Instructor: Welcome to the Maintaining Access lab. 2 2
Now in this lab we're gonna do two things. 3 3
We're gonna learn how to create user accounts 4 4
and add them into different groups, 5 5
such as the Administrator group, 6 6
and then we're also gonna learn how to manipulate 7 7
the firewall so we can open up access 8 8
so we'll be able to get back in at a later time. 9 9
So to begin this lab, we're gonna start with a connection 10 10
on our Windows XP machine again. 11 11
We've exploited the same vulnerability, 12 12
we're back there going through the netapi service again, 13 13
and we're now at the meterpreter prompt. 14 14
So, one of the things I want to do 15 15
is I want to look at what process I am and what user I am. 16 16
So again, we're gonna do our getpid, 980, 17 17
and now if I type in ps, we can see that 980 is associated 18 18
with the system user inside the service host process. 19 19
So what is that if we do the pid and then getsid, 20 20
the sid is -18, because it's a system level. 21 21
Now, what we're gonna do is we're gonna go 22 22
on to the Windows box and we're gonna start creating 23 23
some accounts in this lab, 24 24
and so what I want to do is 25 25
I want to have an Administrator's account. 26 26
The system can create users but it has a hard time with some 27 27
of the groups because it's not used to doing that; 28 28
it's not really what it's made for. 29 29
Usually you need to be a Admin level user. 30 30
We already know that John Sim is a Admin level user, 31 31
he has those rights. 32 32
So what we're gonna do is migrate into his process 33 33
and become John Sim. 34 34
So we can use process 480, which is the explorer process 35 35
and we'll go ahead and migrate there. 36 36
So we'll migrate into 480, 37 37
and then we'll verify our sid again by doing getsid, 38 38
and you can see we are now John Sim, the 1003 level user. 39 39
So that's a good place for us to start. 40 40
Now, what we're gonna do is we're gonna shell, 41 41
which is gonna drop us in to a Windows command prompt, 42 42
because everything we're gonna do from here on out 43 43
is standard Windows commands. 44 44
So, what we're gonna do from here 45 45
is we want to actually see what user accounts 46 46
are on the system. 47 47
So the first thing we're gonna do 48 48
is do net user, and when you do that 49 49
you'll see the accounts that are created. 50 50
You'll see here we have the Administrator account, 51 51
the Guest account, the HelpAssistant account, 52 52
John Sim, and two SUPPORT accounts, 53 53
and what this second SUPPORT account 54 54
is one that I have created, just to show you an example 55 55
of how to do that, and so what we're gonna do here 56 56
is we're gonna create another one, 57 57
and so the real SUPPORT account was actually this one, 58 58
the 388945, I created one 338945, 59 59
and you notice there's just one digit difference, 60 60
so we'll do the same type of thing, 61 61
because it's very well, it's easy to hide 62 62
from your System Administrator 63 63
by having these additional accounts. 64 64
If I put something in there that said hacked 65 65
or ethical hacker, or anything that just looks out 66 66
of the ordinary, it'd be very easy. 67 67
Now in this particular PC, there's very few users, 68 68
so it would be very obvious. 69 69
If you're in a domain environment though 70 70
there's hundreds and thousands of users, 71 71
so you can blend in very easily, 72 72
as long as you use the same naming scheme. 73 73
So in our case, what we're gonna do 74 74
is to create a new account, we're gonna type in net user 75 75
and then the user name we want. 76 76
We'll go ahead and use SUPPORT, just straight up SUPPORT, 77 77
and then we'll give it a password. 78 78
I'm gonna use a1b2c3, just to keep things easy as we play, 79 79
and then /add. 80 80
When I do that, that account has now been created. 81 81
We could type in net user and hit Enter, 82 82
and you'll see that account now exists, the SUPPORT account. 83 83
Now, what rights does that SUPPORT account have? 84 84
Well that's a great question. 85 85
Let's go ahead and look at it. 86 86
The way that we're gonna do that is by typing net user 87 87
and then the username. 88 88
So, net user, and then the username, 89 89
which in our case was SUPPORT, 90 90
and you'll see that the SUPPORT account was created 91 91
and it's password was last set just now, 92 92
the password is good for 60 days, 93 93
it does require a password change every 60 days, 94 94
but it is changeable right now, 95 95
so we could change our password if we wanted to. 96 96
Now, it can log on to all workstations, 97 97
and it has all login hours, but the only membership it has 98 98
is a standard user account at this point. 99 99
So it is a standard user account 100 100
is not gonna be very useful for us, 101 101
we're gonna want to get that into the Administrator group. 102 102
So the first thing we want to do is 103 103
we want to learn what type of groups are on this machine, 104 104
and so what we're gonna do there is 105 105
we're gonna type net localgroup. 106 106
So, when we type in net localgroup, 107 107
you'll see the groups that are on this computer. 108 108
There's the Administrator group, the Backup Operators group, 109 109
the Guest group, the HelpServicesGroup, 110 110
the Network Configuration, Power Users, 111 111
Remote Desktop Users, Replicator, and Users. 112 112
The only group we're a member of though is the Users. 113 113
We want to be a member of the Admin group. 114 114
So how are we gonna do that? 115 115
Well, we're just gonna do net localgroup, 116 116
and we're gonna see who's in the Administrator group first. 117 117
So we're just gonna type in Administrators, 118 118
and you can see right now, the only two Administrators 119 119
in the system, are the Administrator and John Sim. 120 120
Well we want to be Administrator too, 121 121
so we can just do net localgroup, the name of the group, 122 122
which in our case is Administrators, and then, 123 123
we're gonna type the username we want to add, 124 124
which is SUPPORT, and then /add, 125 125
and now it tells us that it was successfully added. 126 126
Now, how do we verify that? 127 127
Well, we can look in the group membership 128 128
or we can look at our user. 129 129
We're gonna go ahead and do both just to verify. 130 130
So, net localgroup Administrators, 131 131
and you can now see that SUPPORT has been added 132 132
to that Administrator group. 133 133
The second thing we're gonna do is net user 134 134
and then SUPPORT, and we'll see that they now 135 135
have the ability of being an Administrator 136 136
as well as a User, their in both groups. 137 137
Now, this is just a very simple example 138 138
but it shows you the power of what you have. 139 139
Once you've got an Administrator account, 140 140
you can start spreading out and creating your own accounts 141 141
and your own ways back into the system, 142 142
and that's the way we wanted to show you 143 143
is just a simple way of creating additional accounts 144 144
from the command line. 145 145
Once you're in this command line, you can do anything 146 146
that the Windows system will allow you to do 147 147
from the command prompt, so it's really important 148 148
to have that Windows System Administrator background 149 149
because than you know how to actually operate the system. 150 150
Now in the second part of this lab, 151 151
we're gonna play with manipulating the firewall. 152 152
So, the firewall can actually be manipulated 153 153
from the command prompt as well, 154 154
and the way we do that is by using the netsh command. 155 155
So if we do netsh, this will drop us into the netsh shell. 156 156
So now that we're at the shell, 157 157
we want to go into the firewall settings, 158 158
so we'll type in firewall. 159 159
So now you'll see our prompt says netsh firewall. 160 160
So if I type in ?, you'll be able to see all 161 161
of the commands that are available for us. 162 162
So, in the context of our firewall, 163 163
we can add a firewall configuration, 164 164
we can delete a firewall configuration, 165 165
we can dump and display the entire configuration script, 166 166
we can get help, which is what we did by the question mark, 167 167
and then we can reset it or set it, 168 168
or show the firewall configuration. 169 169
So what we're gonna do first is we're gonna look 170 170
at the current firewall. 171 171
So what we're gonna do is do show and hit Enter. 172 172
Now, from show, we want to see 173 173
what the service configuration is. 174 174
So what services are allowed to run? 175 175
Right now, they have enabled File and Print Sharing. 176 176
So that's good, that's one of the things we use 177 177
as a way to get back in. 178 178
Now, what about our port configurations? 179 179
Well let's do show portopening, 180 180
and so here we can see what open ports we have. 181 181
We have 139, 445, 137, and 138. 182 182
What are all those ports used for? 183 183
That's right, all those ports are used in the firewall 184 184
to allow file and print sharing. 185 185
Since we have File and Print Sharing enabled, 186 186
those ports are also available for us to use. 187 187
In our case, we use 445 as the port that we exploited, 188 188
that's the one that we came in on. 189 189
Now, let's see what the loggging on our firewall is. 190 190
So if we do show logging, you'll be able to see 191 191
that right now Dropped packets are disabled, 192 192
we don't log those, Connections are disabled, 193 193
they don't log those, and where is the location 194 194
of the log file? 195 195
It's in the Windows directory. 196 196
Why is that important to us? 197 197
Well, in our last step, we want to cover our tracks, 198 198
and so if we've made changes to the firewall, 199 199
all those are gonna get logged. 200 200
We'll want to go and clean those out 201 201
in the log file later on. 202 202
So what are some examples of things that we can do here? 203 203
Well, one of the things that the System Administrator 204 204
might have disabled is ICMP or ping traffic echoing, 205 205
and that way we couldn't footprint the network. 206 206
Well one of the ways that we can do now 207 207
that we're inside the network is we can turn that back on 208 208
if we wanted to, or if it was on 209 209
and it was a vulnerability we used to figure out 210 210
where the network was, we can turn it off. 211 211
So let's go ahead and turn it on, 212 212
I'll show ya how to do that just so you can get used 213 213
to using this tool. 214 214
One of the ways you do that, is you type in set icmpsetting, 215 215
8, which is the echo reply, 216 216
and then you're gonna type in ENABLE, and by doing that, 217 217
we've now set that setting, 218 218
so that other people should be able to ping it. 219 219
Now, if we wanted to disable that, 220 220
we would just do set icmpsetting 8 DISABLE, 221 221
and again, this goes back to what we talked about before. 222 222
When you break into the machine, 223 223
if you want to make sure nobody else can break in, 224 224
because you want to keep that machine to yourself, 225 225
you might go in and actually secure the machine, 226 226
even better than it was before 227 227
such as disabling features like this. 228 228
Now, File and Print Sharing is already enabled 229 229
so we don't have to worry about that, 230 230
but we could actually disable it at this point. 231 231
So once we set our backdoor and we have another way in, 232 232
we can actually hack the vulnerability 233 233
that we first exploited, 234 234
and then we can disable File and Print Sharing, 235 235
so that other people can't get in as well. 236 236
We're not gonna do that right now 237 237
because we haven't set our backdoor yet, 238 238
so we want to make sure that's still open 239 239
and available for us, 240 240
but to do that, what you would do 241 241
is do set service FILEANDPRINT, and then you do DISABLE, 242 242
and then you would hit Enter, 243 243
and that would disable the service. 244 244
We don't want to do that right now 245 245
'cause we're gonna need it to be able to break back 246 246
in to this box later on. 247 247
Now, one of the other things you can do 248 248
is you can just disable the firewall completely, 249 249
and to do that you just do set opmode disable, 250 250
and right now the entire firewall for that machine is off, 251 251
and we can verify that by going over to that Windows machine 252 252
and looking at it. 253 253
So once we're on that machine, we can just go over here, 254 254
look at the computer might be at risk, 255 255
and you'll see now, the firewall is off. 256 256
Now, if we enable that, and we go back, 257 257
you'll see the firewall is now on, 258 258
and that's the type of thing that you can do 259 259
with this firewall, is you can turn things on and off 260 260
as needed because you now have control. 261 261
Normally though what we're gonna do is 262 262
we're just gonna allow specific programs or ports 263 263
through the firewall. 264 264
Let's say for example, I wanted to have a netcat listener 265 265
sitting on port 5000 on the machine. 266 266
Well, the way that we would do that 267 267
is we would have to set an exception in there. 268 268
So what we can do is set allowedprogram, 269 269
whatever the path of the program is, 270 270
in our case it'd be Netcat, 271 271
and then allow, nc is the name of what we're gonna allow 272 272
and then ENABLE. 273 273
Now, we have not setup Netcat, we have not uploaded 274 274
that tool yet, so there's no benefit of setting this 275 275
and it's probably gonna error out if we do it 276 276
but I just wanted to show you what the command is. 277 277
Again, we'll play with that one more 278 278
when we start doing our backdoor's in a future lesson. 279 279
Now what if we just wanted to open up certain ports 280 280
on the firewall? 281 281
Well, let's go ahead and look at that again. 282 282
So again, if we wanted to add something, 283 283
we would do that with the add command. 284 284
Now, what are we gonna add? 285 285
In our case, we want to add ?, 286 286
I'm gonna show you the different things that you can add. 287 287
So here you can see, you can add a port, 288 288
or you can add a program. 289 289
I just showed you the program with the Netcat example. 290 290
Now, for a portopening, let's see what 291 291
the configuration setup is for that. 292 292
Well, what you have to do is do add portopening, TCP, UDP, 293 293
or ALL, the port you want, 294 294
and then you're gonna give it a name, whether it's you know, 295 295
WebPort, if it's IKE, if it's DNS, it could be hacker, 296 296
whatever you want, ENABLE, and then ALL or CUSTOM. 297 297
So in our case, what we're gonna do is 298 298
we're gonna do a add portopening TCP 80, 299 299
we'll call it WWW and then we'll enable it for all. 300 300
So what we'll do is add portopening TCP port 80, 301 301
we'll call is WWW as if they were running a web server, 302 302
and then we're gonna ENABLE ALL. 303 303
Now it says it's good. 304 304
How do we verify it's good? 305 305
Well, we can do that from the command prompt, 306 306
or again we can look on the machine 307 307
and see what it's gonna look like to the victim. 308 308
What we're gonna do here is we're gonna look at it 309 309
from the command prompt. 310 310
So, what we're gonna do is we're gonna do show 311 311
and then we want to show the portopenings, 312 312
and if you remember correctly, 313 313
we had four ports before that were all associated 314 314
with file and print services. 315 315
Now we should see port 80 added to that list, 316 316
and so you see that port 80 is open. 317 317
Now we can verify that on the victim's side. 318 318
What will that look like to them? 319 319
Well for them to see that, their gonna have to actually 320 320
go in to their firewall, and their gonna actually have 321 321
to look at the configuration and the setup for it. 322 322
Now, where do you get to the firewall 323 323
on a Windows XP machine? 324 324
You just scroll down and click on Windows Firewall. 325 325
Then from here, we go to Exceptions, 326 326
and you'll see there's now this exception for WWW, 327 327
and if we Edit it, we can see TCP port 80, 328 328
that's what they actually did. 329 329
And so you can see that from the victim perspective, 330 330
their not gonna see anything unless they really 331 331
are checking their firewall all the time and looking at it. 332 332
In this case, their not, and so they don't see it. 333 333
So those are just some basics of how to use the firewall 334 334
and set it up. 335 335
The nice thing about it is that you can do everything 336 336
from the command line, but you've got to get used 337 337
to the way the command prompt works. 338 338
You have to get used to the way 339 339
the netsh firewall tool works. 340 340
There's lots of things you can do 341 341
once you have the exploitation of the machine, 342 342
it's just a matter of determining what your intent is 343 343
and what it is you want to accomplish.