hello everyone and welcome back to step two or part two of activity 313 we're going to start with step 21 a simple shell script so real quick let's talk about what a shell script is so a couple of things that they talk about in here just the opening paragraphs when we just got done using PS and PS Dash EF to try to figure out how to do this this is one time deal so if I want to see the list of everything all I'm going to do is I'm just type in PS space EF and it's going to give me a list it's going to give me a list of all the processes that are working it's going to give me a list of all the owners the P you know the all of that stuff is going to be in there but it's a one-time deal so if I want to see an update so if anybody added I wouldn't see it it's sort of Frozen it took a snapshot in time of that particular period when I looked at it so if somebody comes in to add stuff after I looked at it then I would have to run PS space EF over and over again it's it's not really it's great to see what's going on at that particular time but it's not like the best if you need to so in order to see something continuously you would have to constantly hit PS space EF over and over and over again to see if that was the case that would be an extremely boring job let's face it so one of the things you can do is you can use Python scripting so for those of you that took cyber security because you thought hey I don't have the code anymore um you might have taken Java you might have taken basic even python um scripting is uh just a little simple five maybe six line scripts for most most of them some get pretty complicated but for most of them they're just really short pieces that just that do the mundane tasks and just put them in loops and all that so even if you uh are doing cyber security you st just like any other job there it's convenient to know a little bit of programming and so in this particular case we're going to do some python scripting to show you now there are two scripts they show you in Step 21 but this really important to understand is once I run the script in Linux right here when I'm doing this in order to get out of it I need to use Ctrl C or control Z so in Step 21 they talk about control C control C just exits you out so if you ever make a mistake in this you can't go back you can't hit the backspace you just have to control C and start over again that's one of the downsides to this but if you need to run this you can use Ctrl C or control Z to get out so keep that in mind as we go through and then they do talk about control Z in Step 23 so we will talk about control Z when I I control Z like zebra when I get there right now we're talking about c as in cat so let's go ahead and move on we're going to hit step 21 and we're gonna just do a simple script so let me go into my program and in order to start this script I'm going to put I'm going to just start putting some coding in so here we go I'm going to put in Wild true and then as soon as I do this you will notice that it doesn't put me in Alpha it gives me a carrot so I put do space and then I'm going to put tab clear yes space e f sleep done okay so this is part a and if you look at it you will notice that what does it do it immediately does this so what does this code do so this code based on what it says it says wall true which means this is going to run forever because as long as true is true it's going to keep running okay and then it's going to do whatever it's it's told so what it's going to do is it's going to clear the screen and then it's going to psef sleep for three seconds and then repeat the process so every three seconds this thing is going to update and so if you're watching this you it's really hard to see but this is going to basically run every three seconds okay so if you'll notice down here every once in a while you will see Alpha right here this first one changes see how it's every three seconds it's changing so this is important to understand the very bottom one so if that's what I was trying to scroll up here so you can see this if you look at the bottom it's 3206 3209 3-12 every three seconds it's updating so if I wanted to get out of this I can hit Ctrl C so let me do that control C TRL C cuts the program and stops and gets you out now there's another way to do this so the way that we did it before by entering each single line in at a time in the cursor is one way to do it you could do it where you put it all in one line now this is going to look more like Java than python because it's going to be separating the differences with semicolons but let's go ahead and do this so we're going to type in while true semicolon space do space clear semicolon BS Dash EF semicolon sleep three semicolon done and here we go again it should there it is every three seconds it'll update that timer right there next to Alpha and it's at 3233 32 36 32 39 Etc so let's everybody see how that works now that's Ctrl C now I'm going to hit Ctrl C to get out of this that is Step 21 just showing you two different ways to do scripting okay now um I did misspeak a little bit earlier you can hit backspace so you can hit backspace to remove a character however if you type in say while wrong you can't go back and hit while again you have to just hit control once you get into the carriage you're gonna have to hit Ctrl C and then start over so be aware of that okay and then in Step 22 it just asks you to observe the output and we've already done that so let's go ahead and give it something more interesting to report now when we do this they're going to ask us to shrink this out so let me move my picture here I'm going to move this up and I'm going to shrink this down all right and I'm just going to type in clear so that I have a simple basic screen and then what they want me to do is they're going to actually have me open up beta so here we go we're going into connections I went to connections I'm going to open up beta there we go get beta and now you'll see there's the beta login now the beta login isn't designed to be a bad malicious person however what it is going to do is it's going to create a different user and we're going to treat it like a malicious person and we're going to see if we can find out who it is identify the beta in our list processes and then once we find them eventually at the bottom of the steps we're going to kill all the processes that beta was using so let's go ahead and start now before we do that step 23 basically talks about the difference between control C and control B if you don't have these in your notes you should have them control c will escape and break the system and put you back to the cursor keep that in mind okay Ctrl Z just temporarily stops it it just pauses the video so keep understanding the difference between the two most often I just use control C now the problem with control C is that maybe the script is working fine so Ctrl Z might be one where I just want to pause it for a second say stop let me take a look at it Ctrl c will actually get out and then I'd have to redo the whole script again so there is use for both of them to do all right so step 24 leaving the terminal open we log into beta I've got beta open already we have Alpha on the left beta on the right and we're going to do a grep search so as an alpha we're going to go ahead and look at this we're going to type in the alpha shell and I'm going to put in PS space e f oops e f and then I'm going to use the pipe and then grab the grep command that we're going to be using here it's a Search tool and we're going to put in beta so grep is a Search tool is going to look for Betas here we go and you will notice that in the root and then we have a couple of betas and then we have an alpha does everybody see that because we logged in right here at 537 according to this particular piece and you'll notice that we actually have beta showing up here so that step 26 shows you this it's an unusual name you can look at grep if you want but basically what you do is when you're using grep it's basically just looking for anything with the word beta in it and that's what we've got if you look each one of these has beta the first one's root but this is sh HD beta up at the top then you have the beta here as the users for The Bash files down here and then in the alpha piece you'll see that I grept for beta so that's also posting there as well all right so continuing on this shell we're going to use a new flag it's called the dash e flag for expression and we're going to use this with grip now they do give you a line that says this it's going to say PS space Dash EF pipe rep Dash e space beta Dash e and then they do this right here they have this bracket it says raise in header row now what is the phrase in the header row so what you don't see in this right here okay if I go over here and I just do this and I put PS base Dash EF you'll notice that when I do this and I scroll up this is the header right up at the top so what they want us to do is they want us to use a header phrase so I can use uid PID ppid stim PTY time command if I wanted to that's what this block means it doesn't mean to type this in so let's go in here and I'm going to get rid of that but what do I want to look for I'm looking for beta's actual users so if you look I grew up the beta but I don't need the ones that have beta in the name of the program I'm looking for beta as a user so what I'm going to do is I'm going to use it right here where I'm going to put in this u i b like that okay and that's what I'm going to do when I go through this so keep that in mind as we do this and I'm sorry I did it wrong I could actually make this it is uid that and you'll notice that the case really doesn't matter it's showing you all of these fun things right here but now what they want us to do is they want us to go through the same exact program that we run before so let's do this we're going to do while true oops true well do clear let me call it yes things EF is that my colon nope we're gonna pipe it sorry I apologize grab space e beta e y b oops sorry semicolon sleep one done okay so we're going to actually type this in so now we're going to do we're going to look at a PS search that's going to give us just what we have up here because we're only looking for Betas but it's going to give it to me every second so when I run this we're going to see what happens if I put something in beta okay so the goal here is I'm going to be typing something in beta here so let's clear this so we're ready to go on beta's n and then over here I'm going to hit run and that's through step 28. so you ready I hit this and you will notice it Alpha is moving relatively fast it's catching it but in beta at step 29 I want to type in bogus underscore SW space 1B all right now it is important to understand that when you are doing 29 that that's a one and not an L or an I so make sure that we are in the beta shell not the alpha okay this is important because what we want to see is we want to see this malicious thing happening from beta so that we can see the results change here so as soon as I hit this I will see a change in Alpha are we ready here we go there you notice how it added it added one right there it says bogus sw1d over here on the left it's right now been added as we created this you'll also notice that the beta one notice that it's running it is still actually running it is not gone to the prompt yet so bogus sw1d is actually in the process of doing something whatever that something is all right and that is Step 29 now let's assume that whatever beta did was malicious let's say that they're a hacker they're coming in and we want to terminate it so this is where we start the kill process this is around step 30. so if we look at it and we want to see this we can force the shoes around for system we can kill a user's bash process or we can go ahead and do anything else now remember the batch process is going to just basically boot them from that system so in Alpha here's what we want to do we're going to go in Alpha shell and the first thing I want to do is I want to get rid of that script because I'm going to hit Ctrl C get us out of that script and then I'm going to record the PID so if you look the PID of the bogus SW command and that is 3555 all right so they're going to ask you to put that into the the line right there go ahead and do that and then you're also supposed to record the ppid which is 3251.
now this is extremely important as we go through because it may scroll off the screen you might lose this just be aware of that so it's always good to just write these down on your notebook so the other thing that we're going to do is when you look at this they talk about sometimes actually creating this in multiple different places so they have a protection measure here in 31 it says the multi-spawning technique is a common way malicious users to hide their presence of the malicious software they're using so since the bogus SW process is Bash we can stop Gathering pids that's what it's saying so if you look right here this is important see the ppid is 3251 you'll notice that the bash PID is 3251 also so these two are tied together right now okay and so we can stop Gathering any other pids at this point we don't have to do that and then if we want to trace this back we can actually use that thing that we did before but instead of doing uid what can I do so instead of putting in the uid what can I do I can actually put let's go ahead and backspace we can put PID if I do that you'll see that it orders all of those okay and so you can see that so I'm now you're looking to go well wait a minute I haven't seen anything that changed basically what I'm doing is I'm looking for things that are I'm I I went with beta but if I would have done 32 50 I would have been able to see those so if I come in oops let's do control C sorry about that if I go back and I do that again you'll notice that it's beta looking for a PID but if I would have changed this to say 32 51. you will see that when I do 3251 it gives me all the 3251's attachments which is the bash and the bogus and me looking for it okay so when I do my search engine when I'm creating those search engines like this obviously if I'm using grep I need this here to match whatever area I'm searching so in this case I'm looking for pids there's no beta mpid they already see that so I'm going to use the numbers for the beta instead so let's go back and do the same thing let's go back and all they're talking about tracing pids and pbid you got to do that same process as well but right now oops let's go back and change that the uid and let's change this to Beta let's run this and now we're back to where we normally were and that's 31. okay now they want us to control Z at this point to access the script so they want us to do this so we stopped it right now at sleep one all right and then what we want to do is we want to kill the the PID so let's go ahead and try this now watch what happens to my screen when I do this I'm going to type in Kill and then the PID of the malicious software what's the PID that we need for the malicious software it is The Bash one which is 3251 32 51.
now if we do this says operation is not permitted why do you think then they got this check your response it says not permitted to kill beta's process so this is important to know so step 33 it says this is actually a good security measure otherwise think about this you're sitting in the room watching this video if you have your screen up with your virtual server and you add and you have a person next to you that's working alongside you and you happen to know what that person's username is think of all the you can just sort of make his day miserable can't you you could just constantly kick out your next door neighbor out of the system every single time if you could just go ahead and say oh yeah just let's find out what his PID is and let's just go ahead and kill it you actually have to do some more stuff and so again part of this is understanding that right now we're doing this as a user Alpha in a group and beta is a user in the group we don't have the Privileges and I can go back and use those privileged pieces if I wanted to to see that all right so what we do here is manage process you do not own you need to use a privileged account so then what we have to do is most of the time we have to go to a account so keep that in mind so if you've noticed it says right here there's a note here with little light bulb you've noticed that most processes that manage the operating system are on my root so if we did the ps. ef again right so I'm going to hit Ctrl C I mean don't worry about I'm going to go back to all of this stuff here so if I do a PS space Dash EF you will notice that I've got all of these roots right so you'll see that a lot of this stuff is being run by root so if I go back to the last one that I just did this one and then I'm going to hit Ctrl Z and get out of that one so we're back to where we were before so if you look at it it sounds like an odd name but basically it's the the way that we're using it they consider it a tree so at the very base of the trees the roots to keep that in mind that's what we're talking about okay so to become a root user you could log out and then log back into the system as a root instead Linux provides the Su command which lets you change your current account to another account so keep that in mind don't worry about it it says it tells you what Su stands for but basically it's known as super user if you will and that's pretty cool so to become root I'm going to just issue the Su space Dash root command okay now it tells you there the options right there okay so let's go ahead and do this and options login invalid option r all right so it's saying that I can't do this let's take a look at this again so let's try this again SGU space let's put a space in between each one so for some reason yeah you need a space in between both when I typed it before I put Dash and then root and so it looked at a dash R like a flag and there is it shows you the options there are no dash R's so I had to put a space in there between those now it gives me a password so obviously you're not going to be able to just become an admin by typing it as you and then go to admin that doesn't work you have to have the password well they give you the password the password is root backwards which is tor t o o r remember that passwords do not show up there they don't show cursor they don't show movement and when I type it in I am now in the Rut okay so now that is up to step 36. so if you've been following it along we've added a couple of things number one we've learned that you can't just go ahead and kill anybody um computer-wise I mean okay and number two if you do want to go ahead and look at any of this or have the ability to remove a malicious user and to kill them from the root you have to become the root and in order to do that you're going to use the Su command or super user command go back to wherever you want to go use the password that you need and then you'll be able to get in okay so moving into step 37 we're going to do the same thing we did before so let's go back in you'll notice that there's a whole bunch of things in here when I moved my arrow up and none of them were what I wanted because I was using those commands with Alpha and I'm no longer an alpha so now that I'm in root I've got to retype it so I'm going to type in k i l l and then what was it that I wanted to do 30 to 51.
