So now, after being able to you get a limited interpreter shell, which can severely limit actions
you can perform on the system.
The next thing to do is escalate your privileges to administrative or system level users.
And for that matter, Peter has a get system command.
Reduces some of the techniques to elevate your privileges on the target.
However, I want to point out, in some cases, the get system command doesn't solve your escalation
problem.
And by that, I mean that there are some other ways for you to be able to escalate your privileges.
So when you get system isn't enough, you can.
Migrate a higher privilege process and use get system.
Search for a local XPoint.
And I'm sure that you'll be able to be more imaginative.
So you can test your limits as well.
So right now, I will use a limited session to try to show you that escalation problem.
So here's my limited session on Métis Voidable three, and right here on the screen, you can see that
the user is anti authority, local service.
In such a session, you can't run some commands on the target.
So here, let me try clear Evy and has done.
And definitely they are not executed.
So the problem here is the user rights, so in such situations, there are some ways that you should
follow sequentially.
And now the first thing to do is use that, get system command.
OK, but somehow that doesn't work either.
It might be better to run the post module of that command, so let's first look at the definition of
the module with the infocom and.
All right, so there are no other variables to set.
So then I can run this module.
And nothing happened.
So the next thing to try other than your patient, is to migrate another process, so this sometimes
works.
However, generally when they get system is negative, this one is also negative.
So to be able to use this command, you must provide a process in.
So let's type's dash as explorer Yuxi.
And this command brings the idea of the explorer Don EIC, which you can try to migrate.
So let's type my migrate and the idea of exploratory sexy five one four four.
Hmm, OK, but nothing has changed.
So, like get system, there is a migrate post module as well.
So let's give that a try.
Let's have a look at the definition of the module.
And we will need to set that aside and the Sporn variables.
Otherwise, it will just migrate a similar process, it has a lower privileges, right?
And now execute this command type run post windows.
Manege.
Migrate.
And then.
Did equals five one four four sworn equals falls.
And then hit enter.
And so that doesn't work either.
So now the next thing to do is check patches and look for local exploits on the target.
How do we do that in patches?
We'll bring you the missing patches on the system and after a quick look over the description.
Yeah, yeah, you can run it directly.
And this may take a while.
But here in my case, this is the result.
And sometimes, but not always, this information may help you.
So let's come back to the actual point.
I'm not going to go into and look for the individual patches, so.
The last place to look for local experts on the system is by doing this manually or using interpretor
local exploit suggestion, and that might just do it for you.
And all that information is here.
Now it only needs a valid interpretor session.
So we can run this command.
And wait a couple of minutes to collect all the local XPoint.
Now, these are the probable local XPoint.
Now, I assume that you set up the lab, so I'll leave these for you to check and please write in a
comment section what you were faced with.
Because right now, I want to show you another thing.
You shouldn't restrict yourself.
So when you look in the Internet for Windows local exploits, you're going to meet with some of the
known XPoint.
And here's one of them, says Rete.
So visit a GitHub page.
You can download it and examine it.
So after the download, extract the files and go to the release folder.
Now, there are two files here which will perform exploitations for us.
And I'm going to go back to the MSF council.
And navigate to the release folder from the console.
OK, so I'm already there.
Now, I'm here in the remote system also.
So now you need to upload these files to the target, a disposable three.
So we can type upload our current directory, see temp.
R is for recursively uploading files in the folder, so it's going to install files to the temp folder
in the C directory.
And by the way, don't forget to get the process, Edet.
Mine is 59 24, so then type shell.
And then we're going to change the directory to the temp folder.
And list the items here by.
Easier for directory.
The uploaded files will reside here now to run the exploit type system, red dot exi dash P I.D. and
your process ID.
In my case it's 59 24.
And it will quickly handle it.
All right, so now hold control Z.
Right type Y and this will send the channel to the background.
Then look at who you are.
I am anti authority system.
And now it's time to use get system.
Excellent.
So you can see that you're finally able to get system level access to this system from interpretor.