So privies escalation, when you first compromise a box, you know, you're going to notice that you
may already have administrative rights, but, you know, if you don't, you know, what you need to
do is something called privilege escalation.
So pretty much this is just the act of trying to gain access, which we would call it for Linux or system
of access for Windows.
So this is going to make you like a super admin on the box and then you can do what I want pretty much.
So that's really the goal.
So I'm going to see you guys just like some different commands that you can run, like after you've
already compromised.
Those are like for Linux and Windows and give you an example of privacy escalation.
OK, guys, so back in Archaia, Linux machines and others, you can go over some of the basic steps
of gathering information on Oleynik machine, you know, figure out what's going on with this account
and learn about the system.
Where are you going to go to send different commands so that you can enumerate information and be able
to figure out how you're exactly going to escalate your probabilities because you need to find some
type of weakness.
So to do that, you to find out about the system.
So let's just go through some commands.
So one of the first commands you can do is just figure out a little bit more about your user and the
way that you can do that.
Right now, we're in a massive admin account that we compromised before.
You can create another account if you want, it's up to you.
You just do that with the user.
I come in and use that account was kind of up to you, especially when you compromised a box.
You do what you want.
So but one of the first things we can do, learning a little bit more about the user and groups and
such, I like the type of proposals they have state ID and you get a little bit more.
We see, like, you know, different groups and such over here.
And we can kind of get a little bit more of an idea about what's going on with this user.
So also, if you want to learn more about users on the system, you remember the shadow file and Linux.
So we could do such slash shadow and see we don't have access for that.
So maybe we can do it if we're lucky.
So, OK, seems like shadow.
A massive admit, and we can learn a little bit more.
We see that there's different uses on here and now we can enumerate a little bit more like figure out,
hey, you know, those are using a building on here.
There's different users now.
So now we know what's on the system.
Maybe we have some new targets or something.
And also, like you saw how it is, permission denied that will happen.
Like in the real world, you may not actually have admin rights.
So you have to be ready for, you know, not being able to print out this file.
So that's very normal.
But it doesn't matter.
You just keep on enumerating.
So one of the things we could do, we could have hostname and just enter.
Now we know a little bit more about the hostname.
So if we do Casaus XY, so that's the issue here.
This is going to give us a little bit more information about the system in general.
So we've kind of seen this when we whenever we go, Antonette, and it shows kind of this right here
and gives us like information right there for logging.
You know, we already have that, but you'll see different things or different systems.
This is just metastable in how it's set up.
So you can also do is Katsas EDC slash star dash release.
And it's going to give you a little more information about the distribution of Linnik.
So this is this is a boon to an eight point of four, which is way behind.
So now we know, hey, this is a pretty old distribution of one to maybe there's some expertise out
there so we can go look up X specifically, you know, four eight point zero four to maybe escalate
privileges.
Another thing that we can do is you name Dash A, and this is going to pretty much give us the kernel
version in architecture.
And this is very important.
You know, when you're I would say that this is one of the more one of the commands that you want to
run and they're going to give you idea because it's out there for privilege, escalation, for specific
kernels of Lennix and for this one, I believe that there is as well.
So it's really important to do that.
So another command you could do is Aksu.
And this is going to pretty much just print out the different processes that are running and the uses
running them.
And it's just kind of get a readable format so you can kind of see.
So what we're going to do, what you would typically do is look through these, maybe see something
of interest, and then you can look into a little bit more.
What they know we're going to take advantage of is this one right here, which is you'd have this,
you'd have the process.
We're going to take a look.
We're going to take advantage of that in a little bit.
But let's continue enumerating because you don't want to stop just because you found one potential point
of attack.
You can probably attack a lot of these different processes that are running.
So you just go through and do your research, write down things, take notes, and then start to look
up like, hey, exploits for this excuse for that.
That's kind of like what you would do.
So we can also type in IPA just a little bit IP information, see what interfaces are in the system.
We can also do slash spending, slash through and this is going to show us running table.
This is not going to be too much here.
You know, this is a small virtual network, so it's not too big of a deal.
We can list out, you know, the network connections right now, just SS dash amp and we can look at
here and see what kind of network connections are made right now, see what systems it's connected to,
maybe numerary a little bit more, you know, about the network or about how this system specifically
acts.
One other thing that we can do is EDC slash Kranti daily.
Oh, we can change over to that directory.
So it's change over there as to L.A. and we can see like the different crosstabs, which are just automated
jobs that run at a specified interval on Linux.
So we can maybe check out some of those, see what's going on and see who's running them and maybe take
advantage of those, put our own commands in there.
And then it's also like a crime weekly on directory as well, on top of the daily one.
So check both those out so then we can see Konta.
And this will show us, you know, what crosstabs actually set to run and stuff like that.
So very, very useful information.
Cron jobs is there are definitely a way that people are able to take advantage of systems.
So you definitely want to know like what tests are on here.
And happening in particular is approvers like admin at its.
And they might have, you know, insecure permission, so some of them to take advantage of one other
thing that we can do is Deep Kaiji cell and this is just going to list out all the install packages.
And so you see that there's versions and names and stuff.
So we can definitely use this to find maybe some privileged escalation vulnerabilities.
So you can so you can look through these and try to figure out some things.
You see Virgin's names of services and stuff.
So definitely something to take advantage of.
OK, so now we know how to enumerate a little bit more for Lennix escalation.
So let's actually try some escalation out for Lennix.
So we're going to go back to that.
You name Dasch a command and we see the colonel for Lennix.
OK, so that's what we see.
So it's very important to take note of that two point six point two four 16.
So we know that that's there.
There's going to be very important.
So let's do a AWEX and then we're going to correct you.
Deve remember I brought up you earlier, so this is going to print out all this service like all those
currently running processes and then is only going to show us lines that have you dove in it.
That's what it does if you don't remember from the living spaces.
So as we can see right here, this one is running his route right here in the studio, Dayman.
So this is what we're going to try to take advantage of, because we know that specifically that we
already know that there's an exploit.
You could have just done research on it.
But we know that this actually for this for this kernel version.
So what we can do is actually go to our Calli machines of another type and we could just do a search
exploit and then we could type you univ and see what comes up.
So we're going to look at this one in particular right here.
It says Linux kernel two point six to eight points and slice nine point zero four.
You do have less than version one point four point one.
So we know that is actually falls into this criteria.
So that's the way that we want to use.
So what we can do is just such a dash and then eight, five, seven to see.
And that's going to copy it into our current directory already over here.
So I didn't know.
But you can see we can just open it up then and actually take a look at the exploit.
So this gives us an idea of the exploit, what's going on here?
It tells us how to use the information about it.
So says, hey, you before version one point four point one doesn't verify whether Nelligan message
originates from kernel speech, which allows local users to gain privileges by sending a message from
you to space.
So that's the explanation was going on and then how to use it.
So what we're going to have to do is pass the process.
ID, as a kid is right there of the link socket and it tells you where that's listed at and we're going
to go through and do all this.
We're going to pass it in when we run, when we run the exploit and then the exploit is going to run
something, a file that we create from like a script we're going to call a payload that's located in
this last temp run directory on the target machine.
So that's what we're going to do.
So let's get out of here.
So quit.
So what we want to do is actually copy this file over to the MFAT, to the political machine, and we
can do that with something called security copy.
And the the command for this is just SICP.
And then we put the phone is a five seven two C, and then we're going to put the user name.
So MSF admin for that wrong MSF event.
And then the IP address went on two to one six eight five six one zero four.
And then to actually, you know, complete the SEP command, we're going to put a call in and then a
four slash and then we're going to just put those into the temp directory then.
So just to go over the command and get really quickly, we we're doing secure copy or copying this file
right here is a Dossie file.
It's redundancy.
We are going to use these this council, MSF admin at this address, which is the most voidable box.
And then we're putting it into the temp directories and it's going to ask for the password.
So he's S.H. for the most part.
So you put your password in MSF admin.
There we go.
Cool.
I didn't know.
So it Chazarreta.
Over, so now what we can do is actually go back over to our session that we have here is CD size temp
and already have some of the files here.
But we're just going to do less.
And as you can see, we have eight, five seven to see here now.
So we just copy that over.
So as you move for it is said that in the in the directory, in its temp directory, we need to have
a file called Run.
So the file is already there.
But let's just check it out really quick.
So we run and you could just type in.
We run just to create the file.
So so now so we have a miniature payload.
So let's talk about what this does.
So as we talked about before and the scripting section batch scripts, start with this pound sign and
this man right here to use the show binary to like interpret this.
So then what we're going to do is we're going to open up a Netcare session.
So this is this big slice net that opens up that cat executes that binary, which, you know, in that
cat does used to connect and listen and such.
And then the dash e is telling you, hey, when you open up this session and execute the following binary,
so is going to open up that cat.
It's going to open up a shell and then it's going to, you know, listen out to this address.
So it's one nine two one six eight five six Windows seven overreport four four four four.
So it's just like creating a shell that's going to go back to our system once we execute the exploit.
So one thing you might also need to do is on your Caleigh machine, you might need to actually allow
traffic from the whole entire segment to your machine because it might not work.
That's what I found.
I was kind of developing this a little bit.
So one thing you just do is pseudo.
You have W studies suslow you have w allow from and then just pull one or two one six eight zero six
twenty four.
This will let all traffic come in from the subnet that we're on so that you're not going to have issues.
What you want u turn to exploit is definitely something that you do.
Kala's machines are pretty locked down.
So, so we have our run file in there.
That's our payload that's going to execute and connect back out to our box, allow us to get the access
that we need.
So now we just need to figure out the net link process ID.
So let's go ahead.
And we're on them.
We're on our machine.
So let's catch proc slash, proc slash nets, slash net link and we're going to look for this number
right here.
So two, three, six, seven, that's what we want right there.
So let's take note of that number in our two, three, six, seven.
So we are in the slash.
We covid overexploit.
So one last thing that we need to do is actually compile exploit.
So what compiling does?
It just turns it into an executable.
So we're going to do G, C, C, this is the where we can use to compile things on Linux for C programs
and then we're going to put eight five seven zero C and then let's do Dasch.
Oh let's just call it UDA does exploit.
Let's do that.
OK, so on that photo, we have Aida Zwally file, we have our run file, everything's compiled.
We have the process ID to two, three, six, seven.
So what we need to do is actually before we run it, we actually need to start in that cat listener
on our callisthenics machine.
So let's go ahead and just do Incat Dash and OVP four four four four.
And this is going to allow us to listen on, you know, that port, which is the port that we put in
there run file.
So as you can see, just to go over really quickly again, it's going to reach out to our machine as
key to show over this port right here.
So quick.
So now what we can do is you exploit to these seven we bam and let's go back over here.
So now is hey connected to, you know, Windows seven from one to four.
So let's see whoever and our route and let's see hostname just to confirm my disposable.
So now we just escalated our privileges and we can do whatever we want on this system.
So that's kind of like a quick walk through of what you would do to escalate your privileges on Linux.
OK, so before we get into the Windows, exploit the Windows privacy escalation stuff, we need to set
up the computers a little bit more so that the little more vulnerable and so that we can also, you
know, be able to connect to them.
So you want to make sure that you have certain features turned on on Windows 10.
You can find this just by typing features into the search box and click on the windows, turn windows
features on or off.
And what we're going to want to make sure is that we have SMB 1.0 spousal support on SMB direct on Telnet
client, CFT client, just simple things that may or may not be on.
It's going to be very helpful for what we're going to do.
So once you select those, it'll turn them on and you just you said, OK, and then you'll be good to
go.
Another thing that we can do is you've got the admin rights for all this stuff too.
But we also made it who made the accounts here?
So what we're hacking, we're imagining that we don't know this information, but right now we're setting
it up.
So you want to go over here to under the system, just type in system here, click on the advanced system
settings, click on the remote, and then make sure that you can allow connections to the computer remote
desktop.
That's how we're going to be.
That's how we're going to connect to this computer because we're imagining that we captured credentials
from this machine, you know, with our spoof login page like we did before with our spoofing.
So that's in this case, we're assuming that we have access to the system.
We don't have admin rights.
We just have the poor victims account information.
So that is what we're going to be doing right now.
So one other thing that you can also do is actually set up some firewall rules if you want to do.
It's pretty simple.
Just you just open up windows to fit a firewall, new rule, click through and just like allow all or
something like that over certain ports.
So you can do that if you want to as well.
Believe you don't have to if you do it, the DVD, those steps.
One of the thing another way that you can do this is allowing app through firewall is covering up a
list of stuff you might actually have to do this step.
So you have to be admin, of course, but you also want to make sure that you're allowing like a remote
desktop through over all these different profiles, allowing remote desktop through and whatever else
that we might need, like these type of file sharing or something if it's on here.
So any minute you want to be able to get through the firewall, you want to put that here and then you'll
be good to go up.
He set that up that you should be able to connect up to the machine.
So let's go ahead and try to connect from Akali Machine to the Windows machine.
OK, so one other thing that we're going to need to do is actually allow ourselves allow this account
to be able to remote into the computer just so that you don't run into any issues.
Are you going to do you go to the search box on a Windows time machine, just l USAR imgur masc and
then just hit enter the things a little bit slower and have so much ram.
But just do that and enter and it is going to pop up with this window and he's going to click on groups,
you know, click on double click on remote desktop users ad and then you can just type in poor and you
probably hit enter and it'll, it'll like autocomplete.
So I already added it's a list I might apply.
Is access denied so far to do this as an admin, so let's go back and exit out of this.
And let's do local usar Magadha MASC, see, right, click it and write it as administrator.
So this is the administrator, account administrator and then the password for that account and we can
run this as an administrator and then now we can add or so Citigroup so at or at our victim to the group.
So check me and go.
OK, apply.
OK, now we should be able to remoted so let's go to the next machine.
OK, so on a colonics machine.
So are we going to do is that our desktop commands pretty much just remote desktop for Linux and then
put the IP address over.
When does the machine enter is going to come with a nice pretty window for RTP.
So we're going to do this.
We're going to make sure we're logging into the domain.
So ethical hacking lab slash is going to be a backslash that we're going to put poor victim and then
the password.
And so let us login.
So now we have access to computers.
So we fished them.
We got his credentials.
So we have access and now we need to, you know, log in, figure a little bit more, you know, about
the network and what's going on on this computer as well and see what we can figure out.
OK, so we're inside of our windows hosts.
So what we're going to do is just go over some enumerations stuff for Windows to sort of get an idea
of, you know, how to find something that might be vulnerable.
So the first thing I want to do is open up a command prompt and you can look around some of the stuff
in the GUI if you want, but we're going to get more bang for our buck in the command problem.
So I want to open up a power shows a little more versatile and I love more powerful.
So you just type in power shell that you exceed and that's going to load up.
So we have that loaded up.
We can just start trying to learn things so we could do like net user to learn a little bit more about,
you know, the local user accounts here and see, you know, if there's any groups or anything, see
what accounts are on the system.
Hostname, just like Linux tells you to hostname, you can type in system info and get a preknowledge
a lot of different information about the system and figure out the distribution to figure out, you
know, when those ten enterprise is this build right here.
This is definitely good information to let you know exactly.
Hey, maybe this is a version of Windows that has a vulnerability, then I would go search for that.
So another thing that we can do is actually look at the running processes right now.
So task list and then slash SBC and it's going to give you a list of different running processes right
now by by privileged users, but not for those users.
So this is going to give you a good idea.
Was running maybe you can find something as vulnerable?
You know, I would look around, maybe start doing some searching for some of these executables right
here and see if they're potentially vulnerable.
If you want to look at the networking information to get a lay of the land line a little bit more about
the network and just do it can fix all you can see all the interfaces and connections and everything.
Another thing, if you want to learn a little bit more networking stuff so you can print and it's got
a first of running tables.
So this is just pretty much an explanation of how packets get from one destination to another.
Pretty much.
So that's some good information.
If you're trying to learn, you know, hey, what's the network like?
We can also do a net stat command and this is going to allow us to view all of our activities, connections.
So we do Desh, you know, specifically, and this is going to give us the address, the important numbers
and the process I.D. So now we kind of have an idea, OK, these are the active Tsipi connections.
These are the poorest.
They're running on these that are process IDs.
When you start to get a feel of like what's going on, you know, on this system.
So another thing that's good to look at is look at the firewall.
You know, you want to see maybe what the rules are.
So the first thing that we can do is do a net search and then every firewall and then show that a current
profile.
And it's going to show us the current profile.
So we see that the domain profile is on deju and it tells us a little bit a little bit more about the
firewall in general.
So what we can also do to learn like the actual rules, if you wanted to, of.
Not a of so I'm not going to enter a TV, so as net show, same thing, Eddie firewall show rule name
equals all equals all the show.
All Yeah.
So maybe so.
So this is going to be a command that you can run and it's going to show you all the firewalls.
I don't want to do that because the last time I did it for like a million rules, but you can do that
and get an idea of the different firewall rules.
We could just go look at the firewall between figure that out if we wanted to.
We do have access in here.
So another thing that we can do is tasks slash query, slash EFO, ALLIÉS T v and this is going to show
us the display tasks, the scheduled tasks, and it's going to display with verbose output.
So just more output, much more information.
So this is going to print a lot of stuff, just like the firewall rule command would have.
So you can start to look through those if you want to start to get an idea of the different scheduled
task and maybe take advantage of those kallikrein jobs in Linux, you can kind of potentially take advantage
of those.
One of the things we could do is look at, you know, the installed applications and versions that by
Windows installer.
I don't think that this one will have it.
But if you're on a different system or if you have some stuff installed that you put on yourself, you
w animacy and then product, and then we're going to put it and we're going to tell them the columns
that we want to see what name, version and vendor and then we just enter.
So there's no instances because I didn't have installed anything on this box.
Another thing we do is look at some updates like no what system, what updates were installed and when
were they installed so we could do that amici command again.
And then we're going to CUFI and then another command.
And now once again, we're going to tell it what columns we actually wanted to display so we can do
caption description.
Then we do hotfix idea and then is stalled on on.
It was on the air and it's going to tell us, hey, these security updates are installed.
This is when it was installed.
So it gives us an idea of what kind of patches, you know, the system has and doesn't have.
And you can start to look online and try to figure out, you know, what you might be able to take advantage
of.
Maybe it's missing a security patch for like a major vulnerability.
You can go ahead and try to take advantage of that.
So that's like some basic enumeration for, like trying to find some vulnerable things in Windows 10.