Instructor: Scripting tools. 2 2
In this lesson, we are going to talk about 3 3
some of the basic scripting tools that you should know 4 4
as a cybersecurity analyst. 5 5
Now, when you issue commands individually 6 6
this can be useful 7 7
especially when you're doing one-time analysis 8 8
but by using scripting, this will allow you to set up 9 9
recurring searches to be repeated easily 10 10
and you can even automate them 11 11
so every day at midnight, this particular thing will happen. 12 12
All of that can be done with scripting. 13 13
Now, when I talk about a script, what is that? 14 14
Well, a script is really basically just a list 15 15
of commands that are executed 16 16
by a certain program or a scripting engine 17 17
and there's lots of different ones out there. 18 18
For instance, you might write a script 19 19
in Bash or PowerShell or Python or Ruby or AWK. 20 20
We're going to talk about a lot of these in this lesson. 21 21
Now, before we dive too deep into scripting 22 22
I want to bring up a quick exam tip for you. 23 23
An in-depth ability to conduct scripting is not needed 24 24
for the CySA+ exam, but it is really, really useful 25 25
in the real world. 26 26
Now, if you do decide to go into the PenTest+ curriculum, 27 27
that exam does expect you to read 28 28
and understand four languages, Bash, PowerShell, Python 29 29
and Ruby. 30 30
Again, you don't have to be an expert 31 31
but you need to be able to read a script 32 32
and understand what it does. 33 33
And you may be asked 34 34
in a performance based question to put a script together 35 35
based on a basic concept or idea 36 36
using different blocks that you'd move around the screen. 37 37
But for the CySA+ exam, you don't have to do that. 38 38
And so we are going to focus very briefly 39 39
on things like Bash and PowerShell, just so you get an idea 40 40
of what these scripts look like, but we are not 41 41
going to cover how to write them and how to become 42 42
an expert in scripting. 43 43
When you get to PenTest+ we will go 44 44
through all four of those languages to teach you 45 45
how to write some basic scripts in those languages. 46 46
If you want to learn that, you can either go 47 47
into the PenTest+ course or you can study on your own. 48 48
But again, for the CySA+ exam 49 49
you will not be asked to create a script. 50 50
You may get a multiple choice question 51 51
that shows you a script 52 52
and asks you to read it and understand what it's doing. 53 53
That's fair game. 54 54
But again, if you can read English, you can pretty much 55 55
read the scripts the way they're going to give it to you 56 56
on the exam. 57 57
Now, the first language we want to talk about is Bash. 58 58
And Bash is a scripting language 59 59
and command shell for Unix-like systems. 60 60
So that's going to be the default shell on Linux and macOSX 61 61
and you can set it up as your shell on a Unix system too. 62 62
Now, when we're dealing with Bash, it supports lots 63 63
of different elements such as variables and loops 64 64
and conditional statements and functions and a lot more. 65 65
When you create a script inside of Bash, 66 66
you always start out with what we call the shell bang, 67 67
which is that hashtag and the exclamation 68 68
then /bin/bash. 69 69
This says this is a script that is written in Bash 70 70
that's all that's telling the computer. 71 71
Then we're going to give it some information 72 72
of what we want it to do. 73 73
In this case, I have a three line script. 74 74
First, echo pulling network manager entries ... 75 75
All that means echo is print this to the screen. 76 76
So if I ran this inside the Unix command shell 77 77
you would end up seeing pulling network manager entries 78 78
once you hit enter. 79 79
Then it's going to do the function, 80 80
grep networkmanager /var/log/syslog 81 81
cut -d " space " -f1-5 82 82
and then we're going to do whatever commands we want it to do. 83 83
So really the benefit of having the echo statement 84 84
is to tell your user who just ran this script 85 85
what's going on saying, Hey, I'm working, 86 86
I'm getting the entries for you, I'm doing something. 87 87
Then it's going to start doing those entries 88 88
and in the background it's going to do this grep. 89 89
It says grep networkmanager /var/log/syslog 90 90
pipe, we're piping that over into the cut command, 91 91
-: d " space " -f1-5. 92 92
So far you should know what this says 93 93
because we just covered this in the last lesson. 94 94
Then we have this greater than sign 95 95
and the greater than sign says, 96 96
take the output of cut, and instead 97 97
of passing it to another tool, put it into a log file. 98 98
And in this case, we're going to log it 99 99
into this text file called netman -log.txt. 100 100
So we've grep'd something, we've formatted it using cut 101 101
and now we're going to save it as a text file. 102 102
Then we're going to put a message to the screen for our user. 103 103
Echo networkmanager log file created. 104 104
That's it. 105 105
And then it goes back to the command prompt. 106 106
All this is doing is basically three simple things. 107 107
Print something to the screen, do a search and save it 108 108
to a log file and then print to the screen saying 109 109
I created the file and now you can go get it. 110 110
That's all this bash does, but it saves me a lot of time 111 111
because I can just run this file every single time I want 112 112
or even set up on a scheduled task 113 113
so it does this once a day maybe, and then 114 114
I'd have all those different files logging up over time. 115 115
Next, let's talk about PowerShell. 116 116
Now, PowerShell is a scripting language 117 117
and command shell for Windows Systems. 118 118
You're not going to find it on Linux or Unix or Mac. 119 119
Now, PowerShell supports elements such as variables, loops, 120 120
conditional statements, functions 121 121
and cmdlets that use a verb-noun syntax. 122 122
So just like Bash, all that stuff is the same. 123 123
The only difference here is we're now going to be able to use 124 124
cmdlets as well. 125 125
Now, what is a cmdlets? 126 126
Well, I'm going to show you that right now. 127 127
As we look at a basic PowerShell script here is one. 128 128
Write-host that is a verb dash noun syntax, right? 129 129
Write-host is just like echo. 130 130
It says print this to the screen. 131 131
So right to the host retrieving login failures. 132 132
Then get-event log, which says, I want to get 133 133
I want to pull information from this thing, the event log. 134 134
I want to get the newest ones, the five newest ones. 135 135
I want to get it from the security log 136 136
and I want to get anything that has the instance ID 137 137
of 4625, and that's the ones that I'm going to select. 138 138
So essentially this is a search command right now. 139 139
Now, what is a search command doing for us? 140 140
Well, it's saying I want to go into the event log 141 141
check the five newest entries that meet these conditions 142 142
they're inside the security log 143 143
and they have the instance of 4625. 144 144
Now, 4625 is a log on failure code. 145 145
So what is the last five people 146 146
who tried to log on and failed? 147 147
That's all I'm asking here. 148 148
Then I have the next line, 149 149
timewritten, message 150 150
pipe out-file C:\log-fail.txt. 151 151
So I want to write the message of those things 152 152
from the logs that I just got to this output file. 153 153
And then the last thing I'm doing is writing 154 154
to the screen again 155 155
write-host log log-fail.txt has been created. 156 156
So essentially we're doing the exact same thing 157 157
we were doing back in Bash, except in Bash 158 158
we were looking for network manager entries 159 159
and in this case, we are looking for failed login entries. 160 160
The next thing we need to talk about is Windows Management 161 161
Instrumentation Command or WMIC. 162 162
This is a program that's used to review log files 163 163
on a remote Windows machine. 164 164
So if I'm sitting on my machine as an administrator 165 165
I can actually remotely go onto your machine 166 166
and check your logs if you're part of my domain. 167 167
Now this looks something like this. 168 168
WMIC and then what I'm searching in this case, NTEVENT. 169 169
NTEVENT, given a certain input will return log entries 170 170
that match your parameters. 171 171
So what am I looking for? 172 172
I'm looking at NTEVENT where the condition, 173 173
log file equals security and event type equals five. 174 174
Then I want to get the source name, 175 175
the time generated and the message. 176 176
So essentially this is doing the same thing 177 177
I was doing before. 178 178
I'm selecting all the security event log entries 179 179
whose events are type five, in this case, an audit failure. 180 180
Meaning they couldn't log in. 181 181
Then I'm going to output the source 182 182
the time the event was generated, 183 183
and a brief message about that event. 184 184
This is really useful if you're trying to find events based 185 185
on specific details, and this is more 186 186
of that one time thing, but you can use this language 187 187
inside of PowerShell as well and call the WMIC 188 188
if you need to. 189 189
Now, at the beginning of the lesson 190 190
I mentioned Python and Ruby. 191 191
Now Python and Ruby are interpreted high level 192 192
general purpose programming languages 193 193
and they're used heavily by cybersecurity analysts 194 194
and penetration testers because they're easy 195 195
to write things in and they can do a great job 196 196
of going through and searching file 197 197
and dissecting things and finding what you need. 198 198
Now, again, going into Ruby or Python is way beyond 199 199
the scope of the CYSA+ exam. 200 200
You should just know that if you see Ruby or Python 201 201
they're interpreted high level programming languages 202 202
and they could be something that you use 203 203
to search for things. 204 204
Now, in addition to that, they can do all sorts 205 205
of other things because they are full programming languages. 206 206
But for the CYSA+ exam, just know these are 207 207
high level languages and they're scripting languages 208 208
meaning they're interpreted line by line as you go through 209 209
the scripts and they are not compiled. 210 210
And since they're not compiled, you're not going to have 211 211
a binary file associated with them, just a text file. 212 212
So you can actually read all the source code very easily 213 213
if you find one on a machine. 214 214
The last thing I want to talk about is AWK. 215 215
Now, AWK is a scripting engine that's geared towards 216 216
modifying and extracting data from files 217 217
or data streams inside Unix and Unix like systems. 218 218
So Unix, Linux, and macOS. 219 219
AWK is pretty easy to use 220 220
and to run it, you're going to do this from the Bash cell. 221 221
So you're going to go and just type in awk and then 222 222
for instance, this case, I'm looking for something. 223 223
So I'm looking for anything that has the word manager 224 224
what's inside the slashes there, 225 225
and I'm going to print them to the screen and I'm going to 226 226
search the file employee.txt. 227 227
So as I go through the employee.txt file 228 228
anytime I find a column that has the word manager in it 229 229
then I would print that to the screen. 230 230
So I might go through all of my user accounts 231 231
and anybody in the manager group gets displayed. 232 232
That's the idea here with AWK. 233 233
Now, obviously there's a lot more 234 234
to AWK than what I'm showing you here, but again 235 235
for the CYSA+ you really just need to know 236 236
that AWK is a scripting engine 237 237
and you can modify and extract data using it.