1.1 Fun with terminal

~~Migration~~

comp-eng terminal fun

setup:

raspberry pi 400 units running raspian 12 (trixie)one victim machine running raspian student laptops with terminal running, homebrew if mac, WSL if PC

IMPORTANT:

NEVER share your login info with others: your passwords are like your underwear: nobody should see it, change it often, and don’t leave it on your desk take notes on every step for future quiz

IMPORTANT:

With great power comes great responsibility: the tools you learn today are powerful, and if used correctly can make you a computer ninja. Abusing them can get you in ~~progress~~trouble with HPA or in the outside world, with greater consequences. Attacking or invading another computer without permission is grounds for dismissal at HPA, according to the student handbook and acceptable use policy at HPA.

What we do in the elab, stays in the elab.

First notes:

Why do we mess with terminal?

it is seen everywhere
it can be done remotely
it give you god-like powers
it looks cool

I really want you to learn to play with these commands, they give you total control of any computer, anywhere in the internet...

Stopping stuff:

ctrl-c means cancel
ctrl-z means halt (stop everything, not gracefully)

Part one: internet tools: ping, traceroute, nslookup, dns

ping:

what is it?
sends a data packet to a computer and records the time it takes to echo back to your computer:

Note that it repeats, sending a packet 64 bytes in size to the computer at 10.14.84.12, taking about 1.85 ms (milliseconds) to return.
1000 milliseconds =1 second 1 second, so this computer is likely on your network, wired and responsive

Try this:

open terminal on your computer ping 8.8.8.8 and notice the return timeuse control-z to stop this ping 10.14.1.4 and notice return time-why are they different?try ping to your neighbors, their IP addresses may be listed on the boardhow can you tell if someone is connected by wire or by wireless from their ping?why are gamers interested in ping?look up a ping flood attack-who might use this and why?how many bits make up a byte?

traceroute:

what is it?
traces the path to a computer, listing the time each packet spends at each node:

Notice that each of these has a name attached to it.
In the internet, each number is an address, and a domain name server (dns) converts these from names to numbers and reverse.
Notice that each name has a number in parentheses after it
Notice also that there are times listed after each one-this is the time spent at each node between your computer and www.apple.com

what is the IP address of the www.apple.com server?what is the name of the server at 10.14.1.4?which node is in Honolulu?traceroute to www.apple.comctrl-z to stopnotice all of the steps between, and the times for each steptraceroute to a local IP address, like 10.14.4.1now try the same thing to elab.hpa.edu-how are they different? traceroute to a site of your choice, note the paths to that machinewhy would gamers like to have short paths?

nslookup:

what is it?
looks up and translates names into numbers, using DNS servers, either the one setup on your computer, or others you can choose, so you can see what IP address a name represents from what DNS server (internal or external)

Ok, lots going on here: first you see 10.14.1.4, which is the DNS server in the elab, which translates names like www.apple.com into numbers like 23.2.84.211
Do you see the same number in the traceroute test?
There are other more complex addresses like 2600:141a:8000:18d::1aca, which is something called IPv6
Why?
We are running out of original IP addresses on the internet in the form of 255.255.255.255, so we use "fake" IP addresses inside homes, schools, and businesses, in the form 192.168.1.x or 10.14.x.y
you can query (ask) either internal name servers like ours at 10.14.1.4, or you can ask outside name servers
why are they different?
look below:

type nslookup, wait for the weird < charactertype server 10.14.1.4then enter www.apple.com enter elab.hpa.edu now type: server 8.8.8.8 (this is the google DNS) enter elab.hpa.edu why is this different? open a browser and enter http://10.14.4.1 type exit to exitlook up your name using the internal dnslook up your address using the same tool in reverse

Part two: secure shell (ssh)

what is it?
a secure connection in terminal between your computer and another computer

Ok, first thing I did here was ssh into 10.14.84.2 as pi
notice the format: ssh who@IPADDRESS
it then asks me if I'm ok trading secure keys with this maching
you say "yes" then the key is added to both machines in a hidden file (ask about this if you are curious)
it permanently adds 10.14.84.2 to the list of "known hosts"
what is not obvious is that the green bit at the bottom is actually INSIDE the second computer
you are now inside the second computer and can run commands-from anywhere in the world

look on the whiteboard for the IP address of the victim computer make sure your laptop (yours or ours) is on the elab wifi network ping the IP address for the victim traceroute to the victim nslookup for the IP address of the victim ssh into the victim machine: ssh admin@IPADDRESS, login info on the board what do you see? where “are” you? type: say “hello guys” if you can ssh into a mac, play with different voices using say -v “hello” look up the say command on osx and learn how to say different voices

Part three: secure shell commands

who also whoami
last your last command, also the up arrow
top lists all processes, useful with kill (see later), looks very cool if you are POS
history: shows recent commands like this, useful for retracing your steps or seeing who might have been in your machine

login to the victim as above type who, it should say who you are repeat with the whoami command. what is the difference? type last, it should show you who last logged in, and from where why is this useful in determining if your computer has been hacked? WITH PERMISSION: type sudo shutdown -r now this is an example of a linux and unix command:

sudo means treat me like the admin for the machine (superuser do) shutdown says shutdown the machine -r is called a “flag” it modifies the previous command, meaning in this case “reboot after shutdown” if you did this command without the -r, the machine would stay offtry the top command, this shows what is going on in the machinetry the history command, this is a list of past commands, very useful if you are working on a project, as you can copy this to your other work or records

Part four: where the heck am i?

New commands:

ls means "list files here"
pwd means print working directory, or "where am I?"
cd means "change directory"
cd .. means "go up a floor"

in the first frame, notice the folders with capital letters like Desktop or Documents
note the red one, this is an app to be installed
rpdiags.txt is a text file
in the second frame, we are in the directory /home/pi
the ~ character means your home directory, you can use this on your mac as well to do cool stuff
in the third frame, I changed from /home/pi to /home/pi/Desktop
to change back, I could use cd ..

ssh into the victim machine type ls (list files), this shows the listing of files where you are in that machine type pwd (print working directory), this shows what “floor” you are on in a buildingtype cd /home/pi to "change directory" to your home directory type cd .. (change directory up one) and repeat pwd, what do you see? repeat these steps in a new terminal window on your own computer, and verify by looking in your own home directoryopen the file browser (yellow icon at the top) and see if what is there matches what you see in terminalquestion: if there is a nice GUI (graphical user interface) like file browser, why do I need to learn terminal?cd to your desktop and use ls list the files there-what do you see?

Part five: creating files

New commands:

nano is a text editor in the terminal
less means "show me what is in a file"
more means the same thing, just more detailed

on your raspberry pi, use terminal to navigate to your home directory: cd /home/pi type sudo nano test in the open window, type some wise words type ctrl-o (overwrite) and return exit using ctrl-x on your pi, navigate to your home directory using the file browser and see if there is a new text file there, and open it using the terminal, navigate to your home directory, and type less test, you should see the same document this also works with the more command

Part six: creating directories (folders)

New commands:

mkdir means"make a new directory" which is a folder with that name on it

Challenge: Linux folder challenge

navigate to your home directory: cd /home/pichange directory to your desktop: cd Desktopuse ls to list what is there-does it match what you see on your desktop?type sudo mkdir awesome (make a directory called awesome) change into this directory using the cd command create a new text file using the nano command inside that folder with your name confirm the new folder and text file show up in the GUI (graphical user interface=your desktop)checklist: awesome folder with text file inside in your name

Part seven: put it all together!

Challenge: ssh and folders

we will be working in pairs for this part ASK PERMISSION FIRST
ssh into your neighbor's computer and look at the who command to see who is logged in and from where:
1. ssh pi@10.14.84.x or ssh pi@name.hpa.edu
2. password
3. who
4. last
navigate to their desktop and create a file there called "payload"
1. cd /home/pi/Desktop
2. sudo nano payload
3. type a note to them, make it nice!
4. ctrl-o, return, ctrl-x
have them verify that you sent them a little message with their file browser
create a folder on their computer called "stuff"
1. cd /home/pi/Desktop
2. pwd
3. ls
4. mkdir stuff
5. cd stuff
6. pwd
7. ls
8. sudo nano herobrine
9. type your name in the message
10. ctrl-o, return, ctrl-x
Have them look in the new folder and open the herobrine document
shutdown their computer using the shutdown - r now command
thank them for letting them invade their computer
checklist: payload folder on another computer, herobrine text file inside with a message

Challenge: Find Herobrine

Checklist: at this point you should know how to use each of these:

ping
traceroute
nslookup
ctrl-c
ctrl-z
network icon
sudo shutdown -r now
ifconfig
who
top
history
ls
pwd
cd
cd ..
sudo nano
mkdir
sudo apt update -y
sudo apt upgrade -y
ssh pi@10.14.84.20
IP address, netmask, gateway, dns

Migrated from Apple ~~Wiki~~Server Wiki. Original page ~~u4a1W5r8D.~~ID: u4a1W5r8D