So just a brief review on this section, we've done some really cool things, you'll probably want to
go back and run this section one or two more times just to make sure that you've got a good handle on
how to create your own exploits and then use those to gain access to a victim computer.
So when we tell you not to download suspicious files, do you see why now just a simple, innocent run
of a program?
In fact, user probably doesn't even know that anything happened.
They think it was just a bad game.
So they might even try to delete it.
They won't be able to delete it.
In fact, let's come back over here and go to our downloads folder.
And if I try to delete this file right now.
It can't be because it's being used in some command line utility.
Oh, well, we probably just reboot the computer, but we've already got access and we've not only got
access, we've got administrator level access and we copied all those password hashes.
So now we can find out if if the system hadn't told us directly what the IP user password was, we would
have been able to use this hash dump that we ran interpreter to capture some of those hashes and then
just use a simple Web service or any other password cracking tool to find out what the passwords might
be for just one of those users.
And let's go through the chain that got us here.
First of all, it all started with an MSF venom or a payload that we wanted to create.
And we created a payload called Gayndah Yuxi that gave us a reverse TCP connection that let us run interpretor
on the remote computer.
That's this remote shell that we were able to list directory files.
We'd be able to download files if we wanted to from here.
We'll see how to do that.
When we hack of Windows 10 computer, we can dump the password hashes so that we can start cracking
passwords on the user system.
We can delete files, we can change the timestamps on files.
There's no limit to the number of things that you can do once you're inside that remote computer, especially
as an elevated user, in this case, as a root or system level user.
So we had to first get the user to click through that Web link and download the exploit file.
But once they downloaded that exploit file, we were able to connect in and then create another exploit.
So we had to come back to our metastable framework and we started them interpretor handler.
So we were able to use the multi exploit handler to listen for that callback from the infected Windows
seven computer when it called home.
We got an interactive session by saying Sessions Space Dashi Space One gave us an interactive session
with that first infected computer.
Again, if we'd infected several computers on the network, we could have said Session space dashi two,
three, four, five and so on.
And we could have multiple computers running this reverse TCP interpreter session.
Once we got into the user computer, though, we were just at the same level of privilege as the user
who ran that executable file.
So we had to bypass user account controls, bypass UAC using another exploit, bypass UAC and elevate
our privileges so that we could get the system level privileges using that technique.
Number one, that was get system space Dashty Space one.
And then we had a system level user access we needed to get UID that gave us the entire authority system.
So we were the route user on Windows seven that allowed us to do something really cool, dump all the
password hashes by running hash, dump an interpreter.
There are lots of other really cool commands like Timestamp that lets you change the timestamps on files
so you can cover your tracks and lots of other things that you can learn as you dig in a little bit
more interpretor.
We'll see a little we'll see a little more of an interpreter when we run a Windows 10 hack in just a
little bit as well.
But that gets us our first thorough introduction to metabolite and interpretor, and we'll see how to
use those even further as we do additional hacks later in the course.
We'll see you in the next section.