Hello everybody, welcome to my "advanced ethical hacking network and penetration testing course".
when comic into all advanced ethical hacking to date guys.
So we are going to talk about brain pain.
Vulnerable labs.
We are in the system in immigration and exploitation.
So what is it.
So we're going to show you exactly where to where to download disorder as we already provide a descent.
So OK let's go straight forward in this.
We find is
by then OK.
Even this link so you can download it and then you will have to download tool to a beauty system.
The pornhub in the brain.
So you will use the point laughter.
So it's good for you if you have read.
OK so we copied copy and you can minimize it and go to the party Crow and Bowser busted down with it
me.
I have downloaded it in my system.
So in case you didn't have it downloaded so you can try to make it that.
OK.
And then you just went with to gloat just a moment.
OK
just for a demonstration I'm going to go in and download it because I have it already in my system.
OK.
Here you download it.
As I said earlier.
So you will find two who of operating system the pointing of one and then bring pain.
Okay so let's close this stuff.
We can minimize it.
So now let's go to all it's going to do when you have it down not on your system.
Now you go to a directory where it is downloaded and then you double click it is all V A extension.
What does that mean.
You don't need to go to virtual box and step by step.
You create and you add a gigabyte properties.
You don't have to with only one thing you have to do is double click.
So you double click it and then we're going out it will import automatically to reach output.
So now.
So if you want you can make some changes for example you can change and change the name like John pain
to do you need to really be dead and enough to we can make some changes after that.
Now it is going to be imported in of veteran box machine.
So let's wait a moment.
All right.
So we have it.
What next.
The next thing First be aware that you're clearly your killing machine version should be configured
exactly as the one that you are trying.
I mean the one the renewable operating system that you trying to export and emulate what I see there.
So let's check for a little bit what color looks much in detail as to what in general so it does it
politically.
Does it matter to us.
What is does matter to us is network whether we are on which network in E and Z will Wi-Fi make sure
that you wouldn't do it would be pain or buddy system.
It will be exactly configure it the same way as it clearly looks.
So that's it guys.
Now let's go to two avoid pain.
What is it.
Is it generally been one.
OK.
You still we don't need to do it but what if you want you can put it as a bi directional so and drag
and drop as well.
OK.
Now we go to storage.
We have it already we don't need anything else because we are not going to.
Input is all fine here.
We don't even need to go there.
So network widget adapter e and see well that is good because that's what we need it.
Well here it's nothing.
It's not being used.
Not a thing.
OK but yeah.
So if we want we can put it on the tree to put it doesn't matter because we are not going to work with
it and then we just want to hack it and exploit it so that we don't even need this thing so we can say
what if you want you can.
OK.
So it doesn't matter.
Yeah okay.
So now it started.
Now wait a minute wait a moment you start the operating system and we went in includes
working with pensions.
Meanwhile we can go on track to to launch the next machine as well.
So let's do it.
So what we did was Time's cutting makes
you do
I think it's one in here.
We still have to wait
now okay we can replace the.
All right.
So now when you if you try to click inside of this operating system your mouse can be frozen.
But boy if only my book.
So you just with com left command and then you will get your mouse back difficult then yeah and then
I would try again.
A Greek colleague I don't see anything.
So I just can type what it's doing nothing.
So I place command again I get my mouse.
Exactly.
So.
Well OK.
So next is lunch.
So I would.
And your password is go.
Key.
So now we have both operating system grunge or Kelly machine or brain pen.
And then the host machine of work.
So we are known in my book.
So.
Okay
okay.
No but we have to do we have to find a way to get the IP address of the vulnerable machine.
How can we see that.
Yes of course we would actually do.
And then being in mine when you want to act something or when you want to to scan something or when
you want to explode some information for me system.
You always have to check and use your brain as if you get to any page.
Try in such a way to get the code to view the source code because it's obviously needed something can
be hidden on BHP file or something like that.
So to get as much as the information that you need of course probably you will not find all the information
but it didn't show information which would help you for your task.
So you have to always try to view the source code no matter what.
OK.
Now let's see how we can check the IP address of that machine.
We've gone terminal here.
GREG Okay.
Now first thing first we have to take these net this quarter minus E and then your interviewees my indifference
Misty t h zero.
How can I get it.
So OK I'm going to show you how you can get it.
So we should order already and the previews allowed but if you forget it.
But I think you will not forget it just for the sake of this video.
So we will try it again.
You take this a W config and then put it there.
Yeah.
So an awareness extension.
That means my water awareness is not connected yet because I don't use it.
No I don't need it either for this demonstration.
But when we get to the Wi-Fi we will need it.
And so so so and good and guys I'm telling you you will see.
No let's go back and then we type discover discover I notice of race and mind if we see in every person
and then we grow it.
So he would get a lot of IP address of computers which are in my vicinity.
So oh we can enjoy to phone owners need to know OK.
This is it.
So now we can use control to see so that we stop it control.
See.
OK.
Now what we can try to do so since we have the IP address of it so we can try to go to a web browser
and then type to IP address.
But one thing we can't we leave fine.
We will not find so good information and we will not be able to connect because we don't know yet on
which port that is server machine is winning.
So to find important ways.
So you have to in must be I mean you Skynet.
So let's do it now.
Where does this come in.
Do you end up with a means.
And then the IP address is going to shift because we or we will just like that and then we enter by
pissing it doing so it will Skynet.
But if we want to find much more information out to make it more efficient we type B and then we place
in there.
So let's put it in there starting in map.
So we have the vision save and wait to see what is the latest version.
So again
it's leading it's trying to destroy in its word
and its worst moment in this country is complete
damn good.
So now we have to read or write it gives us.
To get out.
I'm sure that's all kit.
We have 9 9 9 9 9.
God which is open to people which is open so good.
So how much closed.
Some say sixty five thousand and something close to my end of the line.
It's not important to us.
It's good to own to find more.
We've got numbers ten thousand DCP European all key here.
This is the server on which the operating system.
WAYNE Payne is running.
So now we have it.
It's 10000.
Now we can just go to Firefox and then type the adjacent IP address.
I mean you typed in IP address.
No no no it again.
And then we posted here
what number was 10000.
If we want we can try it out again just quickly.
Quickly given away.
Yeah.
So that's what we can go.
We did it.
We did it a bit but it is simple issue TCO.
Exactly.
So now we're going to go to to Firefox then we passed it must then go and then before that we have to
die.
Yeah I figured it might.
OK.
Here we are.
So now since we get you know what we can do we can check for some information we did it is look like
it looks like it page not so much of the information but the best thing for us in case you have to wait
and then try to figure out something.
OK.
So yeah.
So we can right click then view page source.
OK
well those are not things important here.
Nothing.
So we can just close the page and then.
Why now to find if we can find some more directories and how can we do that you can type so into the
address of course let's say contravene and then you type here and then any day will tell you but you
don't know them how to look for them or using Dobie is in is it terminal tool.
So that helps us to con Web site or IP address of some notable operating system.
And then I mean several and then we we we try to kind of to find if we could find some directories so
let's go back to auto we know and dad and
Kay now we will type to do B and then we will press into.
OK.
So we type do narrow and it seems to be slash slash the IP address of the machine.
It was good.
So let's put it last.
And then the port where the silver is warning.
So it was 10000.
One two three one two three four.
And then to enter into where it is testing is coming that you were going to ID
we are going to do it.
I won't do it.
I'm going to wait O K now what we've got to do since we get the information so more information why
it is scanning the user so we can we did look at it see it just gave was it your base or kill was second
in the need o k d CS they do it totally.
So we will just copy eat and pass it into oh where was it.
So since I have read here already so I can just type being invoicing over Oh excellent.
Well now we get more information.
This is a win on that X so we can try to download it.
But bear in mind this course will teach you how to make some exploitation but in some other Web sites
which you not own these might be a virus.
So you have to be careful too.
OK.
But he goes Well I know it's not going to affect us so we can try to download it we download downloaded
and then we save it like that kid.
So now we should go to or don't know Derek talk cooking.
Why do we went under we did what we went under rated we have it let's minimize them minimize minimize.
OK here we would open this page with immunity.
Immunity debugger.
So if you have it installed on your candidate next.
That's great.
But if you don't have an instant and you have it and start on your windows machine it's not a problem.
You can use as well but debugger so it will help you to analyze descent behind the x file extension.
So let's not waste our time.
Let's go deeply into it.
Okay.
Double click it will click it again.
Key key.
Now on its hand let's go to call and do as much in Tennessee.
This is way too much in when fun kids that we have to do now as I don't see error days.
So we have immunity on Cunningham's machine and then we have ID on Windows as well because so we we
just downloaded it just to make sure we have it on both sides.
If we want to have windows.
So now we can try to find its IP address.
But I've been completely.
1 6 weeks so we can try again.
But learning is common.
Just a quick view 66 with this one.
Okay so I can stop it no control see Stop.
This is really here.
So all weighing on when money is this one okay doesn't change.
So what cookie.
Now let's try to open in you We know you would do on
any.
Okay now we're going to fine okay.
Do we have it here.
Let's see.
No no.
No.
Okay now so we can try to to continue to code or join genetic code or we can put it right on bug wide.
Good luck.
Okay.
So Wiggins calls it no.
So.
Okay.
Now let's go and jump to all kinds of news machine.
For us so we can try net discover.
So to find the IP address of a Windows machine being mine guys if you take your computer and then you
move from place to place your IP network might get changed.
So always when you are working on color Unix and with an order lab you have to save your version for
example if you want to leave your color Unix for five minutes.
Save it and close it while you save the state and then do the same for other labs.
Otherwise when you start again in another place.
For example in your school or at home the IP that you saved will be of course changed.
It's not a bubble but you have to remember that because sometimes you can we warn that I do victim IP
when your carry machine and then it's not working.
The reason behind that is because the IP get changed it doesn't mean that you had a mistake but that
IP get changed always be minimized.
Okay.
Thank you.
So let's go for it.
So as we did your
input here
okay.
Now in its wall and up against the windows
you know it's the port number we see disappearing at least is 9 9 9 9
2.
We do need some simple item.
So I will provide them of course until we sources of this course.
Let's go let's go and open one for the analysis and
get to wanted to really do is so it's an 100 kilometres and then the maximum buffer is for toes and
it's the maximum when when you do a quest Wendy Brinkman would quash
it's much more so.
This is to go to land for less or equal the maximum before ending up in the counter and come to an agreement.
On its own.
Kids is the connection.
So Dad said okay no let's go for the test.
Of course for phoning any pirate I'm fine.
So we have the time we have.
Done.
And then defy and the IP address of your windows machine.
And then deport.
No.
Let's see.
Okay.
Attempting to catch on trade.
It's good to know you went to the broker.
It's analyzed the wood Mr Sun that the resource to
find what you can check the check it.
Okay.
As we can see.
So do we just we have e a eggs.
It is composed of eight convicted f f f so he'll D but he's on about 8 characters.
If you can see 0 3 1 1 7 1 1 1 if it counted.
Okay so before going into the diff so let's go backing into all color and expansion
k.
Now we have Dale.
So get it first thing is so we are trying to create where we gonna find her.
Okay.
So give me
time you can go out and create I can wi fi need.
So we copied and then we go here.
We need 900 bad to to quash debate.
So as we have seen in the I god it's when
I need.
So we copy this dude.
Let's try to open one in it takes a little.
You can only need in g e d a d.
Get it get it do it as a.
We have to analyze it.
And then we can change the API trace of course but.
Okay.
You you've changed according to yours.
D was already quite so in it.
And we study
in New will need to plate.
Good.
Okay.
Yeah.
No it's a looking into leading watching
so again later when they screwed on so we didn't do it eventual King such a ticket machine oil well
you're paying your debugger and Deepika you see key right.
Go it's go to E A B ratings.
B.
Okay.
Yeah.
And beat it 35 72.
Okay so next step is going back to a cutting machine.
Okay
try to keep it in unity
and your mind is skillful but a query and an O E IP number as we have seen earlier in our community
into bigger exact might kill ideas admit to it and it's taking its no moods 5 to four Okay
okay.
So let's take a look at a number.
Good
that's key.
Change e
we analyzed it guys to see
we have to find two overjoyed that the ABC is going to do bigger to find
so it's win again this fight again begins this again.
Again with
one
in let's mention declining it gives it
completed great
or ERP now is 4 2 4 2 4 2 4 2.
What we can do.
Okay let's begin to analyze it.
Okay.
And then we have we have to study
in
this again to own or notified what is within their
what it really does.
It all is sensible can't do to 0 windows.
Data nine eight eight
again we take this in command to run sheet against it to run to describe it against windows of course.
Yeah.
Now let's go back there.
To see if any bicarb data is launched against it we will going to check it at the bottom.
It's the content that we have sent on the list in 0 4 you will do okay let's see.
Okay if it is there let's go on.
Okay okay.
But it's moved to find it.
John code.
We'll wait.
Jump.
I mean the G can be so good in school but again to killing machine.
And we have to use a shell script and then destroyed numbers.
And Charlotte is the change that we need.
And then we locate Sure.
And then up to a copy and we wanted Joan ESB.
It is.
So if you feel is the ESB in we'll try again to go back.
Do you mean you will go to the Windows machine
among insurgent type.
More now
we
men and women in the X
located Team B and Jason for Brain Bank came forward and got out of one pointers.
So this is the address we want to repeat.
Could we do one.
And Giannis
Lindsay see Ben
need
sonority study I mean really sooner he started okay as we have stated earlier MSM fandom is a pay or
boys.
It's a tool of mine that's brought that can be used for creating viruses or malware.
So now when I use it all these common guys they are going to be provided in their resources right.
So when you type any seven on a minus B windows show we regress DCP and port.
Of course you can type any port in the host IP the IP I just carry much in and we we send it back.
It is minus B is the to X as he was a war and then minus stuff done so now.
So we compete on for them but characters day when you copy it and let's check it on so we can open it
as you want.
If you are familiar with the V view v EDIT Also you can use v editor if you are familiar we'd get into
detail so you can use it to do it.
It really doesn't matter guys.
Again
let's take a no bid in what he does next month.
You said to five hundred and twenty four cartoons over this backlog tickets.
OK.
Okay.
Yeah.
So that's all we need you to do we shall swap a string that K and E T C2.
Cut
the IPO on target machine and boom.
Get it saw now and get him to do Windows Server OK.
And then try to go to some fights to avoid it being the ATM machine.
It's gonna take
now it's Linux instead of windows.
So we may notice that puts it on sender and then we copy the buffering in
and then opened it on it.
No he.
Now we have a new.
And save it.
And when it again woman.
Now we try to open with desperate by using meet us both.
So we'll have a lot of options to do so only time myself.
Consultant for sugar men is one to monitor indoor centipede Road said the horse and said deport or you
get and we can.
After everything I said that's it as I said earlier you can always type show Ocean's shore auctions
and then we'll show you your number your IP and then everything that you have taped just to make sure
that everything was well settled.
Take one or explode.
It doesn't matter.
So then do reverse the reverse TCB we started.
Warned to win upon which we have saved indeed v.i. to the V.A. as we go now.
It as lunch let's make it bigger.
Cindy opened it.
So let's check the privileges villages see you would change denied.
OK now it's up to us to try to escalate it
worried
so.
Okay now we can notice.
So we have a user which names easy OK.
No let's go.
Type of common which will show us on dip defines which have wood privileges.
Okay.
So fine fine.
Die within each time.
That's good.
On si si o it wide.
Well so these are they.
U u u e d d.
Okay.
It's nice in this vein invalidate again it's it's it's interesting it's a stitch as well so it's good
on.
So you can try to look it up directory and then see
it's good for an input.
Yeah.
Key.
So by this we can try to escalate the privileges.
No no let's try it so we'll try and try.
Oh okay.
So by using that card.
So we are going to try.
STEPHEN KENNY
This bottle of course it's the port that you used
every type body date but he did.
Is it finding him.
Find him.
And then go on to tell me no.
You won't find phantom not then
I'll be doing as much as that Tucker blushing
and then you put deeper on the validate and you see that.
So now let's go back to cut.
Good fight but again.
It's good.
So now we can make some someone that loses.
Okay so let's make it executive.
I mean that right.
We some based on common knowledge you want to force it.
So you can
eat sign it or get it done.
Say
I use
going to be key.
You can try not to place in order to see what happens OK.
But he did thing in the past so that means now it doesn't catch.
Now we are going to tape again validate that was signed by time and see plane now H.
And then we just put it like two hundred Sigmund Freud.
OK.
You can try now to it.
And the debugger to find out how it works.
We can use the same techniques.
A said put it pattern I'm located
can wade.
Who is it.
And then.
So now we can compete.
Now we can take GBP validate
OK now let's try to type one dollar sign and try to stay here.
Gary and Denzel he'll present our go.
This is the refrain.
Know we're going to use.
We have denied it Don.
It's been eight called DOS complete
so we can leave this terminal in.
And again trying to look at the pattern of St. and then after you find a path and then you're copied
and passed it there.
We did que minus que is the que that's what happened except much so now it's great.
So now what would I do.
So we can try to would it be invalidated again to go to the shelter and then we could be in we passed
a despite all code.
I wouldn't give it to you in the resource file.
Of course
we have.
We should see you.
What is the NAACP what is its component of characters so let's play them no.
And then good bloody doesn't have the ability.
You were awarded e x uh well so now we have to.
That's wondered is the maximum that defined the question.
Okay.
So it when I've been to see how you do.
So
however E X can be too strong and show on injection so now let's see.
Oh gee be Don to find what we need is simply try to find a GS B extension and debugger or a mini debugger
or if you want to use really regret it.
It took two days but it's better to use the same tools as we used here in this video.
Okay now to do that we're going to type all beachy dump minus B that he did in the G M B and glib E
X and so was enter into defining who would always want to know is owed.
Now let's try to go and then present and see it.
Oh I guys we have to go X get them so let's use the first one to two start speed it's got a media address
which we like spot right.
So now we have to find the character which is not good.
I mean I mean the bad characters.
So that would make a good analysis so all of these comments will be provided of course in lectures in
resource so.
Okay.
We can take you to meet and validate to go to the Michelle and then when I want this comment it will
send one hundred and sixteen eight counted following my beef for.
Because it is here.
And send it
in so it's only got men and selected one of hundreds the eggs just to see the overlay that when you
stores all you need to begin.
Oh yeah.
Starting from oil from the 0 0 1 0 1 0 1 4 2 Okay we can try intro to food and fade
lives.
We need
Okay now we're going to try to load this this payload using EMRs okay.
Excluding the backlog days does back onto 0 0 0 9 is a 10 is it tiny in forty six.
We try and do four month which would be in the form of Pi done so it was a no so we have a four year
o
necessary to go back again get took know and then past this combined
it sends the payload which would have just created using MSL on and column by 46
uh
we have a payload.
Oh so many bytes.
Okay wrong way.
Call it a X so not it's known.
Okay.
Well here which is shown as rogue
let's use these
we are seen as a bulk user.
Okay.
In and in.
All right.
So let's go to home to see some file let's try to find some directory as it says before and then have
the less
than
2 to.
So let's see if there is some kind of privileges or permissions or something like that taking sort of
minus
one.
Maggie would know buzzword
can use it without using a personal Oh could you do this thing.
Copy
a 9 to 10.
Now we can type sudo command home and just to find and to see dinner and there we were get if you as
would c o care.
Now we have escalated that we are here now as wood as [REMOVED].
Okay.
Okay that's great.
Okay guys.
So who you know.
You lose
so.
Okay.
By being here.
Now we can find to to read anything any fire just using cut or cut is good common.
That is a very good tool that we use for reading fires inside it coming out of what it's up to you can
Derek go through the path and then try to open you up which are not part of all we do I command it's
up to days.
So no let's check if we can read something.
Oh okay.
So that's all for this nature that we were really thinking that this video was informative for you all
so that we are looking forward to see you in the next video for another exploitation of of a new rule
or clearing system.
Thank you.