In the last lesson, we saw how to use them interpretor to to run commands on a Windows seven computer
from Alcalay Linux box.
It's like we've got a shell open or a command prompt open on the Windows seven box, but we're running
it from a remote Calli Linux computer.
What we saw that we couldn't do, though, was run administrative level commands like maybe removing
the game, not file so that it's no longer there running cashed up.
So we pull passwords from the computer.
We're going to see how we can get that system level access with another exploit called privilege escalation.
We're going to bypass the user account controls and we're going to become a system level user on a Windows
seven box.
So we're in this interactive session and interpreter.
So the very first thing we need to do is put that in the background.
We can access it again with sessions.
So we'll background on Interpretor and we're back in regular media spotlight so we can clear the screen
and we're still connected with that Windows seven computer so we can use a new exploit called exploit
slash windows, slash local bypass UAC.
That's bypass UAC.
I just had to do BWP tab.
We're going to bypass those user account controls on this Windows seven computer and we're going to
become a root user.
So we're going to root Windows seven just like what the other exploit.
We need to show the options.
And you can see we need a session number for this, so will our session number of the machine that we
were just talking to, a session number one.
So we'll say set session with all uppercase one and then we'll show options again.
And now our session is set correctly to one, and the technique is an executable, but that's OK, we
don't need to change anything there.
We're going to set payload.
Windows interpreter slash reverse Tsipi reverse underscore TCP presenter.
So we're still using this same interpreter payload to send things back and forth, we'll show the options
again.
We want to set the local host or the host option to our Linux computer.
So we will set our host.
To 10 dot oh, dot three, dot five for my computer, make sure you're using whatever your I-F config
said from your other window Sitel host.
Now we'll do a show options again, and we've got the lowest in there correctly.
Now we're in the bypass UAC.
So let's run that exploit by typing, exploit and hitting enter.
Now you will see split really going to work.
It's got the reverse Tsipi handler that's connected, the UAC is enabled.
Checking the label, UAC is set to default.
It's bypassing.
And now we're part of the administrators group continuing.
You can see it's uploaded, the agent, the file system, the interpreter, stagers going.
So we have a brand new session session, too.
And I'm already interpreter, so I don't have to use the sections command here.
I can just say get UID and it shows I'm still a user.
Well, what's this command get system Dashty and one get system Dashty.
One use technique one which happens to be pipe named pipe impersonation.
Just a way of getting administrative level privileges.
So I'm no longer the get uid i.e. 827 IEEE user.
If I hit the up arrow a couple of times and get the user ID again, I am now in authority system.
I am the Windows seven enty operating system system level user.
So I am the administrator route on this Windows seven computer.
Now I can run PWP and Seongmin Windows System 32 so I can KDDI all the way to route cDNA users.
Unless you can see I've got a few users, they have been almost KDDI and IHI user.
CD into their desktop downloads folder.
I can see that game like I won't be able to remove game daddy right now, and why is that?
Well, because game Dionysiac is what's running in memory on that Windows seven computer and connecting
me into that box.
But now I am an administrative user so I can do some other useful things.
For example, I can dump all the password hashes so I can run past dump and hash dump has shown me some
pretty interesting things already.
Do you see this IHI user is password?
It's already tell me because we had a password hint in this Windows seven computer that we downloaded
as a VM that gave me the hint that the password for a user is password.
Well, it's usually not that easy, but do you see these hash values down here?
These are intelligent hashes for the administrator.
Password looks like it's the same as the guest password, which is probably blank on this VM and then
the user.
This is the hash that would give me password.
Well, it turns out we can use this hash if we just copy these values.
And save them into a file or copy them, and now that we've got our guest editions, we can copy and
paste back over into our desktop PC, our host machine, but we'll be able to find out what that password
is just by running a couple of different password attacks against this intel hash.
So even though this is a one way hash or an encoded version of the password, I'll be able to recover
it and get it back.
Just for good measure, let's move back over to the Windows seven computer, add a couple more user
accounts and then come back and run this past password hash dump again.
So I'm in my Windows seven VM and I'm going to come to the start menu control panel user accounts and
I'm going to add or remove user accounts.
Let's create a new account.
Name Fred.
And let's make Fred's password create a password.
Wilma WGL A.
Create that password.
Manage another account, create a new account, Wilma.
And let's make her password, Fred.
Create that password.
Now we have two more users, Fred and Wilma.
Let's go back over to our our Kelly Linux box and see if we can dump those ashes just to shore up Arrow
again, run hashed up.
And because we're still connected to that, Windows seven computer hash dump will pull us the fresh
up to the minute list of all the usernames and their hashed passwords.
So you can see my administrator and guest accounts, my IHI user, Fred and Wilma, and notice they
have different hash values out here because those are three different passwords.
We'll see how to crack those in the password section.
So I'm going to copy this.
And for now, I'm just going to store it and leaf pad by pasting it.
And go to file save as.
And say this to my route documents as when seven.
Hashes dot text, he will use these password hashes and the password cracking section, but for right
now we can see that we can do administrative level things, even things that are hard to do on the Windows
box directly.
I can do easily through this interpreter session from Calli Linux.
We'll do a little review and then we'll see how to use those passwords and how to crack those hashes
in an upcoming section.