Welcome back.
Time to gain access to our Windows 10 machine using the S&P ghost vulnerability.
For now, we managed to scan it to see if it's vulnerable.
And we also managed to find a tool that we can use to crash the target system.
But ideally, we don't want to crash it.
Instead, we want to gain Shell on that target machine.
Well, with this vulnerability, it is not that easy.
There are some things that we need to know in order to be able to remotely exploit it.
Let's see what I mean.
The first thing that we must do is we must download the tool that we are going to use for the exploitation.
And I will detect a few of them out.
And they found the best working one to be this Zech Ops severe vulnerability.
If you just type the same thing that we take from the previous video, which is the vulnerability name
and then GitHub, you should find this Zachares link to be on the first page, click on it.
And down here we can see the files that we get.
And right here, we also see the usage of the tool itself.
But before we get into all of this, let us first download the tool from GitHub.
So let's go put the link right here.
Cupie, go to our terminal and type git clone and then the tool link.
Press enter and here it is, it finished downloading that this type else, and we will see a bunch of
these directories with the same name.
This one, however, has this extension of RC and then possie, which stands for remote code execution
proof of concept.
Let's change the directory to the directory.
And if we type ulcerate here, we are going to see a bunch of files.
So we get this dot bad file which runs on windows.
If we get this SMB Ghost Assembly shall code for the 64 bit version and we get this python SMB bleeding
ghost file, which is the exploit itself.
But we don't really know how exactly do we combine all of these files.
So let's go back to the page and check out the usage of the program.
The first step right here tells us that make sure Python and Cat are installed.
Then run this fall on the target computer and adjust the offsets at the top of the S&P bleeding ghost
dot peafowl, according to the script output.
Hmm, what does this mean?
Well, let's go to the Python file first.
Let us know it.
To see what offsets do they mean, and I assume they mean these offsets right here, as we can see,
there are five of them and they have different offsets.
But you might be asking.
Well, it tells us right here that we must run this on the target computer.
And what's the point, then, of calling this an expert if there is a file that we must run on the target
computer first?
Well, let's go to the note down here.
As it says, you might be wondering why it is necessary to run the DOT pedophile script on the target
computer.
And doesn't it defeat the whole point of the remote code execution being remote?
Well, here is the explanation.
These offsets are not random and are the same on all windows.
Instances of the same Windows version.
One could make the attack more universal by detecting the target Windows version and adjusting the offsets
automatically or by not relying on them altogether.
What does this mean?
Well, these offsets right here are the same for the same Windows version.
So, for example, this Windows version that we got right here, if we had a thousand machines that
were running the same Windows version.
Well, it is enough that we run this bed file on this one to check out the offsets.
Then we adjust the offsets right here inside of our exploit, and then we can attack all the thousand
machines without having to run the dot bed file on the.
But a different version of this Windows machine might have a different offset, which will then make
Overexploit not work.
So we must check the offsets first.
How we're going to do that?
Well, as it says right here, we're going to run the bed file on the target system.
So I already downloaded the tool right here on my Windows machine.
Here it is on the desktop.
And what you can do is you can just open the Windows 10 machine, open the Internet Explorer type,
the vulnerability name, and then GitHub navigate to this Jakob's tool.
And then if you click on it, click on this code error right here and click on download zip.
This will download the tool for you and you should have it right here on the desktop right after it.
Great.
Once you do that, what we can do is we can navigate using our terminal to that tool.
So the desktop and then see the CV.
If I type there right here and I run the platform, of course you can run it using command prompt or
you can just double click on this file.
And double click on to calculate target offsets.
As we can see, this will open another terminal and this will give us those five offsets for this particular
Windows 10 version, what we must do right now is we must change these offsets to match inside of our
python file right here.
So let's check it out here.
We got two one seven zero.
The first one is the same, three to one zero.
The second one is also the same.
The third one also appears to be the same.
The fourth one is different here.
It ends with three seven zero and here it ends with four one zero.
So let's change that first.
Let's type it three seven zero and the last one.
Is also different.
So here it is, B, a F A eight, and here if we change it, be a F eight.
Now everything is good.
So if we control OK to save this exploit now, we should have a working expert.
We can close this, we don't need it anymore.
We can also close this.
And if I go back to the page to check out the next step, it tells us Ron and Kate with the following
command line arguments.
So the purpose of running and cat is because once we explain the target and we run the payload, it
must connect to somewhere.
Now, this listening for the incoming connection matters split framework did for us automatically.
Right now we must do it ourselves and we're going to do it with the help of banquette.
So to listen for the incoming connection, we can type and see and then dash LWP and then the number
in this case legislation on Port four thousand four hundred and forty four.
This will listen for the incoming connections.
And once we run the exploit, the target machine will try to connect back to this port.
No, right here on our IP address.
Therefore, right after it, we should have a shell pop up right here and we should be able to execute
commands on target machine.
Great.
Let's check out the next step.
The next step is to run the dot p file while following the command line arguments.
So the command that we must run is the file name, then the target IP address, then the Catalinas IP
address and then the port that we are listening on.
And this reverse shell IP is just the IP address of the machine that you're listening for the incoming
connections and you get the explanation right here as well.
So let's try it out, we are listening right here already and let us run the file right here.
We're going to use Python three percent, be bleeding goes up.
Then comes the target's IP address, which is, in my case, one.
Add to that 168, that one that five, as it says right here.
Then comes the IP address on McKellen's clinic's machine, and I'm going to check it out inside of a
third terminal.
Real quick.
It is not one of the 12.
So let's type it right here, and the last step is to specify the number that we are listening on and
in our case, that is the port four four four four if I press enter.
We get an error that says no attribute Vin Diesel and I knew this error will come up.
The solution to this is to run the exploit from a Windows machine.
So this file right here must be run from another Windows machine and then we can redirect the connection
to this Linux machine to pop a shell.
Why is that?
Well, this type library has no attribute URL, which is only to be ran in a Windows environment, I
believe.
So let's test it out for this.
I'm going to use my main Winterstein machine right here to run the exploit and I will redirect the connection
once exploited to the cleanest machine that is already listening for the incoming connections.
Now, I know it sounds a little bit complicated, but let's give it a try.
I already downloaded the exploit right here.
Here is the file containing all of the other files.
And if I open my command prompt.
Then I navigate to this directory right here containing the exploit,
what I'm going to do is I'm going to run the exact same command that I ran previously on my Caledonius
machine.
Just this time, I'll be running it from my main Windows machine.
So the IP address of the target is first, then comes the IP address of the machine that is listening
for the incoming connections.
And this might sound confusing, but this is still the IP address of our clinics machine if you want.
However, you can also connect back to this Winterstein machine.
But in that case, you must install Netcare for Windows and listen using that cat from a Windows machine.
And then right here you would specify the IP address of the Windows machine that is running the exploit.
Since there is no need for me to do that, I will just specify the Linux IP address and the port number
is four four four four.
Great.
The comment is here and if we execute it.
It will start to exploit and sometimes this exploit will crash the target, as we can see right here,
the first try of running this exploit crashed our target machine.
And this is something that you must get used to once running these type of exploits.
So what I'm going to do is I'm going to control this to create this exploit.
And then what I'm going to do, clear the screen using classic command, and I will run this command
once again just to wait for this Winterstein machine to boot up once again.
And we are going to give it a second try.
And now we're locked in.
I will run the command once again.
Now, there is a chance that it will crash once again, but hopefully it will not.
And here it is.
It crashed once again.
So I'm just going to restart it again real quick and then run the exploit for the third time.
Hopefully the third time it will work.
OK, here it is, and hopefully the third time will be our lucky run.
Let's run the exploit.
For now, everything seems to be working.
We haven't reached this point in the past to try, so hopefully right now the target will not crash.
And what we're looking for at the end of this is after the expert is done, we're looking to gain the
shell right here inside of our colonics machine.
So let's wait for this to finish.
It tells us right here, wrote Chilkoot.
And if I go to my Linux machine here, it is free, got the shell on our Windows 10 target machine,
if I type, who am I?
We are the system level account.
So we are the highest level account possible if I type IP config just to check whether we have the same
IP address and that indeed is the same machine.
So we successfully exploited the Windows Ten Target machine just for this.
We had to use Windows Machine to run the exploit because of some libraries inside of the Python file.
And if you notice right here, it tells us that if we disconnect and if we exit this expert, the target
will probably crash.
So what we would want to do is we would want to execute all of the comments that we want to execute,
do what we need to do on the target machine.
And then after we've done and we've exited the shell, we can go right here, stop the exploit.
And once this exploit has been disrupted, that will again crash the target machine.
As we can see right here, just this time, we managed to run the shell.
We managed to execute commands on the target machine for as long as we wanted before crashing the machine.
So the goal right here is to first gain the shell and then the machine will crash and not crash the
machine at the beginning of the exploit.
But that is something that we do not have control of.
So sometimes you will gain a shell and sometimes you might crash the target machine.
OK, great.
So we successfully exploited Windows 10 machine.
We did it manually with the help of tools that we found online.
We also set up our own listner that was waiting for the incoming connections, and right now that we
covered all of these vulnerabilities, starting from the next video, we're going to see how we can
attack targets that do not have any vulnerability.
So we are going to see how we can generate our own payloads and how we can deliver them to the target
machine.
See you in the next video.