1
1
00:00:00,180 --> 00:00:01,890
Scripting tools.
2
2
00:00:01,890 --> 00:00:03,720
In this lesson, we are going to talk about
3
3
00:00:03,720 --> 00:00:06,270
some of the basic scripting tools that you should know
4
4
00:00:06,270 --> 00:00:08,340
as a cybersecurity analyst.
5
5
00:00:08,340 --> 00:00:10,410
Now, when you issue commands individually
6
6
00:00:10,410 --> 00:00:11,400
this can be useful
7
7
00:00:11,400 --> 00:00:13,590
especially when you're doing one-time analysis
8
8
00:00:13,590 --> 00:00:16,290
but by using scripting, this will allow you to set up
9
9
00:00:16,290 --> 00:00:18,540
recurring searches to be repeated easily
10
10
00:00:18,540 --> 00:00:19,920
and you can even automate them
11
11
00:00:19,920 --> 00:00:23,070
so every day at midnight, this particular thing will happen.
12
12
00:00:23,070 --> 00:00:25,260
All of that can be done with scripting.
13
13
00:00:25,260 --> 00:00:27,210
Now, when I talk about a script, what is that?
14
14
00:00:27,210 --> 00:00:29,640
Well, a script is really basically just a list
15
15
00:00:29,640 --> 00:00:30,870
of commands that are executed
16
16
00:00:30,870 --> 00:00:33,300
by a certain program or a scripting engine
17
17
00:00:33,300 --> 00:00:35,250
and there's lots of different ones out there.
18
18
00:00:35,250 --> 00:00:36,570
For instance, you might write a script
19
19
00:00:36,570 --> 00:00:41,570
in Bash or PowerShell or Python or Ruby or AWK.
20
20
00:00:41,580 --> 00:00:44,340
We're going to talk about a lot of these in this lesson.
21
21
00:00:44,340 --> 00:00:46,230
Now, before we dive too deep into scripting
22
22
00:00:46,230 --> 00:00:49,230
I want to bring up a quick exam tip for you.
23
23
00:00:49,230 --> 00:00:51,990
An in-depth ability to conduct scripting is not needed
24
24
00:00:51,990 --> 00:00:55,920
for the CySA+ exam, but it is really, really useful
25
25
00:00:55,920 --> 00:00:57,330
in the real world.
26
26
00:00:57,330 --> 00:00:59,850
Now, if you do decide to go into the PenTest+ curriculum,
27
27
00:00:59,850 --> 00:01:01,920
that exam does expect you to read
28
28
00:01:01,920 --> 00:01:05,970
and understand four languages, Bash, PowerShell, Python
29
29
00:01:05,970 --> 00:01:06,870
and Ruby.
30
30
00:01:06,870 --> 00:01:08,280
Again, you don't have to be an expert
31
31
00:01:08,280 --> 00:01:09,630
but you need to be able to read a script
32
32
00:01:09,630 --> 00:01:11,280
and understand what it does.
33
33
00:01:11,280 --> 00:01:12,720
And you may be asked
34
34
00:01:12,720 --> 00:01:15,270
in a performance based question to put a script together
35
35
00:01:15,270 --> 00:01:17,070
based on a basic concept or idea
36
36
00:01:17,070 --> 00:01:19,650
using different blocks that you'd move around the screen.
37
37
00:01:19,650 --> 00:01:23,220
But for the CySA+ exam, you don't have to do that.
38
38
00:01:23,220 --> 00:01:25,110
And so we are going to focus very briefly
39
39
00:01:25,110 --> 00:01:27,990
on things like Bash and PowerShell, just so you get an idea
40
40
00:01:27,990 --> 00:01:30,060
of what these scripts look like, but we are not
41
41
00:01:30,060 --> 00:01:32,130
going to cover how to write them and how to become
42
42
00:01:32,130 --> 00:01:33,840
an expert in scripting.
43
43
00:01:33,840 --> 00:01:35,820
When you get to PenTest+ we will go
44
44
00:01:35,820 --> 00:01:38,250
through all four of those languages to teach you
45
45
00:01:38,250 --> 00:01:41,130
how to write some basic scripts in those languages.
46
46
00:01:41,130 --> 00:01:42,840
If you want to learn that, you can either go
47
47
00:01:42,840 --> 00:01:46,200
into the PenTest+ course or you can study on your own.
48
48
00:01:46,200 --> 00:01:48,630
But again, for the CySA+ exam
49
49
00:01:48,630 --> 00:01:50,730
you will not be asked to create a script.
50
50
00:01:50,730 --> 00:01:52,350
You may get a multiple choice question
51
51
00:01:52,350 --> 00:01:53,370
that shows you a script
52
52
00:01:53,370 --> 00:01:55,830
and asks you to read it and understand what it's doing.
53
53
00:01:55,830 --> 00:01:57,000
That's fair game.
54
54
00:01:57,000 --> 00:01:59,400
But again, if you can read English, you can pretty much
55
55
00:01:59,400 --> 00:02:01,080
read the scripts the way they're going to give it to you
56
56
00:02:01,080 --> 00:02:02,250
on the exam.
57
57
00:02:02,250 --> 00:02:04,710
Now, the first language we want to talk about is Bash.
58
58
00:02:04,710 --> 00:02:06,390
And Bash is a scripting language
59
59
00:02:06,390 --> 00:02:09,210
and command shell for Unix-like systems.
60
60
00:02:09,210 --> 00:02:12,720
So that's going to be the default shell on Linux and macOSX
61
61
00:02:12,720 --> 00:02:16,140
and you can set it up as your shell on a Unix system too.
62
62
00:02:16,140 --> 00:02:18,360
Now, when we're dealing with Bash, it supports lots
63
63
00:02:18,360 --> 00:02:20,850
of different elements such as variables and loops
64
64
00:02:20,850 --> 00:02:24,150
and conditional statements and functions and a lot more.
65
65
00:02:24,150 --> 00:02:26,400
When you create a script inside of Bash,
66
66
00:02:26,400 --> 00:02:28,950
you always start out with what we call the shell bang,
67
67
00:02:28,950 --> 00:02:31,620
which is that hashtag and the exclamation
68
68
00:02:31,620 --> 00:02:33,870
then /bin/bash.
69
69
00:02:33,870 --> 00:02:36,750
This says this is a script that is written in Bash
70
70
00:02:36,750 --> 00:02:38,610
that's all that's telling the computer.
71
71
00:02:38,610 --> 00:02:40,170
Then we're going to give it some information
72
72
00:02:40,170 --> 00:02:41,430
of what we want it to do.
73
73
00:02:41,430 --> 00:02:43,650
In this case, I have a three line script.
74
74
00:02:43,650 --> 00:02:46,843
First, echo pulling network manager entries ...
75
75
00:02:47,790 --> 00:02:50,670
All that means echo is print this to the screen.
76
76
00:02:50,670 --> 00:02:53,220
So if I ran this inside the Unix command shell
77
77
00:02:53,220 --> 00:02:55,740
you would end up seeing pulling network manager entries
78
78
00:02:55,740 --> 00:02:56,970
once you hit enter.
79
79
00:02:56,970 --> 00:02:58,798
Then it's going to do the function,
80
80
00:02:58,798 --> 00:03:02,820
grep networkmanager /var/log/syslog
81
81
00:03:02,820 --> 00:03:07,410
cut -d " space " -f1-5
82
82
00:03:07,410 --> 00:03:10,200
and then we're going to do whatever commands we want it to do.
83
83
00:03:10,200 --> 00:03:12,150
So really the benefit of having the echo statement
84
84
00:03:12,150 --> 00:03:14,460
is to tell your user who just ran this script
85
85
00:03:14,460 --> 00:03:16,320
what's going on saying, Hey, I'm working,
86
86
00:03:16,320 --> 00:03:18,660
I'm getting the entries for you, I'm doing something.
87
87
00:03:18,660 --> 00:03:20,370
Then it's going to start doing those entries
88
88
00:03:20,370 --> 00:03:22,170
and in the background it's going to do this grep.
89
89
00:03:22,170 --> 00:03:26,430
It says grep networkmanager /var/log/syslog
90
90
00:03:26,430 --> 00:03:28,890
pipe, we're piping that over into the cut command,
91
91
00:03:28,890 --> 00:03:33,210
d " space " -f1-5.
92
92
00:03:33,210 --> 00:03:34,830
So far you should know what this says
93
93
00:03:34,830 --> 00:03:36,930
because we just covered this in the last lesson.
94
94
00:03:36,930 --> 00:03:38,700
Then we have this greater than sign
95
95
00:03:38,700 --> 00:03:40,110
and the greater than sign says,
96
96
00:03:40,110 --> 00:03:42,210
take the output of cut, and instead
97
97
00:03:42,210 --> 00:03:45,300
of passing it to another tool, put it into a log file.
98
98
00:03:45,300 --> 00:03:46,440
And in this case, we're going to log it
99
99
00:03:46,440 --> 00:03:50,670
into this text file called netman -log.txt.
100
100
00:03:50,670 --> 00:03:53,340
So we've grep'd something, we've formatted it using cut
101
101
00:03:53,340 --> 00:03:55,710
and now we're going to save it as a text file.
102
102
00:03:55,710 --> 00:03:58,290
Then we're going to put a message to the screen for our user.
103
103
00:03:58,290 --> 00:04:01,410
Echo networkmanager log file created.
104
104
00:04:01,410 --> 00:04:02,243
That's it.
105
105
00:04:02,243 --> 00:04:03,930
And then it goes back to the command prompt.
106
106
00:04:03,930 --> 00:04:07,290
All this is doing is basically three simple things.
107
107
00:04:07,290 --> 00:04:09,840
Print something to the screen, do a search and save it
108
108
00:04:09,840 --> 00:04:12,450
to a log file and then print to the screen saying
109
109
00:04:12,450 --> 00:04:14,790
I created the file and now you can go get it.
110
110
00:04:14,790 --> 00:04:17,550
That's all this bash does, but it saves me a lot of time
111
111
00:04:17,550 --> 00:04:20,280
because I can just run this file every single time I want
112
112
00:04:20,280 --> 00:04:21,810
or even set up on a scheduled task
113
113
00:04:21,810 --> 00:04:23,910
so it does this once a day maybe, and then
114
114
00:04:23,910 --> 00:04:26,940
I'd have all those different files logging up over time.
115
115
00:04:26,940 --> 00:04:28,590
Next, let's talk about PowerShell.
116
116
00:04:28,590 --> 00:04:30,480
Now, PowerShell is a scripting language
117
117
00:04:30,480 --> 00:04:32,580
and command shell for Windows Systems.
118
118
00:04:32,580 --> 00:04:35,850
You're not going to find it on Linux or Unix or Mac.
119
119
00:04:35,850 --> 00:04:38,850
Now, PowerShell supports elements such as variables, loops,
120
120
00:04:38,850 --> 00:04:40,410
conditional statements, functions
121
121
00:04:40,410 --> 00:04:43,320
and cmdlets that use a verb-noun syntax.
122
122
00:04:43,320 --> 00:04:46,020
So just like Bash, all that stuff is the same.
123
123
00:04:46,020 --> 00:04:47,840
The only difference here is we're now going to be able to use
124
124
00:04:47,840 --> 00:04:49,470
cmdlets as well.
125
125
00:04:49,470 --> 00:04:50,880
Now, what is a cmdlets?
126
126
00:04:50,880 --> 00:04:52,770
Well, I'm going to show you that right now.
127
127
00:04:52,770 --> 00:04:55,770
As we look at a basic PowerShell script here is one.
128
128
00:04:55,770 --> 00:04:59,123
Write-host that is a verb dash noun syntax, right?
129
129
00:04:59,123 --> 00:05:01,680
Write-host is just like echo.
130
130
00:05:01,680 --> 00:05:03,240
It says print this to the screen.
131
131
00:05:03,240 --> 00:05:06,960
So right to the host retrieving login failures.
132
132
00:05:06,960 --> 00:05:09,780
Then get-event log, which says, I want to get
133
133
00:05:09,780 --> 00:05:13,560
I want to pull information from this thing, the event log.
134
134
00:05:13,560 --> 00:05:16,110
I want to get the newest ones, the five newest ones.
135
135
00:05:16,110 --> 00:05:18,150
I want to get it from the security log
136
136
00:05:18,150 --> 00:05:20,550
and I want to get anything that has the instance ID
137
137
00:05:20,550 --> 00:05:24,240
of 4625, and that's the ones that I'm going to select.
138
138
00:05:24,240 --> 00:05:26,940
So essentially this is a search command right now.
139
139
00:05:26,940 --> 00:05:29,280
Now, what is a search command doing for us?
140
140
00:05:29,280 --> 00:05:31,980
Well, it's saying I want to go into the event log
141
141
00:05:31,980 --> 00:05:34,920
check the five newest entries that meet these conditions
142
142
00:05:34,920 --> 00:05:36,600
they're inside the security log
143
143
00:05:36,600 --> 00:05:38,820
and they have the instance of 4625.
144
144
00:05:38,820 --> 00:05:41,580
Now, 4625 is a log on failure code.
145
145
00:05:41,580 --> 00:05:43,230
So what is the last five people
146
146
00:05:43,230 --> 00:05:45,060
who tried to log on and failed?
147
147
00:05:45,060 --> 00:05:46,590
That's all I'm asking here.
148
148
00:05:46,590 --> 00:05:48,210
Then I have the next line,
149
149
00:05:48,210 --> 00:05:50,220
timewritten, message
150
150
00:05:50,220 --> 00:05:55,220
pipe out-file C:\log-fail.txt.
151
151
00:05:55,290 --> 00:05:58,710
So I want to write the message of those things
152
152
00:05:58,710 --> 00:06:02,310
from the logs that I just got to this output file.
153
153
00:06:02,310 --> 00:06:03,870
And then the last thing I'm doing is writing
154
154
00:06:03,870 --> 00:06:04,710
to the screen again
155
155
00:06:04,710 --> 00:06:09,630
write-host log log-fail.txt has been created.
156
156
00:06:09,630 --> 00:06:11,730
So essentially we're doing the exact same thing
157
157
00:06:11,730 --> 00:06:14,490
we were doing back in Bash, except in Bash
158
158
00:06:14,490 --> 00:06:16,230
we were looking for network manager entries
159
159
00:06:16,230 --> 00:06:19,470
and in this case, we are looking for failed login entries.
160
160
00:06:19,470 --> 00:06:21,960
The next thing we need to talk about is Windows Management
161
161
00:06:21,960 --> 00:06:25,290
Instrumentation Command or WMIC.
162
162
00:06:25,290 --> 00:06:27,570
This is a program that's used to review log files
163
163
00:06:27,570 --> 00:06:29,790
on a remote Windows machine.
164
164
00:06:29,790 --> 00:06:31,800
So if I'm sitting on my machine as an administrator
165
165
00:06:31,800 --> 00:06:34,230
I can actually remotely go onto your machine
166
166
00:06:34,230 --> 00:06:36,720
and check your logs if you're part of my domain.
167
167
00:06:36,720 --> 00:06:38,880
Now this looks something like this.
168
168
00:06:38,880 --> 00:06:43,170
WMIC and then what I'm searching in this case, NTEVENT.
169
169
00:06:43,170 --> 00:06:45,960
NTEVENT, given a certain input will return log entries
170
170
00:06:45,960 --> 00:06:47,460
that match your parameters.
171
171
00:06:47,460 --> 00:06:49,620
So what am I looking for?
172
172
00:06:49,620 --> 00:06:52,650
I'm looking at NTEVENT where the condition,
173
173
00:06:52,650 --> 00:06:57,180
log file equals security and event type equals five.
174
174
00:06:57,180 --> 00:06:59,310
Then I want to get the source name,
175
175
00:06:59,310 --> 00:07:01,500
the time generated and the message.
176
176
00:07:01,500 --> 00:07:03,120
So essentially this is doing the same thing
177
177
00:07:03,120 --> 00:07:04,140
I was doing before.
178
178
00:07:04,140 --> 00:07:06,540
I'm selecting all the security event log entries
179
179
00:07:06,540 --> 00:07:09,900
whose events are type five, in this case, an audit failure.
180
180
00:07:09,900 --> 00:07:11,790
Meaning they couldn't log in.
181
181
00:07:11,790 --> 00:07:13,830
Then I'm going to output the source
182
182
00:07:13,830 --> 00:07:15,000
the time the event was generated,
183
183
00:07:15,000 --> 00:07:17,340
and a brief message about that event.
184
184
00:07:17,340 --> 00:07:19,350
This is really useful if you're trying to find events based
185
185
00:07:19,350 --> 00:07:21,570
on specific details, and this is more
186
186
00:07:21,570 --> 00:07:24,090
of that one time thing, but you can use this language
187
187
00:07:24,090 --> 00:07:27,180
inside of PowerShell as well and call the WMIC
188
188
00:07:27,180 --> 00:07:28,590
if you need to.
189
189
00:07:28,590 --> 00:07:29,730
Now, at the beginning of the lesson
190
190
00:07:29,730 --> 00:07:31,740
I mentioned Python and Ruby.
191
191
00:07:31,740 --> 00:07:34,410
Now Python and Ruby are interpreted high level
192
192
00:07:34,410 --> 00:07:36,510
general purpose programming languages
193
193
00:07:36,510 --> 00:07:38,640
and they're used heavily by cybersecurity analysts
194
194
00:07:38,640 --> 00:07:40,530
and penetration testers because they're easy
195
195
00:07:40,530 --> 00:07:42,840
to write things in and they can do a great job
196
196
00:07:42,840 --> 00:07:45,090
of going through and searching file
197
197
00:07:45,090 --> 00:07:47,760
and dissecting things and finding what you need.
198
198
00:07:47,760 --> 00:07:51,150
Now, again, going into Ruby or Python is way beyond
199
199
00:07:51,150 --> 00:07:53,460
the scope of the CYSA+ exam.
200
200
00:07:53,460 --> 00:07:56,070
You should just know that if you see Ruby or Python
201
201
00:07:56,070 --> 00:07:58,890
they're interpreted high level programming languages
202
202
00:07:58,890 --> 00:08:00,060
and they could be something that you use
203
203
00:08:00,060 --> 00:08:01,470
to search for things.
204
204
00:08:01,470 --> 00:08:03,180
Now, in addition to that, they can do all sorts
205
205
00:08:03,180 --> 00:08:06,540
of other things because they are full programming languages.
206
206
00:08:06,540 --> 00:08:09,090
But for the CYSA+ exam, just know these are
207
207
00:08:09,090 --> 00:08:11,310
high level languages and they're scripting languages
208
208
00:08:11,310 --> 00:08:14,220
meaning they're interpreted line by line as you go through
209
209
00:08:14,220 --> 00:08:16,350
the scripts and they are not compiled.
210
210
00:08:16,350 --> 00:08:18,120
And since they're not compiled, you're not going to have
211
211
00:08:18,120 --> 00:08:20,610
a binary file associated with them, just a text file.
212
212
00:08:20,610 --> 00:08:23,160
So you can actually read all the source code very easily
213
213
00:08:23,160 --> 00:08:25,440
if you find one on a machine.
214
214
00:08:25,440 --> 00:08:27,753
The last thing I want to talk about is AWK.
215
215
00:08:27,753 --> 00:08:30,480
Now, AWK is a scripting engine that's geared towards
216
216
00:08:30,480 --> 00:08:32,910
modifying and extracting data from files
217
217
00:08:32,910 --> 00:08:35,730
or data streams inside Unix and Unix like systems.
218
218
00:08:35,730 --> 00:08:38,430
So Unix, Linux, and macOS.
219
219
00:08:38,430 --> 00:08:40,230
AWK is pretty easy to use
220
220
00:08:40,230 --> 00:08:42,930
and to run it, you're going to do this from the Bash cell.
221
221
00:08:42,930 --> 00:08:45,780
So you're going to go and just type in awk and then
222
222
00:08:45,780 --> 00:08:47,760
for instance, this case, I'm looking for something.
223
223
00:08:47,760 --> 00:08:50,850
So I'm looking for anything that has the word manager
224
224
00:08:50,850 --> 00:08:52,650
what's inside the slashes there,
225
225
00:08:52,650 --> 00:08:54,750
and I'm going to print them to the screen and I'm going to
226
226
00:08:54,750 --> 00:08:57,030
search the file employee.txt.
227
227
00:08:57,030 --> 00:08:59,280
So as I go through the employee.txt file
228
228
00:08:59,280 --> 00:09:02,550
anytime I find a column that has the word manager in it
229
229
00:09:02,550 --> 00:09:03,840
then I would print that to the screen.
230
230
00:09:03,840 --> 00:09:05,940
So I might go through all of my user accounts
231
231
00:09:05,940 --> 00:09:08,250
and anybody in the manager group gets displayed.
232
232
00:09:08,250 --> 00:09:10,440
That's the idea here with AWK.
233
233
00:09:10,440 --> 00:09:11,790
Now, obviously there's a lot more
234
234
00:09:11,790 --> 00:09:14,400
to AWK than what I'm showing you here, but again
235
235
00:09:14,400 --> 00:09:16,770
for the CYSA+ you really just need to know
236
236
00:09:16,770 --> 00:09:18,810
that AWK is a scripting engine
237
237
00:09:18,810 --> 00:09:21,183
and you can modify and extract data using it.