put anything
crazy I think it was literally just like
oh whoops I'm terrible I can't take
those sudo service add status no I'm not
sure why that might actually not refresh
fast enough so we're gonna just put it
out as this we're gonna say sudo service
evil underscore Co status so this
service is loaded and activating with an
auto restart and doing all sorts of like
interesting things going on and so that
I think is really worth looking at in
terms of like its exit code was a
failure and so if I ever do like sudo
service - - status - all you'll notice
that evil dot or evil underscore Co has
a negative sign next to it which should
mean that it's off that it doesn't work
nothing is there so basically it
shouldn't do anything it's disabled it
seems now you'll note that Colin's
machine is now working just as an f5 in
my regular account it's gotta go back
yes it has to count maybe still shot
hopefully not but just to be clear I did
not ready I'm not people are saying that
you definitely definitely having
hardware you gonna take it home I love
my beautiful Mac I think I have no
desire to replace her so yeah Rebecca
Maloy its console and I just kind of
shown that from his perspective that
that service isn't even online so you
shouldn't even really notice it like it
might it was a weird service but it's
not online so in msf or in the console
I'm allowed to do all sorts of cool
things there are many many things to do
and many ways to use this I'm gonna use
kind of like a particular one which is
the multi handler which basically
listens for multiple kinds of
connections and just given a certain
payload can then deal with what should
go back to them so I'm going to set
actually I'm gonna show you guys some
options so if you show options there's
this and then there's also the Advanced
Options and the ones that I want to turn
on so you set to change different
variables you use set G to make them
global I'm going to just use set for
this particular option exit on session
is something that I actually prefer not
having to be true I like having that be
false and the reason for that is I want
this to kind of like continue looking at
things and model and like waiting so I'm
also going to when I run the exploit I'm
gonna run it as a job rather than just
running it so that way when it succeeds
it'll still keep running so it listens
for more connections and throws them
into background sessions so the kind of
idea behind what we're doing right now
is I create some sort of listener on my
end and then somehow on the like machine
that I've compromised it connects back
to this listener it says hey I'm alive
oh good hey hit that pious ball and hit
up is done thankfully these so actually
will let you run that and we'll show
what's going on like so hesitant to run
at this
don't run it yet but we will eventually
run it it's just run using Python so I
didn't do anything crazy you just do
like Python and then that file but don't
run it yet
and so I really think it was because
when I pulled the USB out I didn't it
that might get it like for doubt
so that McKnight did say gave me a good
lesson to remember in the future against
something malicious yeah I guess it was
intended that way it wasn't like me
teaching you a lesson so much is like
yeah so actually we'll have this listen
for your device first and then I'll
disable it and turn it on for the device
that we're like actually compromising so
the paper that I gave you is a matter
Pratap a load so I'm gonna set the
payload to Python meterpreter everyone
always should be aware that I'd suck at
typing just I like to remind people that
bad and then I'm gonna set the L port to
4 4 4 4 which i think is what I set
yours to and L host is just gonna be 0 0
0 Oh No
there we go so that says just listen for
connections and so what I can then do is
I can run this as a job and I can go
here and it's just listening just
listening for things connecting back to
it now this is sending the wrong stage
to stuff so it's gonna die in certain
weird ways basically evil Co is actually
connecting back to it it connects back
constantly but we're gonna have colton
also connect back to me so those two X
sessions are actually all going to die
if I type sessions you can see that
there's like ones that are available but
they're all messed up and weird so
Colton you can go ahead and press enter
all right cool and that'll connect back
to me and you'll notice that your
command is now done so you can actually
like you know just noodle around and
play around whatever but you have
actually now opened something for me and
I believe this is your IP and like is
this your card yes sorry it's a little
small so we'll make it a little bigger
it is my public name so that his
Colton's public IP which means
meterpreter session 5 is something that
I'm really interested in so if I type
jobs I actually get this jobs and these
jobs - K 0 so I'm gonna stop job 0 but I
still have all these active sessions
which is really cool so I'm gonna
connect an G article and I love it it
identifies it yeah that's so yeah I now
have access to his co said his Colton
he's a computer and that's in session
five so I'm gonna connect to that
sessions five and I know have them
interpreter so I'm gonna look around a
little bit
I won't hey this is a private alright
sorry not private a like specific for
being hacked device so I'm gonna there's
nothing too crazy on air I think there's
no personal information I hope oh sorry
I forgot so I can type shell and I now
have no job control but that's okay I
can see Who I am
oh sorry so Who am I very nice John
Harvard I think is what he said happens
I can LS some sorts of things I can type
bash to get into a bash shell which I'm
a little bit keep I keep trying to like
push the screen up to get things to work
properly and I can like CD to see what
John Harvard's home directory looks like
very nice yeah 3d pong on there right
cool and yeah all the other sessions are
gonna slowly start dying because they
don't actually work like they were given
the wrong payload someone says RM RF
slash I won't do that to you but what
does something that's a lot freakier
actually is your volume up Evelyn I
could actually turn it up from the
console but it's set to go Alex it's on
my HDMI we might not want to like blow
people's ears we can make it go through
yeah I'm going through now so if we do
this it'll say hello quality it might
have just blasted everyone's you do all
the time to one more time
hello there yeah yeah yeah so that's a
fun one I'm a huge fan of like if I'm
pranking someone and I would never do
this this would be illegal but if I'm
writing like my family for example I do
have some viruses sitting on some of my
family's old computers so if anyone ever
boots them up they do notify me and when
they do that it kind of talks to them a
little bit and I think that's really
funny
yeah sorry if y'all were listening event
it was super loud Oh awesome Bobby
Knight says it's not loud I'm gonna take
your word for it it's not bad and so I
basically have full control over this
and I can do all sorts of awful things
and that's I think horrifying
if I go onto his desktop though sorry
it's a little slow because we are doing
okay thank you and I see how that PI
love we're gonna just shred her head
that pine you don't have shreds it's a
Mac sorry we're just gonna remove - oh
no tab complete I don't know what we
just tried to remove but hey there's no
200 feet that it kind of talks really
hard everything disappeared and you'll
notice on your desktop now there's
nothing there yeah so we can actually
even like yeah nothing's on his desktop
I've removed it but you'll notice he
doesn't really see everything going on
um he doesn't know what's happening here
I don't think wall exists on OS X yeah
so I can't like necessarily directly
communicate with them but I can see what
processes he's running so I'll switch
back to mine and there's a bunch of
stuff being run this is where things are
a little hazardous is I can see stuff
that's run by your actual user Oh which
is a little I think frightening and then
there's all sorts of things on route and
I can see stuff from myself as well I
can see pretty much anything that's
running on his machine actually and the
kind of key thing to remember I'm going
to exit out of this shell and exit back
into meterpreter which has a lot more
pretty controls it's important to
remember that I didn't even just have
this sitting on something I generated it
configured it got it working in like two
minutes or so so for the fact that like
it's essentially a script kiddie style
attack but I mean I do promise I
understand a lot of what's going on um
if not most but it is a very script
kiddie style attack and I can do
anything I want
really within this machine how do I
disable that process that was really
consuming right sue me there's a process
that's running so if you get on your
machine
I saw the meterpreter script running so
it is still up there how might you try
and go about finding that process I
would probably I usually use what is a
Activity Monitor and then
processes section whoops
sounds reasonable to me I'll run a
process that's pretty CPU intensive so
that you can see it a little bit easier
it'll jump up a little bit it looks like
just as Python yeah so if your web dev
or someone who runs Python a lot and
you're not paying super close attention
I mean I'm writing something that's like
fairly intensive it's just repeating the
same commands as fast as it can so
that's why it shows up at like CPU at
like 105 whatever Oh nope I do not want
to sing terms of that channel oh I can't
actually sick terminal channel yeah oh
there's a channel so now when it's like
sick terms that you'll notice it drops
from being high-intensity usage to
almost nothing so you may not even know
it's there and Python you know you use
Python a lot I'm sure oh yeah so maybe
there's a bunch of Python stuff running
and you will know any better whether
it's like you know legitimately run
yourself or whatever I wanted to confuse
you with it then maybe I drop into a
shell again and I fork a bunch of Python
processes that are all running at 100%
and you kill all of those and you're
like oh I got it
you know one of those is the virus but
the real one was the one that said zero
percent it's always right so there I
would like the CPU time thing to and be
like done very interesting and I think
that's where Colton has some advantage
in that excusing he has some like useful
background knowledge and kind of
intuition for what's going on he's like
please stay out of my system I believe
you will shut me out if you click quit I
believe that does kick me let's confirm
this yeah let's uh verify that for
Colton sake so we're gonna switch back
to mine I typed LS after he pressed quit
yeah there's also this weird I Oh error
yeah so the reason for that was I was
running an intensive process to like
make it pop up to the top of your screen
but basically if I once I press control
C it the way meterpreter looks at it is
there's a channel that's been open to
communicate all that back to me so when
I close that channel it might notify you
by accident because it does that and
you'll notice I'm now timing out so I do
not have command control of your
computer nice and I promise that it's
now gone I tried to destroy it as much
as possible so now that that's all gone
that was kind of a bug little endeavor
that loves something that related to
Louis yeah that was cool this project is
you hack now I would not blame him for
being very much like scared that
everything there is broken I neglected
to thank Muzammil Khan Harvey's paradise
boost up against him is true Theo
Radford a Nicko Circosta sand floor and
follows much appreciated yeah thank you
guys we really appreciate this I need
100% CPU just to do hello world anyway
demonstrated kind of a real world this
attack it's not a real attack in that
you know I had some stuff going on but I
you know if you stuck a bunch of those
on a USB and then just like randomly
hopped into people's computers and
things it's super illegal and I would
not recommend doing any of that but a
hacker could and that's the danger is
don't leave your computer unlocked you
know it's very simple I actually have a
hot key on my keyboard that lets me shut
off my computer with this way so yeah
there's all sorts of things
and luckily Colton's well humor and a
lot of it you know Ballack says just
lock your PC D it's like he's very much
noted never trust me with this device
again he might just take you with him to
the bathroom it would not be super
shocked
we're actually gonna set this to Unix
oh my god I can't remember I think it's
Unix local reverse TCP that might be
real payload okay we're gonna do that
and grep command yeah sorry it's like or
them I needed this show command yeah
it's I'm not I don't play around with
Metasploit as much as I would love to
I'm busy doing stat P so that's a lot of
the time but it is kind of useful to
like know the payload it's like if you I
was doing this a lot I would know oh I
can't pipe that into command okay
whatever we'll just
skimmed through it's a little too big
for me to read it effectively so we're
gonna drop that
trucha nice is gonna go hack the local
police they say I come block I would
certainly not recommend but you know
like whatever you doing whatever you
want to do go for it yes I'm looking for
command UNIX command local UNIX closes
MSF has search command it does and
you're very it would be smart for me to
do that I'm looking for like speedy I am
really surprised that I can't remember
the name of the one that I was using I
can also type history oh maybe I can't
dive history
oh no I typed it out get out this mine
Oh command Unix
just kidding I thought there was local
in that but I guess not
so we're gonna actually command UNIX
reverse TCP and I'm sure all y'all are
complaining now that you can't read
anything oh and that's invalid
oh that's also an element there's an old
one that I use that like worked fine I
think this one's it I was playing around
with a bunch of stuff I don't really
remember what I was doing there you
sorry there's no stuff yes so as has
been pointed out I'm sure a bunch of
stuff in in the group chat is that like
you can search stuff and things very
good point
I just so yeah we now the right payload
we can show options again just to make
sure that all of our options are set
correctly shell everything's good
everything looks fine our payload is
good and if we show in advance
oops typing is always difficult every
time there's a bunch of okay these are
really hard to read when they're not
it's spaced out correctly now things are
kind of like correctly identified you'll
notice exit on yours exit on session
excellent session is still false which
is great so now I can run this as a job
and I'll bring this back up to big size
and basically what's happening here is
I'm really just waiting for that evil co
exploit to come in to connect back to me
and you'll notice that's exactly what
just happened now that one has been
given
right payload this time it knows how to
handle it I think so we shouldn't see
any new ones open I should be able to
actually sessions eight connect and have
everything interact correctly that may
not be true I don't really remember what
payload I put in there it's like probs
about right yep cool so I type ls' I get
to come kind of like ugly looking things
I can switch shells but it doesn't
really tell me much so you kind of have
to like keep track of what's going on in
your head it's not as nice as like a
full meterpreter but it gives me full
access to his machine again I mean I can
type Who am I I'm really cool and I can
do even like a service stashed out of
status stash all and very slowly get
those pipe back out to me now this one
is the one that I don't know it's just
like I really like this particular one
this particular exploit because I now
have full control and I can switch in
and out of it from my machine so and
it's just using Metasploit it's very
nice it's just so convenient it does all
sorts of cool things for you in fact the
way that I set this up which I was gonna
demo on stream but then I realized I
just didn't you know it wasn't necessary
it was I actually had an original shell
script that connected back to me and
gave me a meterpreter shell and then
what I did was I told Metasploit hey
throw a new exploit in that's a
persistence exploit I want you to
install a service called evil or evil
underscore Cove and I want you to take
that service and have it connect back to
me every 10 or 5 seconds or something
and I want you to do all these things
and I want that service to look like
it's dead all the time and I don't want
it to be a hidden service I just wanted
to be there and so that's what we ended
up with you got evil Co it connects back
to me every 5 seconds and I was able to
create a listener that waited and it
successfully waited for it now I can
exit out of this shell in that session
and I can go back to here but you'll
notice that if I typed jobs I still have
that handler running and I just killed
its last connected
so it'll connect right back to me so
even if you figured out which process
was being run so I'll make that a little
bit easier on us
if I that's not a command Metasploit
sound gonna search through all commands
it knows and try and find that sessions
nine I'm interacting I have LS yes who
so this is now just a command it's
relatively CPU intensive I like to run
it to make things easy to see aux and
we'll notice that there's this yes who
command being run by route and if we
were to do like a top sort of thing
there are some things going on that look
a little shady and suspicious
those aren't right again Python is kind
of the like oh that's wrong that's just
because I'm using a Python River shell
you can use ones that are hidden in more
clever places you can use things that
are more I guess interestingly built and
so on and you can essentially hide these
processes a lot better also if you have
a full meterpreter running on it then
you can actually have it migrate which
process it's in so we can spawn a new
processing and hop into an existing one
it can do all sorts of cool things so
there are many many ways to kind of
navigate this if you want to be creative
and that's one of the things that really
got me into the like white hat hacking
was one it's legal and two I get paid
always a good start I like you have to
make a little baby for things three it's
super fun
and four I get to be creative I get to
express my creativity that way I used to
be a musician actually so I expressed
creativity that way but when I came to
college I kind of switch and people are
always like oh you know stems not super
creative or whatever I think that they
just misunderstand how stem works but
this is something where you can be very
creative so you know going around and
trying to like figure out how to exploit
something around how people work how to
make it hidden how what do people
actually look for what are they really
aware of it's a lot of psychology it's a
lot of trying to be interesting you know
I think that one of the coolest things
I've ever done is built a virus that
leaves a very obvious signature it's
very available I left it on a machine
and then I took that virus migrated it
onto a new machine
and then had the new machine run a ton
of stuff that was like brettly just
hitting the network all sorts of scans
and everything and it hit just every
single device accepts it ended up
leaving alone the device that it had
originally been put on so people
recognized that the second machine was
the problem they killed it it cleaned it
everything was good they were taken safe
and secure at their machine their
network everything was clean except the
device that it originally came from was
not clean so you just do it again
so there's all sorts of things that you
can do and as is being pointed out in
the chat there are many ways to kind of
go around and like to counter specific
things my point is I just have to be as
creative as needed you know I can just
cope with as many different ways of
exploiting your system as possible and I
have scripts that will do that for me
I have scripts that will drop as many
different shells we actually didn't even
touch on the fact that the the SSH keys
is really badly misconfigured on this so
I'm gonna actually go into at CES SSH
and I'm gonna cat SSH DS config and I'm
gonna throw it through less so there's
all sorts of things that are badly
configured in here but one of the ones I
want to draw people's attentions to is
permit route login I could have just
tried route and tested its password
that's horrible
don't do that no one should be allowed
to remotely log in as root that's just
it's just another layer of protection do
not let them have everything you'll
notice that there are some other extra
authorized keys files sitting around so
it's really my one of my scripts that is
one of my faves
it actually swaps out your sshd config
with whatever like once I have a root
access to your system it swaps it out
for something like this it's punched
four holes and then I actually don't
deny pub key authentication though I
allow that as well so if you have funky
authentication that's usually allowed I
don't want you like my usual goal is to
sit in your system and make sure you
don't realize I'm there I don't want you
to be disrupted I don't want to mess
with anything I just want to get there
somewhere but yeah normally this should
be it yes this should be a no none of
these should be available except for one
of them
that one everything else should be
completely ignored there's a bunch of
other stuff there's like Pam modules
that should be enabled and things that
aren't there's all sorts of
configuration things in here that should
be done correctly and none of them are
none of them are built correctly I
misconfigured it as much as I could in a
very short period of time so definitely
be aware of how certain things should be
configured that's just one service if
you go up one and go into my sequel
there's a pretty bad config in here as
well I think it's my sequel comedy and
if I can't notice there's a safe one and
knowing is it are people should but they
don't and will pipe this through less as
well there's some other conflict details
in here too like where should I be
running things who should I listen to
who should i bind the address to for
example this binds it to the thing that
faces the World Wide Web all interfaces
it's terrifying I didn't do anything
horrifying with these parameters but you
should be aware that they can be
manipulated just all these configuration
details and it's really difficult to
know all of them you know like I play
around with this stuff all the time so I
know a lot of them but I don't know
everything and I'm not necessarily
always thinking as creatively as
possible
it's one of the reasons that hackers are
so dangerous is there
their objective is a lot easier I'm
gonna kill that process objective is way
easier than the objective of the
defender right in that all I have to do
is find one vulnerability all the
defender has to do is prevent every
single thing from going wrong so that is
the kind of horror one of the many
horrifying parts about this kind of
whole process now we've demoed a lot of
Kali Linux but even that is just a very
small percentage of all the beautiful
things that are on there all the amazing
tools that have exist all the things you
should explore this isn't even a graphic
version of it this is all in command
line there's a graphical version for
people who are graphically inclined who
thinks that that's really cool would
recommend checking it out there are just
so many pieces
- this whole thing but hopefully this is
like an enriching and like fun kind of
intro to it but it's like the lightest
intro you could possibly find because
there's just so many aspects to what's
going on and hopefully that message came
across hopefully the other message that
came across was don't break the law
don't leave your laptop open don't leave
yeah there were three messages like this
is really fun and cool there's a lot of
stuff to do
don't leave your laptop unlocked if any
of us is around and or in general right
Colton never trust me he's never like
this is never gonna be near me again
well as my friends don't have a say that
kind of make sense that's good practice
it's good training it's good training
there's more evil intentions someone
who's not gonna just casually
demonstrate it in front of you thank you
dan and I were coming like yeah I think
that make sense you know yeah we're
gonna go for say they're probably having
another person you can kind of do this
thing's oh yeah I could have
demonstrated I believe the meterpreter
that goes on max now actually supports
grabbing the screenshots from the OS and
grabbing webcam images okay so I could
have I could've taken a picture of your
face that would have been funny I
shouldn't hopefully there isn't a next
time but you know yeah there's no I
checked but like yeah there I saw a
brief description of a V and I think
that that is a good way to kind of wrap
up since we've been talking so much
about just all these exploits and like
we have really talked a whole lot about
how to defend we're gonna close out of
all our windows basically AV the problem
I have with it is as people pointed out
it is very signature based which I'm not
necessarily a huge fan of just because
signatures can be modified they can
adjust people can make viruses of
infinitely many signatures give or take
and yes there are certain techniques and
kind of like analysis techniques that
can make it so that even a modded like a
slightly modified signature still gets
classified as the other signature and
stuff but it's really not necessarily a
great technique for a lot of attacks now
don't even
on disc you know like I removed my
actual attack surface from Colton's are
not the attacks or is the attacking file
from his disk in no longer sat on disk
so a navy that doesn't scan your active
memory but scans the entire disk would
never found it and I was still on his
system it's you know if you have a
pretty clever attacker they might put it
in a higher privileged process than the
AV could check maybe you're running bad
AV maybe haven't updated signatures in a
while maybe your AV doesn't match it to
a signature and says you're clean but
it's something else
some Windows Defender stuff I believe
sandboxes things and checks somewhat for
behavior analysis but even then I can
you know there's the halting problem in
theoretical CS and I can just
perpetually wait and eventually there
has to be a logistical timeout on the
sandbox process so there's that there
are reverse engineering tools that can
try and check for things to make sure
that you're not doing anything weird but
there are counters to those they it's a
really complex sort of thing
that makes is what a VD unit use and I
use a combination of them in kind of an
attempt to protect myself a little bit
but I you know I try Windows Defender I
try all sorts of things from like
Google's virustotal to like certain
private ones and then like malwarebytes
and clamavi and things like that there's
a reason that they're really successful
but there are a lot of other things that
have to be done
I generally actually my best Davie is
that I try and keep things as simple as
possible I shut down an interface that I
can and I recognize it'll probably get
attacked right at some point it's it's
basically that like I'm aware that one
of my best Davey's is to have a good
recovery strategy in addition to trying
and preventing it
so my machine gets backed up twice every
day it gets backed up to different
devices I'm pretty paranoid like I
really do I I'm in this sort of thing I
see it all the time it makes me very
very paranoid my webcam is covered
constantly a privacy on my machine
privacy screen on my machine my device
gets backed up twice a day it has all
sorts of ways for me to access it that
are fairly well secured there's there's
some stuff going on
that I try to mitigate my risk I also
try to make it such that if someone else
gets a hold of my machine they don't get
anything useful
so my device has some like pitfalls
honey traps things that like if you get
on to it it's pretty hard to type my
password you aren't gonna brute-force it
at least not in a reasonable you're not
gonna get it in the century it's just a
random password that I memorize it's not
pronounceable it's not meaningful in any
way and you're not gonna find in a
dictionary it's just a random string of
characters Nick long and this week Nick
won one two three there's like these
parameters that you can take certain
aspects of my device actually don't
necessarily always sit on my device
there are so like certain things are
remotely stored or even not even
remotely stored but I store them on
certain other physical devices certain
parts of my computer require another
physical device in order to access them
they require combinations of presents
like a USB stick or my phone or things
like that Apple does build some of those
things into it but I've added some of my
own tools yeah Bobby Knight says use a
password manager
I really recommend using a password
manager because that way your individual
passwords are secure and you don't have
repetition across them there are all
sorts of things yeah there's just
there's all sorts of stuff going on and
it's very very difficult whoever they
are toyou says InfoSec is a war yeah
it's like a full on and it's only gonna
get worse right like I think that it's
really only this is the beginning of
that InfoSec war and it's super
important that people emphasize these
sorts of things as Lee says thank you
very much for the stream of course we
love doing these streams it's like the
high point of my day at the moment yeah
welcome today was just a terrible mood
but I was excited for this stream and I
was finally get to actually hack people
in you know like fun and positive
environment because it feels good you
know it's like I get to actually use my
creativity a little bit and use kana my
skill it's very fun so yeah very much
thank you for coming like it's great to
have you guys on these streams and we
get to interact with you and have ideas
that we didn't think of before it makes
it a lot better I think than just us
talking
good exactly we're saying that I'm
good-natured appreciate it very good I
know people who would be like oh my god
you did water like
how Demant anybody talked bipartite says
I would make a great do I agree
while I'm in class that's the new best a
new thing talk back on Tuesdays yeah I
don't mean to I kind of like that back
ignite says I'd be paranoid as well yeah
yeah if you're not paranoid
you've watched this whole stream maybe
you missed a partner tux man says after
my network security course at uni I
wouldn't say Cameron my router yeah I've
been there before a couple times where
I'm just like oh my god you know like
everything is just so broken and then we
still use them there's a there's a
trade-off true candy says hey Colton
what's the next code review we're
working on actually getting a code
review finalized again with David and
O'Brien
if not next week maybe the week
afterwards but definitely talking about
it we'll see we'll see what we can do
yeah those were those were fun I enjoyed
this blog yeah that would go free and we
do them on Fridays usually yeah I got a
maybe only the last week of classes a
lot of free Friday oh yeah yeah and then
the password managers generally agree
recommend people use them they do create
a single point of failure there actually
there are password managers that are
trying to avoid that single point of
failure problem by instituting like USB
key authentication of you as well and
like certain like you should physically
be in present with your password manager
there's no need for remote access or
anything to use them but you physically
at the moment and I agree with that
and yeah they do create a single point
of failure if someone gets that password
it screwed they'll have your password to
the actual password manager itself they
have all your passwords in one go okay
the sub password feature
yeah it follows that like it just goes
down a rabbit hole of like infinite loop
and I think the thing to recognize is
that it's different from if someone
compromises a database of Facebook
passwords they're gonna one of the next
things they're gonna do besides either
just selling them on the dark web is
they're gonna try out those passwords
and the email combinations on every
website they know Gmail Yahoo bank
accounts things like that because people
reuse passwords so that's what a
password manager protects you from is
you're no longer part of this
low-hanging fruit problem yes your
Facebook password still compromised in
the still screen you know resent that
but that is the only thing that was
compromised and I think that that's an
important part it is carrot you should
be careful in picking a password manager
some of them don't generate keys quite
correctly some of them have a paddock to
their key generators some of them have
like parameters on like oh how long
should it be lengths is your is your
friend here yeah I'm not really intended
but like you should make your passwords
very long they should be difficult to
brute-force they should use as many
character and combinations as possible
there's all these ways to make yourself
not the easy target is really what
you're trying to do because the easy
targets will be hit first and probably
the only things that'll get hit until
they you know pivot from there onward
let's see this broadcast will be posted
to YouTube yeah absolutely uh probably
on by tomorrow definitely yeah
youtube.com slash cs50 I know you're
watching on Twitter yeah we're a fast
stop on it I mean I guess it's not like
coming to me a name but it's very
convenient you know I don't know if we
have it to begin with I think we might
have it I don't know I don't think we
had to do that I think sometimes people
will buy a name or not buy a name but
get a name but be inactive for like two
years and write a name goes into a
common pool again and you can I sliced
it from from the administration that's
very cool it's pretty nice cuz these
videos so short so concise right it's
hard it's hard to get easy to remember
things like that yeah so people are
saying all sorts of great advice going
on the chair right now spin up a free
instance like this test it out yourself
yeah if you're testing on things that
you own no one's gonna stop you hey
that's that's totally legal that's fine
as long as you actually own it yeah and
yeah we're always happy to bring topics
to light that's kind of our whole point
is like sorry technically we did kind of
deviate a little bit from what our
standard practices where we do have a
little bit of setup that went on here
there was some say by we did have to set
some stuff up before the stream to make
a little bit more interesting but it is
still useful I think and I think we
still stay true to like I still have to
actively recall things Google stuff is
needed this is still very much like a
live version of what's going on with
just some setup down the background if
someone says that until quantum
computing becomes mainstream yeah it
should probably be a little bit
concerning
quantum computing there's plenty of
articles and why that breaks certain
aspects of RSA and certain like
difficult problems a lot of encryption
is based on the idea of like things that
are hard to do
so if quantum computing makes something
like I don't know factoring large
numbers easy to do then I'd be really
problematic I might want to look at your
RSA encryption and almost all asymmetric
encryption techniques at the moment
Adams really trying to sell the the
hardware hacking wondered it's pretty
hard he's gonna start somewhere a really
you know like teleportation technology
and that would be possible miss the
twitch name though the twitch name our
URL is cs50.tv so twitch.tv slash
cs50.tv but we go by cs50 live but if
you want to get on to our youtube it's
you dodo com slash cs50 and then to
facebook.com slash cs50 as well actually
I'm les which bring us back it's the
white shot appreciate it we had
definitely different stay tuned tomorrow
we have just me actually it's been I
don't know last time that I did one by
myself was last week but text adventure
so this is a spy man yeah he's been in
the chat but she she had some questions
about a text adventure should i chat a
little bit and I'm gonna do a live one
in Python because we don't - coding we
always do Lua right yeah you know people
so we're gonna do a text adventure so
this is the thing about this text
eventual oh this is gonna be completely
given by the viewers so whatever you
know I'm not gonna write any of the like
adventure at all oh it might chat back
and forth about basically all of the
people that are in the chat are going to
provide the adventure and we'll we'll
discuss depending on how complex the
adventure gets we'll discuss how we want
to code it but it's all sort of TBD it's
up in the air so let's do it's gonna be
kind of like a choose your own live text
adventure sort of project experiment
think it's gonna be fun that's awesome
yeah I'm sure that will be super
exciting are we using libraries and
frameworks with no she's gonna be here
pure Python it's gonna be all on the
console so it's or we're not doing
anything fancy we're just going straight
to the straight to the action
nozzle navigate from the yeah it's gonna
be from the ground up yeah we haven't
done a full ground-up I haven't been on
a ground up streams in a while yeah yeah
yeah yeah everyone yeah do quit code
something - yeah been doing a lot of
like more conceptual well it's this
admin stuff yeah which is good it's all
really good stuff counsellor extreme
things that route Kinesis kind of
plugging in yeah thank you for putting
those up there those are all great
resources Metasploit unleashed
I think someone asked sorry we didn't
respond his necks plate Unleashed like a
good place to go from this yeah great
place you can just like normal miss
plate like everything dealing with it is
also great it's a hack makes computer in
the text adventure thanks that would be
very fun they asked him we have Nick
versus security needs some real hacking
I think what would be very entertaining
so we do actually I actually participate
in the like cyber security competitions
that are held in the US and I have a
whole team for that wait is not just I
actually mostly act as more of a p.m.
for that one and general triage but I
think what would be kind of fun is doing
like a Red Team Blue team where I'm
other a red team or they're I'm blue
team but like I think the the thing with
Red Team Blue Team stuff is Red Team
almost always gets to pre compromised
things so I think what would be really
fun is for me to pre compromise a bunch
of config stuff and then hand that to
someone who's IT professional and kind
of see how they kind of like walk
through with their processes maybe not
super real-time because I think I can
script everything right like if I just
script all my attacks they aren't
necessarily able to script all of their
repair of config that's really human
intensive like you look at something
you're like oh well this is what I
needed to be based on what I know now
and the other parameter that people
often forget about is a lot of things
that are getting attacked sit in a
business framework so it's true that if
you really wanted to prevent me from
getting into your network from the
outside just set up a firewall that just
blocks everything just shut me out but
you can't do that you lose millions of
dollars a day if you're someone like
Facebook you even maybe they're like
millions a minute like that's it's you
can't do that so they are constrained by
a lot more of these just kind of like
boxes and wires and things that they
have to follow also we don't wanna be
fired you know like they have to follow
certain rules but I think that it'd be
really interesting to see
where they go first what's their mindset
right when someone who and we work
really closely with the IT department
here so they they talk along with us
about how well you know if we get a
machine that's been hacked we sandbox it
and we say okay now what does this do
there are certain viruses that can be
written that they ping back to me and if
they detect that I'm no longer answering
them because you've made me shut them
out they just wipe your entire hard
drive and say yeah do you Beth you know
like shouldn't have walked me from my
for my hacker from my parent and that's
that should scare you you know like
those viruses pretty easy to write it's
all it's all just scripting yeah and
it's just kind of being creative and
there are things that like once you find
them they've alias certain commands in a
wave they know that's how you're gonna
delete them so you go and delete them
and then they're like cool you didn't
just delete me you deleted me and spawn
for more in new places and it's because
they alias you're like RM command to
something that also removes what you
wanted it to remove but spawns new
viruses every time you remove something
and it's just it's a lot of this like in
the real world when you're trying to
just get something done it's hard to be
it's I would argue it's almost
impossible to be adequately thorough all
the time
right like I don't check all my aliases
constantly remember only when I'm
sending an alias will I tell you right
and even then it's just a check that the
alias I just set works like it's not
even to like look for other ones and so
it's a lot of this like you know and I I
just told you of an attack that I've
done on people like at least certain
things to varying other commands
definitely heard of this and it's super
common and yet I don't even check you
know and I think that if I'm not
checking it's pretty likely that other
people are constantly checking and
actually something that someone brought
up and that's the problem of these
dreams it's the beautiful problem with
these dreams is people bring up awesome
topics and then I just want to dive into
it yeah it's like as you might time out
it's an infinite area potential sub so
that rabbit hole it's way better than to
be sent so
basically someone said like if you can
hack the Tesla you get the Tesla I was
like you know what that's actually one
of my biggest fears with like the future
of cars and like autonomous vehicles and
networked vehicles is like it should
probably scare you that like someone
with like an old Nintendo device give or
take can like hack a drone or something
like with a radio controller can hack a
drone that I think should point to the
fact that like hey you know if you have
a Tesla that's networked and I can hack
into it and take your car not good have
you ever seen the movie upgrade they do
kind of have a mentioning of that kind
of topic kind of freaky movie very
gruesome but has a really cool topic and
the ending twist is great
someone says hacking is a federal crime
that's enough to scare me yeah don't
break the law but I mean look at the
laws and reanalyze how much it's a real
crime and what hacking is defined as
things are kind of it's a little shifty
it's clearly not up to code and if
there's any legislators watching this
and you're like wait but we try so hard
it's like yeah I know you try art and
you're very intelligent people in you're
brilliant and you've been elected by the
people that you're supposed to protect
but what I'm saying is that you guys
don't know enough and this is from a
college kid you know I don't even know
enough I know very little but what I'm
saying is I know more than you guys on
average and that shouldn't be really bad
and that that's horrifying
so I mean that's I think that's me just
trying to be honest with what I see as
someone who studies yes in cybersecurity
and these things it's like it's not
necessarily your fault
it's just that we gotta get that okay
and then someone says I think you took
that out of context I mean you'll get
the hardware the Tesla not the software
or control the car so they just want the
physical device I got you yeah so we're
gonna teleportation tech you can only
transport a non digital material with
hardware hacking it's a new technology
up and coming I think it's better than
Bitcoin yeah hey Cole my don't you
stream more time restraints no people
such experts yeah it's mostly just time
restraints we have a lot of a lot of
other projects going on a lot of work
the grave is mad side
sigh - a full-time employer yeah anyway
this is a kind of a side project for
cs50 that we only have so much time for
but it's a great amount of fun and we're
hoping to get more in line with a
three-day schedule going forward Tuesday
Wednesday Friday sort of thing yeah
possibly wow that's awesome I wanted to
be on the Tuesday president yeah that's
a great amount of fun and what we'll
hope to you know have the ability to
dedicate the resources to it but you
know that term gets closer especially
we'll see yeah just so how much we can
do right yeah that's a good point and it
says the invents it in a dream last
night
it is this is great thanks so much for
coming on and doing this again yeah look
at what if what you wanna do next week
uh-huh
that's a great question if you guys have
suggested feel free to like pop mattes
has be kind of new and they you just
said you wanted to give wittmeyer coding
a little bit that'd be very fun I'd be
happy to set up a system and kind of
walk through how it works would be happy
to go through more Callie stuff
if people want I'm happy to there's I
mean I'm happy to do almost anything in
terms of like building stuff for coding
things I think it'd be kind of fun to
code up our own like network scanner I'd
be kind of cute they'd be interesting
it's definitely very possible it's not
not too difficult to do we could code up
a automated script that drops SSH keys
on devices that it gets access to or
like compromises them there's a lot of
stuff I think that we could go to so we
should be get some ideas yeah well we'll
text about that hit just some idea this
week kinda gal chapman but another cool
idea that I just thought about would be
like what if we had the chat like write
a Python program where we like ask
people to like give us a line okay and
people and Lego like build a sentence
sort of thing yeah code yeah I'd be kind
of fun that because actually no idea
where that might lead and we have to
have some brilliant filter a little bit
have some you know I'd be parsing it to
make sure that it would actually work
right right we might add kind of our own
little code to make it work correct and
I think that's like some of that is it
alienates people that might not know
Python true that's true
well I suggest ideas and we I don't know
we could think about that plus we had
the idea of literally grabbing things on
the hat we have a web application stack
map from from randomize framework that
would can you implement TCP guide do
that we we could actually take a con Oh
so actually something that might not be
terrible and actually maybe this is the
thing the perfect intersection for an
extreme is implementing a very simple
version of our a second hmm because I
actually did it code review if somebody
had the RSA algorithm in there I got
math app they had the RSA actual bit in
the kind of code I forgot I forgot whose
repo that was but yeah I did but we can
do like another kind of math related
that hard it's very simple but yeah we
could take like a simple security
concept and program up the algorithm for
it maybe make a simple interface don't
take about two hours yeah that'd be
interest your MS calculator open source
code and critique it that's true they
just came out with that that was been
exciting I looked at that yeah it's all
c-sharp now but I've tried digging
through it to find the old C++ for like
the nineties I didn't I didn't quite
have the patience to dig through all of
it but yeah
and Barrett I told him I says RSA would
literally be a few lines code yeah it's
like five but building the interface
around it and kind of getting messages
in and out of it and then demonstrating
that we can put it on new systems that
would take some time plus we have to
explain everything as we go it's really
important to us that everyone
understands more or less what's going on
so each line would take a little bit of
understanding plus I hop into tangents I
mean literally case in play right now I
have an advantage constantly so like
they would take a plenty of time even
simple things have taken a lot of time
on this but we can also even hop back
into some ml if people want
oh yeah like get no more like a
functional programming we can build like
a k-means classifier from scratch or oh
of course yeah
there's all sorts of things what you do
I've heard of women is that I don't know
what it is exactly remember and have it
like identify stuff that we see all the
streams we can there's all sorts of
stuff we can do I've wanted to learn an
election so it'd be interesting yeah
yeah yeah wouldn't I get posted hop into
some ml stuff I'm always happy to skip
around between my favorites code review
style websites that people submit and
Nick tries to have that actually kind of
funny any of you have like personal
websites and you want us to kind of you
know contest it a little bit I prefer
WordPress as far as what I'm gonna pen
test but wait
go for it we might actually be able to
do that we're like we isn't you yes I
mean Colton Siri providing some more
promotion ideas he comes up with all
sorts of cool ideas if you watch any of
our previous treaties have cool ideas
that have helped us progress pipe dream
ideas yeah so yeah that would be really
cool we probably have to get you to sign
something that you're not gonna sue us
have to throw me in prison you know I
get in writing yeah location testing on
pen test actually tend to be a little
like very cutting square I would imagine
so yeah yeah hacking some public they
open sighs that might sound like a
ticket to jail yeah and effectively I'd
be broadcasting the evidence like it's
in front of a jury and they'd be like
well did you do it I'd be like well you
have a video of me literally doing so
yeah you know yeah so play around with
the idea though we could even have like
Colton build a web site and hack at it
or something okay - build a web site on
one stream and then we hack a baby's
first website yeah there's all sorts of
things and thank you guys for giving us
some ideas yeah this is gangster looks
you know we can put them together that's
dummy infinity I like that they use the
most left-field is the most interesting
so a migraine immediately went like Oh
that'd be a good next dream yeah and
it's like definitely like a good break
from since admitting stuff I get the
code again and we get to build some
momentum yes
not that it matters but you get to learn
so that we have to take everyone else
yeah so we might maybe next time we'll
be an ml I'm kind of like that'd be cool
I'm equal to half per 101 CTF isn't nice
if you want to do some web hacking if
you like that well I don't know that one
off the top my head but that sounds
great if you have a link to it feel free
to post it so that people can kind of
copy it but yeah there's all sorts of
stuff also neural networks would be a
huge we could build a really cool I know
you didn't binary classifier I'm sure we
did a very high level one yeah
tensorflow
lets you build neural nets too right
yeah yeah we can hop into some some
interesting stuff maybe that actually
might be mean like a seriously we could
be types to follow new Vegas using a
deep plane buried deep they called it
and supervised like I was like a deep
reinforcement learning or something it
was a deep no they had a specific name
for it no you see it how they retexture
do vague announcing a neural network I
did not
it's called a deep it was like a deep it
was called it was a deep something but a
play on like a deep learning but it was
like they were completely used machine
learning algorithms to generate all the
textures for new Vegas to my school K
van Gogh painting yeah which is temper
typically look at yeah
machine learning looks like if you
dropped acid and then like painted yeah
like a lot of the Machine like computer
generated things we could even do that
like a computer generates - can you
magic we're like everything would just
oh my god everything gonna be a mess
that's none of my code to make sense
that's not gonna happen
yeah we would be I'd be illegal yeah it
would pass what one drug do not do that
do you man to bad we're not recommending
dropping a Swatch watch the following
new Vegas retexture video instead and
you'll feel out you drop acid and that's
the next closest thing good enough legal
yeah let's whew my dear some pharmacist
I'm gonna know where all the streams
heart set yeah yeah yeah we could
definitely build something like that
bout it's not or maybe not quite as well
thought out as there's the kind of the
gate
yeah it's cool though it's cool like
what you can do with it yeah yeah I
think I think that's alternative let's
say for the next four next week next
week and there's a week enough time
today you're not actively doing a my
need to review raise enough time yeah no
I'm good I'm actually I'm in demo class
so I don't know perpetually review great
plus I'm fairly familiar with it's okay
so yeah yeah then we'll say ml next
Tuesday
oh I'll update you don't like which
specific kind so that you have a
description okay yeah I think we were
publishing a week in advance now so if
you can get that information tonight and
we don't publish it and then yeah
tomorrow text adventure that's all the
streams for this week but next week
we'll try and see if we get three on the
docket Wow until then thanks again for
this Cali stream you're having me this
is great it was very entertaining maybe
some will turn into a meme no that would
be great but yeah thanks everybody who
tuned in and watched and who's watching
now and is watching again on YouTube
subscribe to us on youtube if you
haven't already follow us on twitch and
I'll see you tomorrow for the text
adventure tune in for the text adventure
so that we have maternity awesome I mean
I can't write any of it I need
I hate material for the text adventure
so it can't happen without you
definitely tune in thanks