Welcome back to our next lesson on viewing, downloading and uploading files to and from an infected
Windows 10 computer from our Linux box.
In our previous listen we Rampy WD to print the working directory.
We can see that we're in downloads.
But remember, our Defendor woke up and deleted that downloaded file.
So if I do an L.
S or a D.R, either one of those two commands should work just fine.
I can see I've got a couple of files on my Windows computer.
Now, remember, I'm running interpreter on my Windows computer that's infected and I'm when I run L.
S from Inside Materne program, actually listing the files on that Windows computer.
So I see the fortnight oilskins Dudi XY.
But what I also see a desktop that I, I could try.
Cat Command desktop.
Top dog, I and I and I can see the configuration information for this Windows computer, so that user's
desktop that I and I file just as a little bit of local information.
If we wanted to, we could download that file, download desktop.
I and I that's not very interesting information, but it just shows that we can actually pull those
files locally.
And then if I switch over to a different terminal window and then L.
S.
I will see a new file that it created in my home directory.
My Caleigh home directory.
Desktop.
I and I.
That came from that Windows computer.
If I do an LSD dash l.
I can see that it came from that computer.
Oh.
When it was created on that computer.
So that image had it as March 19th of twenty nineteen.
That was the last modified date for that desktop that I and I, I can see.
All my files are newer from 20/20.
And I'm going to switch back over to Mama Turtur, remote shell.
We've seen how to view files on the remote Windows machine.
We've seen how to download.
Now let's see how to upload.
So I'm in the downloads directory, but I don't want to just upload my fortnight all skins into that
downloads directory again.
I actually want to see D into dot, dot, slash.
Let's go into documents and then p d.
So the dot, dot.
If you've used or if you remember from when we were doing this in Linux and Windows, c.D, dot dot
takes us up one directory slash documents means come out of the downloads folder for this user and go
up into the root and go into the user's home folder, then go into their documents folder.
So go up into the home and then down into their documents.
Now, if I can remember where my file is on this Caleigh Linux box.
And if we remember, we created two copies of ICD to my desktop and else I've got my fortnight, all
skins there.
And if I c.b and if I do a PWP.
On my Caleigh box, I can see that's home Caleigh desktop fortnight oilskins daddy XY, in fact, I'm
going to copy that just so I don't misspell it.
So I'm going to copy that selection.
I want to upload an extra copy of this virus into the documents folder so that if Windows Defender wakes
up and deletes it out of my downloads folder, I'll be able to add it in there.
So if I do an LSN documents right now, we'll see that it's got some folders from my pictures, my videos,
but it doesn't really have very much in here.
Desktop I9, a power shell folder.
So if we look over on our Windows computer and come up to the documents folder, that power show folder
is the only thing that's showing up.
And then we've got links to my pictures and videos.
So what I want to do is from my Kalli computer, from my Caleigh virtual machine running Materne critter
across that reverse CCP connection.
I'm going to upload slash home, slash Caleigh slash desktop.
And I'm going to get my fortnight all skins with a control v, there are control shift V or just a paste
upload slash home, slash Kelly slash desktop fortnight oilskins and press enter.
And you see, it says it's uploading and has uploaded fortnight all skins.
Let's switch back to the Windows computer and see if that's true.
Look at that.
So now in our downloads folder, we have the original copy that we downloaded.
But when we ran it, we gave a remote attacker our Kelly Windows.
Our Kelly virtual machine.
Complete control to access the file system, to view, to download and to upload files across that Materne
Critter connection.
Well, if that scares you, that's a good thing, because you should never run a file that you don't
trust from across the Internet.
But when we come back, we're going to see how to take even more command and control of that Windows
10 computer.
We'll go all the way through how to attack a Web cam that you may have attached.
We'll see that in the next couple lessons.