Book Image

Kali Linux 2018: Windows Penetration Testing - Second Edition

By : Wolf Halton, Bo Weaver
Book Image

Kali Linux 2018: Windows Penetration Testing - Second Edition

By: Wolf Halton, Bo Weaver

Overview of this book

Microsoft Windows is one of the two most common OSes, and managing its security has spawned the discipline of IT security. Kali Linux is the premier platform for testing and maintaining Windows security. Kali is built on the Debian distribution of Linux and shares the legendary stability of that OS. This lets you focus on using the network penetration, password cracking, and forensics tools, and not the OS. This book has the most advanced tools and techniques to reproduce the methods used by sophisticated hackers to make you an expert in Kali Linux penetration testing. You will start by learning about the various desktop environments that now come with Kali. The book covers network sniffers and analysis tools to uncover the Windows protocols in use on the network. You will see several tools designed to improve your average in password acquisition, from hash cracking, online attacks, offline attacks, and rainbow tables to social engineering. It also demonstrates several use cases for Kali Linux tools like Social Engineering Toolkit, and Metasploit, to exploit Windows vulnerabilities. Finally, you will learn how to gain full system-level access to your compromised system and then maintain that access. By the end of this book, you will be able to quickly pen test your system and network using easy-to-follow instructions and support images.
Table of Contents (12 chapters)

Desktop environments

One of the big differences between Unix/Linux systems and Windows is they truly are modular in design. Sure, I know Microsoft says Windows is modular in design, but this really isn't the case. With Windows, the desktop is seamlessly integrated into the operating system. So, until Server 2012, you had to run a Windows server with a running GUI. With Server 2012, you have the option to run the machine headless, but the server's use is very limited running in this mode. Try to uninstall Internet Explorer; well, you can't. Yes, Internet Explorer is an application that has one of the largest security footprints of any common application. Yes, Internet Explorer has system-level access. Yes Toto, this is a problem, which we will exploit later in this book, but for this chapter let's focus on desktop environments.

Linux truly is modular in design. Linux's father is Unix, and Unix's whole design concept was small interactive programs that could be chained together to perform larger tasks. Linux is also designed this way. Actually, Linux is just the kernel of the operating system invented by one man, Linus Torvalds. Almost everything else is a collection of small applications bolted together to make the boy go. A large and constant component set that helps the kernel interact with the hardware is encompassed by the name GNU toolset. Most of these tools were ported from Unix, or rewritten to avoid copyright complications, but still use the same inputs and outputs.

So, with this design structure, the GUI is just another module that can be changed or completely removed from the operating system without any effect on the lower working parts. This gives Linux the ability to do anything from being a Smart Watch to running the Hadron Collider or... be a hacking machine.

Desktop environment versus Window Manager

One important distinction that may help you understand how Desktop Environments work on Kali and other Linuces (plural of Linux) is that of the Window Manager. A desktop environment, also called a GUI, generally includes folders, wallpapers, desktop widgets, icons, windows, toolbars, and interfaces for applications. The Microsoft Windows desktop environment may have been the first such metaphorical construct you discovered. Your smartphone has a desktop environment, and the dramatic failure of the Windows 8 desktop environment was an attempt to merge development of the Windows CE (phone GUI) and Windows 7/Server 2003 GUI. The mistake Microsoft made was assuming that there were more workstations with touch screen capability. Plainly the technology existed, but the monitors were expensive and not in wide use. Bo and Wolf think the Ubuntu Unity desktop environment was a failure based upon the same design assumption. Mouse-driven workstation interfaces are here to stay for a little while longer.

In Kali, a desktop environment usually interacts with a Windowing System such as the X Windows System, or Wayland, which runs directly on top of the hardware, and a Window Manager application which is the interface the user sees and with which the user interacts. The Window Manager provides the look and feel of the Kali Linux experience. There are several Window Managers that can be used with almost any desktop environment in Kali Linux. One of these is the Enlightenment Window Manager, which is included in Kali ISO downloads as E17. The main difference between E17 and a full desktop environment, such as KDE or Gnome, is that E17 has few applications that are built specifically for E17, whereas KDE and Gnome have specialized apps that need a large number of dependencies met to run them in some other desktop environment. Kate and gedit are the specialized text editors for KDE and Gnome respectively.

Enlightenment (E17)

Installing the E17 ISO is rather similar to the installations of any of the other desktops, as long as you are using the default install option. The standard boot screen is runlevel 3, with only a command-line interface, so you have to use the startx command to see the desktop interface. This is shown in the following screenshot:

E17 startup screen

On your first login to the E17 environment, you will be asked a series of questions you already answered in the installation process:

  • Language: The default highlighted is US English.
  • Keyboard Layout: The default highlighted is English (US).
  • Profile: This is hardware profile and the choices are Mobile and Computer. The default highlighted is Computer.
  • Sizing: This is title size. The choices are from 0.8 to 2.0. The default highlighted is 1.0.
  • Window Focus: The choices are Click and Mouse Over. The default highlighted (and the general Linux default) is Mouse Over.
  • Checking to see if Connman exists: Connman is the Enlightenment network connection manager. Click to install/enable Connman.
  • Compositing: This is the source of most of the eye candy in E17. The default is to Enable Compositing, but you might want to use hardware-accelerated (Open-GL) compositing if you are doing a bare-metal installation. If there is a shortage of RAM or you are using a machine with an older processor, you might not want to use compositing at all:
First boot compositing choices
  • Updates: You can enable Checks for Enlightenment Updates. The default is a check in the box to authorize this update. If you are running within a target network, clear this checkbox. It isn't particularly stealthy to have a randomly occurring network check going out to https://www.enlightenment.org/ if the network is supposed to be Windows-only.
  • Taskbar: Enabling the taskbar lets you see open applications and Windows on your Kali Linux E17 desktop. This is enabled by default.

Once you are through with the configurations, E17 will show you the desktop. The following screenshot shows the default desktop. The first thing you might notice is that the background is a flat white plate. The menu line at the top is from Virtual Box. The menu bar at the lower edge is reminiscent of the Apple Mac toolbar. The floating menu bar in the middle is achieved by right-clicking the desktop:

E17 default desktop

The basic default file management window is shown in the following screenshot. It is readable but hardly exciting. If you click on the desktop menu, you can add gadgets. I have added a system gadget to the Taskbar, but you could just as easily place it anywhere on the desktop. The following screenshot shows the right-click menu from the Backlight gadget. If you click Begin Moving Gadgets, you can move all the gadgets around until you click on Stop Moving Gadgets:

Move gadgets

E17 Window Manager issues

  1. Almost all of the security tools are lumped together under the Other Menu, under the Applications Menu, which may cramp your style somewhat.

  1. If you open the click menu too close to the right-screen border, the submenus are offscreen. The effect of Other Menu overcrowding is shown in the following screenshot:
Effect of Other Menu overcrowding
  1. This version of Enlightenment is several years old. The current major version is 22. Perhaps the folks at Offensive Security who created Kali decided to freeze Enlightenment at major version 17 because the Enlightenment developers are moving toward using the Wayland windowing system, and by default Kali-E17 is using the xorg windowing system.

To check whether your version of Kali is running xorg or Wayland, type xdpyinfo on the command line. If it is running a pure Wayland environment, the command will fail. If it is using xorg, it will produce several lines of information about your video configuration. The following screenshot shows a truncated screen of the results on the default installation:

Truncated xpdyinfo output
  1. The easiest way to get at all of the security tools would appear to be opening the Applications | Run Everything dialog, as shown previously. I discovered that this returns an error code when I attempted to open xterm, the default terminal emulator in E17, to install my favorite software installer app, Synaptic. I had to go to the Applications | System Menu and open xterm from there. There does not appear to be a simple fix for the failing Run Everything widget. Perhaps upgrading to the current stable version of Enlightenment (E22.x) would solve it, but the solution would probably require revamping the windowing system, which is a non-trivial undertaking.

To install synaptic:

#> apt install synaptic

To change wallpaper in E17, click on Applications | Settings | Wallpaper Settings. This opens the dialog that is shown in the following screenshot. You can choose your own desktop image or one of the factory images:

Change desktop wallpaper

Gnome desktop

Back in the days of Backtrack, which was the precursor security platform to Kali Linux, the default desktop environment was a very stripped-down version of KDE. When Backtrack was deprecated and Offensive Security published Kali, the default desktop was changed to Gnome. Backtrack was a live-disk CD only, and was not intended to be installed on any computer. The Backtrack version of KDE was stripped down to be able to load from a standard CD. This stripping down removed a lot of the desktop functions. When Kali was published, it was designed to load from a live DVD, and to be installed on x386 and amd_64 architectures. Gnome is slightly reminiscent of the Windows 3.11 look and feel, and uses less memory to draw the desktop than KDE.

The Gnome desktop has been around since the early days of Linux. The Kali Linux default desktop environment is Gnome 3. When you do a standard install, the desktop looks like this:

Gnome 3 default desktop

The toolbar on the left border is the favorites group. When you open any application, its icon arrives in the favorites group on the left, as can be seen in the following screenshot, where I have opened OWASP ZAP:

Adding an application to the favorites group

The security tool menu is found under the Applications tab in the upper-left corner of the desktop. This is a very good categorized list and makes it easier to find any tool you wish to use. The list is shown in the following screenshot:

Gnome application menu for Kali

Changing the desktop image in Gnome 3 is easy, but the settings menu is a bit hard to find. It is hidden under the icon in the upper-right corner. The following screenshot shows the system menu, which has the sound volume control, the network connection dialog, and the settings editor:

Gnome system menu

Most of the settings in Gnome are found in the settings dialog, shown in the next screenshot. There are settings sheets for Wi-Fi, Background, Notifications, Search, Region & Language, Universal Access, Online Accounts, Privacy, Sharing, Sound, Power, and Network. The following screenshot shows the desktop editor, with the default desktop images:

Gnome settings dialog

To change the images, you simply click on the image you wish to change. That opens a dialog box and you can choose one of several included images, or choose one of your own from the images in your Pictures directory:

Gnome 3 desktop issues

  • There doesn't seem to be any easy way to add applications to the favorites group
  • The drop-down menu bar uses a slider bar to take you down to the Usual applications menu instead of a full-length sub-menu

KDE desktop

KDE has been around since the early days of Linux and is Bo Weaver's favorite. With age comes stability and KDE is a very stable desktop. The look and feel are very similar to Windows, so for a Windows user it is easy to use. One advantage of KDE is that the desktop is highly configurable. If you don't like what it looks like, just change it. This can be a big advantage. KDE comes with all the latest Jumping Monkeys and features. You probably like your desktop environment your way, like we do. It doesn't matter what latest thing has been added as long as you can configure the desktop to be the same as it has been for years. This helps with muscle memory. Muscle memory comes into play because having everything in the expected place makes the overhead of the job lower, because there isn't any time spent searching for common tools you use every day. It is more effective not to have to think about where a tool is hidden on the machine or how to save a file since the developers decided the application no longer needs a menu bar. With KDE, you can change your desktop back to an old-school no-frills desktop with everything just like it has been for years. If you are bored, you can customize the desktop beyond any semblance of the default Kali look. The next screenshot shows the default desktop with the Start menu open at Applications. The menu organization is similar to the Gnome 3 menu you have already seen:

Default KDE Kali desktop

One drawback of KDE is since it is so highly configurable and does come with a lot of built-in features, it is very heavy on the memory of the machine and puts a demand on the video card. KDE does need to run on a modern machine with a good amount of memory. Also, being so highly configurable, it is easy to sometimes screw up your settings.

One advantage of KDE is the desktop widgets. Desktop widgets are small applications that run on the desktop to do a number of things. When hacking, you need to keep an eye on your local system resources. There are widgets you can use to keep an eye on system memory, CPU, and network usage at a glance. It's a sad thing to be in the middle of work, fire up one more tool, and have your system crash because you ran out of memory. Using a widget, you can keep an eye on memory usage, network, and CPU usage.

KDE also works really well when using more than one monitor and is completely configurable in assigning which monitor is the main monitor and where your toolbar go. It also reverts to using a single monitor without a reboot or playing with the configuration. This is great when your machine is a laptop that you move a lot.

The KDE developers seem to understand that the desktop interface for a tablet will not work on a workstation that uses a mouse. Since the advent of the tablet, KDE now really comes with two interfaces, Plasma and Neon, and they interchange when the hardware changes. They both use the same backend toolsets; only the look and function changes when changing from tablet mode to workstation mode. This was a failure with the Windows 8 desktop and also a failure with the Gnome desktop. You cannot design an interface to work with your finger and with a mouse. What you will always end up with is an interface that doesn't work well with either.

KDE issues

KDE is graphically busy and uses a lot of resources. This makes it unsuitable for a very old machine, or one with low graphics memory.

  • SHOW STOPPER!: This is an installer issue, and you may not get this effect. The folks who created Kali Linux add updates to the ISO disk files over time, and when Wolf did this install, it came up with this issue. It is easy to fix, and the important thing is not to panic. You did nothing wrong if your install shows up like this. After installation, the KDE instance loads to the tty1 full-screen CLI and startx does not start the GUI. startx is part of the xinit package, so you can install xinit by entering the following as root (the account you just logged in as):
#> xinit
KDE startx after installing xinit

LXDE desktop

LXDE, which stands for Lightweight X11 Desktop Environment, was designed in 2006 by Hong Jen Yee, a Taiwanese programmer who wrote the first module of LXDE. It was a file manager. This is reminiscent of the creation of the Linux kernel itself, where Linus Torvalds started with a file manager module. Installations had problems, but the live disk seems to work well. I noticed the Kali-Linux graphical installation asks for machine domain but regular installation does not. The following screenshot shows the default LXDE desktop.

This desktop environment is also reminiscent of Windows XP with the menu launch button in the lower-left corner:

LXDE default desktop view

To change the desktop background, go to the menu in the lower-left corner and choose Preferences | Desktop Preferences. The menu is shown in the next screenshot. If you want great choices for background images, check out https://pixabay.com/:

LXDE desktop image preference dialog

LXDE issues

  • SHOW STOPPER: Graphical installation failed because No partition table planned and no creation of file systems have been planned
  • SHOW STOPPER: Regular installation failed because No Operating System Installed

MATE desktop

The MATE desktop is a fork of the now-deprecated Gnome 2 desktop environment. MATE stands for MATE Advanced Traditional Environment. This is a similar structure to the GNU acronym, GNU is Not Unix. The renaming of the fork to MATE avoids naming convention issues with the still-current Gnome 3 environment.

MATE includes forks of many Gnome applications, and developers have written new applications. The names are in Spanish to reflect MATE's Argentinian origin.

MATE applications include the following:

  • Caja: File manager (from Nautilus)
  • Atril: Document viewer (from Evince)
  • Engrampa: Archive manager (from Archive Manager)
  • MATE terminal: Terminal emulator (from GNOME Terminal)
  • Marco: Window manager (from Metacity)
  • Mozo: Menu item editor (from Alacarte)
  • Pluma: Text editor (from Gedit)

The first boot, and all subsequent boots, of MATE bring us into runlevel 3, as shown in the following screenshot:

MATE first boot

The default GUI for MATE is familiar to most Linux users, as it is a near-mirror image of Gnome 2. The next screenshot shows that desktop with the default Kali logo. The Applications, Places, and System menu structure has been a long-standing mark of a Linux desktop, and many longtime Linux users welcomed the efforts of the MATE team to maintain the tradition:

MATE GUI

The following screenshot shows all three system menus from the MATE desktop with representative submenus open. The Places menu opens Caja (file management) windows:

MATE System menu

The look and feel menu offers you 12 preset appearance preferences, and those can then be customized further. The following screenshot shows a selection of those presets:

MATE appearance presets

MATE issues

The behavior of booting into runlevel 3 is difficult but not insurmountable, as we know to try startx when faced with this screen. Depending upon the day you download MATE, you might or might not run into this issue. This is the standard runlevel for servers, but you probably want to use both GUI and CLI tools in Kali Linux.

Xfce desktop

The Xfce desktop is a lightweight desktop environment and is Wolf Halton's personal favorite. He used Xfce to conserve resources when writing the first edition of this book. He is using it today as part of a highly customized and quixotic version of the Ubuntu Studio operating system to work on the current edition of the book.

The initials are spoken in the name of this desktop environment as ex-eff-cee-ee. It used to be an acronym for X-Forms Common Environment, but it uses the GTK toolkit rather than X-Forms these days. Xfce was initially designed to be a replacement for the CDE, which was a Unix Common Desktop Environment in 1996, when the latter was still proprietary. Some people might consider Xfce to be a bit old-fashioned in its look and feel. The default Xfce desktop is shown in the following screenshot:

Xfce default desktop

The toolbar at the bottom is minimal but fully functional:

  • The first button minimizes all windows, showing the desktop
  • The second button opens a command-line Terminal emulator
  • The third button opens the Thunar file manager
  • The fourth button opens the Firefox web browser
  • The fifth button is the Application Finder
  • The sixth button is the active user's home folder

The following screenshot shows the outcome of opening the root home folder, a Terminal emulator, a browser window, and the application finder. The application folder has an application menu in it that is the same as the Applications button in the upper-left corner:

Xfce lower toolbar illustrated

The most obvious way to change the personalization is to change the desktop to an image of your choice. There are four tabs of options to make deeper, more subtle changes to the desktop environment and make Xfce your own. Three of those four tabs are shown in the following screenshot:

Xfce Appearance options

Xfce issues

There are no real showstoppers in Xfce desktops. Perhaps this is because Xfce is a very stable desktop environment; it has never brought any issues.