hello again everyone and welcome back to another version of cyber security today we'll be starting activity 313-313 which is analyzing processes is quite a long activity so I'm going to my goal is to try to get down to the scripting in a reasonable amount of time I'm hoping this this video will not take more than 15 minutes um but let's go ahead and through some of the goals so what we're going to do is manage processes and services in a Linux based system we'll be examining a processed tree to identify parent and children processes which you've already done in unit one I believe and then we'll be using search techniques for identifying suspicious processes and then finally we'll be terminating processes so those last two should be in part two of this video component for activity 313. so if you haven't already done so go ahead and spin up a lab 313 I have it up right here and let's before what we're waiting for that let's take a look at managing processes and what we're talking talking about here so one of the things they have in this paragraph and the two paragraphs they have here is that you're going to be dealing with an operating system now as the cyber security specialist you're going to need to know how to basically work in all three major brands of operating systems and that is your Linux your windows and your Mac OS now there is a fourth one and there's probably others as well but there is another one obviously with Chrome OS if you decide to work in a school district you may find yourself with the Chrome OS also and again there's variations of every one of those and if you go into a a company or a manufacturing facility they may actually be running their own OS program as well you need to be familiar with how the programs work they're all going to work on a shell and you'll be able to use bash commands to work through those shells so this is what we're basically going to be doing for the next couple of sessions and then they just basically just say Hey listen this is what you got to do you need to know how to manage these processes and recognize what's malicious what's not and how to stop those that are malicious so when we talk about it they'll talk about the tools and we're going to continue on with this process the first one we're going to be doing is the process status command which is the PS so this is a new Linux command that we're going to be doing again we're going to be using the same topology that we had before we are still using the alpha shortcut so we will still be logged into Alpha if there's if you have any questions or you need to pause or write down some notes please go ahead and do so otherwise let's go ahead and Jump On In so here we are we are connected let's go ahead and log into Alpha here now that I have an alpha I can close this window for the shortcut open this up and you'll notice that I am in my group Alpha so the first thing you want us to do is type in PS which is what we just got done talking about we're looking at our processes and you'll notice it right there this looks very similar to what we did when we pulled up the file explorer so if I go in I'm sorry task manager so if I go ahead and let's say right click on the start button and I go to task manager and I pull up task manager if I go into the details you will notice that the details of all of the programs you will see that you have your PID the PID is the same as this first number and then you have this TTY and then the time and then the command so you can see that we're going to be also working with something that we did work with a little bit in unit one was was the PID and the ppid so just be aware that as we move through you'll have some familiarity with this but now we're going to be doing it in a Linux environment okay all right so they start off by talking about the bash process it's the type of shell that allows you to interact with the system so that first one is the bash command this allows us to work with the OS in terms of uh Communications and just writing things and we'll be writing bash scripts to tell these systems so if you're sitting in a school district and you have all these lockdowns and browsers and all this and things that you can and cannot do most of it is because when you logged in with your username it immediately went through a bash shell command that your it department has created for you which is basically what we call our profile it's created that profile through a bash command telling them what you can and cannot use and that's sort of what we're going to do with this so they go through and they continue on with a bash they talk a little bit about it they um then they have this little window here talking about ping commands and then showing you how the OS works and all of that that fun stuff so one of the things they do say is can you imagine if you have a school of a thousand kids and every time a kid log in you had to write all of the script yourself every single time a kid logged in that could be quite nightmarish so what they're saying is listen there are programs we can write bash programs that will actually do this automatically for us and that's what we're doing so if you haven't already added PS to your notebook please go ahead and do so it is one of the there are several variations of the PS command we're going to see in a little bit which is going to add some Flags there's about six there's three or four variations of PS there's also about six commands that we're going to cover throughout the course of three one three so the first thing we're going to do is we're going to look at man PS so let's go ahead and do this this is step four you can use variation of the PS to see the process is running so let's go ahead and do this we're going to try some of these examples so it's man let's get on to this command man yes and now you will see that this is the manual for the PS command it shows you all the different pieces here it's reporting a snapshot of the current processes if you just typed in PS you saw what we got before that's just a list of all the processes that are working it also shows you that it accepts several different kinds of options here we've got G and ubsd and Unix and then you have some examples of the processes using syntax so if you look at it there are the standard processes that we have now we can go ahead and press h for help or we can hit one or we can hit Q to quit so if I just go ahead and at one I can see that I can do more and I can scroll down manually here I can see several different examples and here's a simple process selection that they're going to go through so you can see there's quite a lot here right so just be aware of that there are some commands there's a helpful tip there I certainly recommend you put this into your notebook recall the commands manipulate Man pages space bars scroll down which is we can do that way we can also hit the enter if we wanted to go line by line B is go back forward slash to check something H to help Q to quit Etc okay so all of that's in step four now let's go ahead and quit this so we get back in here and it says enter the PS command to record and use a scroll bar and so they wanted you to do that but the biggest thing is they want to move on to PS base Dash e f now this is a common use of PS This is showing you every process so if I do this this is similar to what I showed you in task manager so if you look it's got all of them it doesn't mean all of them are running now but this is what all the processes that we're working and so you can see there's your bash and your EF right now down here but you can see all of the others that are also here as well okay now I can also do the more command using PS I can do the pages and pages of this stuff but I can use the more here to create this so let's go ahead and use more this is Step six more space forward slash entc board protocols and let's go to protocols and we're going to jump into this and you will notice that right here you have this is about 75 percent of the list so these are new Protocols are added and you can read through this on your own if you'd like by going through this I am not step seven says when you find uh when when you use more such as protocols it's a full data and then it waits for your command okay so if I hit space there's the rest of it and you can see all of it all right now in eight they want us to do the same thing but they want us to do it with Etc and services so let's go ahead and do that m-o-r-e space forward slash Etc forward slash services and now you can see all of the services this is only about seven percent so there's going to be a lot of pages here that are going to go through this now the contents of protocols and services they say this in the note refer to the same protocols and services you saw in Windows so again if we were going through if we were going through all of this stuff and okay I apologize if I repeat myself I was slightly interrupted here but let's go ahead and continue on so when you use more files such as protocols they show you it's a screen of data and they do all this stuff they ask you in Step eight to go ahead and intermit the more command for the ETC and services and then there's a note here that says that basically um you know they refer to the same protocols and services you saw Windows this was what I was talking about in task manager you saw that whole list it's the same kind of concept here so if I go in here and I just hit spacebar I can go through the whole thing or I can just hit quit which is what I'm going to do and that is Step nine and then it's going to ask me to do the more and then do one more with the PS base EF and that's step nine and it asks what happens and it says no such file or directory for either one and that is because of the way that ps. ef works so if I do PS face EF you'll see I get a whole list of things here but when I do more it's because there really isn't more there you have to have um in order to do this I'll need to use a pipe to create this it's not a it's not a program per se so in order to work on this I have to do PS base EF and then use the pipe right here when I create it with the pipe and I do more and I do this now you'll see that it actually pops up and it now gives me the process for more so now when I go through this I can actually go through and I can see all of these things all right and that is steps 10.
now if you look at it a little bit further you will also notice that it's got the PID and the ppid as you're going through this so keep that in mind as we're going through this that this is again just like what we did in 1. 2 so you should be comfortable with at least those things in Step 11 as we go through okay and I apologize but if you want to get some kind of time frame of how dated this is today is the day the 8th graders are walking through our Halls so there's a lot of distractions all right so anyway step 12 basically asks us to do the same thing where we're going to go ahead while still in more and I'm not in there so let's go ahead and do that so while still in more they want me to type the instruction Alpha so if I go into Alpha like this it will say skipping and then it will show you all of the alpha ones so why is this important because if you look at this you'll see that the Rook command is actually using a lot of them but then the alpha user has done some as well now remember we are the alpha okay so that is that administrator that's working with it the Rook command is the ones that are working through the processes but if I'm looking for somebody that actually might have used a back door they wouldn't be using alpha or root they might be using something else like Damon which you'll see right there above the screen if you look at this now I don't know what this is but if I go through and I highlight this one you'll notice that this is different than the others so is stat D now I'm sure that there's probably some reason for those but we will take a look later on eventually what you're going to do is you're going to look for other ones that's one of the tasks is somebody's going to infiltrate this using the the group beta and the easy way to look at this is going through the PS space EF pipe more and then while you're in more go ahead looking for anybody that is not Alpha okay so you could go in and take a look at all those in depth so that's one way to actually look at this all right moving along Step 13 monitoring process ownership we just talked a little bit about this that will notice that another process is called root that's the administrator account for Linux we're going to learn about those a little bit later on um but right now I've already covered most of this stuff so let's just move along to step 13.
