Assalomu Alaykum) This article is prepared solely for educational purposes. If you want to try it out practically, please ask for permission first, or use it on testing systems (like Metasploitable).

Today, we will briefly discuss the Telnet service and then see how to launch attacks on a target system using it. First, we will start our target system.

Telnet is mainly used for managing and configuring servers, but due to security reasons, safer protocols like SSH (Secure Shell) are preferred. Telnet is a simple and convenient way to access a computer remotely, but it should be used cautiously considering modern security measures.

We will continue our attacks based on ports. Last time we looked at port 22, and today we will examine port 23, where the Telnet service usually operates. First, we will scan it using nmap.

nmap 192.168.130.166 -A -p 23

As a result, we can see that the Telnet service is running and the connection is open. Now, let's try to connect using Telnet.

telnet 192.168.130.166

We encountered a very interesting result: to connect via Telnet, a username and password have been set up, and when we tried them, they turned out to be valid.

Now, let's check our permissions.

Several checks have proven that we have root privileges, and we have indeed gained root access. (Today’s task was easy! 😂😂) This means we can use the command rm -rf /* (to show the house of a mother).

In today’s article, we reviewed Telnet, which is used for remote connections. Generally, Telnet is not used; instead, SSH is preferred (as we hacked a system using SSH last time). During the practice, although Telnet was open, we might not have received a username and password. In that case, we could use a brute force attack or exploit older versions using Metasploit.

We will continue to try to achieve results through each open port. To not miss upcoming articles, follow us on social media.

By the way, if you liked the article, don't forget to register on the site, give it a like, and leave a comment!

Assalomu alaykum) This article is prepared only for educational purposes. If you want to try it in practice, first ask for permission, then use it, or test it in test systems (like Metasploitable).

The purpose of this article is to understand the basics of attacks and to feel how old services can lead to consequences.

First, we need to set up the required environment by installing and starting Metasploitable 2 (a deliberately vulnerable system) in a virtual setting. For carrying out our attacks, we will need an operating system like Kali or Parrot.

We will perform all actions on the system we have prepared for the attack.

Information gathering:

We will use Nmap to scan the network and try to find the IP address of the target system.

namp 192.168.154.0/24

Based on our results, we can identify that there are 3 devices: my computer, my phone, and the target system's IP address. Knowing the IP addresses of the phone and my personal computer, we can determine that 192.168.154.166 is the IP address of the target machine.

Next, we will scan the target machine separately.

nmap -sV 192.168.154.166

It also provides the names and versions of services running on each port.

We will start with port 21 and continue from there. Let's scan port 21 separately once again.

nmap 192.168.154.166 -sV -p 21

From the results, we can see that port 21 is running the FTP (File Transfer Protocol) service with vsftpd version 2.3.4. During our attacks, we will use Metasploit most frequently, so we'll start Metasploit and continue our work through it.

Starting the attack:

msfconsole

We will use Metasploit’s search feature to look for exploits related to the FTP service version.

> search vsftpd 2.3.4

As a result, we have found one exploit (a code or method used to exploit a vulnerability and damage the system or application). We will consider using it.

> use 0

We can use the use command to select the exploit, either by specifying the exploit URL or simply by providing the index number.

> show options

Through this, we can see what the exploit requires from us.

In the Required section of the image, the fields marked as "yes" are mandatory.

`RHOSTS` is the target IP address; we need to enter the target's IP address here.

> set RHOSTS 192.168.154.166 

`RPORT` is the port on which the target's FTP service is running; by default, it is set to 21, so we can leave it as is.

To run the exploit, we use the `run` command.

> run

Finally, we have a result: we have established a connection with the target system, and the `whoami` command shows that we are logged in as root. This means we can use commands like `rm -rf /*` (a dangerous command that deletes all files) on the system.

In today's article, we demonstrated how an outdated service can lead to compromising an entire system and how to search for and use the necessary exploit in Metasploit as an attacker.

We will continue to try to achieve results through each open port in this manner. Follow us on social media to keep up with future articles.

By the way, if you liked the article, don’t forget to register on the site, give it a like, and leave a comment.

Translated by ChatGPT

note: You can also find the first part of the article by typing "Python" into the search bar on the website.

Image sourced from elsewhere

6. System Administration

ℹ️  System Administration - managing systems and networks, monitoring system performance, ensuring security, and working with networks.

📊  According to the Stack Overflow Survey and GitHub Octoverse 2023 statistics, Python is used by over 45% of system administrators and has solidified its position in developing system scripts on GitHub.

🐍  Python Opportunities for System Administrators: Modules like os, subprocess, shutil, and psutil make managing system files, monitoring processes, and automating tasks much easier and more efficient. Tools like Ansible and SaltStack are used for server management and automation.

💻  Facebook: Uses Python scripts for monitoring servers and automatically resolving issues during system operations.

Red Hat: Extensively uses Python-based automation tools for managing Linux servers.

7. Desktop Application Development

ℹ️  Desktop Application - the process of creating standalone software that runs on computers. These applications work with user interfaces and unique functionalities.

📊  According to the Stack Overflow Survey, the use of Python in desktop application development has increased to over 30% in recent years. Despite Java and C++ being leaders in this field, Python is also finding its place in the market.

🐍  Python Desktop Application Development Opportunities: Libraries like Tkinter, PyQt, Kivy, and wxPython are available. These libraries allow for creating graphical interfaces. Tkinter is the most widely used, simple, and effective tool. PyQt and Kivy are well-suited for creating advanced interfaces.

💻  Dropbox: Initially developed with Python and continues to use Python libraries for its main desktop versions.

BitTorrent: The application, which works based on the torrent protocol, was also created using Python and wxPython.

8. DevOps Automation

ℹ️  DevOps - streamlining the management of systems through software development and IT processes and automating them to ensure constant and secure system operations.

📊  According to the Stack Overflow Developer Survey, Python is used in over 35% of DevOps automation tasks. Python is becoming a primary language for scripting, monitoring, log processing, and containerization.

🐍  Python DevOps Automation Opportunities: Tools like Ansible, Fabric, SaltStack, and Chef are widely used for configuring servers and automating processes. Additionally, Python can be used for configuring Docker and Kubernetes.

💻  Google: Utilizes numerous Python-based tools for DevOps and system automation. Python is used in creating and managing Google Cloud Platform (GCP) and other internal tools.

Amazon Web Services: AWS provides advanced SDKs for managing and automating cloud services with Python. AWS CLI and Boto3 (Python library) are written in Python.

9. Robotics and Control Systems

ℹ️  Robotics and Control Systems - creating software to move devices and establish communication with them.

📊  Python-related robotics repositories on GitHub accounted for over 30,000 repositories in 2023. More than 80% of the world's top 50+ universities in robotics choose Python as their programming language.

🐍  Python Robotics and Control Systems Opportunities: Integration with ROS (Robot Operating System) is widely used in robotics. Libraries like Pygame, OpenCV, and PySerial are helpful for control systems. Pygame is used for creating 2D games, OpenCV is used for image recognition, and PySerial is used for communication with microprocessors.

💻  NVIDIA: Uses Python libraries (TensorFlow, PyTorch) to create and apply AI models for robotics and control systems.

Tesla: Utilizes Python libraries for developing control algorithms in automated driving systems.

10. Game Development

ℹ️  Game Development - the process of creating games that combine graphical interfaces and complex mechanics.

📊  Specific statistics are hard to find in this field, as languages like C++, C#, and Java dominate. However, Python is actively used and is expected to have a significant impact on AI (Artificial Intelligence) control parts of game development in the future.

🐍  Python Game Development Opportunities: Pygame is very suitable for creating game mechanics and graphical interfaces. Tools like Panda3D and PyOpenGL are used for creating 3D games.

💻  Battlefield 2 - This military tactics game used Python for server-side modifications and configurations.

Baba Is You - A puzzle game that used Python for game prototypes.

        This article (or rather, this brief piece) aims to provide an understanding of Python's capabilities across various fields. If it has helped you gain insight into these possibilities, I have achieved my goal. In the IT world, choosing any of the 10 areas mentioned above can serve as an introductory and versatile pathway. Certainly, excelling in a single field requires more than just one technology, as each technology has its strengths and weaknesses. However, Python is a great starting point for your first steps. And by the way, that mysterious ingredient Master Oogway mentioned to Po (the panda) was Python 😀🤭.

note: The article was written with the aid of AI technologies, but the general information was compiled from several websites. The details provided about the example programs have been verified by 90%. Statistical data were also gathered from various platforms that present statistical information and then generalized.

If you enjoyed reading the article and found it valuable, I’m glad!

Translated by ChatGPT