Welcome back to our last lesson on the command and control of a Windows 10 machine from Kalli.
In this lesson, we're going to see how to gain admen level privileges or system level privileges and
how to steal passwords from a Windows 10 computer.
So one of the first things we want to do is come over to our Windows 10 computer.
And if you still have your administrator command prompt up, go ahead and open that.
If you don't just do see M.D. in your Windows 10 box and run as administrator, you should get something,
says the administrator command prompt.
And what we want to do is add a few users.
So we've seen how to get just one user name.
A couple of different ways, right?
You can right click and you can grab that password.
You can right.
Click, inspect and grab that password.
You can use the social engineers tool kit to send a phishing email to a person over the Internet and
get their username and password that way.
But that's one password at a time.
What we're going to see with Materne Critter is how to download all of the user accounts on a computer.
Now, if that's your office computer, it may only have you in a couple of other people, an I.T. person
or something like that.
If you're talking about a library or a school computer or a computer that's used by lots of different
people, you may get dozens of passwords from a single infected Windows P.C..
We're going to see how to do that.
But to to get the most out of it, let's go and create a few accounts.
So from an administrative command, prompt type net user.
And let's just make up a few user names like Anna and give her a password of password one and then say
slash add.
Good.
We'll do a net user ban with a little more complex password.
Maybe BP a SSW zero r d exclamation.
We already know that one from our Windows user.
We can do net user, Carol.
And let's make it a little longer.
Password maybe.
Captain Marvel slash ad.
So what we're doing is adding users net user, the user name and the password slash ad will set up a
new user on your Windows 10 box.
And we'll add just a couple more.
Let's do net user Clark with Super Man 20 as his password slash ad.
You can choose fictional characters, you can choose superheroes, whatever you like for your passwords
here.
Net user CARRA with Supergirl.
Girl number seven.
And an exclamation mark slash ad and then maybe one net user, Peter.
Spider-Man Rules.
Spider Man Rule WSA.
And then a smiley face after slash ad.
So I've added five or six passwords that will oh, this is an interesting one.
Good old Windows will say, hey, wait, this password is longer.
The 14 characters, which is a really good thing.
But if you're using any old network computers or Windows 2000 or older, which you usually don't have
to worry about in the year 2020 and beyond.
We're going to say, yes, we do want to continue to create that user.
So we've got several usernames and passwords that we'll be able to try to attack from the Caleigh box.
Now, one thing that's happened here is my Caleigh machine has lost the Materne Fritter session.
So after you've created those handful passwords, let's come back over to Caleigh for just a second.
If you've still got your maturity's session up and running, then you're ready to run.
You don't have to redo this, but this is a useful thing to see.
We were running the the Web cam stream just a moment ago, and that definitely can take up a lot of
bandwidth and cause things to crash.
So I'm still in my expert multi handler, and I should still have all my options, show options.
So my local sent out to an at seven is still listening.
So I'm just going to say exploit again.
Good.
And it's listening.
I'll come back over to my Windows box and I'm going to check to see if it might have woken up.
And it did.
Delete that fortnight, all scans.
But look at my documents folder and copy that.
And I'm actually going to copy that and paste it into my downloads folder because I don't want it.
Hey, there we go.
I don't want it to delete my original copy, but you saw something pop up from my Windows Defender antivirus
settings.
Yeah, there we go.
My antivirus sitting says Windows Defender Antivirus found threats.
Well, we turned off Windows Defender antivirus.
It turns back on.
That's a great thing for Windows, Windows 10 and beyond.
We got threat protection that turns back on for us.
So you need to say virus.
And threat protection, we're going to open those settings.
We're going to come down to the Manege settings.
And we're going to turn off the Real-Time prediction more time this happens from time to time.
It's actually a great thing that Windows has made this change because it keeps your device a little
more well protected.
If you had to turn it off to play a certain video game or to stream something, you you will wind up
having to turn it off a couple of times.
But it is worth it because you've seen what can happen if you don't have that virus in threat protection
running.
So now we're going to go to our documents folder where we ran an exception.
Remember, in the previous section and we can copy that.
We can bring it over to the downloads pasted again.
And this time since we turned off the Real-Time protection, it doesn't catch it.
We're going to run that fortnight, all scans.
And look at this.
We opened a session to over here and.
So that's a great thing.
Well, now that we've got a maternity section connected again to our Windows machine, or if you've
already got yours connected, you're in good shape.
What we're going to do is type background one more time because we're actually going to use that Materne
printer session to inject something called privilege escalation.
We're going to use the a feature inside Windows 10 to gain route access or system level access to our
Windows 10 computer so that we can actually still those passwords.
So the exploit for that now control L is use exploit slash windows slash local slash bypass UAC underscore
fied features on demand helper.
Who.
Now that is a long command.
I know but we're gonna use exploit slash windows slash local slash bypass UAC that will bypass the user
account controls that usually keep you from getting access to these important things like passwords
for other users and the features on Demand Help or The Fired Helper is a program on Windows 10 that's
there for a useful purpose.
But it can be misused.
And you can see here how Kelly's gonna do that.
So if I say sessions, I need to know which session I want to attack.
And that session to over here, you can see on the left hand side, if you're still on your first session,
you may have session one.
We're going to set the session to two or one or whatever.
Your session number is going to set the payload.
Two windows slash materne critter slash reverse underscore TCAP.
So we're gonna make use of that Materne critter connection and we're going to inject another Materne
critter section, but this one is gonna be at a higher level of privilege.
We need to set the local host just like we did before.
L host to 10 Dotto dot nine.
Dot seven is my Caleigh box.
You can IPA if you need to get the IP address and then we want to run exploit and I will try to start
a reverse handler.
And you saw something flash up on the screen there in my Windows 10 box, but nothing terribly out of
the ordinary for a regular user.
But if this works correctly, you should have a new Materne Fritter session opened up.
And this session is not going to be your regular old user session.
This is an administrative or system level user.
Once we escalate those privileges.
So it created a third session.
So now and now we have, well, at least a second session.
We had an original session.
It closed out, so we connected with a second session.
We use the second session with a background to then bypass the user account control.
And now we'll have the ability to get system level access on this Windows team computer.
So I'm going to use control l and I'm going to use the command get system.
And let's see if we can get system level access.
Well, it says it got system.
The a technique one, by the way, if you get an error here that says it's already at an elevated state,
that means you are already in an administrative account.
And that's OK.
The on command should work.
If you didn't get a new maternity or section, you may have to actually go back and rerun the entire
exploit one more time.
So start back and see if you can get a session, then background that session, then connect using the
third helper exploit.
Just go back to the beginning of this, this video one more time after get a system we can check to
see if we really do have system little access with get you I.D..
And look at our user name now.
And we were just i.e. user.
Earlier, we saw that a couple of times, but the user name now is TE Authority system.
We are root level on this windows in teh box.
So we're gonna use a package called Kiwi.
There we go, this is called Mimi Katz, you loda by saying use Kiwi and then the command to dump all
of our Windows passwords as L.
S a underscored dump underscore Sam.
Look at that.
We have hashes for each one of our users.
Now, these are not the plain text passwords.
These are just the user hashes.
But let's choose Anna's password, that in TLM hash.
If we control shift C to copy that, we can come out to a service like Hash Killer and come a hash killer
dot io, come to the hash cracker, come down to n TLM, paste that hash that we just found.
And then usually you'll have to do a captcha.
UW six T for H g.
And we're going to learn how to do password cracking in a later section.
But this is a great way to check to see if you've got a real Windows password that you might be able
to crack.
And look at that.
I may need to control.
Plus, if you see that password, that hash has been resolved to password one.
So we actually got into a Windows computer guy now.
Really great idea would be to highlight and copy all of these hashes and just right click copy the selection
and open up maybe a text document under favorites, text editor and paste these into that text document.
You'll want to clean these up so that they've got just the username and the hash probably.
But with just these hashes and a couple of free online tools like hash killer or hashes dot com where
you can paste in a hash and see if that password has already been cracked out on the Internet, you're
probably going to be able to recover most of the passwords that are on a Windows computer.
So I think we probably did our job in scaring you into never downloading and running a suspicious file,
whether it's from a friend, whether it's from somebody pretending to be a friend, whether it's just
from a Web site or even if you're just downloading something you think you're getting for free.
The latest movie that you're downloading is free from a Web site to watch the whole movie.
It's not just executable files.
It's PDAF files.
It's Web pages.
It could even be movie files or image files that are infected with viruses almost exactly like this
remote access Trojan that we called Materne Critter that gave us complete command and control of a Windows
computer from Alcalay Linux box.
So when we come back in the next lesson, we're going to wrap up the commanding control with some ways
to protect yourself from viruses like the one we just created.
We'll see you in the next lesson.